5

.7

1

. 10

1.1. .10

1.2. . 12

1.3. 13

1.4. . 18

1.5. . .22

1.6. . ..............26

1.7. .27

1.8. .35

1.9. ......36

1.10. .37

2

.39

2.1. ..39

2.2. .46

2.3. .47

2.4. . VPN...50

2.4.1. ....51

2.4.2. VPN ..52

2.4.3. VPN .56

2.4.4. VPN .57

2.4.5. VPN ...58

3

..60

3.1. . .60

3.2. ...62

3.3. 66

3.4. 67

3.4.1. ...68

3.4.2. ...80

3.5. ........86

3.6. (Rootkits)..89

3.7. ..90

3.8. ..93

3.9. ..101

3.9.1. 102

3.9.2. , ' 104

3.9.3. 109

3.9.4. 111

3.10. .112

4

- 115

4.1. - .115

4.2. 116

4.3. 118

4.4. 119

4.5. 120

4.7. 121

4.8. 122

4.9. 123

5

.125

5.1. ...125

5.2. ..127

6

131

6.1. .131

6.2. 132

6.3. .134

.....136

..137

ANNOTATION.138

139

Internet. . . Internet . .

. Internet, script kiddes . .

2 1988 , - . , . 96 .

3 1994 Citibank , 11 .

30 1999 NASA. , , . 1,7 .

2002 , , , . 97 .

20 2004 Microsoft Windows 2000, .

, . . .

, /. / , .

. . :

1. . .

2. .

3. .

- .

- .

.

.

, .

. XVII - : .

. XVII - : .

1

.

, . , , , , , .

, . . , , .

1.1

- , , .

- , , .

' , . , .

' ' , , ', . , IPSEC, IPv6.

' , . : - .

. , .

, .

' , - .

1.2 .

- ' , , .

:

1. , .

2. . , .

3. : ( ), ( , , ) ( , , , .

4. ( , , ) .

:

1. . 5-10 .

2. , -.

3. , .

4. , .

5. , ', . ' (, , ).

6. .

7. . ( ) (' ) .

8. ', .

9. - , .

1.3

:

() , :

, ;

, .

, ( ) . .

, . :

( ), ;

( ', ). .

(, , , ); ( ), .

. , ; , . :

( , );

, (, ), .

. , .

. , .

. , ; ; . , , .

. , ' () , , .

, :

(. 1.1);

(. 1.2); , 1.3, 1.4;

( ) ' ;

( ) .

. 1.1.

. 1.2.

.1.3

. 1.4.

1.4 .

, 1.5. - . ' - , 1.6. ( 1.5 ' - , (. 1.6)). :

( , ( , , , , );

/ , , ( ); (, ) ;

. , ;

(, ).

.

. 1.5.

. 1.6.

1.5 , , ( - '). , . , , , ( ), , , :

( , );

, (, ) ;

( ) ( , ).

1.5 .

:

();

;

.

. : ' ' , ' . , . .

:

, ;

;

;

.

, () '.

:

;

';

';

, / ;

.

:

;

;

;

/ ;

(, );

' '.

- .

, ' . , , , , , .

, .

, , , . , , , () .

. :

1. :

;

;

' .

2. :

;

;

.

3. :

;

.

:

( , , );

( , );

( , );

( , - , );

( , );

( , );

( , );

( , , , );

( );

( ');

( , , ..), ( ) ;

.

1.6 .

() ' . : ; (, ) ; , ; () , ; ; ; . -, , . . . , , , , - , ' - , , . , .

, , , . . , ' [1]. , , .

. . , . , . , .

, , . , , . '.

1.7

, , , , :

1. (The Common Criteria for Information Technology Security Evaluation / ISO 15408).

2. (Code of practice for Information Security Management / ISO 17799).

,

ISO15408: Common Criteria for Information Technology Security Evaluation

- ISO 15408: Common Criteria for Information Technology Security Evaluation ( ), 1999 .

( ) (security functional requirements) (security assurance requirements).

, () , () .

- , , ' .

, , . , .

() .

.

, , , . .

1. , , .

, , , , , , ( - , ).

