Viruses and worms are nothing new; they have been around since the dawn of the computer era. What has changed through the years is the way in which viruses infect systems. There are three broad categories of propagation:

Note

Many antivirus programs work by means of file signature. File signature programs examine boot sectors, files, and sections of program code that are known to be vulnerable to viral programs. Although the programs are efficient, they are only as good as their last update. They must be updated regularly to detect the most recent type of computer viruses.

Worms, unlike viruses, require no interaction on the user's part to replicate and spread. One of the first worms to be released on the Internet was the RTM worm. It was developed by Robert Morris back in 1998 and was meant to be only a proof of concept. Its accidental release brought home the fact that these types of code can do massive damage to the Internet.

Today these are the biggest changes to viruses and worms:

Buffer overflow attacks are used by individuals to gain access to systems or to elevate their privilege. Buffer overflows occur when programmers use unsecured functions or don't enforce limits on buffers. Basically, the programmer is not practicing good coding techniques. If an attacker can find this vulnerable code, he can attempt to inject and run his malicious code on that system. If the original code executed with administrator or root rights, those privileges are granted to the attacker. The end result is that, many times, the attacker will gain a command prompt on the system under attack. When this occurs, the attacker has complete control.

DoS attacks are usually intended to disable or disrupt computer services or resources. Although this sometimes can be accidental, it is most often a deliberate act. DoS attacks are sometimes used in a final act of desperation when an attacker cannot gain access to a system. DoS is also occasionally used in blackmail attempts: “Meet my demands or I will shut down your network.” Because specific DoS attacks have been discussed in other chapters, only the names of common attacks are provided in the following list:

One step above the DoS attack is the DDoS attack. DDoS is similar to DoS, in that the goal of the attack is a disruption of service. However, it is more powerful, in that it uses a large number of previously compromised systems to direct a coordinated attack against the target. These systems, known as zombies, wait until the attacker signals the attack. A DDoS attack can be devastating because of the tremendous amount of traffic generated. DDoS attack tools include these:

Application developers should never assume that users will input the correct data. A user who is bent on malicious activity will attempt to stretch the protocol or application in an attempt to find possible vulnerabilities. An example is an order quantity field on a web page that accepts negative values. Buyers typically don't order negative quantities of an item. Attackers think outside the box, and so should programmers when developing applications. Parameter problems are best solved by implementing pre-validation and post-validation control.

Databases are a common target of malformed input. An attacker can attempt to insert database or SQL commands to disrupt the normal operation of the database. This could cause the database to become unstable and leak information. This type of attack is known as SQL injection. The attacker searches for web pages in which to insert SQL commands. Attackers use logic such as 1 = 1-- or a single quote, such as ' to test the database for vulnerabilities. Responses such as the one shown in the following code give the attacker the feedback needed to know that the database is vulnerable to attack.

Microsoft OLE DB Provider for ODBC Drivers error '80040e07'
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting
the nvarchar value 'sa_login' to a column of data type int.
/index.asp, line 5

Although knowing the syntax and response used for a database attack is not required exam knowledge, it is useful to know as you attempt to secure your infrastructure. Other security issues that can be tied directly to input validation include these:

All of these issues can be addressed by performing proper input validation.

Many of us have dealt with programs such as adware, browser hijackers, surveillance programs, or web bugs. Although spyware programs are nothing new, they continue to grow in virulence and sophistication. There is some debate as to whether these programs are aggressive marketing gone too far or a real invasion of privacy.

Spyware programs are typically installed when the user downloads a free piece of software that contains spyware in the installation package. Vendors justify these programs by declaring that spyware programs allow them to offer their products for free and that if users do not want to install the spyware, they can refrain from installing their programs by opting to purchase a for-pay copy that doesn't include the spyware.

Other spyware programs are less up front about giving you an option to install and might be loaded onto your computer by just visiting a website with a browser that is vulnerable. Spyware programs have become rather advanced. Some have incorporated concepts such as Alternate Data Streams (ADS). This hacker technique allows the spyware distributor to stream one file behind another. A quick search of the drive will find no trace of the offending executable because there is no entry in the File Allocation Table (FAT), where the directory listing of all files is kept. Removing these programs requires one or more specialized tools, such as HijackThis. Other defenses against spyware include changing to an alternate browser, staying current on your patch management, and not downloading or installing adware-supported programs.

Many times back-door programs are used to access and control a computer. These programs are associated with Trojans and other malicious code that can be used to trick the user into installing them. Once installed, these programs operate on high-order or unused ports to communicate with the attacker. Many of the programs give the attacker complete control of the victim's computer and allow him or her to execute programs, access the Registry, turn on the camera and mic, control the browser, and start and stop applications. Common back-door programs include these:

Trapdoors, unlike back doors, are used by programmers as a secret entry point into a program. These can be used to allow someone to gain functionality to the program without going through the usual security procedures. Programmers find these useful during application development; however, they should be removed before the code is finalized.

One of the ways in which malicious code can be detected is through the use of change-detection software. This software can detect changes to system and configuration files. Most of these programs work by storing a hashing algorithm of the original file in a database. Periodically, the file is rechecked and the hashed values are compared. If the two values do not match, the program can trigger an alert to signal that there might have been a compromise.

Checksums and hashed values are widely used. Most software vendors list the fingerprints of their programs on their websites because this give customers a way to ensure they have the authentic file. Popular programs that perform this function include Tripwire and MD5sum.

This step of the process usually includes a meeting with everyone who is involved with the project. This is a good opportunity to make sure everyone gets a chance to meet and that everyone understands the goals of the project. A plan must be developed to map the process and develop deadlines and submission dates.

