Ne Course Part One

1. UNO Copyright: MCC 1
Network Professional CourseNetwork Professional Course
Data & Network SecurityData & Network Security
U Nyein OoU Nyein Oo
COO/DirectorCOO/Director
Myanma Computer Co., LtdMyanma Computer Co., Ltd

2. UNO Copyright: MCC 2
Part OnePart One
Computer VirusComputer Virus

3. UNO Copyright: MCC 3
Topics to be coveredTopics to be covered
Computer virus
Different type of virus
Macro virus
Worm
Trojan horse
Hybrids
Malware
Spam
Spyware
And And
preventing Computer Viruspreventing Computer Virus

4. UNO Copyright: MCC 4
What is Computer Virus?What is Computer Virus?
In 1983, Fred Cohen coined the term “computer virus”,
assume a virus was "a program that can 'infect' other
programs by modifying them to include a possibly
evolved copy of itself.”
Mr. Cohen expanded his definition a year later in his
1984 paper, “A Computer Virus”, noting that “a virus
can spread throughout a computer system or network
using the authorizations of every user using it to infect
their programs”.

5. UNO Copyright: MCC 5
Some History on Fred CohenSome History on Fred Cohen
•BS (Electrical Engineering )
•MS (Information Science)
•Ph.D (Electrical and Computer Engineering)
•Inventor of “Computer Viruses” (1983)
•First published most current virus defense techniques
•Consultant, computer security
•Fred Cohen &Associates
•Sandia National Laboratories
•Global reputation for integrity

6. UNO Copyright: MCC 6
Macro virusMacro virus
Macro viruses are a special case of viruses. Instead of
infecting software program files directly, macro viruses
infect Microsoft Office documents and templates.
They exist because Microsoft has implemented a
complete programming language in their Office
applications which allows any document to contain
software code.

7. UNO Copyright: MCC 7
Macro virus (cont:)Macro virus (cont:)
Macro viruses can be extremely dangerous, since the
scripting language built-in to Microsoft Office (called
"Visual Basic for Applications") gives the virus full control
of the computer, including the ability to run arbitrary
software, send e-mail, delete files, or activate some other
malicious payload.

8. UNO Copyright: MCC 8
What is worm?What is worm?
In contrast to viruses, computer worms are malicious
programs that copy themselves from system to system,
rather than sensitive legal files.
For example, a mass-mailing
email worm is a worm that
sends copies of itself via email.
A network worm makes copies
of itself throughout a network,
an Internet worm sends copies
of itself via vulnerable computers
on the Internet, and so on.

9. UNO Copyright: MCC 9
What is Trojan Horses?What is Trojan Horses?
Trojans, another form of malware, are generally agreed
upon as doing something other than the user expected,
with that “something” defined as malicious.
Most often, Trojans are
associated with remote
access programs that perform
illicit operations such as
password-stealing or which
allow compromised machines
to be used for targeted denial
(rejection) of service attacks.

10. UNO Copyright: MCC 10
Trojan Horses (cont:)Trojan Horses (cont:)
One of the more basic forms of a denial of service
(DoS) attack involves flooding a target system with so
much data, traffic, or commands that it can no longer
perform its core functions.
When multiple machines are gathered together to
launch such an attack, it is known as a distributed
denial of service attack, or DDoS.

11. UNO Copyright: MCC 11
What is Hybrids?What is Hybrids?
In fact, most dangerous software combines the features
of several types. One of the first successful e-mail
attacks, the Happy99 Virus, wasn't merely a virus.
When opened, it displayed
a pleasant fireworks animation,
tricking the user into thinking it
was a harmless entertainment
like a trojan.

12. UNO Copyright: MCC 12
Hybrids (cont:)Hybrids (cont:)
Then, like a virus, it modified the computer's operating
system files and installed software code which would
create copies of itself whenever the user sent e-mail.
Finally, like a worm, Happy99 propagated to other
computers via e-mail.

13. UNO Copyright: MCC 13
What is malware?What is malware?
Taken as a group, these many types of software are
called "malicious software", because they modify your
computer's files without asking and attempt to perform
some kind of annoying or dangerous activity.
 In the computer community,
the spectrum of malicious
software is often called
malware.

