# embedding_metadata

key: chroma:document
string_value:
is attacked. 
A simple example of an internal resource attack is the SYN flood attack. Figure 19.5a 
shows the steps involved: 
1. The attacker takes control of multiple hosts over the Internet, instructing them to 
contact the target Web server.  
2. The slave hosts begin sending TCP/IP SYN (synchronize/initialization) packets, with


key: chroma:document
string_value:
erroneous return IP address information, to the target. 
3. Each SYN packet is a request to open a TCP connection. For each such packet, the 
Web server responds with a SYN/ACK (synchronize/acknowledge) packet, trying to 
establish a TCP connection with a TCP entity at a spurious IP address. The Web server


key: chroma:document
string_value:
maintains a data structure for each SYN request waiting for a response back and becomes 
bogged down as more traffic floods in. The result is that legitimate connections are denied 
while the victim machine is waiting to complete bogus "half-open" connections.


key: full_page_content
string_value:
113 
 
 
 
Figure 3.9. Examples of Simple DDoS Attacks 
The TCP state data structure is a popular internal resource target but by no means the 
only one. Examples are the following: 
1. In many systems, a limited number of data structures are available to hold process 
information (process identifiers, process table entries, process slots, etc.). An intruder 
may be able to consume these data structures by writing a simple program or script that 
does nothing but repeatedly create copies of itself. 
2. An intruder may also attempt to consume disk space in other ways, including 
• 
generating excessive numbers of mail messages 
• 
placing files in anonymous ftp areas or network-shared areas 
• 
intentionally generating errors that must be logged 
Fig 3.9  illustrates an example of an attack that consumes data transmission resources. 
The  
following steps are involved: 
1. The attacker takes control of multiple hosts over the Internet, instructing them to send 
ICMP  
ECHO packets with the target's spoofed IP address to a group of hosts that act as 
reflectors, as described subsequently.  
2. Nodes at the bounce site receive multiple spoofed requests and respond by sending 
echo reply packets to the target site.


key: chroma:document
string_value:
113 
 
 
 
Figure 3.9. Examples of Simple DDoS Attacks 
The TCP state data structure is a popular internal resource target but by no means the 
only one. Examples are the following: 
1. In many systems, a limited number of data structures are available to hold process 
information (process identifiers, process table entries, process slots, etc.). An intruder


key: chroma:document
string_value:
may be able to consume these data structures by writing a simple program or script that 
does nothing but repeatedly create copies of itself. 
2. An intruder may also attempt to consume disk space in other ways, including 
• 
generating excessive numbers of mail messages 
• 
placing files in anonymous ftp areas or network-shared areas 
•


key: chroma:document
string_value:
• 
intentionally generating errors that must be logged 
Fig 3.9  illustrates an example of an attack that consumes data transmission resources. 
The  
following steps are involved: 
1. The attacker takes control of multiple hosts over the Internet, instructing them to send 
ICMP  
ECHO packets with the target's spoofed IP address to a group of hosts that act as


key: chroma:document
string_value:
reflectors, as described subsequently.  
2. Nodes at the bounce site receive multiple spoofed requests and respond by sending 
echo reply packets to the target site.


key: full_page_content
string_value:
114 
 
3. The target's router is flooded with packets from the bounce site, leaving no data 
transmission  capacity for legitimate traffic. 
Another way to classify DDoS attacks is as either direct or reflector DDoS attacks. In a 
direct DDoS attack (Figure 3.10 a), the attacker is able to implant zombie software on a 
number of sites distributed throughout the Internet. Often, the DDoS attack involves two 
levels of zombie machines: master zombies and slave zombies. The hosts of both 
machines have been infected with malicious code. The attacker coordinates and triggers 
the master zombies, which in turn coordinate and trigger the slave zombies. The use of 
two levels of zombies makes it more difficult to trace the attack back to its source and 
provides for a more resilient network of attackers


key: chroma:document
string_value:
114 
 
3. The target's router is flooded with packets from the bounce site, leaving no data 
transmission  capacity for legitimate traffic. 
Another way to classify DDoS attacks is as either direct or reflector DDoS attacks. In a 
direct DDoS attack (Figure 3.10 a), the attacker is able to implant zombie software on a


key: chroma:document
string_value:
number of sites distributed throughout the Internet. Often, the DDoS attack involves two 
levels of zombie machines: master zombies and slave zombies. The hosts of both 
machines have been infected with malicious code. The attacker coordinates and triggers 
the master zombies, which in turn coordinate and trigger the slave zombies. The use of


key: chroma:document
string_value:
two levels of zombies makes it more difficult to trace the attack back to its source and 
provides for a more resilient network of attackers


key: full_page_content
string_value:
115 
 
 
Figure 3.10 Types of Flooding-Based DDoS Attacks 
 
A reflector DDoS attack adds another layer of machines (Figure 310 b). In this type of 
attack, the slave zombies construct packets requiring a response that contain the target's 
IP address as the source IP address in the packet's IP header. These packets are sent to 
uninfected machines known as reflectors. The uninfected machines respond with packets 
directed at the target machine. A reflector DDoS attack can easily involve more machines 
and more traffic than a direct DDoS attack and hence be more damaging.  
3.6.2 Constructing the Attack Network


key: chroma:document
string_value:
115 
 
 
Figure 3.10 Types of Flooding-Based DDoS Attacks 
 
A reflector DDoS attack adds another layer of machines (Figure 310 b). In this type of 
attack, the slave zombies construct packets requiring a response that contain the target's 
IP address as the source IP address in the packet's IP header. These packets are sent to


key: chroma:document
string_value:
uninfected machines known as reflectors. The uninfected machines respond with packets 
directed at the target machine. A reflector DDoS attack can easily involve more machines 
and more traffic than a direct DDoS attack and hence be more damaging.  
3.6.2 Constructing the Attack Network


key: full_page_content
string_value:
116 
 
 The first step in a DDoS attack is for the attacker to infect a number of machines with 
zombie software that will ultimately be used to carry out the attack. The essential 
ingredients in this phase of the attack are the following: 
1. Software that can carry out the DDoS attack. The software must be able to run on a 
large  
number of machines, must be able to conceal its existence, must be able to communicate 
with the attacker or have some sort of time-triggered mechanism, and must be able to 
launch the intended attack toward the target. 
2. A vulnerability in a large number of systems. The attacker must become aware of a 
vulnerability that many system administrators and individual users have failed to patch 
and that enables the attacker to install the zombie software. 
3. A strategy for locating vulnerable machines, a process known as scanning 
 
In the scanning process, the attacker first seeks out a number of vulnerable machines 
and infects them. Then, typically, the zombie software that is installed in the infected 
machines repeats the same scanning process, until a large distributed network of infected 
machines is created. The followings are types of scanning strategies: 
● Random: Each compromised host probes random addresses in the IP address space, 
using a different seed. This technique produces a high volume of Internet traffic, which 
may cause generalized disruption even before the actual attack is launched. 
● Hit-list: The attacker first compiles a long list of potential vulnerable machines. This 
can be a slow process done over a long period to avoid detection that an attack is 
underway. Once the list is compiled, the attacker begins infecting machines on the list. 
Each infected machine is provided with a portion of list to scan. This strategy results in a 
very short scanning period, which may make it difficult to detect that infection is taking 
place. 
● Topological: This method uses information contained on an infected victim machine 
to find more hosts to scan. 
● Local subnet: If a host can be infected behind a firewall, that host then looks for targets 
in its own local network. The host uses the subnet address structure to find other hosts 
that would otherwise be protected by the firewall. 
3.6.3 DDoS Countermeasures 
In general, there are three lines of defense against DDoS attacks 
• Attack prevention and preemption (before the attack): These mechanisms enable the  
victim to endure attack attempts without denying service to legitimate clients. Techniques  
include enforcing policies for resource consumption and providing backup resources 
available on demand. In addition, prevention mechanisms modify systems and protocols 
on the Internet to reduce the possibility of DDoS attacks. 
● Attack detection and filtering (during the attack): These mechanisms attempt to 
detect the attack as it begins and respond immediately. This minimizes the impact of the 
attack on the target. Detection involves looking for suspicious patterns of behavior. 
Response involves filtering out packets likely to be part of the attack. 
• Attack source traceback and identification (during and after the attack): This is an


key: chroma:document
string_value:
116 
 
 The first step in a DDoS attack is for the attacker to infect a number of machines with 
zombie software that will ultimately be used to carry out the attack. The essential 
ingredients in this phase of the attack are the following: 
1. Software that can carry out the DDoS attack. The software must be able to run on a 
large


key: chroma:document
string_value:
large  
number of machines, must be able to conceal its existence, must be able to communicate 
with the attacker or have some sort of time-triggered mechanism, and must be able to 
launch the intended attack toward the target. 
2. A vulnerability in a large number of systems. The attacker must become aware of a


key: chroma:document
string_value:
vulnerability that many system administrators and individual users have failed to patch 
and that enables the attacker to install the zombie software. 
3. A strategy for locating vulnerable machines, a process known as scanning 
 
In the scanning process, the attacker first seeks out a number of vulnerable machines


key: chroma:document
string_value:
and infects them. Then, typically, the zombie software that is installed in the infected 
machines repeats the same scanning process, until a large distributed network of infected 
machines is created. The followings are types of scanning strategies: 
● Random: Each compromised host probes random addresses in the IP address space,


key: chroma:document
string_value:
using a different seed. This technique produces a high volume of Internet traffic, which 
may cause generalized disruption even before the actual attack is launched. 
● Hit-list: The attacker first compiles a long list of potential vulnerable machines. This 
can be a slow process done over a long period to avoid detection that an attack is


key: chroma:document
string_value:
underway. Once the list is compiled, the attacker begins infecting machines on the list. 
Each infected machine is provided with a portion of list to scan. This strategy results in a 
very short scanning period, which may make it difficult to detect that infection is taking 
place. 
● Topological: This method uses information contained on an infected victim machine


key: chroma:document
string_value:
to find more hosts to scan. 
● Local subnet: If a host can be infected behind a firewall, that host then looks for targets 
in its own local network. The host uses the subnet address structure to find other hosts 
that would otherwise be protected by the firewall. 
3.6.3 DDoS Countermeasures 
In general, there are three lines of defense against DDoS attacks


key: chroma:document
string_value:
• Attack prevention and preemption (before the attack): These mechanisms enable the  
victim to endure attack attempts without denying service to legitimate clients. Techniques  
include enforcing policies for resource consumption and providing backup resources 
available on demand. In addition, prevention mechanisms modify systems and protocols


key: chroma:document
string_value:
on the Internet to reduce the possibility of DDoS attacks. 
● Attack detection and filtering (during the attack): These mechanisms attempt to 
detect the attack as it begins and respond immediately. This minimizes the impact of the 
attack on the target. Detection involves looking for suspicious patterns of behavior.


key: chroma:document
string_value:
Response involves filtering out packets likely to be part of the attack. 
• Attack source traceback and identification (during and after the attack): This is an


key: full_page_content
string_value:
117 
 
attempt to identify the source of the attack as a first step in preventing future attacks. 
However, this method typically does not yield results fast enough, if at all, to mitigate an 
ongoing attack. 
3.7 Firewall Design Principles 
Information systems in corporations, government agencies, and other organizations have 
undergone a steady evolution: 
● Centralized data processing system, with a central mainframe supporting a number of 
directly connected terminals 
● Local area networks (LANs) interconnecting PCs and terminals to each other and the 
mainframe 
● Premises network, consisting of a number of LANs, interconnecting PCs, servers, and 
perhaps a mainframe or two 
● Enterprise-wide network, consisting of multiple, geographically distributed premises 
networks interconnected by a private wide area network (WAN) 
● Internet connectivity, in which the various premises networks all hook into the Internet 
and may or may not also be connected by a private WAN. 
3.7.1 Firewall Characteristics 
The following are design goals for a firewall: 
1. All traffic from inside to outside, and vice versa, must pass through the firewall. This 
is achieved by physically blocking all access to the local network except via the firewall. 
Various configurations are possible. 
2. Only authorized traffic, as defined by the local security policy, will be allowed to pass. 
Various types of firewalls are used, which implement various types of security policies, 
as explained later. 
3. The firewall itself is immune to penetration. This implies that use of a trusted system 
with a secure operating system.  Originally, firewalls focused primarily on service 
control, but they have since evolved to provide all four: 
● Service control: Determines the types of Internet services that can be accessed, 
inbound or outbound. The firewall may filter traffic on the basis of IP address and TCP 
port number; may provide proxy software that receives and interprets each service request 
before passing it on; or may host the server software itself, such as a Web or mail service. 
● Direction control: Determines the direction in which particular service requests may 
be initiated and allowed to flow through the firewall. 
● User control: Controls access to a service according to which user is attempting to 
access it. This feature is typically applied to users inside the firewall perimeter (local 
users). It may also be applied to incoming traffic from external users; the latter requires 
some form of secure authentication technology, such as is provided in IPSec. 
● Behavior control: Controls how particular services are used. For example, the firewall 
may filter e-mail to eliminate spam, or it may enable external access to only a portion of 
the information on a local Web server. 
The following capabilities are within the scope of a firewall: 
1. A firewall defines a single choke point that keeps unauthorized users out of the 
protected


key: chroma:document
string_value:
117 
 
attempt to identify the source of the attack as a first step in preventing future attacks. 
However, this method typically does not yield results fast enough, if at all, to mitigate an 
ongoing attack. 
3.7 Firewall Design Principles 
Information systems in corporations, government agencies, and other organizations have 
undergone a steady evolution:


key: chroma:document
string_value:
● Centralized data processing system, with a central mainframe supporting a number of 
directly connected terminals 
● Local area networks (LANs) interconnecting PCs and terminals to each other and the 
mainframe 
● Premises network, consisting of a number of LANs, interconnecting PCs, servers, and 
perhaps a mainframe or two


key: chroma:document
string_value:
● Enterprise-wide network, consisting of multiple, geographically distributed premises 
networks interconnected by a private wide area network (WAN) 
● Internet connectivity, in which the various premises networks all hook into the Internet 
and may or may not also be connected by a private WAN. 
3.7.1 Firewall Characteristics 
The following are design goals for a firewall:


key: chroma:document
string_value:
1. All traffic from inside to outside, and vice versa, must pass through the firewall. This 
is achieved by physically blocking all access to the local network except via the firewall. 
Various configurations are possible. 
2. Only authorized traffic, as defined by the local security policy, will be allowed to pass.


key: chroma:document
string_value:
Various types of firewalls are used, which implement various types of security policies, 
as explained later. 
3. The firewall itself is immune to penetration. This implies that use of a trusted system 
with a secure operating system.  Originally, firewalls focused primarily on service 
control, but they have since evolved to provide all four:


key: chroma:document
string_value:
● Service control: Determines the types of Internet services that can be accessed, 
inbound or outbound. The firewall may filter traffic on the basis of IP address and TCP 
port number; may provide proxy software that receives and interprets each service request 
before passing it on; or may host the server software itself, such as a Web or mail service.


key: chroma:document
string_value:
● Direction control: Determines the direction in which particular service requests may 
be initiated and allowed to flow through the firewall. 
● User control: Controls access to a service according to which user is attempting to 
access it. This feature is typically applied to users inside the firewall perimeter (local


key: chroma:document
string_value:
users). It may also be applied to incoming traffic from external users; the latter requires 
some form of secure authentication technology, such as is provided in IPSec. 
● Behavior control: Controls how particular services are used. For example, the firewall 
may filter e-mail to eliminate spam, or it may enable external access to only a portion of


key: chroma:document
string_value:
the information on a local Web server. 
The following capabilities are within the scope of a firewall: 
1. A firewall defines a single choke point that keeps unauthorized users out of the 
protected


key: full_page_content
string_value:
118 
 
network, prohibits potentially vulnerable services from entering or leaving the network, 
and provides protection from various kinds of IP spoofing and routing attacks.  
2. A firewall provides a location for monitoring security-related events. Audits and 
alarms can be implemented on the firewall system. 
3. A firewall is a convenient platform for several Internet functions that are not security 
related.  
4. A firewall can serve as the platform for IPSec. Using the tunnel mode capability 
described in the firewall can be used to implement virtual private networks. 
Firewalls have their limitations, including the following: 
1. The firewall cannot protect against attacks that bypass the firewall. Internal systems 
may have dial-out capability to connect to an ISP. An internal LAN may support a modem 
pool that provides dial-in capability for traveling employees and telecommuters. 
2. The firewall does not protect against internal threats, such as a disgruntled employee 
or an employee who unwittingly cooperates with an external attacker. 
3. The firewall cannot protect against the transfer of virus-infected programs or files.  
3.7.2 Types of Firewalls 
Fig 3.11 illustrates the three common types of firewalls: packet filters, application-level 
gateways, and circuit-level gateways.


key: chroma:document
string_value:
118 
 
network, prohibits potentially vulnerable services from entering or leaving the network, 
and provides protection from various kinds of IP spoofing and routing attacks.  
2. A firewall provides a location for monitoring security-related events. Audits and 
alarms can be implemented on the firewall system.


key: chroma:document
string_value:
3. A firewall is a convenient platform for several Internet functions that are not security 
related.  
4. A firewall can serve as the platform for IPSec. Using the tunnel mode capability 
described in the firewall can be used to implement virtual private networks. 
Firewalls have their limitations, including the following:


key: chroma:document
string_value:
1. The firewall cannot protect against attacks that bypass the firewall. Internal systems 
may have dial-out capability to connect to an ISP. An internal LAN may support a modem 
pool that provides dial-in capability for traveling employees and telecommuters. 
2. The firewall does not protect against internal threats, such as a disgruntled employee


key: chroma:document
string_value:
or an employee who unwittingly cooperates with an external attacker. 
3. The firewall cannot protect against the transfer of virus-infected programs or files.  
3.7.2 Types of Firewalls 
Fig 3.11 illustrates the three common types of firewalls: packet filters, application-level 
gateways, and circuit-level gateways.


key: full_page_content
string_value:
119 
 
 
Figure 3.11. Firewall Types 
3.7.2.1 Packet-Filtering Router 
A packet filtering firewall applies a set of rules to each incoming and outgoing IP 
packet and then forwards or discards the packet (Figure 22.1b). The firewall is typically 
configured to filter packets going in both directions (from and to the internal network). 
Filtering rules are based on information contained in a network packet: 
 •  Source IP address: The IP address of the system that originated the IP packet (e.g., 19
2.178.1.1) 
•  Destination IP address: The IP address of the system the IP packet is trying to reach (e.
g., 192.168.1.2) 
•   Source and destination transport-level address: The transport-
level (e.g., TCP or UDP) port number, which defines applications such as SNMP or TEL
NET 
•   IP protocol field: Defines the transport protocol


key: chroma:document
string_value:
119 
 
 
Figure 3.11. Firewall Types 
3.7.2.1 Packet-Filtering Router 
A packet filtering firewall applies a set of rules to each incoming and outgoing IP 
packet and then forwards or discards the packet (Figure 22.1b). The firewall is typically 
configured to filter packets going in both directions (from and to the internal network).