2. :

- ;

- , ;

- ;

() - , - , ;

- , ' ';

- , ;

- , '.

3. (254/96-), , , - , ' , , , ' , , . { 3 , N333/2008 (333/2008) 11.04.2008}

4. ' ( - ' ) , . { 4 , N333/2008 (333/2008) 11.04.2008}

5. , , .

6. - , , , , , - , .

- ' ' .

7. , - , , ' , , .

8. ' :

' ; { 8 , N333/2008 (333/2008) 11.04.2008} , ;

- - ' , , ' ; { 8 N333/2008 (333/2008) 11.04.2008}

, , -, ;

, .

{ 9 N 333/2008 (333/2008) 11.04.2008}

{ 10 N 1120/2000 (1120/2000) 06.10.2000}

11. , , :

- ;

- ;

.

12. , , :

, , ;

' - ;

' , , -, - - , - - ,

;

' , , ;

, ;

' .

{ 12 , N333/2008 (333/2008) 11.04.2008}

13. ' :

', ' , ;

;

, , ;

.

14. ' , , , , , ' , .

15. - .

, - , , ' . { 15 , N 333/2008 (333/2008) 11.04.2008}

{ 15 , N333/2008 (333/2008) 11.04.2008}

16. - , ', , , , , , ', , , .

' . .

.

{ 16 , N 333/2008 (333/2008) 11.04.2008}

17. , ' .

{ 17 , N 333/2008 (333/2008) 11.04.2008}

18. , - ', .

. ', , .

19. - .

20. , , , , , , , , , .

' , .

', , ' .

{ 20 , N333/2008 (333/2008) 11.04.2008}

21. , , , , , .

.

22. .

1.8

- , . . , .

:

;

, ' ;

, - , ;

, - , , DNS , ;

;

;

.

, . . . .

1.9

, ' , :

1. ' .

2. (-, , , , , ) () (, , , ).

3. ' .

4. , ( ), ' , ( ) .

5. ' .

6. ( ), ' , , .

7. ' , .

8. ' .

9. ' .

10. , , ' , .

11. , ( , ' ) .

12. ' ( , ' ) , ( , , ).

13. ' , ).

14. ' ' , .

1.10

, :

( ) ;

;

;

, , , (NAT);

;

;

.

, , . :

;

.

- ' . ' . , . , .

' . , . , . .

2

2.1

() (-) (), , / . firewall (. ). (. brand - , mauer - ) ', . ' .

. , (. 2.1). , .

. 2.1.

, , :

, ;

, .

. (, OSI), . , - , , (. 2.2).

' . , .

. 2.2.

, (OSI):

(2 OSI);

(3 4 OSI);

(5 OSI);

(7 OSI);

(3-7 OSI).

. , 2- OSI, (stealth), , . ' . , (frame, ). :

, .

. , . , .

. 2 OSI. , IP - . , . IP- . , ? , , . 2.3.

. 2.3. S

. Packet-filtering firewall ( ) - , ', , , . , TCP- IP- ( , .)

3 ;

, ;

( /, /);

, ( ), ;

20- ;

: (ACL, access control lists) .

. Circuit-level gateway ( ) - , . , , ' . , . ' (NAT, network address translation). , . IP- ' IP-, . , , , . IP- IP-, .

4 ;

TCP , ;

, , ;

;

: SOCKS .

. Application-level gateways ( ) , , OSI. ' - , TCP/IP.

:

' ;

, , ;

;

, .

' (Proxy).

- HTTP- , FTP- .. TCP/IP , . , , , -, ' . , , , . -, ' , -, S.

:

7 ;

;

, ;

;

: Web (http) proxy.

. Stateful inspection firewall - , OSI: , . , .

3 ;

4 ;

5 ;

, ;

: CheckPoint Firewall.

, , .

. , , . , , .

:

- ;

- .

, . .

' ( ) , , , . , ', .

2.2

;

;

.

, . WWW-, FTP-, , . WWW-. 2.4.

. 2.4.

.

, WWW-, . , WWW- FTP-. 2.5.

. 2.5.

.

. , ( 2.6). (DMZ, demilitarized zone).

