Ethical Hacking for an IT Professional

The following article is contributed by Richard Millett, a Senior Instructor for Firebrand Training with 30 years experience specialising in Networks and Security.

As an IT professional having just acquired the skills to administer your assets, and the certifications to prove it, the next stage has to be to ensure they are secure. Security is not just a question of firewalls, anti-virus and permissions. Security is the much wider topic of protecting the entire footprint of your organisation both technically and physically.
The current MCSA and MCSE certifications prove you can administer your systems on a day-to-day basis to provide functionality and reliability but you now have to go one step further to ensure an adequate level of security. Using the services of a professional penetration tester can help to measure your security status and help you move to a consistent level of security, but why not take the time to progress your knowledge to the next level by training in the area of ethical hacking.
Hackers do not play by the rules and the attacks are getting progressively more sophisticated both against networks and users. Attacks are remote, launched over the network, and initiated from the inside of the network, so the ability to be able spot and mitigate both types of attack is now vital.
Ethical hacking is the process of providing protection by measuring security using the same tools and techniques as hackers would do, but within an agreed framework. Understanding networks is one thing but learning how to scan and probe networks, how to manipulate network packets, how to launch attacks against your servers and clients, this is the world of the ethical hacker. Understanding how the hackers get in is the key to keeping them out. By understanding the hacking cycle from reconnaissance to covering tracks helps a good IT professional to improve the security status of not just the network and systems but of the entire organisation.
You have to remember that vulnerability scanners can check your systems and ensure that they are patched to the correct level but if you can run a scanner against your own systems, could the bad guys do the same?
By mastering the same techniques as the hackers you are able to stay one step ahead by ensuring that their methods won’t work on your systems. System and network security is dynamic in a world of constantly evolving threats. An IT professional needs to be equally dynamic by mastering the latest techniques involved in cyber-crime. To be an ethical hacker requires a good knowledge of all aspects of IT infrastructure from networks to web to wireless. These are all ways in to your systems and the damage caused, be it reputational or financial, could be irreparable.
Don’t forget physical security either, think of the following questions:

• Is your server room access as secure as it could be?
• Would it be possible to install a hardware key logger on one of the systems?
• How aware are you of social engineering techniques?

Consider also the well-known system threats against your systems:

• A good MCSA in SQL will want to ensure that the databases that they are responsible for are not being exploited by known SQL injection vulnerabilities.
• A .NET developer will not want to be the guilty party when an application suffers from a buffer overflow attack.
• What happens when a well-crafted DNS poisoning attack is launched?

There are a number of either self-study or instructor led training courses available in all aspects of security from recognised vendors. Ethical Hacker training stretches the mind and becomes self-fulfilling because it not only improves your security posture but also creates that urge to stay one step ahead of the hackers, thus driving the need to learn more. To cement the knowledge acquired there are several recognised certifications from the SANS Institute and EC-Council that provide confirmation of the level of expertise. These certifications can give employers a good indication of not only your skill set but of your mindset as a true IT professional.

Read more

7 Simple Tips To Prevent Web Application Security Breaches

Nazar Tymoshyk is a Security Consultant at SoftServe Inc. He has 5 years experience and a Ph.D. in Information Security and over seven years in network infrastructure management, and specializes in Security Consulting, Enterprise IT Consulting, Application Security Assessments, Penetration Testing, Ruby, OWASP, Linux, Virtualization/Cloud, Automation, Networking, Forensics, and Reversing.

It doesn`t matter which framework you’ve selected for Web application development, you still need proper Web application and server maintenance to avoid security breaches. Learn seven simple tips to mitigate Web application security risks and ensure Web application security.