key: chroma:document
string_value:
Filtering rules are based on information contained in a network packet: 
 •  Source IP address: The IP address of the system that originated the IP packet (e.g., 19
2.178.1.1) 
•  Destination IP address: The IP address of the system the IP packet is trying to reach (e.
g., 192.168.1.2) 
•   Source and destination transport-level address: The transport-


key: chroma:document
string_value:
level (e.g., TCP or UDP) port number, which defines applications such as SNMP or TEL
NET 
•   IP protocol field: Defines the transport protocol


key: full_page_content
string_value:
120 
 
•  Interface: For a firewall with three or more ports, which interface of the fire- 
wall the packet came from or which interface of the firewall the packet is des- tined for 
 • Default = discard: That which is not expressly permitted is prohibited. 
• Default = forward: That which is not expressly prohibited is permitted. 
 The default discard policy is more conservative. Initially, everything is blocked, and 
services must be added on a case-by-case basis. This policy is more visible to users, who 
are more likely to see the firewall as a hindrance. However, this is the policy likely to be 
preferred by businesses and government organizations.  
In each set, the rules are applied top to bottom. The “*” in a field is a wildcard 
designator that matches everything. We assume that the default = discard policy is in 
force


key: chroma:document
string_value:
120 
 
•  Interface: For a firewall with three or more ports, which interface of the fire- 
wall the packet came from or which interface of the firewall the packet is des- tined for 
 • Default = discard: That which is not expressly permitted is prohibited. 
• Default = forward: That which is not expressly prohibited is permitted.


key: chroma:document
string_value:
The default discard policy is more conservative. Initially, everything is blocked, and 
services must be added on a case-by-case basis. This policy is more visible to users, who 
are more likely to see the firewall as a hindrance. However, this is the policy likely to be 
preferred by businesses and government organizations.


key: chroma:document
string_value:
In each set, the rules are applied top to bottom. The “*” in a field is a wildcard 
designator that matches everything. We assume that the default = discard policy is in 
force


key: full_page_content
string_value:
122 
 
A.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. 
However, packets from a particular external host, SPIGOT, are blocked because that host 
has a history of sending massive files in e-mail  messages. 
B.     This is an explicit statement of the default policy. All rulesets include this rule implici
tly as the last rule. 
C.     This ruleset is intended to specify that any inside host can send mail to the out- side. A 
TCP packet with a destination port of 25 is routed to the SMTP server on the destination ma
chine.  
D.This ruleset achieves the intended result that was not achieved in C. The rules take adv
antage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP 
segment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha
t it allows IP packets where the source IP address is one of a list of designated internal hosts 
and the destination TCP port number is 25 
E.   This ruleset isone approach to handling FTP connections. With FTP, two TCP 
connections are used: a control connection to set up the file transfer and a data 
connection for the actual file transfer.  Thus, this ruleset allows 
—  Packets that originate internally 
— Reply packets to a connection initiated by an internal machine 
— Packets destined for a high-numbered port on an internal machine 
This scheme requires that the systems be configured so that only the appropriate port 
numbers are in use. 
 Rule set E points out the difficulty in dealing with applications at the packet-
filtering level. Another way to deal with FTP and similar applications is either state- 
ful packet filters or an application-level gateway, both described subsequently in this 
section. 
One advantage of a packet filtering firewall is its simplicity. Also, packet filters typically 
are transparent to users and are very fast. [WACK02] lists the following weaknesses of 
packet filter firewalls:  
•   Because packet filter firewalls do not examine upper-layer data, they cannot prevent 
attacks 
that 
employ 
application-specific 
vulnerabilities 
or 
functions.  
For example, a packet 
filter 
firewall 
cannot 
block 
specific application commands; if a packet filter firewall allows a given application, all 
functions available within that application will be   permitted. 
•   Because of the limited information available to the firewall, the logging func- 
tionality present in packet filter firewalls is limited. Packet filter logs normally contain the 
same 
information 
used 
to 
make 
access 
control 
decisions 
(source 
address, destination address, and traffic type). 
•  Most packet filter firewalls do not support advanced user authentication schemes. 
Once again, 
this 
limitation 
is 
mostly due to 
the lack of upper-layer 
functionality by the firewall.


key: chroma:document
string_value:
122 
 
A.       Inbound mail is allowed (port 25 is for SMTP incoming), but only to a gateway host. 
However, packets from a particular external host, SPIGOT, are blocked because that host 
has a history of sending massive files in e-mail  messages. 
B.     This is an explicit statement of the default policy. All rulesets include this rule implici
tly as the last rule.


key: chroma:document
string_value:
C.     This ruleset is intended to specify that any inside host can send mail to the out- side. A 
TCP packet with a destination port of 25 is routed to the SMTP server on the destination ma
chine.  
D.This ruleset achieves the intended result that was not achieved in C. The rules take adv
antage of a feature of TCP connections. Once a connection is set up, the ACK flag of a TCP


key: chroma:document
string_value:
segment is set to acknowledge segments sent from the other side. Thus, this ruleset states tha
t it allows IP packets where the source IP address is one of a list of designated internal hosts 
and the destination TCP port number is 25 
E.   This ruleset isone approach to handling FTP connections. With FTP, two TCP


key: chroma:document
string_value:
connections are used: a control connection to set up the file transfer and a data 
connection for the actual file transfer.  Thus, this ruleset allows 
—  Packets that originate internally 
— Reply packets to a connection initiated by an internal machine 
— Packets destined for a high-numbered port on an internal machine


key: chroma:document
string_value:
This scheme requires that the systems be configured so that only the appropriate port 
numbers are in use. 
 Rule set E points out the difficulty in dealing with applications at the packet-
filtering level. Another way to deal with FTP and similar applications is either state- 
ful packet filters or an application-level gateway, both described subsequently in this 
section.


key: chroma:document
string_value:
section. 
One advantage of a packet filtering firewall is its simplicity. Also, packet filters typically 
are transparent to users and are very fast. [WACK02] lists the following weaknesses of 
packet filter firewalls:  
•   Because packet filter firewalls do not examine upper-layer data, they cannot prevent 
attacks 
that 
employ 
application-specific 
vulnerabilities 
or


key: chroma:document
string_value:
or 
functions.  
For example, a packet 
filter 
firewall 
cannot 
block 
specific application commands; if a packet filter firewall allows a given application, all 
functions available within that application will be   permitted. 
•   Because of the limited information available to the firewall, the logging func-


key: chroma:document
string_value:
tionality present in packet filter firewalls is limited. Packet filter logs normally contain the 
same 
information 
used 
to 
make 
access 
control 
decisions 
(source 
address, destination address, and traffic type). 
•  Most packet filter firewalls do not support advanced user authentication schemes. 
Once again, 
this 
limitation 
is 
mostly due to 
the lack of upper-layer


key: full_page_content
string_value:
123 
 
•  Packet filter firewalls are generally vulnerable to attacks and exploits that take 
advantage of problems 
within the TCP/IP 
specification and protocol stack, 
such as network layer address 
spoofing. 
Many 
packet 
filter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor
ma- 
tion has been altered. Spoofing attacks are generally employed by intruders to 
bypass the security controls implemented in a firewall platform. 
Some of the attacks that can be made on packet filtering firewalls and the appropriate 
countermeasures are the following: 
 •  IP address spoofing: The intruder transmits packets from the outside with a 
source IP address field containing an address of an internal host. The attacker 
hopes that the use of a spoofed address will allow penetration of systems that 
employ simple source address security, in which packets from specific trusted 
internal 
hosts 
are 
accepted. The countermeasure 
is 
to 
discard 
packets 
with 
an 
inside source address if the packet arrives on an external interface. In fact, this 
countermeasure is often implemented at the router external to the firewall. 
•  Source routing attacks: The source station specifies the route that a packet 
should take as it crosses the Internet, in the hopes that this will bypass security measures 
that 
do 
not 
analyze 
the 
source 
routing 
information. 
The 
counter- 
measure is to discard all packets that use this option. 
•  Tiny fragment attacks: The intruder uses the IP fragmentation option to create 
extremely small fragments and force the TCP header information into a separate packet f
ragment. This attack is designed to circumvent filtering rules that depend on TCP header 
information. Typically, a 
packet 
filter 
will 
make 
a 
fil- 
tering decision on the first fragment of a packet. All subsequent fragments of that packet 
are filtered out solely on the basis that they are part of the packet 
whose first fragment was rejected.  
3.7.2.2 Stateful Inspection Firewalls 
A traditional packet filter makes filtering decisions on an individual packet basis and does 
not take into consideration any higher layer context. To understand what is meant by 
context and why a traditional packet filter is limited with regard to context, a little 
background is needed. Most standardized applications that run on top of TCP follow a 
client/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail 
is transmitted from a client system to a server system.  
A simple packet-filtering firewall must permit inbound network traffic on all these high-
numbered ports for TCP-based traffic to occur. This creates a vulnerability that can be 
exploited by unauthorized users.  
A stateful inspection packet filter tightens up the rules for TCP traffic by creating a 
directory of outbound TCP connections, as shown in Table 3.3. There is an entry for each 
currently established connection. The packet filter will now allow incoming traffic to 
high-numbered ports only for those packets that fit the profile of one of the entries in this 
directory


key: chroma:document
string_value:
123 
 
•  Packet filter firewalls are generally vulnerable to attacks and exploits that take 
advantage of problems 
within the TCP/IP 
specification and protocol stack, 
such as network layer address 
spoofing. 
Many 
packet 
filter firewalls cannot detect a network packet in which the OSI Layer 3 addressing infor
ma-


key: chroma:document
string_value:
ma- 
tion has been altered. Spoofing attacks are generally employed by intruders to 
bypass the security controls implemented in a firewall platform. 
Some of the attacks that can be made on packet filtering firewalls and the appropriate 
countermeasures are the following: 
 •  IP address spoofing: The intruder transmits packets from the outside with a


key: chroma:document
string_value:
source IP address field containing an address of an internal host. The attacker 
hopes that the use of a spoofed address will allow penetration of systems that 
employ simple source address security, in which packets from specific trusted 
internal 
hosts 
are 
accepted. The countermeasure 
is 
to 
discard 
packets 
with 
an


key: chroma:document
string_value:
packets 
with 
an 
inside source address if the packet arrives on an external interface. In fact, this 
countermeasure is often implemented at the router external to the firewall. 
•  Source routing attacks: The source station specifies the route that a packet 
should take as it crosses the Internet, in the hopes that this will bypass security measures 
that 
do 
not 
analyze


key: chroma:document
string_value:
do 
not 
analyze 
the 
source 
routing 
information. 
The 
counter- 
measure is to discard all packets that use this option. 
•  Tiny fragment attacks: The intruder uses the IP fragmentation option to create 
extremely small fragments and force the TCP header information into a separate packet f


key: chroma:document
string_value:
ragment. This attack is designed to circumvent filtering rules that depend on TCP header 
information. Typically, a 
packet 
filter 
will 
make 
a 
fil- 
tering decision on the first fragment of a packet. All subsequent fragments of that packet 
are filtered out solely on the basis that they are part of the packet 
whose first fragment was rejected.


key: chroma:document
string_value:
3.7.2.2 Stateful Inspection Firewalls 
A traditional packet filter makes filtering decisions on an individual packet basis and does 
not take into consideration any higher layer context. To understand what is meant by 
context and why a traditional packet filter is limited with regard to context, a little


key: chroma:document
string_value:
background is needed. Most standardized applications that run on top of TCP follow a 
client/server model. For example, for the Simple Mail Transfer Protocol (SMTP), e-mail 
is transmitted from a client system to a server system.  
A simple packet-filtering firewall must permit inbound network traffic on all these high-


key: chroma:document
string_value:
numbered ports for TCP-based traffic to occur. This creates a vulnerability that can be 
exploited by unauthorized users.  
A stateful inspection packet filter tightens up the rules for TCP traffic by creating a 
directory of outbound TCP connections, as shown in Table 3.3. There is an entry for each


key: chroma:document
string_value:
currently established connection. The packet filter will now allow incoming traffic to 
high-numbered ports only for those packets that fit the profile of one of the entries in this 
directory


key: full_page_content
string_value:
124 
 
 
 
Table 3.3. Example Stateful Firewall Connection State Table 
Application-Level Gateway 
An application-level gateway, also called a proxy server, acts as a relay of application-
level traffic. 
 The user contacts the gateway using a TCP/IP application, such as Telnet or FTP, and 
the gateway asks the user for the name of the remote host to be accessed. When the user 
responds and provides a valid user ID and authentication information, the gateway 
contacts the application on the remote host and relays TCP segments containing the 
application data between the two endpoints. If the gateway does not implement the proxy 
code for a specific application, the service is not supported and cannot be forwarded 
across the firewall. Further, the gateway can be configured to support only specific 
features of an application that the network administrator considers acceptable while 
denying all other features.  
 Application-level gateways tend to be more secure than packet filters. Rather than trying 
to deal with the numerous possible combinations that are to be allowed and forbidden at 
the TCP and IP level, the application-level gateway need only scrutinize a few allowable 
applications. In addition, it is easy to log and audit all incoming traffic at the application 
level.  
A prime disadvantage of this type of gateway is the additional processing overhead on 
each connection. In effect, there are two spliced connections between the end users, with 
the gateway at the splice point, and the gateway must examine and forward all traffic in 
both directions. 
3.7.2.3 Circuit-Level Gateway 
A third type of firewall is the circuit-level gateway (Figure 20.1c). This can be a 
stand-alone system or it can be a specialized function performed by an application-level 
gateway for certain applications. A circuit-level gateway does not permit an end-to-end


key: chroma:document
string_value:
124 
 
 
 
Table 3.3. Example Stateful Firewall Connection State Table 
Application-Level Gateway 
An application-level gateway, also called a proxy server, acts as a relay of application-
level traffic. 
 The user contacts the gateway using a TCP/IP application, such as Telnet or FTP, and 
the gateway asks the user for the name of the remote host to be accessed. When the user


key: chroma:document
string_value:
responds and provides a valid user ID and authentication information, the gateway 
contacts the application on the remote host and relays TCP segments containing the 
application data between the two endpoints. If the gateway does not implement the proxy 
code for a specific application, the service is not supported and cannot be forwarded


key: chroma:document
string_value:
across the firewall. Further, the gateway can be configured to support only specific 
features of an application that the network administrator considers acceptable while 
denying all other features.  
 Application-level gateways tend to be more secure than packet filters. Rather than trying 
to deal with the numerous possible combinations that are to be allowed and forbidden at


key: chroma:document
string_value:
the TCP and IP level, the application-level gateway need only scrutinize a few allowable 
applications. In addition, it is easy to log and audit all incoming traffic at the application 
level.  
A prime disadvantage of this type of gateway is the additional processing overhead on 
each connection. In effect, there are two spliced connections between the end users, with


key: chroma:document
string_value:
the gateway at the splice point, and the gateway must examine and forward all traffic in 
both directions. 
3.7.2.3 Circuit-Level Gateway 
A third type of firewall is the circuit-level gateway (Figure 20.1c). This can be a 
stand-alone system or it can be a specialized function performed by an application-level


key: full_page_content
string_value:
125 
 
TCP connection; rather, the gateway sets up two TCP connections, one between itself 
and a TCP user on an inner host and one between itself and a TCP user on an outside 
host. Once the two connections are established, the gateway typically relays TCP 
segments from one connection to the other without examining the contents.  
An example of a circuit-level gateway implementation is the SOCKS package; 
version 5 of SOCKS is defined in RFC 1928. The RFC defines SOCKS in the following 
fashion:  
SOCKS consists of the following components:  
● The SOCKS server, which runs on a UNIX-based firewall. 
 ● The SOCKS client library, which runs on internal hosts protected by the 
firewall.  
● SOCKS-ified versions of several standard client programs such as FTP and 
TELNET. The implementation of the SOCKS protocol typically involves the 
recompilation or relinking of TCP based client applications to use the appropriate 
encapsulation routines in the SOCKS library. 
 3.7.2.4 Bastion Host 
A bastion host is a system identified by the firewall administrator as a critical 
strong point in the network's security. Common characteristics of a bastion host include 
the following: 
● The bastion host hardware platform executes a secure version of its operating 
system, making it a trusted system. 
● Only the services that the network administrator considers essential are installed 
on the bastion host.  
● The bastion host may require additional authentication before a user is allowed 
access to the proxy services.  
● Each proxy is configured to support only a subset of the standard application's 
command set. 
● Each proxy is configured to allow access only to specific host systems. This 
means that the limited command/feature set may be applied only to a subset of systems 
on the protected network. 
● Each proxy maintains detailed audit information by logging all traffic, each 
connection, and the duration of each connection. The audit log is an essential tool for 
discovering and terminating intruder attacks. 
● Each proxy module is a very small software package specifically designed for 
network security. Because of its relative simplicity, it is easier to check such modules for 
security flaws. For example, a typical UNIX mail application may contain over 20,000 
lines of code, while a mail proxy may contain fewer than 1000.


key: chroma:document
string_value:
125 
 
TCP connection; rather, the gateway sets up two TCP connections, one between itself 
and a TCP user on an inner host and one between itself and a TCP user on an outside 
host. Once the two connections are established, the gateway typically relays TCP 
segments from one connection to the other without examining the contents.


key: chroma:document
string_value:
An example of a circuit-level gateway implementation is the SOCKS package; 
version 5 of SOCKS is defined in RFC 1928. The RFC defines SOCKS in the following 
fashion:  
SOCKS consists of the following components:  
● The SOCKS server, which runs on a UNIX-based firewall. 
 ● The SOCKS client library, which runs on internal hosts protected by the 
firewall.


key: chroma:document
string_value:
firewall.  
● SOCKS-ified versions of several standard client programs such as FTP and 
TELNET. The implementation of the SOCKS protocol typically involves the 
recompilation or relinking of TCP based client applications to use the appropriate 
encapsulation routines in the SOCKS library. 
 3.7.2.4 Bastion Host


key: chroma:document
string_value:
A bastion host is a system identified by the firewall administrator as a critical 
strong point in the network's security. Common characteristics of a bastion host include 
the following: 
● The bastion host hardware platform executes a secure version of its operating 
system, making it a trusted system.


key: chroma:document
string_value:
● Only the services that the network administrator considers essential are installed 
on the bastion host.  
● The bastion host may require additional authentication before a user is allowed 
access to the proxy services.  
● Each proxy is configured to support only a subset of the standard application's 
command set.


key: chroma:document
string_value:
command set. 
● Each proxy is configured to allow access only to specific host systems. This 
means that the limited command/feature set may be applied only to a subset of systems 
on the protected network. 
● Each proxy maintains detailed audit information by logging all traffic, each 
connection, and the duration of each connection. The audit log is an essential tool for


key: chroma:document
string_value:
discovering and terminating intruder attacks. 
● Each proxy module is a very small software package specifically designed for 
network security. Because of its relative simplicity, it is easier to check such modules for 
security flaws. For example, a typical UNIX mail application may contain over 20,000 
lines of code, while a mail proxy may contain fewer than 1000.


key: full_page_content
string_value:
126 
 
● Each proxy is independent of other proxies on the bastion host. If there is a 
problem with the operation of any proxy, or if a future vulnerability is discovered, it can 
be uninstalled without affecting the operation of the other proxy applications.  
● A proxy generally performs no disk access other than to read its initial 
configuration file.  
● Each proxy runs as a nonprivileged user in a private and secured directory on 
the bastion host. 
3.7.3 Firewall Configurations 
In addition to the use of a simple configuration consisting of a single system, such 
as a single packet filtering router or a single gateway, more complex configurations are 
possible and indeed more common. Figure 3.13 illustrates three common firewall 
configurations. We examine each of these in turn. 
 
Figure 3.13  Firewall Configurations


key: chroma:document
string_value:
126 
 
● Each proxy is independent of other proxies on the bastion host. If there is a 
problem with the operation of any proxy, or if a future vulnerability is discovered, it can 
be uninstalled without affecting the operation of the other proxy applications.  
● A proxy generally performs no disk access other than to read its initial 
configuration file.


key: chroma:document
string_value:
● Each proxy runs as a nonprivileged user in a private and secured directory on 
the bastion host. 
3.7.3 Firewall Configurations 
In addition to the use of a simple configuration consisting of a single system, such 
as a single packet filtering router or a single gateway, more complex configurations are


key: chroma:document
string_value:
possible and indeed more common. Figure 3.13 illustrates three common firewall 
configurations. We examine each of these in turn. 
 
