Week 6 Class Discussion
No unread replies.
No replies.
re-write; For the first post, read this article: Nmap Legal Issues
(Links to an external site.)
What is one way you can mitigate your risk while enumerating?
discussed the myriad ways that Nmap (along with a few other open-source security tools) can be used to slip through firewalls and outsmart intrusion detection systems. Now we look at the situation from the other side of the fence: How technology such as firewalls and IDSs can defend against Nmap. Possible defenses include blocking the probes, restricting information returned, slowing down the Nmap scan, and returning misleading information. The dangers of some defenses are covered as well. Obfuscating your network to the extent that attackers cannot understand what is going on is not a net win if your administrators no longer understand it either. Similarly, defensive software meant to confuse or block port scanners is not beneficial if it opens up more serious vulnerabilities itself. Many of the techniques described herein protect against active probes in general, not just those produced with Nmap.
Proactive scanning provides the opportunity to find and fix vulnerabilities before attackers do. Equally important is closing and blocking unnecessarily available ports to prevent exploitation by vulnerabilities you don’t yet know about. Proactive scanning also makes you better aware of what information attackers can obtain. When you have reviewed the results yourself for weaknesses and are comfortable with your security posture, port scanners become much less threatening. The people who are most paranoid about port scanners and employ the most defensive and detection software are often those who have the least confidence in their network security. I do not want to dissuade anyone from using the techniques described throughout this chapter, but only to suggest that they first seek out and fix any existing network risks and vulnerabilities. Fixing a hole is far more effective than trying to hide it. That approach is also less stressful than constantly worrying that attackers may find the vulnerabilities.
For the second post (re-write),
list one method that a business can use to detect OR stop a malicious port scan.
In the world of information security, port scanning is a vital part. Enterprises, organizations or regular users use port scans to probe systems for open ports and their respective services. If you think of a computer as a hallway of doors, port scanning can be compared with walking through the hallway looking for open doors. Port scanning is part of the “active reconnaissance” phase, a vital part of any penetration test.
PING SCAN
Ping Scans are used to sweep a whole network block or a single target to check to see if the target is alive. It sends an ICMP echo request to the target – if the response is an ICMP reply, then you know the target is alive. However, it is increasingly becoming more common that ICMP pings are being blocked by firewalls and routers that you will likely have to resort to other methods to accurately tell if the target is alive.
Last Completed Projects
| topic title | academic level | Writer | delivered |
|---|