. 2.6.

2.3

, ( , ), (IDS, ), [3].

. , , . , IDS. :

;

, (false positives and false negatives);

100 / ;

, ' ;

, ;

, .

, , :

1 . ( );

2 . ( );

3 . ;

4 . .

, ' , . , , , , , , .

2.7. , , . , . , , , .

. 2.7.

, , . ( , ), , .

, ( ), .

2.4 . VPN

' Internet, intranet, extranet [4].

' Internet . '. , . Internet . .

90- VPN (Virtual Private Networks).

VPN ' ' , .

:

;

, .

' :

;

() ;

.

' . .

' , , . . ', , ', .

2.4.1

', . ', , .

, , . . () , . IP, - , , , NetBEUI. IP, . - .

, . ' . , , - . , , .

, . , , .

2.4.2 VPN

() (secure channel). , (, OSI) (. 2.1).

2.1

OSI VPN , . OSI VPN:

VPN () ;

VPN () ;

VPN ' () .

VPN OSI. , , . - .

( ), , (IP IPX, Ethernet ATM) , . , , .

, . -, . , S/MIME . .

OSI ' .

VPN

VPN, OSI, ( ) - ( ' ). VPN-, L2F (Layer 2 Forwarding) (Point-to-Point Tunneling Protocol), L2TP (Layer 2 Tunneling Protocol), Cisco Systems Microsoft.

. IP, , IPX, DECnet NetBEUI.

L2TP ( Windows). , , , .

VPN

VPN- IP IP. SKIP, IPSec, , IP -.

IPSec . , , , , IP.

IPSec ' , , .

IPSec L2TP; , . IPSec , .

IPSec, (IKE) . .

VPN

VPN (circuit proxy). Internet . ( IP '--, .)

, TLS.

IETF SOCKS, SOCKS v.5 .

SOCKS v.5 ' ( ) , (proxy). - ' . , , - , . , , , .

2.4.3 VPN

:

- VPN ;

- VPN;

- VPN.

VPN (Remote Access) / (home-office) .

VPN (intranet-VPN) , ' ', .

VPN (extranet-VPN) , , , , ..

Extranet - VPN , ', . .

2.4.4 VPN

VPN:

VPN ;

VPN ;

VPN ;

VPN ;

VPN .

VPN

VPN Windows NT. VPN Microsoft , Windows NT. , Windows . VPN, Windows NT, , PDC (Primary Domain Controller). PAP, CHAP MS CHAP. Point-to-Point Encryption 40- , '.

, .

- .

VPN

VPN . , , , .

VPN

. .

, . ', .

VPN

VPN . , ' proxy-. ' .

VPN

VPN , . .

2.4.5 VPN

VPN , ' '. ' , (), Internet.

, , , , . ' . ', (, Internet), , , , . , . VPN . , , . , , VPN, , .

3

3.1 .

, , , , . 70-80% (. 3.1).

. 3.1.

, , , . , . , , . , , , 20% , 5% . .

' ' . . , (hacker) ' , - ' . (white-hats), , . (cracker), kid-hacker, spy . [5]. (intruder), , [6]. :

Outsiders (. , ) - , ( - , ..) , . , , ' (, , ..).

Insiders (. , ) - , , . , , (, ). , Outsiders. , . , , - , , , . , , , - ' , , ..

[7].

. 2001 Commerce One, , , ( ) . , , . 2002 .

3 , [8].

, . . ( ), . , .

3.2

.

70-90 % - , , . , . , , .

, . , . , . . . , , , [9].

- . . . : ' .

, Gartner Group , 85% , [10]. Gartner 2005 50%, . , , , , . , , , , .

:

;

;

, ;

, ' ;

, ;

"" "", , ;

, . , 3- . , . 4-, , , . ISS, - , . 3- , .

, , , , , . . , , , .

, , . , , , .

[11]:

1. :

;

.

2. :

;

;

;

.

3. :

;

.

4. :

;

';

;

;

;

;

- ;

- .

5. :

;

;

.

.

, . , : - , , .

3.3

, . , , .

