WIRELESS AUDITING AND RISK ASSESTMENT

WIRELESS AUDITING AND RISK ASSESTMENT

1. CONCEPT

   • WLAN Discovery Tools
     • NetStumbler
       • Designed to locate and interrogate WLANs
       • Detect rogue access point
       • Not work well with Modern 64-bit systems
     • Kismet
       • a Wi-Fi scanner that runs on Linux
       • works as network sniffer & detector
       • for wardriving, site survey & detect rogue APs
     • HeatMapper
       • locates and maps radio frequecy footprint for each discovered access point
     • InSSIDer
       • a commercial Wi-Fi network scanning application
       • supports Windows & Max OS
   • Penetration Testing Tools
     • Metasploit
       • open source software
       • built to assist administration in "attacking their own networks
       • used for pentesting and vulnerability assestment
     • Security Auditor’s Research Assistant (SARA)
       • Pentest tool that also works as a vulnerability scanner
       • Performs SQL injection, cross-site scripting (XSS) tests, and other pentests

2. OBJECTIVE

   • Password-Capture and Decryption Tools
     • Auditing and recovering passwords
       • Nessus is good at spotting default administrator passwords for Web applications
     • Dictionary-style attacks
       • Each item in word list is encrypted in sequence using the same encryption method as the password; resulting hash code is compared to original password’s hash code. If they match, password is revealed
     • Brute-force attacks
       • Cracks the password , comparing all possible combinations of characters for a given password length
     • Mitigate threat of password cracking by
       • Creating strong passwords
       • Using different passwords for different applications
       • Use a password management system (PMS) to remember passwords
   • Network Management and Control Tools
     • Wireless protocol analyzers
       • Used for security purposes to reveal and locate devices
     • Aircrack-ng
       • used against passwords on WEP- and WPA-protected networks
     • Airshark
       • for discovering rogue access points, other rogue devices, viruses
     • Network Management Systems
       • Provides a single viewpoint from which administrator can view, plan, and configure network

3. TECHNOLOGY

   • Risk Assessment
     • Used to determine any change in requirements, technologies, or threats
     • you must know system or network’s vulnerabilities
       • 1) Interception
         • Applies to data that travels over the network
         • Encrypting data
       • 2) Availability
         • Systems, servers, and applications must be available
         • Use of fault-tolerant and high-availability designs that eliminate single points of failure
       • Access
         • Refers to the points where remote users can join the network
         • Firewalls, intrusion prevention systems
     • Conduct security risk assessments
       • At least every two years
       • When new technologies or major changes are introduced
   • Other Types of Risk Assessment
     • Pre-production assessment
     • High-level assessment
   • IT Security Management
     • should be appropriate for size and value of network
     • Should be cost-effective

4. UNDERSTANDING

   • Security Risk Assessment Terms
     • ASSET is anything of value
     • THREAT is anything that can damage or compromise an asset
     • VULNERABILITY is a weakness that makes a threat possible or even probable
     • RISK = Asset × Threat × Vulnerability
   • Security Risk Assessment Stages
     • 1) Planning
       • Occurs before security risk assessment can take place
       • Stakeholders, roles, and responsibilities are determined
     • 2) Information gathering
       • 1)Security policy and objectives 2)System and network architecture 3)As-built designs and diagrams 4)Physical asset inventories 5)Network protocols and services 6)Access control procedures 7)Firewall deployment and policy 8)Identification and authorization mechanisms or systems 9)Documented policies and guidelines
       • General controls review (GCR) identifies threats existing in the general security processes
     • 3) Risk analysis
       • Stage at which security team uses risk-analysis techniques to determine value of assets and identify associated risks
       • subprocesses
         • Asset Identification and Valuation
         • Threat analysis
           • Social threats - related to human actions
           • Technical threats - Result from technical issues or faults
           • Environmental threats - Result of environmental elements
         • Vulnerability analysis
           • Is the task of identifying, evaluating, and documenting existence of vulnerabilities
         • Asset, threat, and vulnerability mapping
           • Process of documenting or pairing asset vulnerabilities with potential threats that could expose those vulnerabilities
         • Impact and probability assessment
           • Impact assessment to determine the consequences of a threat exploiting a vulnerability on an asset
           • Probability assessment(likelihood assessment) used to identify greater or lesser threats based on a score rather than a mathematic probability
         • Risk results analysis
           • use method
             • Quantitative and qualitative methods
             • A risk map
             • A matrix approach
     • 4) Identifying and implementing controls
     • 5) Monitoring
       • repetitive process - represents a snapshot in time
   • Security Audits
     • follows many of same steps as risk assessment
     • Security risk assessment is conducted at beginning of security management cycle

5. CONTEXT

   • ATTACK TOOLS AND TECHNIQUE
     • Radio Frequency Jamming
       • Wireless 802.11 network are vulnerable to interference and jamming
       • Specialized products allow to flood frequency channel
     • Denial of Services
       • Sending constant stream of deauthentication packets with spoofed MAC addresses to access points
     • Hijacking Devices
       • Attacker must have visibility at Transport Layer (Layer 4)
       • Data encryption at Layer 2 or Layer 3 mitigates attack
     • Hijacking a Session
       • One attack uses deauth packets and then takes advantage of how client devices attempt to reconnect
   • Network Utilities
     • Ping
     • Traceroute/ Tracert
     • Netstat
     • Ifconfig/ Ipconfig
     • InSSIDer
     • Hotspot Shield

Images and files in the map