My Network Security Secret : Ways to Think like a Hacker!

Posted by Geraldine Hunt on Thu, Apr 16th, 2015

The CBS television show Scorpion introduces us to Walter, who was arrested as a child for hacking into government computers. He is the villain in the series, right? No, not by a long shot. The government now uses Walter’s hacker mindset for good.

The hacker mindset can be cultivated by anyone!

To catch a hacker, it pays to think like a hacker. Many think that the best pen testers (penetration testers) are security consultants that were black hats in the past. But the hacker mindset can be cultivated by anyone. As well as using technology to toughen your organization’s defensive posture, take a step back and look at your network as a whole.

Approach your network as an outsider would.

What are your attack surfaces? In other words, what public face does your network show? Hackers gather information from lots of different sources and then create an overall view of your network. A little data here, a little data there, and it all adds up to real information that can be used to attack you.

Let’s say you have an interview with XYZ Corporation for a 6-figure job. What sources of information would you use? I would guess you’d explore all of the following:

• Web-based information
  • The corporate website
  • Information gathered from using a search engine
  • Social media information
• People-based information
  • Email or call someone you know who works for the company
  • Ask friends, neighbors, and relative what they know about the organization

Hackers approach your network in exactly the same way. This means that you need to consider the following:

• What can outsiders find out about your network simply by performing a whois or other simple command? You might be surprised. Limiting your public footprint is the easiest way to reduce your attack surface. What are your employees sharing on social media?
• What network information does your corporate website reveal? Let’s say that you have a webpage boasting of your “state-of-the-art XYZ 250 servers with Socrates Super software”. A hacker can search the web for exploits pertaining to that specific software and hardware. And exploits are out there, many for free and even more for a price. Applying all updates to your software and firmware decreases your attack surface, but does not eliminate it. A Windows vulnerability has been in the news lately that makes credentials retrievable by attackers. And how long ago was this vulnerability first reported? In 1997! 
• Perform a simple search on your company’s name periodically to see what kind of information turns up. Then use Google hacking tools to find what sensitive data might be available publicly for all to see. This will show you a plethora of documents that the web crawler is indexing, trust me. 
• Be on the lookout for information about your organization on social media. It is not uncommon for employees to innocently divulge information that can lead to network break-ins. Suppose an employee maintains a Facebook page with the names of their spouse, children, and pets, along with a mountain of likes and dislikes. Left to their own devices, most people use such things to construct their online usernames and passwords, making the account vulnerable to a brute-force attack. Your organization’s security policy and practice can help protect against this by requiring passwords to be changed on a regular basis and prescribing password complexity and/or length.
• Hackers use email phishing techniques as well and have been known to avail themselves of Facebook and LinkedIn information to create targeted phishing attacks. Keep your ear to the ground by asking users what types of email they receive. Often users are not aware that they have been phished. 

Policy, procedure, and involving people

Email phishing is an example of social engineering, which can be used for reconnaissance (finding out as much about the target organization as possible) as well as the attack itself. The most successful attackers use social engineering techniques to make network penetration easier. An exquisite account of the variety of social engineering attacks is provided by The Art of Deception: Controlling the Human Element of Security by Kevin D. Mitnick, William L. Simon, and Steve Wozniak.

Leveraging Management Buy in for IT Security

If your organization has a set of policies and procedures for IT services, you are lucky (although you may not always think so).  Just the fact that policies exist proves that management buy-in has occurred at some time. It is a good idea to leverage that management blessing of IT security! Here are some ideas:

• Disseminate a newsletter periodically that describes social engineering attacks, what a phishing email looks like, etc. Include an article on some new tech gadget that grabs users’ attention so they will actually read the newsletter.
• Make sure that new employees are introduced to the policies and procedures personally. If you are in a large organization, schedule a meeting about once a quarter for a slide show and question and answer period. Include information that they can use for their own personal computer security and they’ll pay more attention.

Remember that whenever a user complains about the rules, at least they are not complaining about you.

Once an attacker gets hold…

This is where defense in depth comes in. Secure each device so that the attacker cannot hop from one device to another with utter abandon. Router and switch manufacturers often have canned scripts for lockdown. These disable unneeded services, restrict private and public addresses, and shut down unneeded interfaces. (More on this in another article.)

Those hacker skills come in handy

In some industries companies pay hackers to look and find security weaknesses.  However most companies are understandably reluctant to open their doors to hackers. Instead, why not attempt to think like a hacker and design the most secure network you possibly can.

Changing your worldview can be a real asset when it comes to securing your network. Consider the people in your organization as part of your network and guard against social engineering attacks. Approach each network node as an opportunity for an intruder to penetrate your defenses. When you think like a hacker, your organization will be more secure, and you might even enjoy your job more than ever.

Ultimate System Administrators Toolbox -  For any small to medium-sized business, funding and maintaining an IT infrastructure is always a daunting proposition. The first line of defense for a company is the system administrator, the tireless hero who works 24 X 7 X 365 to ensure that the IT infrastructure is always secure.  The sys admin toolbox below is a one stop shop, full of IT resources that will come in handy if you are ever hit with a security incident or breach.