. , , 5- . (switch) (hub). ' ' . , , . . . ( ) IP-, , (VLAN) . 2000 , . , , . () Windows 95, 98, NT4 Workstation, 2000, XP ( 90 % Windows ). Windows NT4 Server/Terminal Server Edition, 2000 Server, 2003 Server. () : 1, MS Outlook, MS Office 97/2000/XP : 1, MS SQL Server, MS Exchange.

: Agnitum Outpost Firewall, Kerio Personal Firewall, Kaspersky Anti-Hacker, Norton Personal Firewall; Black ICE, Snort, RealSecure.

3.4

' , . ' . , , . , . '.

. . , . 3.2.

. 3.2.

3.4.1

' (sniffing) . (promiscuous) . , , , . , . , ', . ' "A" ' "B", ' "" . , , . - ARP Spoofing (ARP poisoning), MAC Flooding MAC Duplicating [12].

ARP-Spoofing (man-in-the-middle).

ARP. ARP (Address Resolution Protocol) ' MAC- IP - . Ethernet, MAC- . ARP. , ' , MAC- ARP-. , MAC-, IP- . , IP- IP-, (ARP-reply), MAC-. MAC- ARP-, . MAC-.

, ARP . ARP-reply :

, , IP- MAC- ;

, , IP- MAC- .

ARP, reply-, ARP - . , , , ARP- IP- MAC- . ARP-poisoning ( ARP-). , -- --.

:

ARP , ARP-spoofing (VLAN);

ARP-, ;

, , - .

. 3.3. ARP-spoofing

, Port-Security ( ), MAC- MAC-.

MAC-duplicating MAC-, MAC- , . , . , .

MAC-flooding . ARP- IP-, ' . .

, ARP-Spoofing MAC-duplicating, - , .

- . , . , Microsoft Network Monitor Windows, '. , , Sniffer Pro NAI, IRIS Network Traffic Analyzer eEYE TCP Dump. Cain&Abel 2.5 Massimiliano Montoro, . , , . , , , NGSSniff NGSS Inc., , Windows Sockets.

, . , . , . - -TCP/IP, ARP, HTTP, FTP, SMTP, POP3 .. 5-10 , . . IPv4 IPv6, IPSec . . .

. , POP3, SMTP IMAP, , - (, ' ) , . , POP3 [13] . (. 3.4).

, , , . - , . . , - .

. 3.4. Cain & Abel, .

. Microsoft Exchange Windows NT/2000, , ' , Windows NT. , , , . , ' , .

, , . Windows 2000/XP/Server (file and printer sharing), NetBIOS, ' ( ). , . ', ' , , ' , '.

- . Windows, NetBIOS, .

FTP-, . FTP [14].

Web- . (, SSL), HTTP ' . Telnet SNMPv1.

, mail.ru, hotbox.com .. web- , Microsoft Outlook The Bat. , ' , - , , ' . , , . , InfoSecurity 2003. 152 password 12%. ' -16%. (11%) (8%). InfoSecurity 2003 , : , , .

, (IM-) - ICQ, Windows Messenger, AOL . (IM, instant messaging) - , , . , . , IM- , . . ', , , ' , , . , IM . Ferris Research, 70 % ICQ IM- , . . , , , . IM- . , , ICQ IM- ( ). - - ICQ- ICQ sniff (. 3.5)

. 3.5. IM- - ICQ- ICQ Sniff

, .

, , , . , MS Windows, : LAN Manager, NTLM v.1, NTLM v.2, Kerberos. Windows Microsoft . LAN Manager, NTLM v.1, NTLM v.2. [15]. Windows 2000 Microsoft - Kerberos v.5, . , Windows [16], [17]. , Windows, .

, , , , . , ( 3.6). , , .

. 3.6.

, . : ( ) (table precomputation).

. , , , . , , . , (. 3.7).

. 3.7. User0

, . 1980 Matrin Hellman. - Philippe Oechslin Time-Memory Trade-Off ( ') [18]. RainbowCrack [19].

- . , 7 , , LAN Manager, 3- ' Celeron 666 MHz. ' 610 . , - , , 10 . , .

. , , , 7 , 7, 5 Celeron 666 MHz 119 Gb. , .

. 3.8. Winrtgen 1.1 -

3.4.2

- , . . , , . , , , ', , , , .

, , . , , . , ' , , . , . Internet Security Scanner (ISS) (. 3.9). , , , . ISS , .

. 3.9.

, , , , , , -, . ', , .

:

, (overflow based attacks);

, -- (Denial-Of-Service attacks);

.

, , , . ' .

, Microsoft Internet Information Services (IIS) 4.0 5.0. . ISAPI .IDA . ' Code Red -, :http://www.example.com/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a

, 224 N default.ida . (inject) .

-- ' , . , .

Ping Of Death. : ICMP (64KB). Windows 95/98 .

, . , - CGI-. , , , -.

, .

"exploit" , . - "". ( - . , ). , exploit, PoC ( . Proof of Concept , ). - , . , , PoC.

, , . . , , . , , . , - , ' . , , Microsoft Windows Server 2003 14 , 6 [20]. , Microsoft , , , . .

, , . , , . , , , . , . .

KaHt2, , MS Windows. -- (Denial-Of-Service, DoS) (Remote Procedure Call, RPC). MS Windows NT/2000/XP/2003 [13]. KaHt2, RPC, , - ( . 3.10).

( 0,1 .) 135- , RPC, BLACK TCP - HOST1. RPC HOST1 , 33815.

, .. (shell rootshell), - (, net user add), (. 3.11).

. 3.10. RPC (135- ) BLACK HOST1

. 3.11. Windows XP SP1 kaHt2 .

.

. , () '. :

. , ;

, Rootkits;

;

' - , ;

' . , ;

. ;

.

3.5

(Trojans) - , ' . ( ) : (server) (client). , , , ' . ' TCP UDP. , , , (. 3.12), ' , , . , Windows . , IP- . (DHCP), IP-, IP- . '- , ICQ IRC.

:

(remote access). , '-.

. , Outlook , ICQ .. , . .

(keyloggers). , . .

. . '- .

DoS-. - DoS-. , , '- .

. 3.12. Back Orifice 2000 ' 1031 Windows Explorer.

, , - , , , ' .

:

;

web- web-;

.

3.6 (Rootkits)

, . Windows, Linux, Rootkits, .

, AFX Windows Rootkit 2003 (), Windows 9x/NT/2000/XP/2003 , , , , . , , ', , , netstat.

3.13 3.14.

. 3.13. AFX Windows Rootkit 2003 , notepad.

. 3.14. Notepad, Task Manager, .

. :

, , ;

: , .

. , - , , MyDoom, - Word, Excel, Access .. , 70-90% , . . ( 3.1).

3.1

(%)

75

69

62

49

47

33

18

13

12

9

9

7

2

. ' ' - IM-. 2002 ' 5 IM-, 2004 Bizex - ICQ. IM-' Bizex. ' ICQ-, , , -. "Joecartoon". Java-, , ICQ, ' - . , . , IM- . , IM- , .

3.7

, . , . , ' . , , , , . , . ' 1 / / (, GPRS), . , , ' , '. , , , , - . , , . , , .

3.8 .

, ' - . - , ARP, DNS [14].

(Ping method) , ICMP Echo request (Ping ) MAC- , IP-. .

1. , , , IP- 10.1.1.1 MAC- 00-40-05-A4-79-32.

2. ' , '.

3. ICMP Echo request, IP- MAC-, , 00-40-05-A4-79-33.

4. , , MAC- MAC-. MAC-, ICMP Echo Reply, . , .

5. - , MAC-,

, , , TCP-' UDP 7 ().

ARP (ARP method) , ARP Windows Linux. Windows .

1. , () c IP- 192.168.86.19 . ARP-, Ethernet- FF:FF:FF:FF:FF:FF, ' MAC- (), , , IP- ARP-. 3.2 ARP-.

