ARTICLE SUMMARY

3. Which application is used for Step #2 in the hacking process to perform a vulnerability assessment scan?

* Check existing security scan reports, from WireShark and NetWitness Investigator, and see if we can identify data leakage, and setup new policies and procedures for monitoring web servers and applications.

Our company is looking for security threats inside and outside their network. The best way to see what our network is vulnerable to is to use penetration testing (pen-testing) to find the leaks in and out of our network. Penetration testing is a network security approach that simulates an attack from an intruder trying to get unauthorized access to the infrastructure. With this type of testing the intent is to discover flaws in the security settings of the system before they can be exploited. Information Assurance Research Corporation (IARC) should conduct penetration testing on a regular basis, so we have the ability to locate weaknesses in the hardware and software, check the security controls currently established and determine if the

It is expressed as a dotted decimal number format to make it easier for human beings and the computer to remember.

Penetration testing is the attempt to identify security weaknesses within the IT infrastructure of an

The port scan basically scans the target computer services that use TCP and UDP ports and finds the available open ports. This is harmless as it only scans but it can give away potential information to the attacker and then once the attacker gathers the info, it helps them to plan and launch various attacks. There are different types of port scanning tools available for free such as nmap and SAINT but nmap is the most used tools to scan a network as it hardly needs administrative rights to run the

10. There are four phases of penetration testing, according to NIST. They are planning, discovery, attack, and reporting. In the planning phase, rules are identified, management approval is finalized, and testing goals are set. The discovery phase starts the actual testing. Techniques commonly used in the discovery phase include port scanning, DNS interrogation, whois queries, search of the target organizations web servers, search of the LDAP, packet capture, NetBIOS enumeration, and Banner grabbing. While vulnerability scanners only check that a vulnerability may exist, the attack phase of a penetration test exploits the vulnerability, confirming its existence. The reporting phase occurs simultaneously with the other three phases of the penetration test.

Despite Kenneth argues that hacktivism is morally impermissible due to its moral disvalue by referring that hacker are trying to get away from punishment and negatively affect innocent third party, I believe that non-malicious hacktivism is morally permissible. I will attack her points by arguing if the intellectual property rights is unnecessary, there will not be any legitimate punishments. Then from the utilitirism side, I will discuss the moral value or benefits of hacktivism is over its moral disvalue to the whole society.

Security audit is a measurable technical assessment of a system. Penetration test is a part of security audit. At the end of security audit process, there will be report-generated use for future reference and mitigation plan if

9. Are open ports necessarily a risk? Why or why not? They are a risk because a trojan can be used to transmit data to an attacker. They hold a port open, e.g. Port 31337. The attacker connects to the trojan and sends requests to do a certain task, for example to make a screenshot. The trojan makes the screenshot and sends the image via the port to the attacker. On newer trojans, the port number is quite freely configurable, which makes identifying the trojan by the port number difficult. There are no control mechanisms available which can prevent a trojan from using an specific port. If a trojan does use the port 80, for instance, a novice user could imagine the program is a webserver, and may even simply ignore the port.

CISSP is the ideal credential for those with proven deep technical and managerial competence, skills, experience, and credibility to design, engineer, implement, and manage their overall information security program to protect organizations from growing sophisticated attacks ((ISC)^2, 2016). The test for this certification is $600. A little more expensive than the others, but it is necessary because of the career field. One with this certification can chose a career in Information Technology Auditor, Security Analysis, and an Information Security

It provides modules for testing thousands of known vulnerabilities, is updated when new vulnerabilities are identified, and is one of the most used penetration testing tools used (Rapid7, nd).

Computer hacking: Is the practice of modifying computer hardware and software to accomplish a goal outside of the creator’s original purpose. People who engage in computer hacking activities are often called hackers. Since the word “hack” has long been used to describe someone who is incompetent at his/her profession, some hackers claim this term is offensive and fails to give appropriate recognition to their skills. The majority of hackers are technology buffs. They are self-motivated and learning about computers is their true passion. ("What Is Computer Hacking?" WiseGEEK. N.p., n.d. Web. 27 July 2013).

The ethical issues surrounding hacking, stem from several sources mainly dealing with order and control, and information ownership. What is difficult to decipher from all the media hoopla surrounding the terms, "hacker" and "hacking" is both the simultaneous sensationalism and the condemnation of said activities. Of course just recently, even a movie was made and was appropriately called Hackers. The term and all that it implies has truly entered our popular consciousness when Hollywood has made a box office movie on it. As the advancement of computer technologies and systems of information become increasingly more and more complex in today's fast paced modern world and said technologies become an integral

Hacking is the process of gaining unauthorized access to information through various means like systems or computers. In the context of computer security, a hacker is that person who looks for weakness in a system so that they can gain access to unauthorized information. They are motivated by various reasons like protest, profits or evaluating the entire system weaknesses.