14. UNO Copyright: MCC 14
What is SPAM?What is SPAM?
"Spamming [the sending of unsolicited email] is the
scourge of electronic-mail and newsgroups on the
Internet.
It can seriously interfere with the operation of public
services, to say nothing of the effect it may have on
any individual's e-mail mail system.
Spammers are, in effect, taking
resources away from users and
service suppliers without
compensation and without
authorization."

15. UNO Copyright: MCC 15
SpywareSpyware
Spyware is any software or program that employs a
user's Internet connection in the background (the so-
called "backchannel") without their knowledge or
explicit permission.

16. UNO Copyright: MCC 16

17. UNO Copyright: MCC 17
Virus EncyclopediaVirus Encyclopedia
1. File Virus
2. Boot Virus
3. Multi parties Virus (File and Boot )
4. Multi Platform Virus
5. Virus Constructors
6. Script Virus
7. Polymorphic Generator
8. Virus Hoaxes
9. Palm
10. Jokes

18. UNO Copyright: MCC 18
File Extensions of EvilFile Extensions of Evil
User File Extension
Xxx.doc
Xxx.xls
Xxx.ppt
xxx.pmd
Xxx.pdf
Xxx.bmp
And others
System File Extension
Xxx.exe
Xxx.bat
Xxx.com
xxx.sys
Xxx.int
Xxx.dll
And others

19. UNO Copyright: MCC 19
The Golden Rule of E-mail ProtectionThe Golden Rule of E-mail Protection
NEVER OPEN AN E-MAIL ATTACHMENT UNLESS
YOU HAVE INDEPENDENTLY CONFIRMED ITS
CONTENT AND VALIDITY!
a separate e-mail with a clear description of the file
names and contents of the attachments,
a telephone call discussing the attached files,
a face-to-face conversation, or
any other communication independent of the e-mail
containing the attachments, which specifies the file
names and file contents.

20. UNO Copyright: MCC 20
Example of Attached FileExample of Attached File

21. UNO Copyright: MCC 21
Other Ways to Secure Your System Other Ways to Secure Your System
Don't use file and print sharing unless you must
If you do use file sharing, use good passwords
Don't allow Windows to open .VBS(vb script)
or .WSF(Windows Script) files
Beware software of unknown origin
Forged E-mail Addresses
Anti-virus Software
Malicious Software Documented at Rice
To get More Help
To Find Security Patches

22. UNO Copyright: MCC 22
Example of Service Pack FileExample of Service Pack File

23. UNO Copyright: MCC 23
Top 10 Virus Report in Feb 2007

24. UNO Copyright: MCC 24
Top Antivirus SoftwareTop Antivirus Software
Nortan Antivirus ( www.symantec.com)
Mcafee Antivirus ( www.macfee.com)
Bitdeffender (www.bitdeffender.com)
F-Secure (www.f-secrure.com)
PC-cillin (www.trendmicro.com)
E-safe…etc

25. UNO Copyright: MCC 25

26. UNO Copyright: MCC 26

27. UNO Copyright: MCC 27

28. UNO Copyright: MCC 28

29. UNO Copyright: MCC 29

30. UNO Copyright: MCC 30

31. UNO Copyright: MCC 31

32. UNO Copyright: MCC 32
criteria of anti-virus software.criteria of anti-virus software.
Ease of Use
Effective at Identifying Viruses and Worms
Effective at Cleaning or Isolating Infected Files
Activity Reporting
Feature Set (Scanning Capabilities)
Ease of Installation and Setup
Help Documentation

33. UNO Copyright: MCC 33
Main Features of AntivirusMain Features of Antivirus
Provides complete e-mail virus Protection
Eliminates all types of viruses
Easy to use: install and forget
Automatic virus definitions updates
Uses powerful virus scanning engines
Creates detailed scan reports ..etc

