Intrusion Methods

I l @ ve RuBoard

The next step in intrusion detection is understanding the processes used by intruders to attack an information system. There are a number of intrusion methods that are used successfully against information systems. Intrusion methods are either technical or social. These attacks have been performed by both lone individuals and by groups working a well-orchestrated script.

You should take a look at your system from the perspective of an attacker from outside the system. The log files on network equipment, like routers and bridges, can give insight into activities that are unusual. Hackers will often clean up logs on systems but overlook the logs left on network devices.

Intruders tend to follow the path of least resistance, so attacks will be where it is easiest to gather the information or at the sites where information accumulates in order to give a greater return on investment from the attack. Strongly secured systems will be skipped over for easier targets. Intruders will focus on desktop and laptop computers where the security is often lax. They have a tendency to attack file servers and database systems, since these systems contain a greater amount of valuable information.

Malicious attacks on information can be either a social intrusion, when information is gathered from a person, or a technical intrusion, when information is retrieved from a computer. When the goal of the attack is information, the form of information is irrelevant.

Physical Intrusions

Physical intrusions require the attackers to come to the organization to make physical contact. They may gain access as part of a tour, or they might impersonate a delivery person or maintenance person. They might physically remove items or just be gathering information. Dumpster diving, which is pawing through trash and looking for some useful information, is a form of physical intrusion.

Technical Intrusions

Technical intrusions use a technical aspect of the information system to gain access and authorization. They will exploit vulnerabilities in technical systems to gain access to information. Computer hacking is a form of a technical intrusion.

Social Intrusions

Social intrusions utilize people to gather information. There are a number of processes used to get people to reveal information. Today, these processes are collectively called social engineering.

I l @ ve RuBoard