IT Security: Threats and vulnerabilities

The risks associated with information security can be classified into two categories, threats and vulnerabilities. Threats refer to the actions of people and nature that endanger an organization’s information assets and infrastructure. Vulnerabilities are the weaknesses in the assets and infrastructure that are at risk of unintended and unwanted events. Rather than being unrelated, threats and vulnerabilities are two sides of the same coin, threats are the potential actions that will follow the path of least resistance to the greatest vulnerabilities.

THREATS

A security threat is the wilful intention on someone’s part to inflict injury or damage to an individual’s or organization’s networks, computers, software or data. Threats come from people in the organization itself: employees, contractors and visitors. People outside the organization also threaten it. The types of injury or damage that could occur are practically limitless. A few examples include:

Ø  Sabotage of computer hardware or software

Ø  Theft and subsequent disclosure of proprietary or personally sensitive information

Ø  Attacks on information infrastructure to render it unavailable for legitimate uses

Ø  Development and release of a virus or worm intended to cause widespread damage.

VULNERABILITIES

Vulnerability is any weakness in computer or network hardware or software that makes it open to attack or damage. Vulnerability can be the result of an imperfection in design, implementation or configuration. While vulnerability is generally thought of as an oversight, the existence of vulnerability can be the result of a deliberate act. Some examples of vulnerabilities include:

Ø  A flaw in a software program that permits an intruder to cause the program to malfunction, generally with the intention of breaking into the system running the program

Ø  An operating system misconfigurations that permits an ordinary user to switch to privileged mode, which gives the user full administrative control over the system

Ø  A flaw in a business process that permits an employee to log in using a new employee’s account by entering a well-known default/initial password

Ø  A recently installed system with default administrative passwords, permitting anyone with knowledge of the password to gain full access to the system

Ø  Servers in the enterprise that individuals set up on their own that lack anti-virus protection and security patches.

Different Types of Network Address Translation

Three basic types of NAT 

Static mapping 

The network address translation has a pool of public IP addresses configured. Each private address is statically mapped to a specific public address. So computer A always receives the public address x, computer B always receives the public address y, and so on. This is generally used for servers that need to keep the same public address at all times.

Dynamic mapping 

The network address translation has a pool of IP addresses, but instead of statically mapping a public address to a specific private address, it works on a first-come, first-served basis. So if A needs to communicate over the Internet, his system makes a request to the NAT server. The NAT server takes the first IP on the list and maps it to A is private address. The balancing act is to estimate how many computers will most likely need to communicate outside the internal network at one time. This estimate is the number of public addresses the company purchases, instead of purchasing one public address for each computer.

Port Address Translation

Port Address Translation (PAT), is an extension to network address translation (NAT) that permits multiple devices on a local area network (LAN) to be mapped to a single public IP address. The goal of PAT is to conserve IP addresses.

Most home networks use PAT. In such a scenario, the Internet Service Provider (ISP) assigns a single IP address to the home network's router. When Computer X logs on the Internet, the router assigns the client a port number, which is appended to the internal IP address. This, in effect, gives Computer X a unique address. If Computer Z logs on the Internet at the same time, the router assigns it the same local IP address with a different port number. Although both computers are sharing the same public IP address and accessing the Internet at the same time, the router knows exactly which computer to send specific packets to because each computer has a unique internal address.

Port Address Translation is also called porting; port overloading, port-level multiplexed NAT and single address NAT.

Network Address Translation Basics 

Definition: I have one address I would like to share with everyone.

IP addresses have become hardly until the full adoption of IPv6 and expensive. So some smart people came up with network address translation (NAT), which enables a network that does not follow the internet’s addressing scheme to communicate over the internet. Private IP addresses have been reserved for internal LAN address use. These addresses can be used within the boundaries of a company, but they cannot be used on the internet. NAT enables a company to use these private addresses and still be able to communicate transparently with the computer on the internet.

Private IP address ranges

10.0.0.0—10.255.255.255                Class A networks

172.16.0.0—172.31.255.255             Class B networks

192.168.0.0—192.168.255.255        Class C networks

Many firewall vendors have implemented NAT into their products, and it has been found that NAT actually provides a great security benefit. When attackers want to hack a network, they first do what they can to learn all about the network and its topology, services, and addresses. Attackers cannot easily find out a company’s address scheme and its topology when NAT is in place, because NAT act as security guard by standing in front of the network and hiding the true IP scheme.

Network Address Translation (NAT)

The internet is expanding faster than anyone ever imagined.  A computer with communicate with other computers and web servers on the internet; it must have an IP address. An IP address is unique 32 bit number that identifies the location of your computer on a network. 

The total number of IP addresses 4,294,967,296 unique addresses (2³²). The actual number of addresses is smaller. These addresses are separated into classes, and because some addresses are set aside for multicasting, testing or research purpose. With the explosion of the Internet and the increase in home networks and business networks, the number of available IP addresses is simply not enough.

As the amount of information and resources increases, it is becoming a requirement for even the smallest businesses and homes to connect to the Internet. The obvious solution is to redesign the address format to allow for more possible addresses. This is being developed (called IPv6), but will take several years to implement because it requires modification of the entire infrastructure of the Internet. This is where NAT comes to the rescue part. Network Address Translation (NAT) is a method of connecting multiple computers to the Internet using one IP address.