McKINNON - THE FUNDAMENTALS OF COMPUTER SECURITY FOR BEGINNERS: A simple and comprehensive guide to start working in cybersecurity. Ethical Hacking to learn and protect your family and business

THE FUNDAMENTALS OF COMPUTER SECURITY FOR BEGINNERS

A simple and comprehensive guide to start working in cybersecurity. Ethical Hacking to learn and protect your family and business
GUY McKINNON

Copyright 2020 Guy McKinnon
All rights reserved.
DEDICATION
To Jason McGregor, my teacher, mentor, and friend...
CONTENTS

HARDENING OF MOBILE DEVICES .................................................................................. 69
ENCRYPTION ................................................................................................................... 69
STEGANOGRAPHY ........................................................................................................... 74
PKI.................................................................................................................................... 74
LIFE CYCLE OF CERTIFICATES .......................................................................................... 76
DIGITAL SIGN................................................................................................................... 77
SENDER AND RECIPIENT ROLES...................................................................................... 78
OTHER APPLICATIONS .................................................................................................... 78
HARDWARE ENCRYPTION ................................................................................................... 79
VPNS ................................................................................................................................ 80
PHYSICAL SECURITY ........................................................................................................ 82
PRACTICAL EXAMPLES OF PENTESTING AND VULNERABILITY ANALYSIS ....................... 84
INSTALLATION OF OPERATING SYSTEMS .......................................................................... 85
METASPLOITABLE ................................................................................................................ 85
PRELIMINARY STAGE .......................................................................................................... 86
ARMITAGE ........................................................................................................................... 92
OPENVAS ........................................................................................................................... 101
CONCLUSIONS ................................................................................................................... 117

SIGN .................................................................................................................................47
ANOMALIES .....................................................................................................................47
EURISTICA........................................................................................................................48
SDN ..................................................................................................................................48
FALSE POSITIVES AND FALSE NEGATIVES ......................................................................48
SEM AND SIEM ................................................................................................................49
DLP...................................................................................................................................50
LOG MONITORING ..........................................................................................................51
NETWORK LOGGING: SYSLOG ........................................................................................52
ANALYSIS TECHNIQUES...................................................................................................52
VULNERABILITY SCANNER ..............................................................................................53
PENETRATION TEST.........................................................................................................54
ACCESS CONTROL............................................................................................................55
CERTIFICATE ....................................................................................................................56
AUTHENTICATION ...........................................................................................................56
AUTHORIZATION .............................................................................................................58
ACCOUNT MANAGEMENT ..............................................................................................59
SUBNETTING ...................................................................................................................60
THE NAT...........................................................................................................................62
WIRELESS NETWORK VULNERABILITY............................................................................63
WIRELESS NETWORK ENCRYPTION ................................................................................63
WI-FI HARDENING...........................................................................................................65
PATCH MANAGEMENT ...................................................................................................65
HOST HARDENING ..........................................................................................................66
HARDWARE SECURITY ....................................................................................................66
VIRTUALIZATION .................................................................................................................67
CLOUD COMPUTING .......................................................................................................67
DATA PROTECTION .........................................................................................................68
v

vi
INTRODUCTION TO INFORMATION SECURITY

Safety , from the Latin sine cura ("without concern"), is the condition that makes and makes one feel free from danger, or that gives the possibility to prevent, eliminate or make less serious damage, risks, difficulties, unpleasant events and the like. Companies, most of the time, underestimate the security aspect, when it would be enough just a little common sense to devote a small amount of time to staff training to make everyone understand the main issues that concern them; it is necessary to create security policies that are not too complicated for users and to accustom the "distracted" user to have more attention in daily activities. Security can be divided into three distinct types:

1) Physical security

Physical security helps to protect the premises from attempted intrusion through the use of cameras, locks and other security tools; it must also be able to detect intruders and repair damage caused by an intrusion (e.g. copies of data or use of replacement HDDs).

2) Security of operations

This type of security is concerned with protecting data on a daily basis and securing the network, HW and database.
3) Policies
Policies are nothing but guidelines to follow. We distinguish different types of policies that we can subdivide in this way:
A) Administrative Policies
Rules to be followed by those who run the business.
B) Disaster Recovery Plans
Choice of dangerous events.
C) Data policy
Who has access to what.
D) Security policy