Unitec: Advanced Cyber Security

Vulnerability 3: Cross-Site Scripting (XSS): It is one of the most common application layer hacking techniques ("What is cross-site," 2015).

One of the most common is the CGI scripting. CGI scripting works by sending Bash command to the web server i.e. (Apache, *gnix, Webrick... etc.) to generate dynamic content for the user. Dynamic content is when a website appears personalized to the user. A normal Web browser would not allow the user to execute special query in the address bar. So, the attacker can use Bash to interact with website. For instance, the command in Bash called "curl" is a utility that is used to make HTTP request to a give specific URL essentially you are navigating the website without the Graphical User Interface (GUI). So, if the victims have CGI scripting enabled and the shellshock bug is present we know we can get the bash to run arbitrary code. So if the attacker runs this

Specify the red flag(s) that Target overlooked or ignored before the retail attack and give your opinion as to why Target overlooked or ignored the red flag(s).

VAH6500 provides a concise policy which states any individuals that access sensitive information or systems must complete annual security training. Key persons with “significant” roles must attend additional training. All training is monitored for completeness. Policy indicates before employees can use systems security training must be completed.

The framework of security policy is defined to construct a structure by the help of which policy gaps can be identified in an easy manner. A system specific policy would assist to ensure that all employees and management comply with the policies. This is also used to maintain the confidentiality for user authentication would assist in the confidentiality aspect of security, maintain integrity (There are several limiting rules or constraints which are distinct in the relational data model and whose work is to maintain the data’s accuracy and maintain its integrity.), availability and authenticity of the system. Access controls are a collection of mechanisms that work together to create security architecture to protect the assets of an information system. One of the goals of access control is personal accountability, which is the mechanism that proves someone performed a computer activity at a specific point in time. So, the framework acts as the guideline

Global Information Assurance Certification (GIAC) is an information security certification entity that specialises in technical and practical certification as well as new research in the form of its GIAC Gold program. SANS Institute founded the certification entity in 1999 and the term GIAC is trademarked by The Escal Institute of Advanced Technologies.

Cross-site scripting (XSS) is one of the most often found vulnerabilities as well as one of the most dangerous related to web applications.

With another breach hitting the news (Anthem), I often wonder when companies will learn a lesson, a right lesson even. What I found fascinating about the recent Anthem breach, was that it was an employee of Anthem that discovered that something was wrong. Not a firewall, not an intrusion prevention system, not an intrusion detection system, not a web application firewall, or any other of the dozens of technologies I could mention. According to news reports [1], a database administrator noticed queries made with his/her account, that they never made. The employee reported it, and the trickle effect occurred spurring the notification of Anthem being breached. Kudos to the alert employee, and shame on the technology that failed Anthem. That in itself - “shame on the technology” - was not a fair statement but was somewhat meant to get your attention. Did it work?

While working as the Chief Information Security Officer (CISO) at the Army Materiel Command, the command was under constant attack by hackers. The Army’s current network defense system was woefully inadequate for protecting the commands 140 locations worldwide. After sustaining a couple of very high profile attacks using these tools, it became evident that something else was needed. One of the command’s subordinate commands was the Army Research Labs and is on one the foremost research labs in the world. One of the labs mission was Cyber Defense and came under my preview as it program manager. The lab had developed several cyber security tools and had been testing them very successfully on a several platforms. The power of this tool

Simply put, cross-site scripting refers to the malicious injection of scripting code, into a given web server or application, in order to exploit or extract information and/or data, or even modify the contents of the targeted web server or application. Regarding cross-site scripting, cross-site scripting attacks utilize the process of cross-site scripting, and may be classified into two categories: persistent, or stored, and non-persistent, or reflective.

SNC did a descent job when explaining the orientation for the plan of attack. Body langauge and tone of voice indicated that SNC was not sure of how to execute the plan. SNC seemed unsure as to understanding the mission and how to accomplish it. SNC did brief the adminstration and the logistics paragraph, however he failed to develop an initial plan prior to starting exectuion. It wasn't until the fireteam had difficulty in the execution of the mission that SNC decided to step in and develop an initial plan. SNC did not respond in a timely manner which left his Marines confused as to what's going on. SNC got involved after valuable time was wasted. SNC did maintian focus of the assignment, however SNC was too relaxed during the time when his

On October 31, 2010, The United States Cyber Command (USCYBERCOM) achieved Full Operational Capability becoming a sub-unified command under the United States Strategic Command. As a newly formed armed forces command, USCYBERCOM was given the mission for centralizing cyberspace operations, organizing existing cyber resources and synchronizing the defense of military networks. In order to achieve this mission, prior Secretary of Defense, Robert M. Gates, directed the USCYBERCOM to focus on developing cyber capability and capacity via the DoD’s Cyber Strategy. The purpose of this strategy is to guide the development of DoD's cyber forces and strengthen the United States cyber defense and cyber deterrence posture while building cyber capabilities

While having an interview with the head of security we have learned more information about how security at LBCC works. LBCC security has to pay insurance for having security, just in case a security guard would happen to damage poverty or people. SInce this is the case, she believes that LBCC should not have firearms. Their liability would go up and every security guard would have to be trained each year, which costs extra money. The training would have to come from the college and same with equipment. Also, a larger space for the equipment. With containing a firearm as a guard their wages would need to increase. If they were to have firearms and it were to go off while at LBCC insurance will increase. They currently only have 6 full time

Abstract – Software Security is the need of the hour today, especially when we have so many of our day to day activities depending upon computers, internet and software’s. These technologies are of utmost importance even for the most basic activities like banking, trading, shopping, social media and communication, which uses different software tools to provide service to users all around the world. Migrating to this tech world has made it a necessity to provide a high quality of software with equally good security. Systems nowadays like a banking system deals with highly sensitive personal information, so providing software security is as much important as the development of the software. The course project required us to develop a secure banking system which helped us to learn about the various software security tools and the get knowledge regarding the current trends in the field, what can be the possible attack vectors , attack patterns and how to mitigate their effects and defend the system against various such factors.

Cyber Security also called computer security and IT security, is the assurance of data from theft or any harm to the gadget, the product and information stored on hardware. It incorporates controlling physical access to the equipment and additionally ensuring against code or data injection or via network access.