34. UNO Copyright: MCC 34
Activity Log File LocationActivity Log File Location

35. UNO Copyright: MCC 35
Preventing Computer VirusPreventing Computer Virus
1.Install anti-virus software and keep the virus
definitions up to date.
2.Don't automatically open attachments
3.Scan all incoming email attachments
4.Get immediate protection
5.Update your anti-virus software frequently.
6.Avoid downloading files you can't be sure are safe
7.Don't boot from a floppy disk
8.Don't share floppies
9.Scan floppies before using them
10.Use common sense

36. UNO Copyright: MCC 36
Useful linksUseful links
Virus Encyclopedia
http://www.antivirus.com/vinfo/virusencyclo/
Virus pattern downloads http://
www.antivirus.com/download/pattern.asp
Subscribe to email alerts on Virus http://www.antivirus.com/vinfo/
Online virus scanner, Housecall
http://housecall.antivirus.com/
Real-time Virus Tracking
http://wtc.trendmicro.com/wtc/
Mcafee Security
http://www.mcafee.com
Nortan Antivirus
http://symantec.com

37. UNO Copyright: MCC 37
Part TwoPart Two
OOthers Data Security Issuethers Data Security Issue

38. UNO Copyright: MCC 38
Topic to be coveredTopic to be covered
Encryption
Firewall
Authentication
Virtual Private Network (VPN)
Digital Certificate
Digital Signature
Certification Authorities
On-Line Security Assistants

39. UNO Copyright: MCC 39
EncryptionEncryption
The translation of data into a secret code. Encryption is the
most effective way to achieve data security.
To read an encrypted file, you must have access to a secret
key or password that enables you to decrypt it.
Unencrypted data is called plain text; encrypted data is
referred to as cipher text.
There are two main types of encryption: asymmetric
encryption (also called public-key encryption) and
symmetric encryption.

40. UNO Copyright: MCC 40
Sample Diagram for EncryptionSample Diagram for Encryption

41. UNO Copyright: MCC 41
FirewallFirewall
A combination of hardware and software that secures
access to and from the LAN.
A firewall blocks unwanted access to the protected
network while giving the protected network access to
networks outside of the firewall.
An organization will typically install a firewall to give users
access to the internet while protecting their internal
information.

42. UNO Copyright: MCC 42
42
Sample usage of FirewallSample usage of Firewall

43. UNO Copyright: MCC 43
AuthenticationAuthentication
Determines a user's identity, as well as determining what
a user is authorized to access.
The most common form of authentication is user name
and password, although this also provides the lowest level
of security.
VPNs use digital certificates and digital signatures to more
accurately identify the user.

44. UNO Copyright: MCC 44
Sample Authentication Sample Authentication

45. UNO Copyright: MCC 45
Virtual Private NetworkVirtual Private Network
A virtual private network (VPN) is a private data
network that makes use of the public
telecommunication infrastructure, maintaining privacy
through the use of a tunneling protocol and security
procedures.
The idea of the VPN is to give the company the same
capabilities at much lower cost by using the shared
public infrastructure rather than a private one.

46. UNO Copyright: MCC 46
Tunneling ProtocolTunneling Protocol
A tunneling protocol is a network protocol which
encapsulates one protocol or session inside another.
Protocol A is encapsulated within protocol B, such that
A treats B as though it were a data link layer.
Tunneling is used to get data between administrative
domains which use a protocol that is not supported by
the internet connecting those domains.

47. UNO Copyright: MCC 47
VPNs ScenariosVPNs Scenarios
Internet VPN
Over the public access Internet
Connect remote office across the Internet
Connect remote dialup users to their home gateway
through ISP: known as VPDN
Intranet VPN
Within an enterprise or organization that might or
might not involve traffic traversing a WAN
Extranet VPN
Between two or more separate entities that can
involve data traversing the Internet or some other
WAN

48. UNO Copyright: MCC 48
Sample usage of VPN

49. UNO Copyright: MCC 49
Why should use VPN?Why should use VPN?
Data confidentiality
Encrypt the packets before transmitting across the
network
Data Integrity
Authenticate peers and examine packets ensuring
that data has not been altered during transmission
Data origin authentication
Authenticate the source of data sent
Depend on data integrity service
Anti-replay
Detect and reject replayed packets preventing
spoofing and MITM attacks

50. UNO Copyright: MCC 50
Digital CertificateDigital Certificate
Electronic counterparts to driver licenses, passports.
Certificates are the framework for identification
information, and bind identities with public keys.
They provide a foundation for
 identification ,
 authentication and
 non-repudiation.
Enable individuals and organizations to secure
business and personal transactions across
communication networks.

