Information Security and Disaster Recovery

GIAC Certification
GIAC (Global Information Assurance Certification) was established in 1999 to certify the knowledge of network security experts. GIAC's mission is to validate that an accredited professional has the skills appropriate to provide services in vital areas of network, data, and application software security. GIAC certifications are recognized by companies and institutions around the world including and the United States National Security Agency (NSA).

GIAC certifications cover a variety knowledge areas ranging from information security fundamentals to advanced topics such as audit, intrusion detection, incident handling, firewalls and perimeter protection, forensics, hacker techniques, Windows and UNIX system security, and secure application programming. GIAC certifications require candidates to demonstrate their depth of skills in specific knowledge areas rather than general computer security knowledge.

Progent offers the professional services of GIAC-certified experts via remote access anywhere in the world or onsite at select cities throughout the U.S. By offering economical rates and the highest level of expertise, Progent can give small and mid-size businesses the same quality of system security and data protection once available only to large enterprises.

Progent can provide your network with any of the security support services covered under GIAC certification programs including:

• Auditing Networks, Perimeters, and Systems
• Incident Handling and Response
• Intrusion Detection and Traffic Analysis
• Web Application Security

Auditing Networks, Perimeters, and Systems
Progent's security engineers who have obtained the GIAC Systems and Network Auditor (GSNA) credential understand the best practices, system analysis, and forensics required to perform thorough network security audits that can uncover a wide range of known threats and vulnerabilities. Progent can also help you build appropriate countermeasures and defenses based on realistic risk assessment in order to provide ongoing protection for your information system. Specific network security auditing services offered by Progent's GIAC-certified consultants include:

• Conduct detailed router audits
• Test the Firewall for OS configuration, firewall configuration, and system administration
• Test the Firewall rulebase for vulnerabilities, packet flow from all networks, and change control
• Assess third-party software encryption, authentication, virus scanning, and URL redirection
• Review logs and alerts from the Intrusion Detection System (IDS) and Firewall
• Deploy router analysis tools such as Router Audit Tool (RAT), scanning tools such as Nmap, packet building tools such as -Hping2 and Nemesis, sniffers such as Wire Shark, and IDS auditing tools such as Fragroute
• Audit wireless security including 802.11b security issues and LEAP/PEAP authentication using wireless auditing tools such as WSA, Airopeek, and Net Stumbler
• Map your network from inside and outside your Firewall and auditing perimeter defenses
• Perform penetration tests
• Audit configuration of key network services such as DNS and SMTP
• Check database security for Microsoft SQL, MySQL and Oracle
• Identify security weaknesses for web-enabled services and applications
• Evaluate web application architectures and infrastructures
• Look for web-based phishing, resource exhaustion, buffer overflows, hidden form elements, and unexpected user input
• Audit web application user sign-on and sign-off process, session tracking, and management
• Audit Windows-based systems focusing on patch levels, network based services, local services, installed software, security configuration, group policy management, plus log aggregation, management and analysis
• Perform event reconstruction if necessary
• Sarbanes-Oxley and Graham-Leach-Bliley compliance

Progent's incident handling experts can offer consulting assistance both on how to respond to a security incident and how to understand and foil the techniques used by hackers to penetrate your network.

Responding to a Security Incident
Progent can help you plan and implement a precise step-by-step procedure for responding to successful network attacks or to physical incidents such as fires, floods and crime. By putting in place a proven and well-defined methodology for incident handling, your company will be able to get systems and services back online as quickly and securely as possible. The step-by-step incident response model recommended and supported by Progent covers these phases:

• In the Preparation Phase, you create a set of tools to use as an incident response Jump Kit, identify the core team of responders, and deploy appropriate instrumentation for your site and system
• In the Identification Phase you report signs of an incident, take the first steps to control it, and establish a chain of custody so that no relevant information or evidence is lost or unreported
• In the Containment Phase you implement predetermined video and audio documentation strategies, execute containment and quarantine procedures, pull the network cable and switch if required, and identify and isolate the Trust Model
• In the Eradication Phase you evaluate whether a backup is compromised, totally rebuild the Operating System if required, and if necessary move to a new architecture
• In the Recovery Phase you determination who makes the decision to return to production, monitor the system, and prepare for increase in attacks
• For Special Incidents such as espionage, inappropriate use, or sexual harassment, take appropriate actions determined by the type of incident
• In the Incident Record Keeping Phase you complete legally acceptable pre-built forms to document and report the incident
• In the Incident Follow-Up Phase you conduct a lessons-learned meeting and define appropriate changes in process for the future