Figure 3.13  Firewall Configurations


key: full_page_content
string_value:
127 
 
In the screened host firewall, single-homed bastion configuration (Figure 3.13 a), the 
firewall consists of two systems: a packet-filtering router and a bastion host. Typically, 
the router is configured so that 
1. For traffic from the Internet, only IP packets destined for the bastion host are allowed 
in. 
2. For traffic from the internal network, only IP packets from the bastion host are allowed 
out. 
The bastion host performs authentication and proxy functions. This configuration 
has greater security than simply a packet-filtering router or an application-level gateway 
alone, for two reasons.  
This configuration also affords flexibility in providing direct Internet access. For 
example, the internal network may include a public information server, such as a Web 
server, for which a high level of security is not required. In that case, the router can be 
configured to allow direct traffic between the information server and the Internet. 
The screened host firewall, dual-homed bastion configuration physically 
prevents such a security breach (3.13 b). The advantages of dual layers of security that 
were present in the previous configuration are present here as well. Again, an information 
server or other hosts can be allowed direct communication with the router if this is in 
accord with the security policy. 
The screened subnet firewall configuration of Figure 20.2c is the most secure of 
those we have considered. In this configuration, two packet-filtering routers are used, one 
between the bastion host and the Internet and one between the bastion host and the 
internal network. This configuration offers several advantages: 
● There are now three levels of defense to thwart intruders. 
● The outside router advertises only the existence of the screened subnet to the 
Internet; therefore, the internal network is invisible to the Internet. 
● Similarly, the inside router advertises only the existence of the screened subnet 
to the internal network; therefore, the systems on the inside network cannot construct 
direct routes to the Internet. 
3.8 Trusted Systems 
One way to enhance the ability of a system to defend against intruders and malicious 
programs is to implement trusted system technology. 
3.8.1 Data Access Control 
Following successful logon, the user has been granted access to one or a set of 
hosts and applications. This is generally not sufficient for a system that includes sensitive 
data in its database. Through the user access control procedure, a user can be identified 
to the system. Associated with each user, there can be a profile that specifies permissible


key: chroma:document
string_value:
127 
 
In the screened host firewall, single-homed bastion configuration (Figure 3.13 a), the 
firewall consists of two systems: a packet-filtering router and a bastion host. Typically, 
the router is configured so that 
1. For traffic from the Internet, only IP packets destined for the bastion host are allowed 
in.


key: chroma:document
string_value:
in. 
2. For traffic from the internal network, only IP packets from the bastion host are allowed 
out. 
The bastion host performs authentication and proxy functions. This configuration 
has greater security than simply a packet-filtering router or an application-level gateway 
alone, for two reasons.


key: chroma:document
string_value:
This configuration also affords flexibility in providing direct Internet access. For 
example, the internal network may include a public information server, such as a Web 
server, for which a high level of security is not required. In that case, the router can be 
configured to allow direct traffic between the information server and the Internet.


key: chroma:document
string_value:
The screened host firewall, dual-homed bastion configuration physically 
prevents such a security breach (3.13 b). The advantages of dual layers of security that 
were present in the previous configuration are present here as well. Again, an information 
server or other hosts can be allowed direct communication with the router if this is in 
accord with the security policy.


key: chroma:document
string_value:
The screened subnet firewall configuration of Figure 20.2c is the most secure of 
those we have considered. In this configuration, two packet-filtering routers are used, one 
between the bastion host and the Internet and one between the bastion host and the 
internal network. This configuration offers several advantages:


key: chroma:document
string_value:
● There are now three levels of defense to thwart intruders. 
● The outside router advertises only the existence of the screened subnet to the 
Internet; therefore, the internal network is invisible to the Internet. 
● Similarly, the inside router advertises only the existence of the screened subnet


key: chroma:document
string_value:
to the internal network; therefore, the systems on the inside network cannot construct 
direct routes to the Internet. 
3.8 Trusted Systems 
One way to enhance the ability of a system to defend against intruders and malicious 
programs is to implement trusted system technology. 
3.8.1 Data Access Control


key: chroma:document
string_value:
Following successful logon, the user has been granted access to one or a set of 
hosts and applications. This is generally not sufficient for a system that includes sensitive 
data in its database. Through the user access control procedure, a user can be identified 
to the system. Associated with each user, there can be a profile that specifies permissible


key: full_page_content
string_value:
128 
 
operations and file accesses. The operating system can then enforce rules based on the 
user profile.  
 A general model of access control as exercised by a file or database management 
system is that of an access matrix (3.14 a). The basic elements of the model are as 
follows:  
● Subject: An entity capable of accessing objects. Generally, the concept of 
subject equates with that of process. Any user or application actually gains access to an 
object by means of a process that represents that user or application.  
● Object: Anything to which access is controlled. Examples include files, 
portions of files, programs, and segments of memory. 
 ● Access right: The way in which an object is accessed by a subject. Examples 
are read, write, and execute.


key: chroma:document
string_value:
128 
 
operations and file accesses. The operating system can then enforce rules based on the 
user profile.  
 A general model of access control as exercised by a file or database management 
system is that of an access matrix (3.14 a). The basic elements of the model are as 
follows:  
● Subject: An entity capable of accessing objects. Generally, the concept of


key: chroma:document
string_value:
subject equates with that of process. Any user or application actually gains access to an 
object by means of a process that represents that user or application.  
● Object: Anything to which access is controlled. Examples include files, 
portions of files, programs, and segments of memory. 
 ● Access right: The way in which an object is accessed by a subject. Examples


key: full_page_content
string_value:
129 
 
 
Figure 3.14  Access Control Structure 
One axis of the matrix consists of identified subjects that may attempt data access. 
Typically, this list will consist of individual users or user groups, although access could 
be controlled for terminals, hosts, or applications instead of or in addition to users. The 
other axis lists the objects that may be accessed.  
Decomposition by rows yields capability tickets (Figure 3.14 c). A capability 
ticket specifies authorized objects and operations for a user. Each user has a number of 
tickets and may be authorized to loan or give them to others. Because tickets may be 
dispersed around the system, they present a greater security problem than access control 
lists. In particular, the ticket must be unforgeable. One way to accomplish this is to have 
the operating system hold all tickets on behalf of users. These tickets would have to be 
held in a region of memory inaccessible to users. 
3.8.2 The Concept of Trusted Systems  
Much of what we have discussed so far has been concerned with protecting a 
given message or item from passive or active attacks by a given user. A somewhat 
different but widely applicable requirement is to protect data or resources on the basis of 
levels of security. This is commonly found in the military, where information is 
categorized as unclassified (U), confidential (C), secret (S), top secret (TS), or beyond. 
This concept is equally applicable in other areas, where information can be organized 
into gross categories and users can be granted clearances to access certain categories of 
data.  
When multiple categories or levels of data are defined, the requirement is referred 
to as multilevel security. The general statement of the requirement for multilevel security 
is that a subject at a high level may not convey information to a subject at a lower or 
noncomparable level unless that flow accurately reflects the will of an authorized user. A 
multilevel secure system must enforce the following: 
 ● No read up: A subject can only read an object of less or equal security level. 
This is referred to in the literature as the Simple Security Property.  
● No write down: A subject can only write into an object of greater or equal 
security level.  
Fig 3.15 illustrates reference monitor. The reference monitor is a controlling 
element in the hardware and operating system of a computer that regulates the access of 
subjects to objects on the basis of security parameters of the subject and object. The 
reference monitor has access to a file, known as the security kernel database, that lists the 
access privileges (security clearance) of each subject and the protection attributes 
(classification level) of each object. The reference monitor enforces the security rules (no 
read up, no write down) and has the following properties:


key: chroma:document
string_value:
129 
 
 
Figure 3.14  Access Control Structure 
One axis of the matrix consists of identified subjects that may attempt data access. 
Typically, this list will consist of individual users or user groups, although access could 
be controlled for terminals, hosts, or applications instead of or in addition to users. The 
other axis lists the objects that may be accessed.


key: chroma:document
string_value:
Decomposition by rows yields capability tickets (Figure 3.14 c). A capability 
ticket specifies authorized objects and operations for a user. Each user has a number of 
tickets and may be authorized to loan or give them to others. Because tickets may be 
dispersed around the system, they present a greater security problem than access control


key: chroma:document
string_value:
lists. In particular, the ticket must be unforgeable. One way to accomplish this is to have 
the operating system hold all tickets on behalf of users. These tickets would have to be 
held in a region of memory inaccessible to users. 
3.8.2 The Concept of Trusted Systems  
Much of what we have discussed so far has been concerned with protecting a


key: chroma:document
string_value:
given message or item from passive or active attacks by a given user. A somewhat 
different but widely applicable requirement is to protect data or resources on the basis of 
levels of security. This is commonly found in the military, where information is 
categorized as unclassified (U), confidential (C), secret (S), top secret (TS), or beyond.


key: chroma:document
string_value:
This concept is equally applicable in other areas, where information can be organized 
into gross categories and users can be granted clearances to access certain categories of 
data.  
When multiple categories or levels of data are defined, the requirement is referred 
to as multilevel security. The general statement of the requirement for multilevel security


key: chroma:document
string_value:
is that a subject at a high level may not convey information to a subject at a lower or 
noncomparable level unless that flow accurately reflects the will of an authorized user. A 
multilevel secure system must enforce the following: 
 ● No read up: A subject can only read an object of less or equal security level.


key: chroma:document
string_value:
This is referred to in the literature as the Simple Security Property.  
● No write down: A subject can only write into an object of greater or equal 
security level.  
Fig 3.15 illustrates reference monitor. The reference monitor is a controlling 
element in the hardware and operating system of a computer that regulates the access of


key: chroma:document
string_value:
subjects to objects on the basis of security parameters of the subject and object. The 
reference monitor has access to a file, known as the security kernel database, that lists the 
access privileges (security clearance) of each subject and the protection attributes 
(classification level) of each object. The reference monitor enforces the security rules (no


key: full_page_content
string_value:
130 
 
● Complete mediation: The security rules are enforced on every access, not just, 
for example, when a file is opened.  
● Isolation: The reference monitor and database are protected from unauthorized 
modification.  
● Verifiability: The reference monitor's correctness must be provable. That is, it 
must be possible to demonstrate mathematically that the reference monitor enforces the 
security rules and provides complete mediation and isolation. 
 
 
Figure 3.15 Reference Monitor Concept 
These are stiff requirements. The requirement for complete mediation means that 
every access to data within main memory and on disk and tape must be mediated. Pure 
software implementations impose too high a performance penalty to be practical; the 
solution must be at least partly in hardware. The requirement for isolation means that it 
must not be possible for an attacker, no matter how clever, to change the logic of the 
reference monitor or the contents of the security kernel database.  
A final element illustrated in Figure 3.15 is an audit file. Important security 
events, such as detected security violations and authorized changes to the security kernel 
database, are stored in the audit file. In an effort to meet its own needs and as a service to 
the public, the U.S. Department of Defense in 1981 established the Computer Security 
Center within the National Security Agency (NSA) with the goal of encouraging the 
widespread availability of trusted computer systems. This goal is realized through the 
center's Commercial Product Evaluation Program.


key: chroma:document
string_value:
130 
 
● Complete mediation: The security rules are enforced on every access, not just, 
for example, when a file is opened.  
● Isolation: The reference monitor and database are protected from unauthorized 
modification.  
● Verifiability: The reference monitor's correctness must be provable. That is, it


key: chroma:document
string_value:
must be possible to demonstrate mathematically that the reference monitor enforces the 
security rules and provides complete mediation and isolation. 
 
 
Figure 3.15 Reference Monitor Concept 
These are stiff requirements. The requirement for complete mediation means that 
every access to data within main memory and on disk and tape must be mediated. Pure


key: chroma:document
string_value:
software implementations impose too high a performance penalty to be practical; the 
solution must be at least partly in hardware. The requirement for isolation means that it 
must not be possible for an attacker, no matter how clever, to change the logic of the 
reference monitor or the contents of the security kernel database.


key: chroma:document
string_value:
A final element illustrated in Figure 3.15 is an audit file. Important security 
events, such as detected security violations and authorized changes to the security kernel 
database, are stored in the audit file. In an effort to meet its own needs and as a service to 
the public, the U.S. Department of Defense in 1981 established the Computer Security


key: chroma:document
string_value:
Center within the National Security Agency (NSA) with the goal of encouraging the 
widespread availability of trusted computer systems. This goal is realized through the 
center's Commercial Product Evaluation Program.


key: full_page_content
string_value:
131 
 
3.8.3 Trojan Horse Defense  
One way to secure against Trojan horse attacks is the use of a secure, trusted 
operating system. Figure 3.16 illustrates an example. In this case, a Trojan horse is used 
to get around the standard security mechanism used by most file management and 
operating systems: the access control list. In this example, a user named Bob interacts 
through a program with a data file containing the critically sensitive character string 
"CPE170KS." User Bob has created the file with read/write permission provided only to 
programs executing on his own behalf: that is, only processes that are owned by Bob may 
access the file.  
 
 
Figure 3.16 Trojan Horse and Secure Operating System 
The Trojan horse attack begins when a hostile user, named Alice, gains legitimate 
access to the system and installs both a Trojan horse program and a private file to be used 
in the attack as a "back pocket." Alice gives read/write permission to herself for this file 
and gives Bob write-only permission (Figure 3.16 a). Alice now induces Bob to invoke 
the Trojan horse program, perhaps by advertising it as a useful utility. When the program 
detects that it is being executed by Bob, it reads the sensitive character string from Bob's 
file and copies it into Alice's back-pocket file (Figure 3.16 b). Both the read and write 
operations satisfy the constraints imposed by access control lists. Alice then has only to 
access Bob's file at a later time to learn the value of the string. Now consider the use of a 
secure operating system in this scenario (Figure 3.16 c). Security levels are assigned to 
subjects at logon on the basis of criteria such as the terminal from which the computer is 
being accessed and the user involved, as identified by password/ID. Alice's file and 
processes are restricted to public. If Bob invokes the Trojan horse program (Figure 3.16 
d), that program acquires Bob's security level. It is therefore able, under the simple


key: chroma:document
string_value:
131 
 
3.8.3 Trojan Horse Defense  
One way to secure against Trojan horse attacks is the use of a secure, trusted 
operating system. Figure 3.16 illustrates an example. In this case, a Trojan horse is used 
to get around the standard security mechanism used by most file management and 
operating systems: the access control list. In this example, a user named Bob interacts


key: chroma:document
string_value:
through a program with a data file containing the critically sensitive character string 
"CPE170KS." User Bob has created the file with read/write permission provided only to 
programs executing on his own behalf: that is, only processes that are owned by Bob may 
access the file.  
 
 
Figure 3.16 Trojan Horse and Secure Operating System


key: chroma:document
string_value:
The Trojan horse attack begins when a hostile user, named Alice, gains legitimate 
access to the system and installs both a Trojan horse program and a private file to be used 
in the attack as a "back pocket." Alice gives read/write permission to herself for this file 
and gives Bob write-only permission (Figure 3.16 a). Alice now induces Bob to invoke


key: chroma:document
string_value:
the Trojan horse program, perhaps by advertising it as a useful utility. When the program 
detects that it is being executed by Bob, it reads the sensitive character string from Bob's 
file and copies it into Alice's back-pocket file (Figure 3.16 b). Both the read and write 
operations satisfy the constraints imposed by access control lists. Alice then has only to


key: chroma:document
string_value:
access Bob's file at a later time to learn the value of the string. Now consider the use of a 
secure operating system in this scenario (Figure 3.16 c). Security levels are assigned to 
subjects at logon on the basis of criteria such as the terminal from which the computer is 
being accessed and the user involved, as identified by password/ID. Alice's file and


key: chroma:document
string_value:
processes are restricted to public. If Bob invokes the Trojan horse program (Figure 3.16 
d), that program acquires Bob's security level. It is therefore able, under the simple


key: full_page_content
string_value:
132 
 
security property, to observe the sensitive character string. When the program attempts 
to store the string in a public file (the back-pocket file), however, the is violated and the 
attempt is disallowed by the reference monitor. Thus, the attempt to write into the back-
pocket file is denied even though the access control list permits it:  
 
References: 
• William Stallings, “ Cryptography and Network Security”, 4th Edition, Pearson, 2009. 
• Behrouz A. Forouzan, “ Cryptography and Network Security”, Tata McGraw-Hill, 2008.


key: chroma:document
string_value:
132 
 
security property, to observe the sensitive character string. When the program attempts 
to store the string in a public file (the back-pocket file), however, the is violated and the 
attempt is disallowed by the reference monitor. Thus, the attempt to write into the back-
pocket file is denied even though the access control list permits it:  
 
References:


key: full_page_content
string_value:
133 
 
 
SCHOOL OF COMPUTING 
DEPARTMENT OF INFORMATION TECHNOLOGY 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
UNIT – IV – Cyber Security – SITA1602


key: full_page_content
string_value:
134 
 
4. Operations and Physical Security 
Origin – Process – Laws –Physical Security – Controls – Protecting People – Protecting Data – 
Protecting Equipment 
4.1 Operations Security 
• Operations security, known in military and government circles as OPSEC, is, at a high level, 
a process that we use to protect our information.  
• The entire process involves not only putting countermeasures in place, but before doing so, 
carefully identifying what exactly we need to protect, and what we need to protect it against. 
• It is important to remember when putting security measures in place that we should be 
implementing security measures that are relative to the value of what we are protecting. If we 
evenly apply the same level of security to everything, we may be overprotecting some things 
that are not of high value and under protecting things of much greater value. 
4.1.1 Origins of operations Security 
• Operations security may be a fairly recent idea, as far as the specific implementation of 
OPSEC by the U.S.  government is concerned, but the concepts comprising it are truly ancient 
indeed.  
• We can see such ideas put forth in the works of Sun Tzu thousands of years ago, and in the 
words of the founders of the United States, such as George Washington and Benjamin 
Franklin.  
• While we can point to nearly any period in history, and nearly any military or large 
commercial organization, and find the principles of operations security present, a few specific 
occasions present themselves as being particularly influential in the development and use of 
operations security. 
4.1.1.1 Sun Tzu 
• Sun Tzu was a Chinese military general who lived in the sixth century BC.  
• Among those of a military or strategic bent, Sun Tzu’s work The Art of War is considered to 
be somewhat of a bible for conducting such operations.  
• The Art of War has spawned countless clones and texts that apply the principles it espouses 
to a variety of situations, including, but not limited to, information security.  
• The text provides some of the earliest examples of operations security principles that are 
plainly stated and clearly documented.


key: chroma:document
string_value:
134 
 
4. Operations and Physical Security 
Origin – Process – Laws –Physical Security – Controls – Protecting People – Protecting Data – 
Protecting Equipment 
4.1 Operations Security 
• Operations security, known in military and government circles as OPSEC, is, at a high level, 
a process that we use to protect our information.


key: chroma:document
string_value:
• The entire process involves not only putting countermeasures in place, but before doing so, 
carefully identifying what exactly we need to protect, and what we need to protect it against. 
• It is important to remember when putting security measures in place that we should be 
implementing security measures that are relative to the value of what we are protecting. If we


key: chroma:document
string_value:
evenly apply the same level of security to everything, we may be overprotecting some things 
that are not of high value and under protecting things of much greater value. 
4.1.1 Origins of operations Security 
• Operations security may be a fairly recent idea, as far as the specific implementation of


key: chroma:document
string_value:
OPSEC by the U.S.  government is concerned, but the concepts comprising it are truly ancient 
indeed.  
• We can see such ideas put forth in the works of Sun Tzu thousands of years ago, and in the 
words of the founders of the United States, such as George Washington and Benjamin 
Franklin.  
• While we can point to nearly any period in history, and nearly any military or large


key: chroma:document
string_value:
commercial organization, and find the principles of operations security present, a few specific 
occasions present themselves as being particularly influential in the development and use of 
operations security. 
4.1.1.1 Sun Tzu 
• Sun Tzu was a Chinese military general who lived in the sixth century BC.