A sensitivity assessment should also be conducted. This should help identify the type of information that will be processed and its level of sensitivity. Discussions should be held to determine the level of risk involved in handling this data and to establish the results from its accidental exposure. These items must be completed before the system design specifications are locked in.

In this step, the system is designed, developed, programmed, and acquired. Programmers work to develop the application code. Security should be the focus here, as the programmers work to ensure that input and output controls, audit mechanisms, and file-protection schemes are used. Examples of input controls include dollar counts, transaction counts, error detection, and correction. Example output controls include validity checking and authorizing controls. It's important that programmers don't assume that systems are always installed and operated in trusted environments.

This step occurs when the application coding is complete. The acceptance testing and implementation should not be performed by the programmers. Testing should be performed by a different group of individuals. These tasks are usually assigned to auditors or quality assurance engineers. The important concept here is separation of duties. If the code is built and verified by the same individuals, errors can be missed and security functions can be bypassed.

When the issues and concerns have been worked out between the QA engineers and the programmers, the application is ready for deployment.

At this step, the application is prepared for release into its intended environment. Certification and accreditation are the final steps involved in accepting the application and agreeing that it is ready for use.

Note

Certification is a technical evaluation and analysis of the security features and safeguards of a system, to establish the extent to which the security requirements are satisfied and vendor claims are verified.

Note

Accreditation is the formal process of management's official approval of the certification, that the application or system operates as specified in the environment it was designed to be used in.

This step of the process is reached when the application or system is no longer needed. Those involved in this step of the process must consider the disposal of the application, archiving of any information or data that might be needed in the future, disk sanitization (to ensure confidentiality), and the disposal of equipment. This is an important step that is sometimes overlooked.

Probably the most well-known software-development process is the waterfall model. This model operates as the name suggests: Developers are limited to going back only one stage; therefore, the process flows logically from one stage to the next. An advantage of this method is that it provides a sense of order and is easily documented. The primary disadvantage is that it does not work large and complex projects.

This model was developed in 1988 by Barry Boehm. Each phase of the spiral model starts with a design goal and ends with the client review. The client can be either internal or external, and is responsible for reviewing the progress. Analysis and engineering efforts are applied at each phase of the project. An advantage of the spiral model is that it takes risk much more seriously. Each phase a of the project contains its own risk assessment. Each time a risk assessment is performed, estimated costs to complete and schedules are revised and then a decision is made to continue or cancel the project. The disadvantage of this method is that it is much slower and takes longer to complete.

JAD is a process that was developed at IBM in 1977. Its purpose is to accelerate the design of information technology solutions. An advantage of JAD is that it helps developers work effectively with users to develop applications that work. A disadvantage is that it requires users, expert developers, and technical experts to work closely together throughout the entire process. Projects that are good candidates for JAD include some of the following characteristics:

RAD is a fast application-development process that was created to deliver fast results. RAD is not suitable for all projects. An advantage of RAD is that it works well for projects that are on strict time limits and must be developed quickly. However, this can also be a disadvantage if the quick decisions lead to poor design and product. That is why you won't see RAD used for things such as shuttle launches or other highly critical systems. Two of the most popular RAD systems for Microsoft Windows are Delphi and Visual Basic.

CASE enhances the software development life cycle by using software tools and automation to perform systematic analysis, design, development, and implementation of software products. Its advantage is that it is useful for large, complex projects that involve multiple software components and a lot of people. Its disadvantages include that it requires building and maintaining software tools, and training developers to understand how to use the tools effectively. CASE can be used for tasks such as these:

Note

Prototyping is the process of building a proof-of-concept model that can be used to test various aspects of a design and verify its marketability. Prototyping is widely used during the development process.

Object-oriented programming (OOP) is a modular form of programming that supports object technology. It allows pieces of software to be reused and interchanged between programs. This method of programming has been widely embraced because it is more efficient and results in lower programming costs. Because it makes use of modules, a programmer can easily modify an existing program. New modules can be inserted into the program that inherit features from existing objects. Objects that share a particular structure and behavior are said to belong to a particular class. Code from one class can be passed down to another through the process of inheritance. Java and C++ are two examples of OOP languages.

Common Object Request Broker Architecture (CORBA) is vendor-independent middleware. Its purpose is to tie together different vendor products so they can seamlessly work together over distributed networks. The heart of the CORBA system is the Object Request Broker (ORB). The ORB simplifies the process of a client requesting server objects. The ORB finds the object; transparently activates it, if necessary; and then delivers the requested object back to the client.

Transaction management is a big concern because locking mechanisms are needed to ensure that only one user at a time can alter data and that transactions are valid and complete. Programmers involved in database management talk about the ACID test when discussing whether a database-management system has been properly designed to handle transactions.

If you are not familiar with the world of databases, you might not be familiar with some other terms. These are listed here:

A data warehouse is a database that contains data from many different databases. These warehouses have been combined, integrated, and structured so that they can be used to provide trend analysis and make business decisions. Data warehousing is used to get a strategic view.

Data mining is the process of analyzing data to find and understand patterns and relationships about the data. The result of data mining is metadata, or data about data. The patterns discovered in this data can help companies understand their competitors and understand usage patterns of their customers to carry out targeted marketing. Data mining is used to get a tactical view. As an example, a store might discover that digital camera buyers also purchase blank CDs, so by moving blank CDs to the camera department, they experience higher sales.

Knowledge management seeks to make use of all the knowledge of the organization. It attempts to tie together databases, document management, business processes, and information systems. It is used to interpret the data derived from these systems and automate the knowledge extraction. This knowledge-discovery process takes the form of data mining, in which patterns are discovered through artificial intelligence techniques. These are the three main approaches to knowledge extraction: