Unauthorized Access Attack
In the most basic form of an access attack, a hacker tries to gain illegal access to equipment in your network. This is called an unauthorized access attack. To accomplish this kind of attack, a hacker can use many tools, including the following:
® Guessing passwords for well-known accounts, such as root and Administrator
® Using a protocol analyzer and executing an eavesdropping attack to examine clear-text passwords in packets ® Accessing a password file and using a password-cracking program on it ® Using social engineering
The last item, social engineering, is probably the hacker's easiest method of gaining unauthorized access to resources in your network. With social engineering, a hacker calls various users in your network, pretending to be a network administrator. The hacker tells the user about some fictional network security problem and, using guile and ingenuity, gathers information from the user that the hacker then can use to access resources on your network. This can go the other way, too; the hacker can pretend to be a user and can call a network
This document was created by an unregistered ChmMagic, please go to http://www.bisenter.com to register it. Thanks, administrator, acting as if he has forgotten his password.
The solution that you implement to restrict unauthorized access attacks depends on the method the hacker is using to gain unauthorized access. For instance, if the hacker is trying to gain illegal access to your network through your network's remote access (dialup) server, you probably would want to implement the following solutions:
® Use the Challenge Handshake Authentication Protocol (CHAP) with PPP (Point-to-Point Protocol), where the password is not sent across the wire, is tied to a specific user, and is verified by a security server
® Use double authentication. Cisco IOS routers have two features: Lock-and-key access control lists (ACLs) and authentication proxy. Lock-and-key works hand-in-hand with PPP's CHAP. The user is authenticated first through CHAP and then through lock-and-key. However, lock-and-key also works over nondialup links. Lock-and-key is discussed in Chapter 13. "Lock-and-Key Access Lists." Authentication proxy (AP) is the preferred method of authenticating users and is discussed in Chapter 14. "Authentication Proxy." It also has the capability to authenticate users before allowing them access to network resources. As you will see in Chapter 14. Cisco recommends using AP over lock-and-key because it is more flexible, supporting Telnet, FTP, HTTP, and HTTPS for authentication.
For application security, if your applications support additional security mechanisms, you definitely should implement them. For some applications, you might consider replacing them. For instance, the standard Telnet application uses clear-text passwords when performing authentication. You might want to consider replacing your standard Telnet application with a secure one that encrypts the password before sending it across the network, such as SSH. You also should disable all unnecessary services and consider using a host-based firewall. Host-based firewalls are discussed in more depth in Chapter 2.
Continue reading here: Repudiation Attacks
Was this article helpful?