Web Application Security Risks
In my career, I have regularly seen cases when the lack of proper web server support and maintenance resulted in a company`s Web application being hacked and exploited by attackers. Even though more and more often companies host their web applications in the cloud and select a private cloud for the web applications that are critical to their business, it makes no difference from a hacker`s point of view. So when talking about web application security, it`s important to consider the infrastructure of wherever the web app is hosted (even if it`s hosted by one of the top cloud players).
Unfortunately, it’s not unusual for businesses to invest into Web application development only or store all their Web applications (as well as mail servers) on a single dedicated machine without an established and safe backup process and without considering the security of the infrastructure. Additionally, if a company lacks a comprehensive security strategy and prefers to overlook a well-known security principle of “better safe than sorry”, a Web application administrator may not be ready for real-time attacks, which can result in Web application being down and sensitive data compromised.
Sure, skimping on server and Web application maintenance, regular security check-ups and trainings will save you money in the short term, however, in the long run it`ll save you more if you invest into a secure server hosting provider and proper software architecture instead.
A simple truth is, it doesn`t matter which framework you selected for Web application development a couple of years ago – Joomla, Wordpress, ASP .NET or Java – over time they all need to be patched for discovered vulnerabilities and require regular security check-ups. The frameworks provide a fast and cheap way to create great Web applications, so businesses large and small continue using them despite the security risks presented by possible vulnerabilities, but what`s important is to specifically focus (and many large brands do) on proper Web application security and maintenance.
Secure Software Development: Levels of Responsibility
Owning an internet Web application is similar to owning a car – both require upfront costs, a maintenance program to keep them running smoothly, ease of use and ultimately should attract people to purchase. To properly maintain your Web application:

• Check for vendor notifications about updates and patches or withdraws
• Buy insurance to protect yourself against risks.

Web application security starts with a developer who writes secure code. Then, a Quality Assurance expert tests the code for bugs and possible vulnerabilities. Next, the Development Operations (DevOps) team is tasked with automating build processes, patching application and server software as well as monitoring performance and log files. At the next stage, a Security expert should review the results with security in mind.
Any mid-size or large company has an individual responsible for IT, often the CIO but sometimes this role is combined with the CTO and even the CEO. This person is responsible for IT decisions on support and Web application operations, as well as for preventing Web application security breaches, as it is the IT staff’s responsibility to support the company`s servers. A part of this process is designing backup and recovery plans for "after-an-incident" cases. Continuing with the car analogy, it’s similar to ensuring your spare tyre is functional in the event of an emergency.
When IT engineers (or a software development vendor) develop software, the CTO/CIO should define where to deploy it (on separate servers in the Cloud or special containers, versus all sites on a single server) and how it should operate and be protected. Otherwise, ask your internal (or vendor`s) security consultants to design and implement a proper security strategy.
Seven Simple Tips to Ensure Web application Security
1. Educate your organization. Inform employees that Security experts need to ensure that an application is secure in code and design. Explain that DevOps experts are needed to implement monitoring and patch management as well as to secure support of your server and software. Security often goes hand in hand with DevOps, architecture assessment and business analysis.
2. Don’t put all of your eggs in one basket. Do not store all Web applications on a single server. It is architecturally incorrect and could negatively affect Web application performance. Using Microsoft Azure for your web apps has already proved to be an effective way to significantly decrease costs and create truly flexible and reliable solutions in the Cloud.
3. Patch your web apps and web server. Regardless of what framework is used, it’s important to remember that none are a safe haven for your Web application. All of them have some vulnerability that needs to be addressed.
4. Store your access keys and passwords securely. There have been far too many cases of hackers attacking developers and IT guys to steal ssh or cloud access keys to take it lightly.
5. Engage a DevOps and/or security service provider. All Web applications need regular check-ups for the code and server security reviews & assessments. If your organization does not have internal experts, you can ask a security vendor to help establish a comprehensive security strategy and develop a plan for regular security check-ups.
6. If you`re outsourcing Web application development, make sure that security is part of the deal. Discuss the security maintenance and check-up possibilities with your vendor. For long-term strategic partnerships, consider a shared responsibility model.
7. The greedy pay twice. It`s best not to skimp or cut corners on security, especially if you’re responsible for protecting the sensitive data of your Web application users. Security is a significant part of quality service and customer satisfaction. If you do not secure your Web application and data upfront, you can end up with additional unexpected costs.
This post was originally written for SoftServe

Read more