Understanding and Defeating Hacker Techniques
Networks invariably expose substantial amounts of information that can assist potential attackers. In addition to looking for information leakage, attackers also run scans of systems to find security gaps such as weak DMZ systems and firewalls or unsecured wireless LANs. Popular hacking techniques include inverse scanning, blind scans, and bounce scans that obscure their source. Attackers also try to understand and manipulate firewall rule sets and evade Intrusion Detection Systems. Progent’s consultants who hold the GIAC Certified Incident Handler credential can help you understand contemporary hacking techniques in detail so you can take appropriate countermeasures to protect your network. Some of the hacking techniques that Progent can help you understand and defend against include:

• Network-level Attacks such as session hijacking (from Telnet to SSL and SSH), person-in-the-middle attacks, and passive sniffing
• Gathering and Parsing Packets via active sniffing through ARP cache poisoning and DNS injection, DNS cache poisoning to redirect traffic on the Internet, using Netcat for backdoors and Nasty Relays, and IP Address spoofing
• Operating System and Application-Level Attacks utilizing buffer overflows, the MetaSploit Exploitation Framework, the Perl Exploit Library, and format string attacks to exploit vulnerabilities in Windows
• Netcat-based Attacks for transferring files, creating backdoors, shell shoveling, setting up relays to obscure the source of an attack, and launching replay attacks
• Password Cracking with L0phtCrack and John the Ripper
• Web Application Attacks for account harvesting, SQL Injection to manipulate back-end databases, session cloning to grab other Users' web sessions, and cross-site scripting
• Denial of Service Attacks involving distributed Denial of Service, pulsing zombies and reflected attacks, Local Denial of Service, SYN floods and smurf attacks using spoofed broadcast ping messages
• Maintaining Unauthorized Access by creating backdoors using QAZ and Tini, using application-level Trojan Horse Backdoor suites such as VNC and SubSeven, using rootkits to substitute binary executables with malware, and using kernel-level rootkits such as Adore and KIS to compromise the operating system
• Covering the Attacker's Tracks via file and directory camouflage and hiding, log file editing, accounting entry editing of UTMP, WTMP, and Shell Histories, establishing covert channels over HTTP, ICMP, TCP and other protocols, and hiding data in images, music, binaries, or other file types

• In-depth understanding of the TCP/IP Communication Model
• Fragmentation
• Core Internet protocols such as Internet Control Message Protocol (ICMP)
• Stimulus and Response
• Microsoft Networking and Security
• Domain Name System (DNS)
• Routing
• The IPSec (Internet Protocol Security) suite of Internet security protocols
• Use of the TCPdump tool to examine Datagram Fields
• Analysis of TCPdump Output
• Using the Snort network intrusion detection system
• Traffic patterns and analysis
• Interoperability and standards in intrusion detection
• Passive analysis techniques
• Identifying crafted packets
• In-depth protocols analysis
• Advanced Analysis Profiling Techniques
• Reducing false-positives
• Identifying Denial-of-Service activity
• IDS/IPS architecture and implementation techniques
• Event correlation and common attack techniques

• Securing web application architectures and infrastructures
• Cryptography
• Authentication
• Access control
• Session mechanism
• Web application logging
• Input issues and validation
• SQL injection due to incorrect escape character filtering, type handling, etc.
• Cross-Site Scripting
• Phishing attacks for unauthorized information gathering such as name and password harvesting
• HTTP Response Splitting
• Cross-Site Request Forgery
• Resource exhaustion
• Buffer overflows
• Hidden form elements
• Unexpected user input
• User sign-on and sign-off process
• Session tracking and management
• GET vs. POST
• Improper Server Logic
• Web Browser Security
• Server-side Techniques for Protecting Sensitive Data

For more information about Progent's network security support services, call Progent at 800-993-9400 or email Progent at security-help@progent.com.