3.2

ARP-

Ethernet- -

FF:FF:FF:FF:FF:FF

Ethernet- -

MAC-

(ARP=0806)

08 06

(Ethernet = 01)

00 01

-

MAC-

IP- -

IP-

-

00 00 00 00 00 00

IP- -

IP- ()

3.15 ARP- Sniffer Pro.

.3.15. ARP- Sniffer Pro ' MAC- IP- 192.168.86.19

, , ARP-.

2. , ARP-, FF:FF:FF:FF:FF:FF FF:FF:FF:FF:FF:FE ( , ). , . , Windows 2000/XP/2003 , , , . (A), , IP- IP-, ARP-reply. , (A) , . 3.16 3.17, Sniffer Pro:

. 3.16. ARP- FF:FF:FF:FF:FF:FE.

. 3.17. () ARP- ARP-, , .

ARP- Windows Linux, .

, . , . , , . L0pth Antisniff, Cain & Abel PMD:

L0pht Antisniff , 1998 , ( beta), . Windows 9x/NT Windows 2000/XP, .

Cain & Abel, , ARP- (. 3.18).

PMD (Promiscuous Mode Detector) Anti Sniff Toolbox, Roberto Larcher. ARP. - IRIS Network Analyzer, Sniffer Pro, TCP Dump, , , .

. 3.18. IP- 192.168.86.19 ARP- B31 (FF:FF:FF:FF:FF:FE).

, ARP-spoofing, MAC-duplicating MAC-flooding. , .

MAC-flooding - - , . . Port Security, MAC . MAC- , ' . MAC-Flooding MAC-Duplicating, ARP-Spoofing.

ARP-Spoofing. , , , ARP. ARP-spoofing . ACiD (ARP Change Intrusion Detector) Anti Sniff Toolbox, Roberto Larcher, , ARP- (. 3.19).

. 3.19. ARP-Spoofing AciD

ARP-Spoofing ARP, . Linux Arp_antidote, ARP , . . ARP-reply MAC-, . ARP-, IP- MAC-. ARP-Spoofing "" , IP-, , , , . MAC- ' , , , "" MAC-, , . ("") : "ARP_ANTIDOTE: Possible MITM attempt!" ARP-, , . Windows .

ARP- . Windows 9x/NT/2000/XP/2003 ARP , ARP .

, ISS RealSecure, ARP- IP-.

, , . . . 3- OSI, IPSec. - POP3, SMTP, FTP .. Windows Windows 2000. , Windows NT4/9x/ME .

IPSec , , , . . , POP3S SMTPS (POP3, SMTP over SSL) . HTTP - HTTPS, FTP -FTPS, IMAP - IMAPS , .

, . , .

, Cain, . Cain . , , , , , , . , . , ' . , , , . .

3.9

, , , . , .

[26]. , , , , ' - , , .

, . . (plug-in) , . , . , Nmap , :

- . ;

, , IP- . , , .

, .

3.9.1

, , , . , . , , , . 3.20 Black ICE 3.5 KaHt2.

. 3.20. Black ICE DoS-, , DCOM RPC Buffer Overflow, .

, (. 3.21).

. 3.21. Agnitum Outpost PRO , , MS04-007-dos Microsoft Windows ASN.1

, , RPC, .

3.9.2 , '

, (). ( Tauscan Agnitum), , , , (. 3.22).

. 3.22. Symantec Antivirus Server 8.1 kaHt2 Back Orifice 2000

. - , , , (. 3.23).

. 3.23. Agnitum Outpost , explorer.exe ( Back Orifice) ' 192.168.105.75

, , , , :

1. '. 1024, , . Windows netstat-an (. 3.24).

2. , , ( shell ), SYSTEM. SYSTEM , (. 3.25). , CMD.EXE Windows Task Manager Windows ( , Windows ).

, , , SYSTEM, , (. 3.26).

. 3.24. , kaHT2 39720 ' ( established).

. 3.25. , , , SYSTEM, MS Windows .

. 3.26. , , Users .

3.9.3

, . , , Rootkit Hunter (Linux/Unix) Patchfinder (Windows) (. 3.27).

. ( ) , . , AFX Windows Rootkit 2003, Troyan.Win32.Madtol.a ' (. 3.28). , ', / , .

.3.27. Patchfinder rootkit

HackerDefender Windows, .

