1. Submitted by
Samin Sabeeh
CT-006

2. Cyber security combines people, processes,
and technology to continually monitor
vulnerabilities and involves protecting the
information by preventing, detecting, and
responding to attacks.
Cyber Security is a highly technical, specialized
field.

3. Cyber crime is an evil having its origin in the
growing dependence on computers in modern life
.
93% of electronic records breached were in the
financial services industry.
90% of breaches were tied to organized crime.

4. NETWORK
HOST
APPLICATION

5. Network
Sniffing
Spoofing
Session Hijacking
Denial of services
Host
Viruses, Trojan
horses, and worms
Password cracking
Unauthorized
access
Application
Input validation
Authentication
Authorization
Exception
management

6. NETWORK LEVEL THREAT

7. Sniffing or eavesdropping is
the act of monitoring traffic on
the network for data such as
plaintext passwords or
configuration information.

8. Countermeasures:
• Use strong physical security and proper
segmenting of the network.
• Use firewalls
• Encrypt communication fully. This prevents
sniffed packets from being usable to an
attacker. SSL and IPSec (Internet Protocol
Security) are examples of encryption
solutions.

9. Spoofing is a means to hide
one's true identity on the
network. To create a spoofed
identity, an attacker uses a
fake source address that does
not represent the actual
address of the packet.

10. Countermeasures:
• Filter incoming packets that appear to come
from an internal IP address at your perimeter.
• Filter outgoing packets that appear to
originate from an invalid local IP address.

11. Also known as man in the
middle attacks, session
hijacking deceives a server or
a client into accepting the
upstream host as the actual
legitimate host.

12. Countermeasures:
• Use encrypted session negotiation.
• Use encrypted communication channels.
• Stay informed of platform patches to fix
TCP/IP vulnerabilities.

13. Denial of service denies
legitimate users access to
a server or services.

14. Countermeasures:
• Apply the latest service packs.
• Harden the TCP/IP stack by applying settings
to increase the size of the TCP connection
queue.
• Use a network Intrusion Detection System
(IDS) because these can automatically detect
and respond to attacks.

15. HOST LEVEL THREAT

16. A virus is a program that is designed to perform malicious
acts and cause disruption to your operating system or
applications.
A Trojan horse resembles a virus except that the malicious
code is contained inside what appears to be a harmless data
file or executable program.
A worm is similar to a Trojan horse except that it self-
replicates from one server to another.

17. Countermeasures:
• Stay current with the latest operating system
service packs and software patches.
• Block all unnecessary ports at the firewall and
host.
• Disable unused functionality including
protocols and services.
• Harden weak, default configuration settings.

18. When an attacker wants to
establish an authenticated
connection only he/she
has to crack the account's
password.

19. Countermeasures:
• Use strong passwords for all account types.
• Apply lockout policies to end-user accounts to
limit the number of retry attempts that can be
used to guess the password.
• Do not use default account names, and
rename standard accounts such as the
administrator's account and the anonymous
Internet user account used by many Web
applications.

20. Inadequate access controls
could allow an unauthorized
user to access restricted
information or perform
restricted operations.

21. Countermeasures:
• Configure secure Web permissions.
• Lock down files and folders with restricted
NTFS permissions.
• Use .NET Framework access control
mechanisms within your ASP.NET
applications, including URL authorization and
principal permission demands.

22. APPLICATION LEVEL
THREAT

23. Input validation is a security issue if an
attacker discovers that your application
makes unfounded assumptions about
the type, length, format, or range of
input data. The attacker can then
supply carefully crafted input that
compromises your application.

24. Example of susceptible threats
• Buffer overflows
• Cross-site scripting

25. Buffer Overflow
• A buffer overflow occurs when a program or process
tries to store more data in a buffer (temporary data
storage area) than it is intended to hold. Since
buffers are created to contain a limited amount of
data; the extra information can overflow into
adjacent buffers, corrupting or overwriting the valid
data held in them.
Countermeasure
• A stack cannot be altered when a function returns.
The mechanism of Buffer overflow protect will check
this problem.
• Use software like StackGuard. It supports and
checks for immediate corruption of a canary during
buffer overflow.

26. Cross site Scripting
• Cross Site Scripting is a process that can occur anywhere
a web application uses input from a malicious user to
generate output without validating or encoding the input.
Countermeasure
• Validate the users input against what is expected
• Encode user supplied output
• After you believe you’ve done the right things during code
development, inspect your code with a scan.

27. Financial crimes
Intellectual Property crimes
Cyber Stalking
Data diddling
Defamatory emails

31. http://static.usenix.org/event/leet08/tech/ful
l_papers/burstein/burstein.pdf
www.wikipedia.com.pk
www.scribd.com/doc/105994475/a2z-of-
cyber-crime