key: chroma:document
string_value:
• Among those of a military or strategic bent, Sun Tzu’s work The Art of War is considered to 
be somewhat of a bible for conducting such operations.  
• The Art of War has spawned countless clones and texts that apply the principles it espouses 
to a variety of situations, including, but not limited to, information security.


key: chroma:document
string_value:
• The text provides some of the earliest examples of operations security principles that are 
plainly stated and clearly documented.


key: full_page_content
string_value:
135 
 
• We can point out numerous passages within The Art of War as being related to operations 
security principles.  
• The first passage is “If I am able to determine the enemy’s dispositions while at the same 
time, I conceal my own, then I can concentrate and he must divide”.  
• This is a simple admonition to discover information held by our opponents while protecting 
our own. This is one of the most basic tenets of operations security. 
4.1.1.2 George Washington 
• George Washington, the first president of the United States, was well known for being an 
astute and skilled military commander and is also well known for promoting good operational 
security practices.  
• He is known in the operations security community for having said, “Even minutiae should 
have a place in our collection, for things of a seemingly trifling nature, when enjoined with 
others of a more serious cast, may lead to valuable conclusion”, meaning that even small items 
of information, which are valueless individually, can be of great value in combination.  
• We can see an example of exactly this in the three main items of information that constitute 
an identity: a name, an address, and a Social Security number.  
• Individually, these items are completely useless. We could take any one of them in isolation 
and put it up on a billboard for the world to see, and not be any worse for having done so. In 
combination, these three items are sufficient for an attacker to steal our identity and use it for 
all manners of fraudulent activities. 
4.1.1.3 Vietnam War 
• During the Vietnam War, the United States came to realize that information regarding troop 
movements, operations, and other military activities was being leaked to the enemy.  
• Clearly, in most environments, military or otherwise, having our opponents gain 
foreknowledge of our activities is a bad thing, particularly so when lives may be at stake.  
• In an effort to curtail this unauthorized passing of information, a study, codenamed Purple 
Dragon, a symbol of OPSEC that persists to this day Ultimately, the study brought about two 
main ideas: first, in that particular environment, eavesdroppers and spies abounded; and 
second, a survey was needed to get to the bottom of the information loss.  
• The survey asked questions about the information itself, vulnerability analysis, and other 
items. The team conducting these surveys and analyses also coined the term operations 
security and the acronym OPSEC.


key: chroma:document
string_value:
135 
 
• We can point out numerous passages within The Art of War as being related to operations 
security principles.  
• The first passage is “If I am able to determine the enemy’s dispositions while at the same 
time, I conceal my own, then I can concentrate and he must divide”.  
• This is a simple admonition to discover information held by our opponents while protecting


key: chroma:document
string_value:
our own. This is one of the most basic tenets of operations security. 
4.1.1.2 George Washington 
• George Washington, the first president of the United States, was well known for being an 
astute and skilled military commander and is also well known for promoting good operational 
security practices.


key: chroma:document
string_value:
• He is known in the operations security community for having said, “Even minutiae should 
have a place in our collection, for things of a seemingly trifling nature, when enjoined with 
others of a more serious cast, may lead to valuable conclusion”, meaning that even small items 
of information, which are valueless individually, can be of great value in combination.


key: chroma:document
string_value:
• We can see an example of exactly this in the three main items of information that constitute 
an identity: a name, an address, and a Social Security number.  
• Individually, these items are completely useless. We could take any one of them in isolation 
and put it up on a billboard for the world to see, and not be any worse for having done so. In


key: chroma:document
string_value:
combination, these three items are sufficient for an attacker to steal our identity and use it for 
all manners of fraudulent activities. 
4.1.1.3 Vietnam War 
• During the Vietnam War, the United States came to realize that information regarding troop 
movements, operations, and other military activities was being leaked to the enemy.


key: chroma:document
string_value:
• Clearly, in most environments, military or otherwise, having our opponents gain 
foreknowledge of our activities is a bad thing, particularly so when lives may be at stake.  
• In an effort to curtail this unauthorized passing of information, a study, codenamed Purple 
Dragon, a symbol of OPSEC that persists to this day Ultimately, the study brought about two


key: chroma:document
string_value:
main ideas: first, in that particular environment, eavesdroppers and spies abounded; and 
second, a survey was needed to get to the bottom of the information loss.  
• The survey asked questions about the information itself, vulnerability analysis, and other 
items. The team conducting these surveys and analyses also coined the term operations 
security and the acronym OPSEC.


key: full_page_content
string_value:
136 
 
4.1.1.4 Business 
• In the late 1970s and early 1980s, some of the operations security concepts that were used in 
the world of the military and government were beginning to take root in the commercial 
world.  
• The ideas of industrial espionage and spying on our business competition in order to gain a 
competitive advantage have been around since the beginning of time, but as such concepts 
were becoming more structured in the military world, they were becoming more structured in 
the business world as well.  
• In 1980, Michael Porter, a professor at Harvard Business School, published a book titled 
Competitive Strategy: Techniques for Analyzing Industries and Competitors.  
• This text, now nearing its sixtieth printing, set the basis for what is referred to as competitive 
intelligence.  
• Competitive intelligence is generally defined as the process of intelligence gathering and 
analysis in order to support business decisions.  
• The counterpart of competitive intelligence, competitive counterintelligence, correlates in a 
fairly direct manner to the operations security principles that were laid out by the government 
only a few years previously, and is an active part of conducting business to this day. 
4.1.2 The operations security Process 
• The operations security process, as laid out by the U.S. government, will look very familiar 
to anyone who has worked with risk management.  
• In essence, the process is to identify what information we have that needs protection, analyze 
the threats and vulnerabilities that might impact it, and develop methods of mitigation for 
those threats and vulnerabilities. 
 
Fig. 1 Operation Security Process


key: chroma:document
string_value:
136 
 
4.1.1.4 Business 
• In the late 1970s and early 1980s, some of the operations security concepts that were used in 
the world of the military and government were beginning to take root in the commercial 
world.  
• The ideas of industrial espionage and spying on our business competition in order to gain a


key: chroma:document
string_value:
competitive advantage have been around since the beginning of time, but as such concepts 
were becoming more structured in the military world, they were becoming more structured in 
the business world as well.  
• In 1980, Michael Porter, a professor at Harvard Business School, published a book titled 
Competitive Strategy: Techniques for Analyzing Industries and Competitors.


key: chroma:document
string_value:
• This text, now nearing its sixtieth printing, set the basis for what is referred to as competitive 
intelligence.  
• Competitive intelligence is generally defined as the process of intelligence gathering and 
analysis in order to support business decisions.  
• The counterpart of competitive intelligence, competitive counterintelligence, correlates in a


key: chroma:document
string_value:
fairly direct manner to the operations security principles that were laid out by the government 
only a few years previously, and is an active part of conducting business to this day. 
4.1.2 The operations security Process 
• The operations security process, as laid out by the U.S. government, will look very familiar 
to anyone who has worked with risk management.


key: chroma:document
string_value:
• In essence, the process is to identify what information we have that needs protection, analyze 
the threats and vulnerabilities that might impact it, and develop methods of mitigation for 
those threats and vulnerabilities. 
 
Fig. 1 Operation Security Process


key: full_page_content
string_value:
137 
 
4.1.2.1 Identification of Critical Information 
• The initial step, and, arguably, the most important step in the operations curity process, is to 
identify our most critical information assets.  
• Although we could spend a great deal of time identifying every little item of information that 
might even remotely be of importance, this is not the goal in this step of the operations security 
process.  
• For any given business, individual, military operation, process, or project, there are bound to 
be at least a few critical items of information on which everything else depends.  
• For a soft drink company, it might be our secret recipe, for an application vendor it might be 
our source code, for a military operation it might be our attack timetable, and so on.  
• These are the assets that most need protection and will cause us the most harm if exposed, 
and these are the assets we should be identifying.  
4.2.2.2 Analysis of Threats  
• In the case of analyzing threats to our information assets, we would start with the critical 
information we identified in the previous step.  
• With the list of critical information, we can then begin to look at what harm might be caused 
by critical information being exposed, and who might exploit the exposure.  
• This is the same process used by many military and government organizations to classify 
information and determine who is allowed to see it.  
• For instance, if we are a software company that has identified the proprietary source code of 
one of our main products as an item of critical information, we might determine that the chief 
threats of such an exposure could be exposure to attackers and exposure to our competition.  
• If the source code were exposed to attackers, they might be able to determine the scheme we 
use to generate license keys for our products in order to prevent piracy, and use access to the 
source code to develop a utility that could generate legitimate keys, thus costing us revenue 
to software piracy.  
• In the case of our competition, they might use access to our source code to copy features for 
use in their own applications, or they might copy large portions of our application and sell it 
themselves.  
• This step in the process needs to be repeated for each item of information we have identified 
as being critical, for each party that might take advantage of it if it were exposed, and for each 
use they might make of the information.


key: chroma:document
string_value:
137 
 
4.1.2.1 Identification of Critical Information 
• The initial step, and, arguably, the most important step in the operations curity process, is to 
identify our most critical information assets.  
• Although we could spend a great deal of time identifying every little item of information that


key: chroma:document
string_value:
might even remotely be of importance, this is not the goal in this step of the operations security 
process.  
• For any given business, individual, military operation, process, or project, there are bound to 
be at least a few critical items of information on which everything else depends.


key: chroma:document
string_value:
• For a soft drink company, it might be our secret recipe, for an application vendor it might be 
our source code, for a military operation it might be our attack timetable, and so on.  
• These are the assets that most need protection and will cause us the most harm if exposed, 
and these are the assets we should be identifying.  
4.2.2.2 Analysis of Threats


key: chroma:document
string_value:
• In the case of analyzing threats to our information assets, we would start with the critical 
information we identified in the previous step.  
• With the list of critical information, we can then begin to look at what harm might be caused 
by critical information being exposed, and who might exploit the exposure.


key: chroma:document
string_value:
• This is the same process used by many military and government organizations to classify 
information and determine who is allowed to see it.  
• For instance, if we are a software company that has identified the proprietary source code of 
one of our main products as an item of critical information, we might determine that the chief


key: chroma:document
string_value:
threats of such an exposure could be exposure to attackers and exposure to our competition.  
• If the source code were exposed to attackers, they might be able to determine the scheme we 
use to generate license keys for our products in order to prevent piracy, and use access to the 
source code to develop a utility that could generate legitimate keys, thus costing us revenue


key: chroma:document
string_value:
to software piracy.  
• In the case of our competition, they might use access to our source code to copy features for 
use in their own applications, or they might copy large portions of our application and sell it 
themselves.  
• This step in the process needs to be repeated for each item of information we have identified


key: chroma:document
string_value:
as being critical, for each party that might take advantage of it if it were exposed, and for each 
use they might make of the information.


key: full_page_content
string_value:
138 
 
4.2.2.3 Analysis of Vulnerabilities 
• Vulnerabilities are weaknesses that can be used to harm us.  
• In the case of analyzing the vulnerabilities in the protections we have put in place for our 
information assets, we will be looking at how the processes that interact with these assets are 
normally conducted, and where we might attack in order to compromise them.  
• When we looked at threats, we used the source of a software company as an example of an 
item of critical information that might cause us harm if it were to find its way into the hands 
of our competition.  
• When we look at vulnerabilities, we might find that our security controls on the source code 
with which we are concerned are not very rigorous, and that it is possible to access, copy, 
delete, or alter it without any authorization beyond that needed to access the operating system 
or network shares.  
• This might make it possible for an attacker who has compromised the system to copy, tamper 
with, or entirely delete the source code, or might render the files vulnerable to accidental 
alteration while the system is undergoing maintenance.  
4.2.2.4 Assessment of Risks 
• Assessment of risks is where the proverbial rubber meets the road, in terms of deciding what 
issues we really need to be concerned about during the operations security process.  
• Risk occurs when we have a matching threat and vulnerability, and only then. To go back to 
our software source code example, we had determined that we had seen a threat in the 
potential for our application source code being exposed in an unauthorized manner.  
• Furthermore, we found that we had a threat in the poor controls on access to our source code, 
and a lack of policy in how exactly it was controlled.  
• These two matching issues could potentially lead to the exposure of our critical information 
to our competitors or attackers. It is important to note again that we need a matching threat 
and vulnerability to constitute a risk.  
• If the confidentiality of our source code was not an issue—for instance, if we were creating 
an open source project and the source code was freely available to the public—we would not 
have a risk in this particular case. 
4.2.2.5 Application of Countermeasures  
• Once we have discovered what risks to our critical information might be present, we would 
then put measures in place to mitigate them. Such measures are referred to in operations


key: chroma:document
string_value:
138 
 
4.2.2.3 Analysis of Vulnerabilities 
• Vulnerabilities are weaknesses that can be used to harm us.  
• In the case of analyzing the vulnerabilities in the protections we have put in place for our 
information assets, we will be looking at how the processes that interact with these assets are 
normally conducted, and where we might attack in order to compromise them.


key: chroma:document
string_value:
• When we looked at threats, we used the source of a software company as an example of an 
item of critical information that might cause us harm if it were to find its way into the hands 
of our competition.  
• When we look at vulnerabilities, we might find that our security controls on the source code


key: chroma:document
string_value:
with which we are concerned are not very rigorous, and that it is possible to access, copy, 
delete, or alter it without any authorization beyond that needed to access the operating system 
or network shares.  
• This might make it possible for an attacker who has compromised the system to copy, tamper


key: chroma:document
string_value:
with, or entirely delete the source code, or might render the files vulnerable to accidental 
alteration while the system is undergoing maintenance.  
4.2.2.4 Assessment of Risks 
• Assessment of risks is where the proverbial rubber meets the road, in terms of deciding what 
issues we really need to be concerned about during the operations security process.


key: chroma:document
string_value:
• Risk occurs when we have a matching threat and vulnerability, and only then. To go back to 
our software source code example, we had determined that we had seen a threat in the 
potential for our application source code being exposed in an unauthorized manner.  
• Furthermore, we found that we had a threat in the poor controls on access to our source code,


key: chroma:document
string_value:
and a lack of policy in how exactly it was controlled.  
• These two matching issues could potentially lead to the exposure of our critical information 
to our competitors or attackers. It is important to note again that we need a matching threat 
and vulnerability to constitute a risk.


key: chroma:document
string_value:
• If the confidentiality of our source code was not an issue—for instance, if we were creating 
an open source project and the source code was freely available to the public—we would not 
have a risk in this particular case. 
4.2.2.5 Application of Countermeasures  
• Once we have discovered what risks to our critical information might be present, we would


key: full_page_content
string_value:
139 
 
security as countermeasures. As we discussed, in order to constitute a risk, we need a 
matching set of threats and vulnerabilities.  
• When we construct a countermeasure for a particular risk, in order to do the bare minimum, 
we need only to mitigate either the threat or the vulnerability.  
• In the case of our source code example, the threat was that our source code might be exposed 
to our competitors or attackers, and the vulnerability was the poor set of security controls we 
had in place to protect it. 
• In this instance, there is not much that we can do to protect ourselves from the threat itself 
without changing the nature of our application entirely, so there is really not a good step for 
us to take to mitigate the threat.  
• We can, however, put measures in place to mitigate the vulnerability. In the case of our source 
code example, we had a vulnerability to match the threat because of the poor controls on  he 
handling of the code itself.  
• If we institute stronger measures on controlling access to the code and also put policy in place 
to lay out a set of rules for how it is to be handled, we will largely remove this vulnerability.  
• Once we have broken the threat/vulnerability pair, we will likely no longer be left with much 
in the way of a serious risk.  
• It is important to note that this is an iterative process; once we reach the end of the cycle, we 
will, in all likelihood, need to go through the cycle more than once in order to fully mitigate 
any issues.  
• Each time we go through the cycle, we will do so based on the knowledge and experience we 
gained from our previous mitigation efforts, and we will be able to tune our solution for an 
even greater level of security.  
• In addition, when our environment changes and new factors arise, we will need to revisit this 
process.  
4.1.2 Laws of operations security 
• 
As a somewhat different, and briefer, viewpoint on the operations security process, we can 
look at the Laws of OPSEC, developed by Kurt Haas while he was employed at the Nevada 
Operations Office of the DOE.  
• 
These laws represent a distillation of the operations security process we discussed earlier and, 
while we might not necessarily call them the most important parts of the process, they do 
serve to highlight some of the main concepts of the overall procedure.


key: chroma:document
string_value:
139 
 
security as countermeasures. As we discussed, in order to constitute a risk, we need a 
matching set of threats and vulnerabilities.  
• When we construct a countermeasure for a particular risk, in order to do the bare minimum, 
we need only to mitigate either the threat or the vulnerability.


key: chroma:document
string_value:
• In the case of our source code example, the threat was that our source code might be exposed 
to our competitors or attackers, and the vulnerability was the poor set of security controls we 
had in place to protect it. 
• In this instance, there is not much that we can do to protect ourselves from the threat itself


key: chroma:document
string_value:
without changing the nature of our application entirely, so there is really not a good step for 
us to take to mitigate the threat.  
• We can, however, put measures in place to mitigate the vulnerability. In the case of our source 
code example, we had a vulnerability to match the threat because of the poor controls on  he 
handling of the code itself.


key: chroma:document
string_value:
• If we institute stronger measures on controlling access to the code and also put policy in place 
to lay out a set of rules for how it is to be handled, we will largely remove this vulnerability.  
• Once we have broken the threat/vulnerability pair, we will likely no longer be left with much 
in the way of a serious risk.


key: chroma:document
string_value:
• It is important to note that this is an iterative process; once we reach the end of the cycle, we 
will, in all likelihood, need to go through the cycle more than once in order to fully mitigate 
any issues.  
• Each time we go through the cycle, we will do so based on the knowledge and experience we


key: chroma:document
string_value:
gained from our previous mitigation efforts, and we will be able to tune our solution for an 
even greater level of security.  
• In addition, when our environment changes and new factors arise, we will need to revisit this 
process.  
4.1.2 Laws of operations security 
• 
As a somewhat different, and briefer, viewpoint on the operations security process, we can


key: chroma:document
string_value:
look at the Laws of OPSEC, developed by Kurt Haas while he was employed at the Nevada 
Operations Office of the DOE.  
• 
These laws represent a distillation of the operations security process we discussed earlier and, 
while we might not necessarily call them the most important parts of the process, they do 
serve to highlight some of the main concepts of the overall procedure.


key: full_page_content
string_value:
140 
 
(a) First Law 
• The first law of operations security is “If you don’t know the threat, how do you know what 
to protect?”. This law refers to the need to develop an awareness of both the actual and 
potential threats that our critical data might face.  
• This law maps directly to the second step in the operations security process.  
• Ultimately, as we discussed earlier, we may face many threats against our critical information.  
• Each item of information may have a unique set of threats and may have multiple threats, 
each from a different source.  
• Particularly as we see the surge of services that are cloud based, it is also important to 
understand that threats may be location dependent.  
• We may have enumerated all the threats that face our critical data for a particular location, 
but if we have our data replicated across multiple storage areas in multiple countries due to a 
cloud-based storage mechanism, threats may differ from one storage location to another. 
Different parties may have better or easier potential access in one particular area, or the laws 
may differ significantly from one location to another and pose entirely new threats.  
(b) Second Law 
• “If you don’t know what to protect, how do you know you are protecting it?”  This law of 
operations security discusses the need to evaluate our information assets and determine what 
exactly we might consider to be our critical information.  
• This second law equates to the first step in the operations security process. In the vast majority 
of government environments, identification and classification of information is mandated.  
• Each item of information, perhaps a document or file, is assigned a label that attests to the 
sensitivity of its contents, such as classified, top secret, and so forth.  
• Such labeling makes the task of identifying our critical information considerably easier, but 
is, unfortunately, not as frequently used outside of government.  
• In the business world, we may see the policy that dictates the use of such information 
classification, but, in the experience of the author, such labeling is usually implemented 
sporadically, at best. A few civilian industries, such as those that deal with data that has 
federally mandated requirements for protection (financial data, medical data), do utilize 
information classification, but these are the exception rather than the rule. 
(c) Third Law  
• The third and last law of operations security is “If you are not protecting it (the information), 
… THE DRAGON WINS!”.