. 3.28. AFX Windows Rootkit 2003

3.9.4

- - , -. , . ', '. , '. , '. - - (BIOS), , . BIOS - , , Secret Net, Spectr-M. , Secret Net 2000. ' .

' : , '. , ' , . ' . () . ', . . Secret Net. '. . . ', , , .

3.10

' . --. , , , , . ( .) . , . , , , , . . , - . Symantec Enterprise Security Manager, Tivoli IT Director.

, .

. - honeypots ( ), ' . - , , .

KFSensor NFR Back Officer Friendly (BOF) (. 3.29). , FTP-, POP3-, SMTP-, TELNET-, HTTP-, SQL- , BackOrifice. - . . KFSensor .

. 3.29 NFR BackOfficer Friendly, TELNET-, (IP- 192.168.105.75)

. , .

4

-

, . .

4.1 -

, .

, .

:

1. .

2. .

3. .

4. .

5. .

6. .

.

.

4.1.

4.1

/

()

, .

1.

.

7

2.

22

3.

5

4.

.

14

5.

.

50

6.

.

17

115

4.2

, , , , .

, - , . .

, .

, , . , , . , .

24,5 /., 196 ./. ( 8 .).

. : 4,5...8,0 ./., 3,0...5,0 ./., 3,5...5,5 ./., 3,0...4,5 ./., 2,0...3,5 ./.

:

. = ,(4.1)

, .;

.

,

. = 5 115 = 575 .

1015 % .

. = . .,(4.2)

, 0,10,15 ( 0,15).

= 575 0,15 = 86,25 .

(..) :

.. = . + .(4.3)

.. = 575 + 86,25 = 661,25 .

, :

1. 1,3 %;

2. 2,9 %;

3. 32,3 %.

37,5 %.

, :

.. = 0,375 ,(4.4)

, .

.. = 661,25 0,375 = 236,07 .

4.2.

4.2

/

, .

, .

. , .

, .

6=3+4+5

, .

. .

. /., .

1

2

3

4

5

6

1.

5

115

575

86,25

236,07

897,32

4.3

:

= qi pi ,(4.5)

: qi ;

.

, :

.. = .(4.6)

4.3.

4.3

.

., .

., .

-- - , .

., .

1

2

3

4

5

6

7

1.

Internet

100

100

100

:

100

4.4

1 :

= W T S ,(4.7)

W , ;

T ;

S - .

- (0,203 . + 20% 1 ). , 1 0,2436 .

550 , 3.1 115 .

,

= 0,55 115 0,2436 = 15,41 .

4.5

. , .

.

:

,(4.8)

, .;

, .;

, %.

. 60 % ( 15 %).

. 7900 . , :

A = 7900 5% / 100% = 395 .

115 , :

= 395 115 / 115 = 395 .

4.6

, .

- , 2060 % .

= .. 0,20,6 ,(4.9)

.

, :

= 661,25 0,2 = 132,25 .

4.7

4.4.

4.4

, .

%

1

2

( )

575

39,6

236,07

16,2

100

6,8

15,41

1,1

395

27,2

4.4

132,25

9,1

1453,73

100

() :

= .. + .. + .. + + + . (4.10)

, :

= 575 + 236,07 + 100 + 15,41 + 395 + 32,25 = 1453,73 .

4.8

:

,(4.11)

. , 30 %;

, . ( );

.. , . ( );

, (20 %).

, , . , .

, :

.(4.12)

:

= 1453,73 (1 + 0,3) (1 + 0,2) = 2267,82 .

4.9

, .

() :

,(4.13)

;

.

() :

= .(4.14)

:

= 2267,82 1453,73 = 814,09 .

, :

.(4.15)

,

= 814,09 / 1453,73 = 0,56 .

():

,(4.16)

:

= 1 / 0,56 = 1,8

:

- - ( 4.5).

, 0,56, .

, 1 3 , . 1,8 .

4.5

/

1.

, .

1453,73

2.

, ..

814,09

3.

, .

2267,82

4.

0,56

5.

,

1,8

, , - .

5

5.1

. , . - " ", ., ., 56.

: , , , , , , . :

6,0 . , ' 20,0 . ;

II-4-79 3.3.2-007-98;

, () 1,5%;

;

, 3223-85, 3044-84, 2411-81, 12.1.003-83;

, 2.04.05-91. , , 4088-86, 2152-80, 12.1.005-88, 12.1.007-76;

- 0,7 - 0,8, 0,5 - 0,6;

0,3 - 0,5. , , ;

;

, 40.1-1.01-97, ;

' , , , ;

' ;

' , 3-6 ' ;

.

() - (), - () ().

.

- - , , " " (. 45, 46, 49).

- . . , .

5.2

. , , .

.

() , .

12 . . 1711 805 , 6 . , 176 . 623 . .

, , .

, 100% . , 10-12%. . .

,(l2) . ' . , .

- - , 2,5 . , . 32. . , , - . , , , : , . : ; ; ; ; ; ; ; .

. -5, -6 . , . 2%- , . 1%- . . .

(H2S) , . - . . , , .

, . , , , , , . .

, 15 2%- .

: ; ; .

. , , ' , . , .

- , . : , , . , , . , , , , , .

; ( ) , . , . , .

. . (, , ) , () , , .

, . .

6

6.1

, , , - .

, , : - - . , , , .

, , . , : , , , .

. .

, () - , : .

' (). , , , , , , , .

. , , , .

, . . 5 / 0,1 . 400 - 735 , 10 / . 50 10 / 3 , 100 / - 10 .

6.2 .

- . ' - , ', , . ' : , , , . - , ', ' ' , ' , , , . ..

, , . . ' (), , , , , ( ), () , . , . , , . .

, , , , , , , , , . ( , ).

- . , , , , , , .

, , , , . .

- , , , . ( ) , , (), . , . () ; , , , .

6.3 .

- , . - , , , ' . .

, .

Ibas, 2012 , 70% . , , , . , , 72% , , . , , , , , 85% (), 15% : 5% - - , , , ; 5% - , 50% 50%; 5% - , , . , - ' . , , 5% , , . , . , , .

:

;

;

.

.. .

.

.

- .

.

2013

2013

: , , sniffer, .

.141 , . - 45 , .. - 8 , . 9, 28 .

ANNOTATION

A. Polishchuk Research methods and tools for information security in corporate networks.

The aim is to study threats to modern information secure corporate networks.

The object of study is the methods and means of protection of corporate networks.

The object of study - safety secure corporate networks.

This work can be applied to a decision support system for information security in networks.

Thesis release year 2013

Defense of the thesis year 2013

Key words: network security, corporate network, sniffer, protection of corporate networks.

Explanatory note consists of pages - 141, figures - 45 , tables - 8, placards.

9.

1. . . / . . , 2010.

2. .. / .. - Hackzone, 2009.

3. . . IDS / . : [ ]. : URL : http://www.globaltrust.ru/security/Pubs/Pub2_part5. - .

4. . . . / . . , . . . - ., 2012. 656.

5. Hacker Dictionary [Electronic Resource]. Mode of access : URL : http://www.robergraham.com/hacker-dictionary. - .

6. Deborah Russell. Computer Security Basics, OReilly & Associates / Deborah Russell, G. T. Gangemi. CA, 2011.

7. .. / .. - : , 2010.

8. . / . : , 2005. ( ).

9. [ ]. : URL : http://www.globaltrust.ru/security/knowbase/Policies/Guide_Struct. - .

10. ? [ ]. : URL : http://www.iitrust.ru/articles/zat_ibezop. - .

11. .. / .. - : -, 2003.

12. Whalen, Sean. An Introduction to ARP Spoofing / Whalen, Sean. 2001.

13. RFC 1734 POP3 Authentication command [Electronic Resource]. Mode of access : URL : http://www.faqs.org/rfcs/rfc1734. - .

14. RFC 959 File Transfer Protocol [Electronic Resource]. Mode of access : URL : http://www.faqs.org/rfcs/rfc959. - .

15. Cracking NTLMv2 Authentication [Electronic Resource]. Mode of access : URL : http://www.securityfriday.com. - .

16. