SANS GIAC Certification

About the Authors Eric Cole has worked in the information security arena for more than 10 years. He holds several professional certifications and has helped develop several of the SANS GIAC certifications and corresponding courses. Eric has a BS and MS in computer science from New York Institute of Technology and is completing his Ph.D. in network security. He has extensive experience with all aspects of information security including the following: cryptography, stenography, intrusion detection, NT security, Unix security, TCP/IP and network security, Internet security, router security, security assessment, penetration testing, firewalls, secure Web transactions, electronic commerce, SSL, TLS,IPSec, and information warfare. Eric has created and headed up corporate security for several large organizations, built several security consulting practices, and worked for more than five years at the Central Intelligence Agency. He was an adjunct professor at New York Institute of Technology and is currently an adjunct professor at Georgetown University. Eric is author of the book Hackers Beware and contributing author to Know Thy Enemy: The HoneyNet Project. Eric teaches a wide range of courses for SANS and is actively involved with several of there search projects that SANS is performing. He led the SANS Top 20 vulnerability consensus project and is actively involved with the Cyber Defense Initiative. Mathew Newfield serves as a Senior Security Analyst for TruSecure Corporation. His background includes penetration testing, security architecture, and design and network consulting. He currently works with several companies in securing their environments and obtaining corporate security certifications. John M. Millican has been providing information consulting services since 1978. During that time, he has supported numerous versions of Unix, including AT&T, CTIX, SCO Unix, AIX, Unixware, and Linux. John was the first person to earn all the GIAC Level 2 Certifications offered by the SANS Institute. He is certified by SANS GIAC for Intrusion Detection In Depth (GCIA); Advanced Incident Handling and Hacking Exploits (GCIH); Firewalls, VPNs, and Perimeter Protection (GCFW); Securing Windows (GCFW); Securing Unix (GCUX); and Auditing Networks, Perimeters, and Systems (GCNA). He is currently the chairman of the SANS Unix Security Certification Board. John also assisted in the development of the SANS Security Essentials Bootcamp. Technical Reviewers Mike Poor is a security analyst for Compugenx, a Washington, D.C.-based consulting company. He holds SANS, GSEC, and GCIA certifications. As a security analyst, he conducts vulnerability assessments, penetration tests and security audits and administers intrusion detection systems. Previously, Mike has worked in network engineering and systems, network, and Web administration. He is currently working on merging Snort, Shadow, and ngrep to bring more analytical power to the analyst. . Sheila Ettinger is gainfully employed as a Unix Systems Administrator at Concordia University in Montreal. In her previous life, she worked in contract research and as a technical writer, software tester, and Windows trainer. Sheila is currently part of the design team involved in a project to reorganize Concordia's IT services. (She is being dragged kicking and screaming into the world of Active Directory. We'll let you know if she survives.) In addition to her day job, Sheila teaches evening computer courses at Concordia's Center for Continuing Education and is a Program Consultant for the center's Computer Institute. In her down time, she enjoys playing clarinet in a number of community concert bands and taking courses in the university's music department. David Goldsmith has been working in the computer and network industry for over 10 years, of which he has focused the last 3 on Internet connectivity and system/network security. From 1990 to 1995, he worked for the USMC as a system/network administrator and systems engineer. From 1995 to 1999, he worked for Ocean Systems Engineering Corporation providing system administration and network security support for the USMC. David currently has his own business, Rappahannock Technologies, Incorporated, which focuses on providing network security consulting services to commercial companies. He holds a degree in computer science from the University of California, San Diego.

Introduction.


Who Should Read This Book. What's in This Book. Conventions Used in This Book.



1. Security Overview.


Introduction to Security Tools. Exercise 1: Configuring Your System.

I. SECURITY OVERVIEW.

2. Trojans.


Exercise 1: Trust Relationships. Exercise 2: Trojan Software NetBus. Exercise 3: Trojan Software SubSeven.

3. Host-Based Intrusion Detection.


Exercise 1: TCP Wrappers. Exercise 2: xinetd. Exercise 3: Tripwire. Exercise 4: Swatch. Exercise 5: PortSentry. Exercise 6: Auditing Your System.

4. Network-Based Intrusion Detection.


Exercise 1: Sniffing with tcpdump. Exercise 2: Nuking a System. Exercise 3: Snort.

5. Firewalls.


Exercise 1: Personal Firewalls and ZoneAlarm. Exercise 2: Tiny Firewall. Exercise 3: ipchains.

6. Scanning Tools.


Exercise 1: Scanning with Nmap. Exercise 2: Scanning with SuperScan. Exercise 3: Vulnerability Scanning with Nessus. Exercise 4: Legion. Exercise 5: hping2.

II. SECURITY CONCEPTS.

7. Understanding Exploits.


Exercise 1: Null Session Exploits. Exercise 2: Extracting Information with DumpSec.

8. Security Policy.


Exercise 1: Developing a Security Policy.

9. Password Cracking.


Exercise 1: John the Ripper. Exercise 2: L0pht Crack (LC3).

10. Forensic Backups.


Exercise 1: Disk Imaging with Ghost. Exercise 2: Forensics with dd.

11. Denial of Service and Deception Attacks.


Exercise 1: Denial of Service with TFN2K. Exercise 2: Deception with Fragrouter.

12. Web Security.


Exercise 1: Web Security with BlackWidow. Exercise 2: Web Security with WebSleuth. Exercise 3: Finding Web Vulnerabilities with Whisker.

III. NETWORK SECURITY.

13. Network Design.


Exercise 1: Cisco ConfigMaker.

14. Base Conversions, IP Addressing, and Subnetting.


Exercise 1: Binary Conversion. Exercise 2: Subnetting.

15. Network Security Tools.


Exercise 1: Router ACLs. Exercise 2: Scanning Hosts with Ping War. Exercise 3: Analysis with Ethereal.

IV. SECURE COMMUNICATIONS.

16. Secure Communications.


Exercise 1: PGP. Exercise 2: Steganography with JPHS. Exercise 3: Steganography with S-Tools.

V. WINDOWS.

17. Windows Security.


Exercise 1: Security Configuration and Analysis. Exercise 2: Startup Cop. Exercise 3: Hfnetchk. Exercise 4: MPSA. Exercise 5: How to Baseline and Audit Your System. Exercise 6: Backups. Exercise 7: IIS Lockdown. Exercise 8: Socket80.

VI. UNIX.

18. Unix.


Exercise 1: The Unix File System. Exercise 2: Sudo. Exercise 3: Unix Permissions. Exercise 4: Unix Network Commands. Exercise 5: Log Files. Exercise 6: tar.

19. Summary.
Index.