51. UNO Copyright: MCC 51
Types of CertificatesTypes of Certificates
 Root or Authority certificates
These are self signed by the CA that created them
 Institutional authority certificates
Also called as “campus certificates”
 Client certificates
These are also known as end-entity
certificates, identity certificates,or personal
certificates.
 Web server certificates
used for secure communications to and from
Web servers

52. UNO Copyright: MCC 52
Sample of Digital CertificateSample of Digital Certificate

53. UNO Copyright: MCC 53
Content of Digital CertificateContent of Digital Certificate
Version
Serial number
Certificate issuer
Certificate holder
Validity period Attributes, known as certificate extensions,
that contain additional information such as allowable uses
for this certificate
Digital signature from the certification authority to ensure
that the certificate has not been altered and to indicate the
identity of the issuer
And other…

54. UNO Copyright: MCC 54
Digital SignatureDigital Signature
An electronic signature that can be used to authenticate
the identity of the sender of a message, or of the signer of
a document.
It can also be used to ensure that the original content of
the message or document that has been conveyed is
unchanged.

55. UNO Copyright: MCC 55
How Digital Signature Work?How Digital Signature Work?

56. UNO Copyright: MCC 56
Digital Certificate SampleDigital Certificate Sample

57. UNO Copyright: MCC 57
Verisign Certificate SampleVerisign Certificate Sample

58. UNO Copyright: MCC 58
Certification AuthorityCertification Authority
A third party organization which is used to confirm the
relationship between a party to the https transaction
and that party's public key.
Certification authorities may be widely known and
trusted institutions for Internet based transactions;
where https is used on companies internal networks, an
internal department within the company may fulfill this
role.

59. UNO Copyright: MCC 59
How CA Work?How CA Work?

60. UNO Copyright: MCC 60
Some Famous CAsSome Famous CAs
Verisign ( www.verisign.com)
Europki (www.europki.org)
CyberTrust ( www.cybertrust.com)
And many more…

61. UNO Copyright: MCC 61

62. UNO Copyright: MCC 62

63. UNO Copyright: MCC 63

64. UNO Copyright: MCC 64
On Line Security AssistantOn Line Security Assistant
The CERT® Program is part of the Software
Engineering Institute (SEI), a federally funded
research and development center at Carnegie Mellon
University in Pittsburgh, Pennsylvania. Following the
Morris worm incident, which brought 10 percent of
internet systems to a halt in November 1988, the
Defense Advanced Research Projects Agency
(DARPA) charged the SEI with setting up a center to
coordinate communication among experts during
security emergencies and to help prevent future
incidents. This center was named the
CERT Coordination Center (CERT/CC).

65. UNO Copyright: MCC 65
On Line Security AssistantsOn Line Security Assistants

66. UNO Copyright: MCC 66
Area of work by CERTArea of work by CERT
Software Assurance
Secure Systems
Organizational Security
Coordinated Response
Education and Training

67. UNO Copyright: MCC 67
Participation in OrganizationsParticipation in Organizations
Forum of Incident Response and Security Teams
(FIRST) - The CERT/CC was a founding member of
FIRST, which is a coalition of individual response teams
around the world.
Internet Engineering Task Force (IETF) - The IETF is
an international organization that is instrumental in
developing internet standards.
National Security Telecommunications Advisory
Committee's Network Security Information
Exchange (NSTAC NSIE) - The NSTAC NSIE works to
reduce vulnerabilities in critical infrastructures.

68. UNO Copyright: MCC 68

69. UNO Copyright: MCC 69

70. UNO Copyright: MCC 70
Myanmar Online Security Myanmar Online Security

71. UNO Copyright: MCC 71
Thanks You!Thanks You!