Computer Security Handbook, Fifth Edition

CHAPTER 15

PENETRATING COMPUTER SYSTEMS AND NETWORKS

Chey Cobb, Stephen Cobb, and M. E. Kabay

15.1 MULTIPLE FACTORS INVOLVED IN SYSTEM PENETRATION

15.1.1 System Security: More than a Technical Issue

15.1.2 Organizational Culture

15.1.3 Chapter Organization

15.2 NONTECHNICAL PENETRATION TECHNIQUES

15.2.1 Misrepresentation (Social Engineering)

15.2.2 Incremental Information Leveraging

15.3 TECHNICAL PENETRATION TECHNIQUES

15.3.1 Data Leakage: A Fundamental Problem

15.3.2 Intercepting Communications

15.3.3 Breaching Access Controls

15.3.4 Spying

15.3.5 Penetration Testing, Toolkits, and Techniques

15.3.6 Penetration via Web Sites

15.3.7 Role of Malware and Botnets

15.4 POLITICAL AND LEGAL ISSUES

15.4.1 Exchange of System Penetration Information

15.4.2 Full Disclosure

15.4.3 Sources

15.4.4 Future of Penetration

15.5 SUMMARY

15.6 FURTHER READING

15.7 NOTES

15.1 MULTIPLE FACTORS INVOLVED IN SYSTEM PENETRATION.

Although penetrating computer systems and networks may sound like a technical challenge, most information security professionals are aware that systems security has both technical and nontechnical aspects. Both aspects come into play when people attempt to penetrate systems. Both aspects are addressed in this chapter, which is not a handbook on how to penetrate systems but rather a review of the methods and means by which systems penetrations are accomplished.

15.1.1 System Security: More than a Technical Issue.

The primary nontechnical factor in system security and resistance ...