Network

Attack Surface: How can I reduce the attack surface?

There are various ways to decrease the attack surface. Let’s take a look at some of the more widely used techniques.

The digital side

The easiest target to attack is the digital attack surface. Let’s explore effective strategies to reduce the attack surface.

Less code, less software attack surface

When you reduce the code you’re running in your desktop, server, or cloud instance, you’re reducing the possibilities for entry points to be discovered and later exploited. Turn off, disable, or remove unnecessary software features, and simplify your code. Fewer codes also mean fewer software bugs and vulnerabilities; at the end of the day, that equals fewer security risks overall.

Remove unnecessary OS software and services.

Cleaning the OS includes removing unnecessary functions, applications, and system tools. Do you need a printing service running if you don’t use a printer? What about that MYSQL server running on the 3306 port? Do you need it if you don’t host any databases? And is Adobe Suite required if you don’t work with any PDF files? Install only the strictly necessary applications for your employees’ daily work, and turn off all unused protocols or services. The same advice goes for servers.

Scan your network ports.

Scanning the open ports in your public IP addresses is often the first thing attackers do when performing infosec reconnaissance on any target.

Luckily, there are many ways for you to stay one step ahead of your attackers. And your best bet is to begin auditing your network ports before they do. In our previous article about most scanned ports, we showed a quick way to get famous using the almighty Nmap command.

While using the Nmap top-ports option helps audit your port exposure, this activity can be done using different port scanners such as Unicornscan, Angry IP Scanner, or Netcat.

Analyze your SSL certificates.

People often see SSL certificates as a way to prove a website is secure, but that can be a big mistake.

How hardened are your SSL certificates? Are you keeping your SSL chains complete and well-secured? Are you using strong cipher suites? These are fundamental questions that all developers, system administrators, and technical managers should ask themselves more often. Additional information can be found in our article: Is SSL a real sign of security?

But SSL security doesn’t end up in your hardening, chain, and overall security score. You also need to consider the data you’re exposing to the public.

Have you ever thought about your SSL certificate expiration and validity? Your attack surface includes all your SSL certificates—valid, active, and expired ones.

Of course, the bad guys can explore such public information. So, remember that while SSL certificates are suitable for encrypting your information…not having a thorough audit or control over them can lead to some of your worst nightmares.

Segmentation your network

Keeping all your assets within a single network is often one of the biggest mistakes you can make. Splitting and segmenting your network is one of the easiest ways to reduce your attack surface.

This will help increase your network barriers and, at the same time, help you gain better and more effective server or desktop controls over all machines connected to the network.

Audit your software, network, and traffic.

Auditing your software is one of the oldest known tactics for reducing your attack surface. This will help detect misconfigurations and outdated software, test the security system, and keep users’ activity under control.

Analyzing the network, protocols, OS services, and current and past traffic over the network is a great way to detect factors that could expose your attack surface even more.

Log analysis plays a critical role in reducing your attack surface. Also, running scheduled audits on overlooked services (such as the DNS service) can help keep your exposure under control, as we covered in our previous article: Why should I perform a DNS audit?

The human side

The physical attack surface involves our world, making its most significant component none other than the human being.

As we’ve said before, company staff is often one of the weakest links in the cybersecurity chain of your online business.

Let’s see what can be done to avoid exposing your physical attack surface as much as possible:

Train all your employees to avoid getting tricked by social engineering calls or phishing emails. These are two of the most common ways to sabotage networks, routers, and other physical hardware, most of the time allowed by your human capital.

While nothing can prevent rogue employees from stealing sensitive information about your company (including email or user logins), human resource and hiring departments do have psychological tests in hand for screening applicants. These tests may reveal the true nature (including many unconscious aspects) of the people in line to work with your team.

Teaching your employees correct policies concerning using unknown and unauthorized devices in the office can also help reduce baiting attacks.

There are more social engineering techniques we’ll explore in future posts. Fortunately, they all rely on following company-based security practices and constant employee education.

November 15, 2023 by Brian Cyber Security 0

Attack Surface: What is an attack surface?

Photo by Bernd 📷 Dittrich on Unsplash

What does “attack surface” mean? I see the attack surface as the entire network and software environment exposed to remote or local attacks. For others, it’s the sum of compromised points—although that’s not the attack surface, but the attack vectors.

An attack surface refers to all the ways attackers can exploit your apps. This includes software, operating systems, network services and protocols, domain names, and SSL certificates.

A classic example to help illustrate the concept of attack surface is your business’s physical office. What’s the attack surface of your local office?

The answer is simple: doors, windows, safe boxes, etc. What about your home? Even simpler: front and back doors, windows, garage doors, climbable trees or tables, etc.

The difference between detecting a breach in your home and a violation in your company’s online attack surface can be characterized by the size of the area and its inclusion of multiple complex regions to explore.

You’d clearly notice if someone had broken a window or forced open the door in your home. It’s even easier to have a home alarm system that notifies you immediately.

However, due to the extensive network, software, protocols, and services running within an online company, detecting what part of the attack surface was the origin of the breach or intrusion can be tricky, even with a solid IDS in place, application firewalls, and notification alerts. Most of the time, it may pass unnoticed.

November 7, 2023 by Brian Cyber Security 0

What is Network Security?

Photo by Scott Webb on Unsplash

In this vulnerable world, it’s necessary to take steps for the sake of existence. It could be against anything; whether it is a disease, an accident or maybe even a flaw in the system of existence.

One of the most important parts of a lifestyle is a NETWORK. Everything is done on a network in the upcoming digital world. From viewing to advertising, from purchasing to selling and from learning to teaching. Therefore, it is necessary to secure a network just so all users can keep themselves protected.

Now the first question that comes to our mind is “What is network security?”

Network security is basically a number of steps we walk on or follow in order to protect ourselves from different kind of threats which may include integrity, confidentiality, and availability of our data. These steps can be applied to both hardware equipment as well as software technologies. Effective and sufficient security steps allow secure and efficient access to the network. The main objective of network security is to detect all the flaws and vulnerabilities and patch them up just so a user is provided with a secure connection.

Before following any step, a person always wonders as to why is network security necessary or important?

Apparently, the most important and greatest reason for this is the attacks that a lot of users fall victim to while spending their time on the internet. There’s a huge variety of attacks that are often performed to disrupt a network. Some of the most common attacks that are often performed these days from which we need to protect ourselves are Malware attacks which are often initialized to disrupt, damage or gain unauthorized access to a network or a computer system, Botnets where a number of private computers are infected using corrupted software so that those systems can be controlled altogether without the knowledge of their owners to initiate a new attack, DoS(Denial of Service) where an attacker spams a huge amount of data packet onto a system or a server just to make it lose its connection or to make it overload and break and so much more attacks like such. Sometimes we fall a victim to an entire organization’s attack because of multiple systems and an efficient amount of resources being present there just to initiate an attack regardless of all the efforts needed to be put in for the attack. As in May 2017, a huge amount of systems running the Microsoft operating system were exploited all over the world by a single attack known as “WannaCry ransomware”. This attack encrypted all the data present in target systems and the exploiters demanded ransom payment in the bitcoin currency from the victim user in return for their own data. The attack was estimated to have affected more than 0.2 million computer systems across 150 countries, with a total damage of about millions to billions of dollars.

One thing that we think about is, “What are the harmful events than a hacker can cause which makes us take steps towards network security?”

The most important reason for implementing network security is the destruction an attacker or hacker can cause to you or your system. An attacker can sniff out your every username and password that you use in different accounts, they can disrupt your funding cards like credit or debit card or even use those cards to steal money from you, they can misuse your social security number, they can steal your sensitive data and misuse them, they can steal your identity and impersonate you while committing some serious crime and there’s so much more an attacker/hacker can do to harm you. Being in an advanced world. there a lot of devices that have been invented that makes it efficient for an attacker to harm you one of which is “LAN TURTLE” which can blend in physically with other network devices and can be used to gain remote and unauthorized access to your system by completely bypassing the network firewall and can steal and store any data available, “Bash Bunny” another device that can hijack your network and inject any malware or virus through that network to corrupt or infect your system added to which, this device can also gain access to the shell of your system and steal out any information that the attacker wants. Another device that is known as “LANTAP” is one of the most famous yet notorious devices that is capable enough to tap into your network scan and analyze all the incoming and outgoing data through your network which can be modified or even disrupted in its path and also can be decrypted using various tools if ever encrypted.

All these words conclude up to the fact that network security is quite essential in the trending digital lifestyle just so we’re able to use the internet at its full extent without facing any negatives that could lead us to a great loss.

March 15, 2022 by Brian Network Security 0