key: chroma:document
string_value:
140 
 
(a) First Law 
• The first law of operations security is “If you don’t know the threat, how do you know what 
to protect?”. This law refers to the need to develop an awareness of both the actual and 
potential threats that our critical data might face.  
• This law maps directly to the second step in the operations security process.


key: chroma:document
string_value:
• Ultimately, as we discussed earlier, we may face many threats against our critical information.  
• Each item of information may have a unique set of threats and may have multiple threats, 
each from a different source.  
• Particularly as we see the surge of services that are cloud based, it is also important to 
understand that threats may be location dependent.


key: chroma:document
string_value:
• We may have enumerated all the threats that face our critical data for a particular location, 
but if we have our data replicated across multiple storage areas in multiple countries due to a 
cloud-based storage mechanism, threats may differ from one storage location to another. 
Different parties may have better or easier potential access in one particular area, or the laws


key: chroma:document
string_value:
may differ significantly from one location to another and pose entirely new threats.  
(b) Second Law 
• “If you don’t know what to protect, how do you know you are protecting it?”  This law of 
operations security discusses the need to evaluate our information assets and determine what 
exactly we might consider to be our critical information.


key: chroma:document
string_value:
• This second law equates to the first step in the operations security process. In the vast majority 
of government environments, identification and classification of information is mandated.  
• Each item of information, perhaps a document or file, is assigned a label that attests to the 
sensitivity of its contents, such as classified, top secret, and so forth.


key: chroma:document
string_value:
• Such labeling makes the task of identifying our critical information considerably easier, but 
is, unfortunately, not as frequently used outside of government.  
• In the business world, we may see the policy that dictates the use of such information 
classification, but, in the experience of the author, such labeling is usually implemented


key: chroma:document
string_value:
sporadically, at best. A few civilian industries, such as those that deal with data that has 
federally mandated requirements for protection (financial data, medical data), do utilize 
information classification, but these are the exception rather than the rule. 
(c) Third Law  
• The third and last law of operations security is “If you are not protecting it (the information),


key: full_page_content
string_value:
141 
 
• This law is an overall reference to the necessity of the operations security process.  
• If we do not take steps to protect our information from the dragon (our adversaries or 
competitors), they win by default. The case of the “dragon” winning—from the constant 
appearance of security breaches reported by the news media and on Web sites that track 
breaches, such as www.datalossdb.org—appears to be unfortunately common.  
• In many cases, we can examine a breach and find that it was the result of simple carelessness 
and noncompliance with the most basic security measures and due diligence.  
• We can see an example of exactly this in a breach announced by Louisiana’s Tulane 
University in January 2011. In this case, the university exposed a database containing the 
names, addresses, Social Security numbers, and tax documents for every employee of the 
school, more than 10,000 individuals all told.  
• Although we might assume that a wily band of hackers had subverted the university’s 
stringent security measures and managed to steal a copy of the database from a protected 
system on the university network, this is sadly not the case.  
• The employee data was located on an unencrypted laptop, which was placed in a briefcase 
and left in a car by a university employee that had gone out of town. 
 
4.2 Physical Security  
• Physical security is largely concerned with the protection of three main categories of assets: 
people, equipment, and data. Our primary concern, of course, is to protect people.  
• People are considerably more difficult to replace than equipment or data, particularly when 
they are experienced in their particular field and are familiar with the processes and tasks they 
perform.  
• Next in order of priority of protection is our data. If we have sufficiently planned and prepared 
in advance, we should be able to easily protect our data from any disaster that is not global in 
scale.  
• If we do not prepare for such an issue, we can very easily lose our data permanently.  
• The threats we face when we are concerned with physical security generally fall into a few 
main categories, as listed here and shown in Figure 2


key: chroma:document
string_value:
141 
 
• This law is an overall reference to the necessity of the operations security process.  
• If we do not take steps to protect our information from the dragon (our adversaries or 
competitors), they win by default. The case of the “dragon” winning—from the constant 
appearance of security breaches reported by the news media and on Web sites that track


key: chroma:document
string_value:
breaches, such as www.datalossdb.org—appears to be unfortunately common.  
• In many cases, we can examine a breach and find that it was the result of simple carelessness 
and noncompliance with the most basic security measures and due diligence.  
• We can see an example of exactly this in a breach announced by Louisiana’s Tulane


key: chroma:document
string_value:
University in January 2011. In this case, the university exposed a database containing the 
names, addresses, Social Security numbers, and tax documents for every employee of the 
school, more than 10,000 individuals all told.  
• Although we might assume that a wily band of hackers had subverted the university’s


key: chroma:document
string_value:
stringent security measures and managed to steal a copy of the database from a protected 
system on the university network, this is sadly not the case.  
• The employee data was located on an unencrypted laptop, which was placed in a briefcase 
and left in a car by a university employee that had gone out of town. 
 
4.2 Physical Security


key: chroma:document
string_value:
• Physical security is largely concerned with the protection of three main categories of assets: 
people, equipment, and data. Our primary concern, of course, is to protect people.  
• People are considerably more difficult to replace than equipment or data, particularly when 
they are experienced in their particular field and are familiar with the processes and tasks they


key: chroma:document
string_value:
perform.  
• Next in order of priority of protection is our data. If we have sufficiently planned and prepared 
in advance, we should be able to easily protect our data from any disaster that is not global in 
scale.  
• If we do not prepare for such an issue, we can very easily lose our data permanently.


key: chroma:document
string_value:
• The threats we face when we are concerned with physical security generally fall into a few 
main categories, as listed here and shown in Figure 2


key: full_page_content
string_value:
142 
 
 
Fig.2 Major Categories of Physical Threats 
4.2.1 Physical security controls  
• Physical security controls are the devices, systems, people, and other methods we put in place 
to ensure our security in a physical sense.  
• There are three main types of physical controls: deterrent, detective, and preventive, as shown 
in Figure 3.  
• Each has a different focus, but none is completely distinct and separate from the others, as we 
will discuss shortly.  
• Additionally, these controls work best when used in concert. Any one of them is not sufficient 
to ensure our physical security in most situations. 
 
Fig. 3 Types of Security Controls 
 
(a) Deterrent  
• Deterrent controls are designed to discourage those who might seek to violate our security 
controls from doing so.  
• A variety of controls might be considered to be a deterrent, including, as we discussed earlier 
in this section, several that overlap with the other categories.


key: chroma:document
string_value:
142 
 
 
Fig.2 Major Categories of Physical Threats 
4.2.1 Physical security controls  
• Physical security controls are the devices, systems, people, and other methods we put in place 
to ensure our security in a physical sense.  
• There are three main types of physical controls: deterrent, detective, and preventive, as shown 
in Figure 3.


key: chroma:document
string_value:
in Figure 3.  
• Each has a different focus, but none is completely distinct and separate from the others, as we 
will discuss shortly.  
• Additionally, these controls work best when used in concert. Any one of them is not sufficient 
to ensure our physical security in most situations. 
 
Fig. 3 Types of Security Controls 
 
(a) Deterrent


key: chroma:document
string_value:
(a) Deterrent  
• Deterrent controls are designed to discourage those who might seek to violate our security 
controls from doing so.  
• A variety of controls might be considered to be a deterrent, including, as we discussed earlier 
in this section, several that overlap with the other categories.


key: full_page_content
string_value:
143 
 
• In the sense of pure detective controls, we can point to specific items that are intended to 
indicate that other controls may be in place.  
• Examples of this include signs in public places that indicate that video monitoring is in place, 
and the yard signs with alarm company logos that we might find in residential areas.  
• The signs themselves do nothing to prevent people from acting in an undesirable fashion, but 
they do point out that there may be consequences for doing so.  
• Such measures, while not directly adding to what we might think of as physical security, do 
help to keep honest people honest.  
(b) Detective 
• Detective controls serve to detect and report undesirable events that are taking place. The 
classic example of a detective control can be found in burglar alarms and physical intrusion 
detection systems.  
• Such systems typically monitor for indicators of unauthorized activity, such as doors or 
windows opening, glass being broken, movement, and temperature changes, and also can be 
in place to monitor for undesirable environmental conditions such as flooding, smoke and 
fire, electrical outages, excessive carbon dioxide in the air, and so on.  
• We may also see detective systems in the form of human or animal guards, whether they are 
physically patrolling an area or monitoring second hand through the use of technology such 
as camera systems.  
• This type of monitoring has both good and bad points, in that a living being may be technically 
less focused than an electronic system, but does have the potential to become distracted and 
will need to be relieved for meals, bathroom breaks, and other similar activities.  
• Additionally, we can scale such guards from the lowliest unarmed security guard to highly 
trained and well-armed security forces, as is appropriate for the situation.  
(c) Preventive 
• Preventive controls are used to physically prevent unauthorized entities from breaching our 
physical security.  
• An excellent example of preventive security can be found in the simple mechanical lock. 
Locks are nearly ubiquitous for securing various facilities against unauthorized entry, 
including businesses, residences, and other locations.  
• 
In addition to locks, we can also see preventive controls in the form of high fences, bollards 
(the brightly painted and cement-filled posts that are placed to prevent vehicles from driving 
into buildings), and, once again, guards and dogs.


key: chroma:document
string_value:
143 
 
• In the sense of pure detective controls, we can point to specific items that are intended to 
indicate that other controls may be in place.  
• Examples of this include signs in public places that indicate that video monitoring is in place, 
and the yard signs with alarm company logos that we might find in residential areas.


key: chroma:document
string_value:
• The signs themselves do nothing to prevent people from acting in an undesirable fashion, but 
they do point out that there may be consequences for doing so.  
• Such measures, while not directly adding to what we might think of as physical security, do 
help to keep honest people honest.  
(b) Detective


key: chroma:document
string_value:
(b) Detective 
• Detective controls serve to detect and report undesirable events that are taking place. The 
classic example of a detective control can be found in burglar alarms and physical intrusion 
detection systems.  
• Such systems typically monitor for indicators of unauthorized activity, such as doors or


key: chroma:document
string_value:
windows opening, glass being broken, movement, and temperature changes, and also can be 
in place to monitor for undesirable environmental conditions such as flooding, smoke and 
fire, electrical outages, excessive carbon dioxide in the air, and so on.  
• We may also see detective systems in the form of human or animal guards, whether they are


key: chroma:document
string_value:
physically patrolling an area or monitoring second hand through the use of technology such 
as camera systems.  
• This type of monitoring has both good and bad points, in that a living being may be technically 
less focused than an electronic system, but does have the potential to become distracted and


key: chroma:document
string_value:
will need to be relieved for meals, bathroom breaks, and other similar activities.  
• Additionally, we can scale such guards from the lowliest unarmed security guard to highly 
trained and well-armed security forces, as is appropriate for the situation.  
(c) Preventive 
• Preventive controls are used to physically prevent unauthorized entities from breaching our


key: chroma:document
string_value:
physical security.  
• An excellent example of preventive security can be found in the simple mechanical lock. 
Locks are nearly ubiquitous for securing various facilities against unauthorized entry, 
including businesses, residences, and other locations.  
• 
In addition to locks, we can also see preventive controls in the form of high fences, bollards


key: chroma:document
string_value:
(the brightly painted and cement-filled posts that are placed to prevent vehicles from driving 
into buildings), and, once again, guards and dogs.


key: full_page_content
string_value:
144 
 
• 
We may also see preventive controls focused specifically on people, vehicles, or other 
particular areas of concern, depending on the environment in question.  
4.2.2 How We Use Physical Access Controls 
• Preventive controls are generally the core of our security efforts, and in some cases, they may 
be the only effort and the only physical security control actually in place.  
• We can commonly see this in residences, where there are locks on the doors, but no alarm 
systems or any other measures that might deter a criminal from gaining unauthorized entry.  
• In commercial facilities, we are much more likely to see all three types of controls 
implemented, in the form of locks, alarm systems, and signs indicating the presence of the 
alarm systems.  
• Following the principles of defense in depth, the more layers we put in place for physical 
security, the better-off we will be.  
• Another important consideration in implementing physical security is to only put security in 
place that is reasonably consistent with the value of what we are protecting.  
• If we have an empty warehouse, it does not make sense to put in high-security locks, alarm 
systems, and armed guards.  
• Likewise, if we have a house full of expensive computers and electronics, it does not make 
sense to equip it with cheap locks and forgo an alarm system entirely. 
(a) Protecting people  
• 
The primary concern of physical security is to protect the individuals on which our business 
depends and those that are close to us.  
• 
While we put security measures and backup systems in place to ensure that our facilities, 
equipment, and data remain in functional condition, if we lose the people we depend on to 
work with the equipment and data, we have a rather difficult problem to solve.  
• 
In many cases, we can restore our data from backups, we can build new facilities if they 
become destroyed or damaged, and we can buy new equipment; but replacing experienced 
people beyond the one or two at a time that we find with normal turnover is difficult, if not 
impossible, within any reasonable period of time.  
(b) Physical Concerns for People 
• As people are rather fragile in comparison to equipment, they can be susceptible to nearly the 
entire scope of threats.  
• Extreme temperatures, or even not so extreme temperatures, can quickly render a person very 
uncomfortable, at best.


key: chroma:document
string_value:
144 
 
• 
We may also see preventive controls focused specifically on people, vehicles, or other 
particular areas of concern, depending on the environment in question.  
4.2.2 How We Use Physical Access Controls 
• Preventive controls are generally the core of our security efforts, and in some cases, they may


key: chroma:document
string_value:
be the only effort and the only physical security control actually in place.  
• We can commonly see this in residences, where there are locks on the doors, but no alarm 
systems or any other measures that might deter a criminal from gaining unauthorized entry.  
• In commercial facilities, we are much more likely to see all three types of controls


key: chroma:document
string_value:
implemented, in the form of locks, alarm systems, and signs indicating the presence of the 
alarm systems.  
• Following the principles of defense in depth, the more layers we put in place for physical 
security, the better-off we will be.  
• Another important consideration in implementing physical security is to only put security in


key: chroma:document
string_value:
place that is reasonably consistent with the value of what we are protecting.  
• If we have an empty warehouse, it does not make sense to put in high-security locks, alarm 
systems, and armed guards.  
• Likewise, if we have a house full of expensive computers and electronics, it does not make 
sense to equip it with cheap locks and forgo an alarm system entirely.


key: chroma:document
string_value:
(a) Protecting people  
• 
The primary concern of physical security is to protect the individuals on which our business 
depends and those that are close to us.  
• 
While we put security measures and backup systems in place to ensure that our facilities, 
equipment, and data remain in functional condition, if we lose the people we depend on to


key: chroma:document
string_value:
work with the equipment and data, we have a rather difficult problem to solve.  
• 
In many cases, we can restore our data from backups, we can build new facilities if they 
become destroyed or damaged, and we can buy new equipment; but replacing experienced 
people beyond the one or two at a time that we find with normal turnover is difficult, if not


key: chroma:document
string_value:
impossible, within any reasonable period of time.  
(b) Physical Concerns for People 
• As people are rather fragile in comparison to equipment, they can be susceptible to nearly the 
entire scope of threats.  
• Extreme temperatures, or even not so extreme temperatures, can quickly render a person very 
uncomfortable, at best.


key: full_page_content
string_value:
145 
 
• In the case of liquids, gases, or toxins, the absence, presence, or incorrect proportion of a 
variety of them can be harmful to individuals.  
• We can very clearly see how a liquid such as water, in excessive quantities, might be an 
undesirable thing, as we saw in the case of the massive flooding that took place in the southern 
United States during Hurricane Katrina in 2005.  
• Likewise, the lack of a gas such as oxygen, or too much of the same, can become deadly to 
people very quickly.  
• Although we can see where harm might come from a toxin being introduced to an 
environment very clearly, a number of common substances may already be present, but are 
not toxic in the quantities or mixtures in which they are commonly used.  
• We might see certain chemicals as being beneficial when they are used to filter the water in 
our facilities, but the same might not be true if the chemical ratios or mixtures are changed. 
Any variety of living organisms can be dangerous to people, from larger animals, to insects, 
to nearly invisible molds, fungi, or other microscopic organisms.  
• People can suffer from contact with living organisms in a variety of ways, from being bitten 
or stung by various critters, to developing breathing problems from inhaling mold.  
• Movement can be very harmful to people, particularly when said movement is the result of 
an earthquake, mudslide, avalanche, building structural issue, or other similar problems.  
• In most cases, such threats can be both very harmful and very difficult to protect against. 
(c) Safety  
• The safety of people is the first and foremost concern on our list when we plan for physical 
security. Safety of people falls above any other concern and must be prioritized above saving 
equipment or data, even when such actions will directly cause such items to be damaged. 
• We might find an example of this in the fire suppression systems in use in some data centres.  
• In many cases, the chemicals, gases, or liquids that are used to extinguish fires in such 
environments are very harmful to people and may kill them if used in such an environment.  
• For this reason, fire suppression systems are often equipped with a safety override that can 
prevent them from being deployed if there are people in the area.  
• If we were to prevent the suppression system from extinguishing the fire because we knew a 
person was still in the data centre, we might lose all the equipment in the data centre, and 
potentially data that we could not replace.  
(d) Evacuation 
• Evacuation is one of the best methods we can use to keep our people safe.


key: chroma:document
string_value:
145 
 
• In the case of liquids, gases, or toxins, the absence, presence, or incorrect proportion of a 
variety of them can be harmful to individuals.  
• We can very clearly see how a liquid such as water, in excessive quantities, might be an 
undesirable thing, as we saw in the case of the massive flooding that took place in the southern


key: chroma:document
string_value:
United States during Hurricane Katrina in 2005.  
• Likewise, the lack of a gas such as oxygen, or too much of the same, can become deadly to 
people very quickly.  
• Although we can see where harm might come from a toxin being introduced to an 
environment very clearly, a number of common substances may already be present, but are


key: chroma:document
string_value:
not toxic in the quantities or mixtures in which they are commonly used.  
• We might see certain chemicals as being beneficial when they are used to filter the water in 
our facilities, but the same might not be true if the chemical ratios or mixtures are changed. 
Any variety of living organisms can be dangerous to people, from larger animals, to insects,


key: chroma:document
string_value:
to nearly invisible molds, fungi, or other microscopic organisms.  
• People can suffer from contact with living organisms in a variety of ways, from being bitten 
or stung by various critters, to developing breathing problems from inhaling mold.  
• Movement can be very harmful to people, particularly when said movement is the result of


key: chroma:document
string_value:
an earthquake, mudslide, avalanche, building structural issue, or other similar problems.  
• In most cases, such threats can be both very harmful and very difficult to protect against. 
(c) Safety  
• The safety of people is the first and foremost concern on our list when we plan for physical


key: chroma:document
string_value:
security. Safety of people falls above any other concern and must be prioritized above saving 
equipment or data, even when such actions will directly cause such items to be damaged. 
• We might find an example of this in the fire suppression systems in use in some data centres.  
• In many cases, the chemicals, gases, or liquids that are used to extinguish fires in such


key: chroma:document
string_value:
environments are very harmful to people and may kill them if used in such an environment.  
• For this reason, fire suppression systems are often equipped with a safety override that can 
prevent them from being deployed if there are people in the area.  
• If we were to prevent the suppression system from extinguishing the fire because we knew a


key: chroma:document
string_value:
person was still in the data centre, we might lose all the equipment in the data centre, and 
potentially data that we could not replace.  
(d) Evacuation 
• Evacuation is one of the best methods we can use to keep our people safe.


key: full_page_content
string_value:
146 
 
• In almost any dangerous situation, an orderly evacuation away from the source of danger is 
the best thing we can do.  
• There are a few main principles to consider when planning an evacuation: where, how, and 
who.  
(i) Where 
• Where we will be evacuating to is an important piece of information to consider in advance, 
whether we are evacuating a commercial building or a residence.  
• We need to get everyone to the same place to ensure that they are at a safe distance and that 
we can account for everyone.  
• If we do not do this in an orderly and consistent fashion, we may end up with a variety of 
issues. In commercial buildings, evacuation meeting places are often marked with signs, and 
on evacuation maps. 
(ii) How  
• Also of importance is the route we will follow to reach the evacuation meeting place. When 
planning such routes, we should consider where the nearest exit from a given area can be 
reached, as well as alternate routes if some routes are impassable in an emergency.  
• We should also avoid the use of areas that are dangerous or unusable in emergencies, such as 
elevators or areas that might be blocked by automatically closing fire doors. 
(iii) Who  
• The most vital portion of the evacuation, of course, is to ensure that we actually get everyone 
out of the building, and that we can account for everyone at the evacuation meeting place. 
• This process typically requires at least two people to be responsible for any given group of 
people: one person to ensure that everyone he or she is responsible for has actually left the 
building and another at the meeting place to ensure that everyone has arrived safely.  
(iv) Practice  
• Particularly in large facilities, a full evacuation can be a complicated prospect. In a true 
emergency, if we do not evacuate quickly and properly, a great number of lives may be lost.  
• As an unfortunate attestation to this, we can look to the example of the 2001 attacks on the 
World Trade Center in the United States.  
• A study conducted in 2008 determined that only 8.6 percent of the people in the buildings 
actually evacuated when the alarms were sounded. The rest remained in the buildings, 
gathering belongings, shutting down computers, and performing other such tasks. It is


key: chroma:document
string_value:
146 
 
• In almost any dangerous situation, an orderly evacuation away from the source of danger is 
the best thing we can do.  
• There are a few main principles to consider when planning an evacuation: where, how, and 
who.  
(i) Where 
• Where we will be evacuating to is an important piece of information to consider in advance,


key: chroma:document
string_value:
whether we are evacuating a commercial building or a residence.  
• We need to get everyone to the same place to ensure that they are at a safe distance and that 
we can account for everyone.  
• If we do not do this in an orderly and consistent fashion, we may end up with a variety of 
issues. In commercial buildings, evacuation meeting places are often marked with signs, and


key: chroma:document
string_value:
on evacuation maps. 
(ii) How  
• Also of importance is the route we will follow to reach the evacuation meeting place. When 
planning such routes, we should consider where the nearest exit from a given area can be 
reached, as well as alternate routes if some routes are impassable in an emergency.


key: chroma:document
string_value:
• We should also avoid the use of areas that are dangerous or unusable in emergencies, such as 
elevators or areas that might be blocked by automatically closing fire doors. 
(iii) Who  
• The most vital portion of the evacuation, of course, is to ensure that we actually get everyone 
out of the building, and that we can account for everyone at the evacuation meeting place.


key: chroma:document
string_value:
• This process typically requires at least two people to be responsible for any given group of 
people: one person to ensure that everyone he or she is responsible for has actually left the 
building and another at the meeting place to ensure that everyone has arrived safely.  
(iv) Practice


key: chroma:document
string_value:
(iv) Practice  
• Particularly in large facilities, a full evacuation can be a complicated prospect. In a true 
emergency, if we do not evacuate quickly and properly, a great number of lives may be lost.  
• As an unfortunate attestation to this, we can look to the example of the 2001 attacks on the 
World Trade Center in the United States.


key: chroma:document
string_value:
• A study conducted in 2008 determined that only 8.6 percent of the people in the buildings 
actually evacuated when the alarms were sounded. The rest remained in the buildings, 
gathering belongings, shutting down computers, and performing other such tasks. It is


key: full_page_content
string_value:
147 
 
important that we train our personnel to evacuate safely, and to respond quickly and properly 
when the signal to evacuate has been given. 
(e) Administrative Controls 
• We may, and likely will, also have a variety of administrative controls in place to protect 
people, in addition to the physical measures we put in place.  
• Administrative controls are usually based on rules of some variety.  
• More specifically, they may be policies, procedures, guidelines, regulations, laws, or similar 
bodies, and may be instituted at any level from informal company policies to federal laws.  
• Companies put several common practices in place specifically to protect our people and our 
interests in general. One of the most common is the background check.  
• When an individual has made it far enough through the hiring process that it seems likely he 
or she will be hired, the hiring company will often institute a background check.  
• A number of companies globally carry out such background checks, including AccuScreen 
and LexisNexis.  
• Such investigations will typically involve checks for criminal history, verification of previous 
employment, verification of education, credit checks, drug testing, and other items, depending 
on the position being pursued.  
• We may also conduct a variety of reoccurring checks on those in our employ.  
• One of the more common and well-known examples can be seen in the drug tests conducted 
by certain employers. We may also see any of the checks we discussed as being common at 
the initiation of employment repeated in a similar fashion.  
• Whether such checks occur or not often depends on the specific employer in question, and 
some employers may not conduct them at all.  
4.2.3 Protecting data  
• Second only to the safety of our personnel is the safety of our data. One of our primary means 
of protecting data is the use of encryption. Although this is a reasonably sure solution, certain 
attacks may render it useless, such as those that break the encryption algorithm itself, or use 
other means to obtain the encryption keys.  
• Another layer of security we need to ensure is the physical element. If we keep our physical 
storage media physically safe against attackers, unfavourable environmental conditions, or 
other threats that might harm them, we place ourselves on a considerably more sound security 
footing. 
(a) Physical Concerns for Data


key: chroma:document
string_value:
147 
 
important that we train our personnel to evacuate safely, and to respond quickly and properly 
when the signal to evacuate has been given. 
(e) Administrative Controls 
• We may, and likely will, also have a variety of administrative controls in place to protect 
people, in addition to the physical measures we put in place.


key: chroma:document
string_value:
• Administrative controls are usually based on rules of some variety.  
• More specifically, they may be policies, procedures, guidelines, regulations, laws, or similar 
bodies, and may be instituted at any level from informal company policies to federal laws.  
• Companies put several common practices in place specifically to protect our people and our


key: chroma:document
string_value:
interests in general. One of the most common is the background check.  
• When an individual has made it far enough through the hiring process that it seems likely he 
or she will be hired, the hiring company will often institute a background check.  
• A number of companies globally carry out such background checks, including AccuScreen 
and LexisNexis.


key: chroma:document
string_value:
and LexisNexis.  
• Such investigations will typically involve checks for criminal history, verification of previous 
employment, verification of education, credit checks, drug testing, and other items, depending 
on the position being pursued.  
• We may also conduct a variety of reoccurring checks on those in our employ.


key: chroma:document
string_value:
• One of the more common and well-known examples can be seen in the drug tests conducted 
by certain employers. We may also see any of the checks we discussed as being common at 
the initiation of employment repeated in a similar fashion.  
• Whether such checks occur or not often depends on the specific employer in question, and 
some employers may not conduct them at all.


key: chroma:document
string_value:
4.2.3 Protecting data  
• Second only to the safety of our personnel is the safety of our data. One of our primary means 
of protecting data is the use of encryption. Although this is a reasonably sure solution, certain 
attacks may render it useless, such as those that break the encryption algorithm itself, or use 
other means to obtain the encryption keys.


key: chroma:document
string_value:
• Another layer of security we need to ensure is the physical element. If we keep our physical 
storage media physically safe against attackers, unfavourable environmental conditions, or 
other threats that might harm them, we place ourselves on a considerably more sound security 
footing. 
(a) Physical Concerns for Data


key: full_page_content
string_value:
148 
 
• Depending on the type of physical media on which our data is stored, any number of adverse 
physical conditions may be problematic or harmful to their integrity.  
• Such media are often sensitive to temperature, humidity, magnetic fields, electricity, impact, 
and more, with each type of media having its particular strong and weak points.  
• Magnetic media, whether we refer to hard drives, tapes, floppy disks, or otherwise, generally 
involves some variety of movement and magnetically sensitive material on which the data is 
recorded.  
• The combination of magnetic sensitivity and moving parts often makes such storage media 
fragile in one way or another. In most cases, strong magnetic fields can harm the integrity of 
data stored on magnetic media, with media outside of metal casing, such as magnetic tapes, 
being even more sensitive to such disruption.  
• Additionally, jolting such media while it is in motion, typically while it is being read from or 
written to, can have a variety of undesirable effects, often rendering the media unusable. 
• Flash media, referring to the general category of media that stores data on non-volatile 
memory chips, is actually rather hardy in nature.  
• If we can avoid impacts that might directly crush the chips on which the data is stored and we 
do not expose them to electrical shocks, they will generally withstand conditions that many 
other types of media will not.  
• They are not terribly sensitive to temperature ranges below what would actually destroy the 
housing, and will often survive brief immersion in liquid, if properly dried afterward.  
• Some flash drives are designed specifically to survive extreme conditions that would normally 
destroy such media, for those that might consider such conditions to be a potential issue.  
• Optical media, such as CDs and DVDs, is fairly fragile, as those with small children can attest 
to. Even small scratches on the surface of the media may render it unusable.  
• It is also very temperature sensitive, being constructed largely of plastic and thin metal foil. 
Outside of a protected environment, such as a purpose- built media storage vault, any of a 
variety of threats may destroy the data on such media. 
(b) Availability  
• One of our larger concerns when we discuss protecting data is to ensure that the data is 
available to us when we need to access it.  
• The availability of our data often hinges on both our equipment and our facilities remaining 
in functioning condition, as we discussed earlier, and the media on which our data is stored 
being in working condition.


key: chroma:document
string_value:
148 
 
• Depending on the type of physical media on which our data is stored, any number of adverse 
physical conditions may be problematic or harmful to their integrity.  
• Such media are often sensitive to temperature, humidity, magnetic fields, electricity, impact, 
and more, with each type of media having its particular strong and weak points.


key: chroma:document
string_value:
• Magnetic media, whether we refer to hard drives, tapes, floppy disks, or otherwise, generally 
involves some variety of movement and magnetically sensitive material on which the data is 
recorded.  
• The combination of magnetic sensitivity and moving parts often makes such storage media


key: chroma:document
string_value:
fragile in one way or another. In most cases, strong magnetic fields can harm the integrity of 
data stored on magnetic media, with media outside of metal casing, such as magnetic tapes, 
being even more sensitive to such disruption.  
• Additionally, jolting such media while it is in motion, typically while it is being read from or


key: chroma:document
string_value:
written to, can have a variety of undesirable effects, often rendering the media unusable. 
• Flash media, referring to the general category of media that stores data on non-volatile 
memory chips, is actually rather hardy in nature.  
• If we can avoid impacts that might directly crush the chips on which the data is stored and we


key: chroma:document
string_value:
do not expose them to electrical shocks, they will generally withstand conditions that many 
other types of media will not.  
• They are not terribly sensitive to temperature ranges below what would actually destroy the 
housing, and will often survive brief immersion in liquid, if properly dried afterward.


key: chroma:document
string_value:
• Some flash drives are designed specifically to survive extreme conditions that would normally 
destroy such media, for those that might consider such conditions to be a potential issue.  
• Optical media, such as CDs and DVDs, is fairly fragile, as those with small children can attest 
to. Even small scratches on the surface of the media may render it unusable.


key: chroma:document
string_value:
• It is also very temperature sensitive, being constructed largely of plastic and thin metal foil. 
Outside of a protected environment, such as a purpose- built media storage vault, any of a 
variety of threats may destroy the data on such media. 
(b) Availability  
• One of our larger concerns when we discuss protecting data is to ensure that the data is


key: chroma:document
string_value:
available to us when we need to access it.  
• The availability of our data often hinges on both our equipment and our facilities remaining 
in functioning condition, as we discussed earlier, and the media on which our data is stored 
being in working condition.


key: full_page_content
string_value:
149 
 
• Any of the physical concerns we discussed earlier can render our data inaccessible, in the 
sense of being able to read it from the media on which it is stored Although we are specifically 
discussing access to data here, and we talked about some of the potential hardware issues in 
accessing certain types of media earlier there is also a fairly substantial equipment and 
infrastructure component to consider when discussing availability.  
• Not only can we experience issues in reading the data from the media, but we may also have 
problems in getting to where the data is stored.  
• If we are experiencing an outage, whether it is related to network, power, computer systems, 
or other components, at any point between our location and a remote data location, we may 
not be able to access our data remotely.  
• Many businesses operate globally today, and it is possible that the loss of ability to access 
data remotely, even temporarily, will be a rather serious issue.   
(c) Residual Data  
• When we look at the idea of keeping data safe, we not only need to have the data available 
when we need access to it, but we also must be able to render the data inaccessible when it is 
no longer required.  
• In some cases, this need is relatively obvious; for instance, we might not overlook the need 
to shred a stack of paper containing sensitive data before we throw it away. But the data stored 
on electronic media may not present itself so clearly to everyone that might be handling it or 
disposing of it. 
• In many cases, we can find stored data in several computing-related devices, such as 
computers, disk arrays, portable media devices, flash drives, backup tapes, CD or DVD 
media, and similar items.  
• We would hope that the relatively computer savvy people would realize the media or device 
might contain some sensitive data, and that they should erase the data before they dispose of 
it.  
• Unfortunately, this is not always the case. In the early 2000s, a study was conducted on more 
than 150 used hard drives purchased from a variety of different sources, with a large number 
of them being purchased from eBay.  
• When the contents of the disks were analyzed, it was discovered that many of them still 
contained data, to include medical data, pornography, e-mail messages, and several disks that 
appeared to have been used for financial data containing more than 6,500 credit card numbers.  
In many cases, no attempt had been made to erase the data from the disks


key: chroma:document
string_value:
149 
 
• Any of the physical concerns we discussed earlier can render our data inaccessible, in the 
sense of being able to read it from the media on which it is stored Although we are specifically 
discussing access to data here, and we talked about some of the potential hardware issues in 
accessing certain types of media earlier there is also a fairly substantial equipment and


key: chroma:document
string_value:
infrastructure component to consider when discussing availability.  
• Not only can we experience issues in reading the data from the media, but we may also have 
problems in getting to where the data is stored.  
• If we are experiencing an outage, whether it is related to network, power, computer systems,


key: chroma:document
string_value:
or other components, at any point between our location and a remote data location, we may 
not be able to access our data remotely.  
• Many businesses operate globally today, and it is possible that the loss of ability to access 
data remotely, even temporarily, will be a rather serious issue.   
(c) Residual Data


key: chroma:document
string_value:
(c) Residual Data  
• When we look at the idea of keeping data safe, we not only need to have the data available 
when we need access to it, but we also must be able to render the data inaccessible when it is 
no longer required.  
• In some cases, this need is relatively obvious; for instance, we might not overlook the need


key: chroma:document
string_value:
to shred a stack of paper containing sensitive data before we throw it away. But the data stored 
on electronic media may not present itself so clearly to everyone that might be handling it or 
disposing of it. 
• In many cases, we can find stored data in several computing-related devices, such as


key: chroma:document
string_value:
computers, disk arrays, portable media devices, flash drives, backup tapes, CD or DVD 
media, and similar items.  
• We would hope that the relatively computer savvy people would realize the media or device 
might contain some sensitive data, and that they should erase the data before they dispose of 
it.


key: chroma:document
string_value:
it.  
• Unfortunately, this is not always the case. In the early 2000s, a study was conducted on more 
than 150 used hard drives purchased from a variety of different sources, with a large number 
of them being purchased from eBay.  
• When the contents of the disks were analyzed, it was discovered that many of them still


key: chroma:document
string_value:
contained data, to include medical data, pornography, e-mail messages, and several disks that 
appeared to have been used for financial data containing more than 6,500 credit card numbers.  
In many cases, no attempt had been made to erase the data from the disks


key: full_page_content
string_value:
150 
 
(d) Backups  
• In order to ensure that we can maintain the availability of our data, we will likely want to 
maintain backups.  
• Not only do we need to back up the data itself, but we also need to maintain backups of the 
equipment and infrastructure that are used to provide access to the data. We can perform data 
backups in a number of ways.  
• We can utilize redundant arrays of inexpensive disks (RAID) in a variety of configurations to 
ensure that we do not lose data from hardware failures in individual disks, we can replicate 
data from one machine to another over a network, or we can make copies of data onto backup 
storage media, such as DVDs or magnetic tapes.  
4.2.4 Protecting equipment  
• Last on the list of our concerns for physical security, although still very important and 
significant, is protecting our equipment, and, to a certain extent, the facilities that house it.  
• This category falls last on the list because it represents the easiest and cheapest segment of 
our assets to replace.  
• Even in the case of a major disaster that completely destroys our facility and all the computing 
equipment inside it, as long as we still have the people needed to run our operation and are 
able to restore or access our critical data, we can be back in working order very shortly.  
• Replacing floor space or relocating to another area nearby can generally be accomplished 
with relative ease, and computing equipment is both cheap and plentiful.  
• Although it may take us some time to be back to the same state we were in before the incident, 
getting to a bare minimum working state technology-wise is often a simple, if arduous, task. 
 
(a) Physical Concerns for Equipment 
• The physical threats that might harm our equipment, although fewer than those we might find 
harmful to people, are still numerous.  
• Extreme temperatures can be very harmful to equipment. We typically think of heat as being 
the most harmful to computing equipment, and this is largely correct.  
• In environments that contain large numbers of computers and associated equipment, such as 
in a data centre, we rely on environmental conditioning equipment to keep the temperature 
down to a reasonable level, typically in the high-60s to mid-70s on the Fahrenheit scale, 
although there is some debate over the subject.


key: chroma:document
string_value:
150 
 
(d) Backups  
• In order to ensure that we can maintain the availability of our data, we will likely want to 
maintain backups.  
• Not only do we need to back up the data itself, but we also need to maintain backups of the 
equipment and infrastructure that are used to provide access to the data. We can perform data 
backups in a number of ways.


key: chroma:document
string_value:
• We can utilize redundant arrays of inexpensive disks (RAID) in a variety of configurations to 
ensure that we do not lose data from hardware failures in individual disks, we can replicate 
data from one machine to another over a network, or we can make copies of data onto backup 
storage media, such as DVDs or magnetic tapes.  
4.2.4 Protecting equipment


key: chroma:document
string_value:
• Last on the list of our concerns for physical security, although still very important and 
significant, is protecting our equipment, and, to a certain extent, the facilities that house it.  
• This category falls last on the list because it represents the easiest and cheapest segment of 
our assets to replace.


key: chroma:document
string_value:
• Even in the case of a major disaster that completely destroys our facility and all the computing 
equipment inside it, as long as we still have the people needed to run our operation and are 
able to restore or access our critical data, we can be back in working order very shortly.  
• Replacing floor space or relocating to another area nearby can generally be accomplished


key: chroma:document
string_value:
with relative ease, and computing equipment is both cheap and plentiful.  
• Although it may take us some time to be back to the same state we were in before the incident, 
getting to a bare minimum working state technology-wise is often a simple, if arduous, task. 
 
(a) Physical Concerns for Equipment


key: chroma:document
string_value:
• The physical threats that might harm our equipment, although fewer than those we might find 
harmful to people, are still numerous.  
• Extreme temperatures can be very harmful to equipment. We typically think of heat as being 
the most harmful to computing equipment, and this is largely correct.


key: chroma:document
string_value:
• In environments that contain large numbers of computers and associated equipment, such as 
in a data centre, we rely on environmental conditioning equipment to keep the temperature 
down to a reasonable level, typically in the high-60s to mid-70s on the Fahrenheit scale, 
although there is some debate over the subject.


key: full_page_content
string_value:
151 
 
• Liquids can be very harmful to equipment, even when in quantities as small as those that can 
be found in humid air.  
• Depending on the liquid in question, and the quantity of it present, we may find corrosion in 
a variety of devices, short circuits in electrical equipment, and other harmful effects.  
• Clearly, in extreme cases, such as we might find in flooding, such equipment will often be 
rendered completely unusable after having been immersed.  
• Living organisms can also be harmful to equipment, although in the environments with which 
we will typically be concerned, these will often be of the smaller persuasion.  
• Insects and small animals that have gained access to our equipment may cause electrical 
shorts, interfere with cooling fans, chew on wiring, and generally wreak havoc.  
• Movement in earth and in the structure of our facilities can be a very bad thing for our 
equipment. One of the more obvious examples we can look at is an earthquake.  
• Not only can earthquakes cause structural damage to our facilities, but the resultant shaking, 
vibrations, and potential for impacts due to structural failures can cause a large amount of 
damage.  
• Energy anomalies can be extremely harmful to any type of electrical equipment in a variety 
of ways.  
• If we see issues with power being absent or temporarily not sending the expected amount of 
voltage, our equipment may be damaged beyond repair as a result.  
• Good facility design will provide some measure of protection against such threats, but we 
generally cannot completely mitigate the effects of severe electrical issues, such as lightning 
strikes. Smoke and fire are very bad for our equipment, as they introduce a number of harmful 
conditions. With smoke or fire, we might experience extreme temperatures, electrical issues, 
movement, liquids, and a variety of other problems.  
• Efforts to extinguish fires, depending on the methods used, may also cause as much harm as 
the fire itself.  
(b) Site Selection 
• When we are planning a new facility, or selecting a new location to which to move, we should 
be aware of the area in which the facility will be located.  
• A number of factors could cause us issues in terms of protecting our equipment and may 
impact the safety of our people and data as well.


key: chroma:document
string_value:
151 
 
• Liquids can be very harmful to equipment, even when in quantities as small as those that can 
be found in humid air.  
• Depending on the liquid in question, and the quantity of it present, we may find corrosion in 
a variety of devices, short circuits in electrical equipment, and other harmful effects.


key: chroma:document
string_value:
• Clearly, in extreme cases, such as we might find in flooding, such equipment will often be 
rendered completely unusable after having been immersed.  
• Living organisms can also be harmful to equipment, although in the environments with which 
we will typically be concerned, these will often be of the smaller persuasion.


key: chroma:document
string_value:
• Insects and small animals that have gained access to our equipment may cause electrical 
shorts, interfere with cooling fans, chew on wiring, and generally wreak havoc.  
• Movement in earth and in the structure of our facilities can be a very bad thing for our 
equipment. One of the more obvious examples we can look at is an earthquake.


key: chroma:document
string_value:
• Not only can earthquakes cause structural damage to our facilities, but the resultant shaking, 
vibrations, and potential for impacts due to structural failures can cause a large amount of 
damage.  
• Energy anomalies can be extremely harmful to any type of electrical equipment in a variety 
of ways.


key: chroma:document
string_value:
of ways.  
• If we see issues with power being absent or temporarily not sending the expected amount of 
voltage, our equipment may be damaged beyond repair as a result.  
• Good facility design will provide some measure of protection against such threats, but we 
generally cannot completely mitigate the effects of severe electrical issues, such as lightning


key: chroma:document
string_value:
strikes. Smoke and fire are very bad for our equipment, as they introduce a number of harmful 
conditions. With smoke or fire, we might experience extreme temperatures, electrical issues, 
movement, liquids, and a variety of other problems.  
• Efforts to extinguish fires, depending on the methods used, may also cause as much harm as 
the fire itself.  
(b) Site Selection


key: chroma:document
string_value:
(b) Site Selection 
• When we are planning a new facility, or selecting a new location to which to move, we should 
be aware of the area in which the facility will be located.  
• A number of factors could cause us issues in terms of protecting our equipment and may 
impact the safety of our people and data as well.


key: full_page_content
string_value:
152 
 
• If the site is located in an area prone to natural disasters such as floods, storms, tornadoes, 
mudslides, or similar issues, we may find our facility to be completely unusable or destroyed 
at some point.  
• Similar issues might include areas that have the potential for civil unrest, unstable power or 
utilities, poor network connectivity, extreme temperature conditions, and so forth.  
• With the proper facility design, we may be able to compensate for some problems without 
great difficulty, by installing power filtering and generators in order to compensate for power 
problems, for instance, but others, such as the local temperature, we may ultimately not be 
able to mitigate to any great extent.   
• Although potential site selection issues may not completely preclude our use of the facility, 
we should be aware that they may cause us problems and plan for such occurrences. For 
certain types of facilities, such as data centres, for instance, it may be very important for us 
to have as problem-free of an environment as we can possibly select, and, in the case of such 
site issues, we may want to look elsewhere.  
(c) Securing Access  
• When we discuss securing access to our equipment or our facility, we return again to the 
concept of defense in depth.  
• There are multiple areas, inside and outside, where we may want to place a variety of security 
measures, depending on the environment.  
• A military installation may have the highest level of security available, whereas a small retail 
store may have the lowest level. We can often see measures for securing physical access 
implemented on the perimeter of the property on which various facilities sit.  
• Very often, we will at least see minimal measures in place to ensure that vehicle traffic is 
controlled and does not enter undesirable places. Such measures may take the form of security 
landscaping. For example, we may see trees, large boulders, large cement planters, and the 
like placed in front of buildings or next to driveways in order to prevent vehicle entry.  
• At more secure facilities, we might see fences, concrete barriers, and other more obvious 
measures.  
• Such controls are generally in place as deterrents, and may be preventive in nature as well.  
• At the facility itself, we will likely see some variety of locks, whether mechanical or electronic 
with access badges, in place on the doors entering the building.  
• A typical arrangement for non-public buildings is for the main entrance of the building to be 
unlocked during business hours and a security guard or receptionist stationed inside.


key: chroma:document
string_value:
152 
 
• If the site is located in an area prone to natural disasters such as floods, storms, tornadoes, 
mudslides, or similar issues, we may find our facility to be completely unusable or destroyed 
at some point.  
• Similar issues might include areas that have the potential for civil unrest, unstable power or


key: chroma:document
string_value:
utilities, poor network connectivity, extreme temperature conditions, and so forth.  
• With the proper facility design, we may be able to compensate for some problems without 
great difficulty, by installing power filtering and generators in order to compensate for power 
problems, for instance, but others, such as the local temperature, we may ultimately not be


key: chroma:document
string_value:
able to mitigate to any great extent.   
• Although potential site selection issues may not completely preclude our use of the facility, 
we should be aware that they may cause us problems and plan for such occurrences. For 
certain types of facilities, such as data centres, for instance, it may be very important for us


key: chroma:document
string_value:
to have as problem-free of an environment as we can possibly select, and, in the case of such 
site issues, we may want to look elsewhere.  
(c) Securing Access  
• When we discuss securing access to our equipment or our facility, we return again to the 
concept of defense in depth.  
• There are multiple areas, inside and outside, where we may want to place a variety of security


key: chroma:document
string_value:
measures, depending on the environment.  
• A military installation may have the highest level of security available, whereas a small retail 
store may have the lowest level. We can often see measures for securing physical access 
implemented on the perimeter of the property on which various facilities sit.


key: chroma:document
string_value:
• Very often, we will at least see minimal measures in place to ensure that vehicle traffic is 
controlled and does not enter undesirable places. Such measures may take the form of security 
landscaping. For example, we may see trees, large boulders, large cement planters, and the 
like placed in front of buildings or next to driveways in order to prevent vehicle entry.


key: chroma:document
string_value:
• At more secure facilities, we might see fences, concrete barriers, and other more obvious 
measures.  
• Such controls are generally in place as deterrents, and may be preventive in nature as well.  
• At the facility itself, we will likely see some variety of locks, whether mechanical or electronic 
with access badges, in place on the doors entering the building.


key: chroma:document
string_value:
• A typical arrangement for non-public buildings is for the main entrance of the building to be 
unlocked during business hours and a security guard or receptionist stationed inside.


key: full_page_content
string_value:
153 
 
• In more secure facilities, we are likely to see all doors locked at all times, and a badge or key 
required to enter the building.  
• Typically, once inside the building, visitors will have limited access to a lobby area, and, 
perhaps, meeting and restrooms, whereas those authorized to enter the rest of the building 
will use a key or badge to access it.  
• Once inside the facility, we will often see a variety of physical access controls, depending on 
the work and processes being carried out.  
• We may see access controls on internal doors or individual floors of the building in order to 
keep visitors or unauthorized people from freely accessing the entire facility.  
• Very often, in the case where computer rooms or data centers are present, access to them will 
be  estricted to those that specifically need to enter them for business reasons.  
• We may also find more complex physical access controls in place in such areas, such as 
biometric systems.  
(d) Environmental Conditions 
• For the equipment within our facilities, maintaining proper environmental conditions can be 
crucial to continued operations. Computing equipment can be very sensitive to changes in 
power, temperature, and humidity, as well as electromagnetic disturbances.  
• Particularly in areas where we have large quantities of equipment, such as we might find in a 
data center, maintaining the proper conditions can be challenging, to say the least When 
facilities that will contain equipment sensitive to such conditions are  constructed, they are 
often equipped with the means to provide emergency electrical power, often in the form of 
generators, as well as systems that can heat, cool, and moderate the humidity, as required.  
• Outside of locations that are so equipped, our equipment will be at considerably greater risk 
of malfunction and damage. Unfortunately, such controls can be prohibitively expensive and 
we may not find smaller facilities appropriately equipped. 
 
References 
Jason Andress, Steven Winterfeld, “The Basics of Information Security”, 2nd Edition, Elsevier, 
2014.


key: chroma:document
string_value:
153 
 
• In more secure facilities, we are likely to see all doors locked at all times, and a badge or key 
required to enter the building.  
• Typically, once inside the building, visitors will have limited access to a lobby area, and, 
perhaps, meeting and restrooms, whereas those authorized to enter the rest of the building 
will use a key or badge to access it.


key: chroma:document
string_value:
• Once inside the facility, we will often see a variety of physical access controls, depending on 
the work and processes being carried out.  
• We may see access controls on internal doors or individual floors of the building in order to 
keep visitors or unauthorized people from freely accessing the entire facility.


key: chroma:document
string_value:
• Very often, in the case where computer rooms or data centers are present, access to them will 
be  estricted to those that specifically need to enter them for business reasons.  
• We may also find more complex physical access controls in place in such areas, such as 
biometric systems.  
(d) Environmental Conditions


key: chroma:document
string_value:
• For the equipment within our facilities, maintaining proper environmental conditions can be 
crucial to continued operations. Computing equipment can be very sensitive to changes in 
power, temperature, and humidity, as well as electromagnetic disturbances.  
• Particularly in areas where we have large quantities of equipment, such as we might find in a


key: chroma:document
string_value:
data center, maintaining the proper conditions can be challenging, to say the least When 
facilities that will contain equipment sensitive to such conditions are  constructed, they are 
often equipped with the means to provide emergency electrical power, often in the form of 
generators, as well as systems that can heat, cool, and moderate the humidity, as required.


key: chroma:document
string_value:
• Outside of locations that are so equipped, our equipment will be at considerably greater risk 
of malfunction and damage. Unfortunately, such controls can be prohibitively expensive and 
we may not find smaller facilities appropriately equipped. 
 
References 
Jason Andress, Steven Winterfeld, “The Basics of Information Security”, 2nd Edition, Elsevier, 
2014.


key: full_page_content
string_value:
154 
 
 
SCHOOL OF COMPUTING 
DEPARTMENT OF INFORMATION TECHNOLOGY 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
UNIT – V – Cyber Security – SITA1602


key: full_page_content
string_value:
155 
 
5. Application Security 
 
 
Software Development Vulnerabilities – Buffer Overflow – Race Condition – Web Security – 
Database Security - Tools 
Equally important to ensuring that we can keep attackers from interacting with our networks in an 
unauthorized manner and subverting our operating system security is ensuring that our applications 
are not misused. 
5.1 Software development vulnerabilities  
• A number of common software development vulnerabilities can lead to security issues in our 
applications.  
• These issues are all well known as being problematic from a security perspective, and the 
reasons the development practices that lead to them should not be used are a frequent topic of 
discussion in both the information security and software engineering communities. 
• The main categories of software development vulnerabilities include buffer overflows, race 
conditions, input validation attacks, authentication attacks, authorization attacks, and 
cryptographic attacks.  
• All these vulnerabilities can be avoided with relative ease when developing new software by 
simply not using the particular programming techniques that enable them to exist. 
 
Fig. 1 Main Software Development Vulnerabilities 
5.2 Buffer Overflows 
• Buffer overflows, also referred to as buffer overruns, occur when we do not properly account 
for the size of the data input into our applications.


key: chroma:document
string_value:
155 
 
5. Application Security 
 
 
Software Development Vulnerabilities – Buffer Overflow – Race Condition – Web Security – 
Database Security - Tools 
Equally important to ensuring that we can keep attackers from interacting with our networks in an 
unauthorized manner and subverting our operating system security is ensuring that our applications 
are not misused.


key: chroma:document
string_value:
are not misused. 
5.1 Software development vulnerabilities  
• A number of common software development vulnerabilities can lead to security issues in our 
applications.  
• These issues are all well known as being problematic from a security perspective, and the 
reasons the development practices that lead to them should not be used are a frequent topic of


key: chroma:document
string_value:
discussion in both the information security and software engineering communities. 
• The main categories of software development vulnerabilities include buffer overflows, race 
conditions, input validation attacks, authentication attacks, authorization attacks, and 
cryptographic attacks.


key: chroma:document
string_value:
• All these vulnerabilities can be avoided with relative ease when developing new software by 
simply not using the particular programming techniques that enable them to exist. 
 
Fig. 1 Main Software Development Vulnerabilities 
5.2 Buffer Overflows 
• Buffer overflows, also referred to as buffer overruns, occur when we do not properly account


key: full_page_content
string_value:
156 
 
• If we are taking data into an application, most programming languages will require that we 
specify the amount of data we expect to receive, and set aside storage for that data.  
• If we do not set a limit on the amount of data we take in, called bounds checking, we may 
receive 1,000 characters of input where we had only allocated storage for 50 characters.  
• In this case, the excess 950 characters of data may be written over other areas in memory that 
are in use by other applications, or by the operating system itself.  
• An attacker might use this technique to allow him to tamper with other applications, or to 
cause the operating system to execute his own commands.  
• Proper bounds checking can nullify this type of attack entirely. Depending on the language 
we choose for the development effort, bounds checking may be implemented automatically, 
as is the case with Java and C#. 
5.3 Race Conditions  
• Race conditions occur when multiple processes or multiple threads within a process control 
or share access to a particular resource, and the correct handling of that resource depends on 
the proper ordering or timing of transactions.  
• For example, if we are making a $20 withdrawal from our bank account via an ATM, the 
process might go as follows: 
1. Check the account balance ($100) 2. Withdraw funds ($20) 3. Update the account balance ($80) 
If someone else starts the same process at roughly the same time and tries to make a $30 withdrawal, 
we might end up with a bit of a problem:  
1. User 1: Check the account balance ($100) 2.  
2. User 2: Check the account balance ($100) 
3. 3. User 1: Withdraw funds ($20)  
4. 4. User 2: Withdraw funds ($30) 
5. 5. User 1: Update the account balance ($80) 6. User 2: Update the account balance ($70) 
• Because access to the resource, our bank account, is shared, we end up with a balance of $70 
being recorded, where we should see only $50.  
• In reality, our bank will have implemented measures to keep this from happening, but this 
illustrates the idea of a race condition. Our two users “race” to access the resource, and 
undesirable conditions occur.  
• Race conditions can be very difficult to detect in existing software, as they are hard to 
reproduce.


key: chroma:document
string_value:
156 
 
• If we are taking data into an application, most programming languages will require that we 
specify the amount of data we expect to receive, and set aside storage for that data.  
• If we do not set a limit on the amount of data we take in, called bounds checking, we may 
receive 1,000 characters of input where we had only allocated storage for 50 characters.


key: chroma:document
string_value:
• In this case, the excess 950 characters of data may be written over other areas in memory that 
are in use by other applications, or by the operating system itself.  
• An attacker might use this technique to allow him to tamper with other applications, or to 
cause the operating system to execute his own commands.


key: chroma:document
string_value:
• Proper bounds checking can nullify this type of attack entirely. Depending on the language 
we choose for the development effort, bounds checking may be implemented automatically, 
as is the case with Java and C#. 
5.3 Race Conditions  
• Race conditions occur when multiple processes or multiple threads within a process control


key: chroma:document
string_value:
or share access to a particular resource, and the correct handling of that resource depends on 
the proper ordering or timing of transactions.  
• For example, if we are making a $20 withdrawal from our bank account via an ATM, the 
process might go as follows: 
1. Check the account balance ($100) 2. Withdraw funds ($20) 3. Update the account balance ($80)


key: chroma:document
string_value:
If someone else starts the same process at roughly the same time and tries to make a $30 withdrawal, 
we might end up with a bit of a problem:  
1. User 1: Check the account balance ($100) 2.  
2. User 2: Check the account balance ($100) 
3. 3. User 1: Withdraw funds ($20)  
4. 4. User 2: Withdraw funds ($30)


key: chroma:document
string_value:
5. 5. User 1: Update the account balance ($80) 6. User 2: Update the account balance ($70) 
• Because access to the resource, our bank account, is shared, we end up with a balance of $70 
being recorded, where we should see only $50.  
• In reality, our bank will have implemented measures to keep this from happening, but this


key: chroma:document
string_value:
illustrates the idea of a race condition. Our two users “race” to access the resource, and 
undesirable conditions occur.  
• Race conditions can be very difficult to detect in existing software, as they are hard to 
reproduce.


key: full_page_content
string_value:
157 
 
• When we are developing new applications, careful handling of the way we access resources 
to avoid dependencies on timing can generally avoid such issues.  
5.4 Web security 
Attackers can use an enormous variety of techniques to compromise our machines, steal 
sensitive information, and trick us into carrying out activities without our knowledge. These types of 
attacks divide into two main categories: client-side attacks and server-side attacks. 
5.4.1 Client-Side Attacks 
Client-side attacks take advantage of weaknesses in the software loaded on our clients, or those 
attacks that use social engineering to trick us into going along with the attack. There are a large 
number of such attacks that use the Web as an attack vehicle. 
5.4.1.1 Cross-Site Scripting 
Cross-site scripting (XSS) is an attack carried out by placing code in the form of a scripting 
language into a Web page, or other media, that is interpreted by a client browser, including Adobe 
Flash animation and some types of video files. When another person views the Web page or media, 
he or she executes the code automatically, and the attack is carried out.  
5.4.1.2 Cross-Site Request Forgery 
A cross-site request forgery (XSRF) attack is similar to XSS, in a general sense. In this type 
of attack, the attacker places a link, or links, on a Web page in such a way that they will be 
automatically executed, in order to initiate a particular activity on another Web page or application 
where the user is currently authenticated. For instance, such a link might cause the browser to add 
items to our shopping cart on Amazon, or transfer money from one bank account to another. If we 
are browsing several pages and are still authenticated to the same page the attack is intended for, we 
might execute the attack in the background and never know it.  
5.4.1.3 Clickjacking 
Clickjacking is an attack that takes advantage of the graphical display capabilities of our 
browser to trick us into clicking on something we might not otherwise. Clickjacking attacks work by 
placing another layer over the page, or portions of the page, in order to obscure what we are actually 
clicking. For example, the attacker might hide a button that says “buy now” under another layer with 
a button that says “more information.” 
5.4.1.4 Defense


key: chroma:document
string_value:
157 
 
• When we are developing new applications, careful handling of the way we access resources 
to avoid dependencies on timing can generally avoid such issues.  
5.4 Web security 
Attackers can use an enormous variety of techniques to compromise our machines, steal 
sensitive information, and trick us into carrying out activities without our knowledge. These types of


key: chroma:document
string_value:
attacks divide into two main categories: client-side attacks and server-side attacks. 
5.4.1 Client-Side Attacks 
Client-side attacks take advantage of weaknesses in the software loaded on our clients, or those 
attacks that use social engineering to trick us into going along with the attack. There are a large 
number of such attacks that use the Web as an attack vehicle.


key: chroma:document
string_value:
5.4.1.1 Cross-Site Scripting 
Cross-site scripting (XSS) is an attack carried out by placing code in the form of a scripting 
language into a Web page, or other media, that is interpreted by a client browser, including Adobe 
Flash animation and some types of video files. When another person views the Web page or media,


key: chroma:document
string_value:
he or she executes the code automatically, and the attack is carried out.  
5.4.1.2 Cross-Site Request Forgery 
A cross-site request forgery (XSRF) attack is similar to XSS, in a general sense. In this type 
of attack, the attacker places a link, or links, on a Web page in such a way that they will be


key: chroma:document
string_value:
automatically executed, in order to initiate a particular activity on another Web page or application 
where the user is currently authenticated. For instance, such a link might cause the browser to add 
items to our shopping cart on Amazon, or transfer money from one bank account to another. If we


key: chroma:document
string_value:
are browsing several pages and are still authenticated to the same page the attack is intended for, we 
might execute the attack in the background and never know it.  
5.4.1.3 Clickjacking 
Clickjacking is an attack that takes advantage of the graphical display capabilities of our 
browser to trick us into clicking on something we might not otherwise. Clickjacking attacks work by


key: chroma:document
string_value:
placing another layer over the page, or portions of the page, in order to obscure what we are actually 
clicking. For example, the attacker might hide a button that says “buy now” under another layer with 
a button that says “more information.” 
5.4.1.4 Defense


key: full_page_content
string_value:
158 
 
These types of attacks are, for the most part, thwarted by the newer versions of the common 
browsers, such as Internet Explorer, Firefox, Safari, and Chrome. In many cases, however, new attack 
vectors are simply variations of old attacks. Additionally, there are innumerable vulnerable clients 
running on outdated or unpatched software that are still vulnerable to attacks that are years old. 
5.4.2 Server-Side Attacks 
On the server side of the Web transaction, a number of vulnerabilities may cause us problems 
as well. Such threats and vulnerabilities can vary widely depending on our operating system, Web 
server software, various software versions, scripting languages, and many other factors.  
5.4.2.1 Lack of Input Validation 
SQL injection gives us a strong example of what might happen if we do not properly validate 
the input of our Web applications. Structured Query Language (SQL) is the language we use to 
communicate with many of the common databases on the market today. In the case of databases 
connected to Web applications, entering specially crafted data into the Web forms that interact with 
them can sometimes produce results not anticipated by the application developers.  
5.4.2.2 Improper or Inadequate Permissions 
Inadequate permissions can often cause us problems with Web applications, and Internet-
facing applications of most any kind. Particularly with Web applications and pages, there are often 
sensitive files and directories that will cause security issues if they are exposed to general users. One 
area that might cause us trouble is the exposure of configuration files.  
For example, in many Web applications that make use of a database (that is a vast majority 
of them), there are configuration files that hold the credentials the application uses to access the 
database. If these files and the directories that hold them are not properly secured, an attacker may 
simply read our credentials from the file and access the database as he or she pleases. For applications 
that hold sensitive data, this could be disastrous.  
5.4.2.3 Extraneous Files 
When we move a Web server from development into production, one of the tasks often missed 
in the process is that of cleaning up any files not directly related to running the site or application, or 
that might be artifacts of the development or build process. 
If we leave archives of the source code from which our applications are built, backup copies 
of our files, text files containing our notes or credentials, or any such related files, we may be handing


key: chroma:document
string_value:
158 
 
These types of attacks are, for the most part, thwarted by the newer versions of the common 
browsers, such as Internet Explorer, Firefox, Safari, and Chrome. In many cases, however, new attack 
vectors are simply variations of old attacks. Additionally, there are innumerable vulnerable clients


key: chroma:document
string_value:
running on outdated or unpatched software that are still vulnerable to attacks that are years old. 
5.4.2 Server-Side Attacks 
On the server side of the Web transaction, a number of vulnerabilities may cause us problems 
as well. Such threats and vulnerabilities can vary widely depending on our operating system, Web


key: chroma:document
string_value:
server software, various software versions, scripting languages, and many other factors.  
5.4.2.1 Lack of Input Validation 
SQL injection gives us a strong example of what might happen if we do not properly validate 
the input of our Web applications. Structured Query Language (SQL) is the language we use to


key: chroma:document
string_value:
communicate with many of the common databases on the market today. In the case of databases 
connected to Web applications, entering specially crafted data into the Web forms that interact with 
them can sometimes produce results not anticipated by the application developers.  
5.4.2.2 Improper or Inadequate Permissions


key: chroma:document
string_value:
Inadequate permissions can often cause us problems with Web applications, and Internet-
facing applications of most any kind. Particularly with Web applications and pages, there are often 
sensitive files and directories that will cause security issues if they are exposed to general users. One 
area that might cause us trouble is the exposure of configuration files.


key: chroma:document
string_value:
For example, in many Web applications that make use of a database (that is a vast majority 
of them), there are configuration files that hold the credentials the application uses to access the 
database. If these files and the directories that hold them are not properly secured, an attacker may


key: chroma:document
string_value:
simply read our credentials from the file and access the database as he or she pleases. For applications 
that hold sensitive data, this could be disastrous.  
5.4.2.3 Extraneous Files 
When we move a Web server from development into production, one of the tasks often missed


key: chroma:document
string_value:
in the process is that of cleaning up any files not directly related to running the site or application, or 
that might be artifacts of the development or build process. 
If we leave archives of the source code from which our applications are built, backup copies 
of our files, text files containing our notes or credentials, or any such related files, we may be handing


key: full_page_content
string_value:
159 
 
an attacker exactly the materials he or she needs in order to compromise our system. One of the final 
steps when we are rolling out such a server should be to make sure all such files are cleaned up, or 
moved elsewhere if they are still needed.  
5.5 Database security 
In some cases, applications may hold very sensitive data, such as tax returns, medical data, or 
legal records; or they may contain only the contents of a discussion forum on knitting. In either case, 
the data such applications hold is important to the owners of the application and they would be 
inconvenienced, at the very least, if it were damaged or manipulated in an unauthorized manner. A 
number of issues can cause trouble in ensuring the security of our databases. The canonical list 
includes the following:  
• Unauthenticated flaws in network protocols  
• Authenticated flaws in network protocols 
• Flaws in authentication protocols 
• Unauthenticated access to functionality 
 
Fig 2 Categories of Database Security Issues 
 
• Arbitrary code execution in intrinsic SQL elements 
• Arbitrary code execution in securable SQL elements 
• Privilege escalation via SQL injection 
• Local privilege escalation issues


key: chroma:document
string_value:
159 
 
an attacker exactly the materials he or she needs in order to compromise our system. One of the final 
steps when we are rolling out such a server should be to make sure all such files are cleaned up, or 
moved elsewhere if they are still needed.  
5.5 Database security 
In some cases, applications may hold very sensitive data, such as tax returns, medical data, or


key: chroma:document
string_value:
legal records; or they may contain only the contents of a discussion forum on knitting. In either case, 
the data such applications hold is important to the owners of the application and they would be 
inconvenienced, at the very least, if it were damaged or manipulated in an unauthorized manner. A


key: chroma:document
string_value:
number of issues can cause trouble in ensuring the security of our databases. The canonical list 
includes the following:  
• Unauthenticated flaws in network protocols  
• Authenticated flaws in network protocols 
• Flaws in authentication protocols 
• Unauthenticated access to functionality 
 
Fig 2 Categories of Database Security Issues


key: chroma:document
string_value:
• Arbitrary code execution in intrinsic SQL elements 
• Arbitrary code execution in securable SQL elements 
• Privilege escalation via SQL injection 
• Local privilege escalation issues


key: full_page_content
string_value:
160 
 
5.5.1 Protocol Issues  
 
We might find a number of issues in the protocols in use by any given database. In either case, there 
is often a steady stream of vulnerabilities for most any major database product and version we might 
care to examine. Such vulnerabilities often involve some of the more common software development 
issues. Defending against presently unknown network protocol issues often revolves around limiting 
access to our databases, either in the sense of actually limiting access to who is able to connect to the 
database over the network, using some of the methods or, in the case of authenticated protocol 
problems, by limiting the privileges and accounts make available for the database itself, following 
the principle of least privilege. 
 
5.5.2 Unauthenticated Access  
 
When we give a user or process the opportunity to interact with our database without supplying a set 
of credentials, we create the possibility for security issues. Such issues may be related to simple 
queries to the database through a Web interface, in which we might accidentally expose information 
contained in the database; or we might expose information on the database itself, such as a version 
number, giving an attacker additional material with which to compromise our application. If the user 
or process is forced to send us a set of credentials to begin a transaction, we can monitor, or place 
limits on, what the user or process is allowed to do, based on those credentials.  
 
Generally, these are concentrated on SQL, as it is the most common database language in use. In the 
default SQL language, a number of builtin elements are possible security risks, some of which we 
can control access to and some of which we cannot. In these language elements, we may find a 
number of issues related to bugs in the software we are using, or issues spawned by not using secure 
coding practices, that might allow us to execute arbitrary code within the application. For example, 
a flaw allowing us to conduct a buffer overflow might enable us to insert attack code into the memory 
space used by the database or the operating system, and compromise either or both of them.  
 
5.5.3 Arbitrary Code Execution 
In the default SQL language, a number of builtin elements are possible security risks, ome of which 
we can control access to and some of which we cannot.For example, a flaw allowing us to conduct a 
buffer overflow, as we discussed earlier in this chapter, might enable us to insert attack code into the 
memory space used by the database or the operating system, and compromise either or both of them.


key: chroma:document
string_value:
160 
 
5.5.1 Protocol Issues  
 
We might find a number of issues in the protocols in use by any given database. In either case, there 
is often a steady stream of vulnerabilities for most any major database product and version we might 
care to examine. Such vulnerabilities often involve some of the more common software development


key: chroma:document
string_value:
issues. Defending against presently unknown network protocol issues often revolves around limiting 
access to our databases, either in the sense of actually limiting access to who is able to connect to the 
database over the network, using some of the methods or, in the case of authenticated protocol


key: chroma:document
string_value:
problems, by limiting the privileges and accounts make available for the database itself, following 
the principle of least privilege. 
 
5.5.2 Unauthenticated Access  
 
When we give a user or process the opportunity to interact with our database without supplying a set 
of credentials, we create the possibility for security issues. Such issues may be related to simple


key: chroma:document
string_value:
queries to the database through a Web interface, in which we might accidentally expose information 
contained in the database; or we might expose information on the database itself, such as a version 
number, giving an attacker additional material with which to compromise our application. If the user


key: chroma:document
string_value:
or process is forced to send us a set of credentials to begin a transaction, we can monitor, or place 
limits on, what the user or process is allowed to do, based on those credentials.  
 
Generally, these are concentrated on SQL, as it is the most common database language in use. In the


key: chroma:document
string_value:
default SQL language, a number of builtin elements are possible security risks, some of which we 
can control access to and some of which we cannot. In these language elements, we may find a 
number of issues related to bugs in the software we are using, or issues spawned by not using secure


key: chroma:document
string_value:
coding practices, that might allow us to execute arbitrary code within the application. For example, 
a flaw allowing us to conduct a buffer overflow might enable us to insert attack code into the memory 
space used by the database or the operating system, and compromise either or both of them.  
 
5.5.3 Arbitrary Code Execution


key: chroma:document
string_value:
In the default SQL language, a number of builtin elements are possible security risks, ome of which 
we can control access to and some of which we cannot.For example, a flaw allowing us to conduct a 
buffer overflow, as we discussed earlier in this chapter, might enable us to insert attack code into the


key: full_page_content
string_value:
161 
 
Our best defenses against such attacks are twofold. From the consumer side, we should stay current 
on the version and patch levels for our software. From the vendor side, we should mandate secure 
coding practices, in all cases, in order to eliminate the vulnerabilities in the first place, as well as 
conducting internal reviews to ensure that such practices are actually being followed. 
 
5.5.4 Privilege Escalation 
  
 Privilege escalation is a category of attack in which we make use of any of a number of methods to 
increase the level of access above what we are authorized to have, or have managed to gain on the 
system or application through attack. Privilege escalation is aimed at gaining administrative access 
to the software in order to carry out other attacks without needing to worry about not having the 
access required. SQL injection can be used to gain information from the database in an unauthorized 
manner, modify data contained in the database, and perform many other similar activities. SQL 
injection can also be used to gain or escalate privileges in the database.  
 
5.6 Application security tools 
 
 There are number of tools in an attempt to assess and improve the security of our applications.  
5.6.1 Sniffers 
 
     Sniffers can be of great use in a variety of security situations. We can use them at a very high level 
to examine all the traffic traveling over the portion of the network to which we are attached, 
presuming we can get our sniffer placed properly to see the traffic in question. Such tools can be used 
very specifically in order to watch the network traffic being exchanged with a particular application 
or protocol. In Figure 3, we are using Wireshark to examine Hypertext Transfer Protocol (HTTP) 
traffic specifically.


key: chroma:document
string_value:
161 
 
Our best defenses against such attacks are twofold. From the consumer side, we should stay current 
on the version and patch levels for our software. From the vendor side, we should mandate secure 
coding practices, in all cases, in order to eliminate the vulnerabilities in the first place, as well as


key: chroma:document
string_value:
conducting internal reviews to ensure that such practices are actually being followed. 
 
5.5.4 Privilege Escalation 
  
 Privilege escalation is a category of attack in which we make use of any of a number of methods to 
increase the level of access above what we are authorized to have, or have managed to gain on the


key: chroma:document
string_value:
system or application through attack. Privilege escalation is aimed at gaining administrative access 
to the software in order to carry out other attacks without needing to worry about not having the 
access required. SQL injection can be used to gain information from the database in an unauthorized


key: chroma:document
string_value:
manner, modify data contained in the database, and perform many other similar activities. SQL 
injection can also be used to gain or escalate privileges in the database.  
 
5.6 Application security tools 
 
 There are number of tools in an attempt to assess and improve the security of our applications.  
5.6.1 Sniffers


key: chroma:document
string_value:
5.6.1 Sniffers 
 
     Sniffers can be of great use in a variety of security situations. We can use them at a very high level 
to examine all the traffic traveling over the portion of the network to which we are attached, 
presuming we can get our sniffer placed properly to see the traffic in question. Such tools can be used


key: chroma:document
string_value:
very specifically in order to watch the network traffic being exchanged with a particular application 
or protocol. In Figure 3, we are using Wireshark to examine Hypertext Transfer Protocol (HTTP) 
traffic specifically.


key: full_page_content
string_value:
162 
 
 
Fig 3 Wireshark Examining HTTP Traffic 
A good example of this is the Microsoft Network Monitor tool, which will enable us to not only sniff 
the network traffic but also easily associate the traffic we are seeing with a particular application or 
process running on the system. This allows us to very specifically track information we see on the 
network interface of the system back to a certain process, as shown in Figure 4


key: chroma:document
string_value:
162 
 
 
Fig 3 Wireshark Examining HTTP Traffic 
A good example of this is the Microsoft Network Monitor tool, which will enable us to not only sniff 
the network traffic but also easily associate the traffic we are seeing with a particular application or 
process running on the system. This allows us to very specifically track information we see on the


key: full_page_content
string_value:
163 
 
 
Fig 4 Microsoft Network Monitor Examining Traffic from an application 
 
5.6.2 Web Application Analysis Tools 
 For purposes of analyzing Web pages or Web-based applications, a great number of tools exist, some 
of them commercial and some of them free. Most of these tools perform the same general set of tasks 
and will search for common flaws such as XSS or SQL injection flaws, as well as improperly set 
permissions, extraneous files, outdated software versions, and many more such items. 
 
5.6.2.1 Nikto and Wikto 
 
 Nikto is a free and open source Web server analysis tool that will perform checks for many of the 
common vulnerabilities. Nikto will index all the files and directories it can see on the target Web 
server, a process commonly referred to as spidering, and will then locate and report on any potential 
issues it finds. 
Nikto is a command-line interface tool that runs on Linux. For those of us who are in a Windows-
centric environment, or prefer to use a graphical interface, SensePost has produced a Windows 
version of Nikto called Wikto, as shown in Figure 5. Wikto is very similar in functionality to Nikto 
and provides us with a GUI.


key: chroma:document
string_value:
163 
 
 
Fig 4 Microsoft Network Monitor Examining Traffic from an application 
 
5.6.2 Web Application Analysis Tools 
 For purposes of analyzing Web pages or Web-based applications, a great number of tools exist, some 
of them commercial and some of them free. Most of these tools perform the same general set of tasks


key: chroma:document
string_value:
and will search for common flaws such as XSS or SQL injection flaws, as well as improperly set 
permissions, extraneous files, outdated software versions, and many more such items. 
 
5.6.2.1 Nikto and Wikto 
 
 Nikto is a free and open source Web server analysis tool that will perform checks for many of the


key: chroma:document
string_value:
common vulnerabilities. Nikto will index all the files and directories it can see on the target Web 
server, a process commonly referred to as spidering, and will then locate and report on any potential 
issues it finds. 
Nikto is a command-line interface tool that runs on Linux. For those of us who are in a Windows-


key: chroma:document
string_value:
centric environment, or prefer to use a graphical interface, SensePost has produced a Windows 
version of Nikto called Wikto, as shown in Figure 5. Wikto is very similar in functionality to Nikto 
and provides us with a GUI.


key: full_page_content
string_value:
164 
 
 
Fig 5 Wikto 
 
5.6.2.2 Burp Suite  
Quite a few commercial Web analysis tools are also available, and they vary in price from several 
hundred dollars to many thousands of dollars. Burp Suite is one such tool, tending toward the lower 
end of the cost scale for the professional version but still presenting a solid set of features. Burp Suite 
runs in a GUI interface, as shown in Figure 6, and, in addition to the standard set of features we might 
find in any Web assessment product, includes several more advanced tools for conducting more in-
depth attacks.


key: chroma:document
string_value:
164 
 
 
Fig 5 Wikto 
 
5.6.2.2 Burp Suite  
Quite a few commercial Web analysis tools are also available, and they vary in price from several 
hundred dollars to many thousands of dollars. Burp Suite is one such tool, tending toward the lower 
end of the cost scale for the professional version but still presenting a solid set of features. Burp Suite


key: chroma:document
string_value:
runs in a GUI interface, as shown in Figure 6, and, in addition to the standard set of features we might 
find in any Web assessment product, includes several more advanced tools for conducting more in-
depth attacks.


key: full_page_content
string_value:
165 
 
 
Fig 6 : Burb Suite 
 
Burp Suite is also available in a free version that allows the use of the standard scanning and 
assessment tools but does not include access to the more advanced features 
References 
Jason Andress, Steven Winterfeld, “The Basics of Information Security”, 2nd Edition, Elsevier, 2014.


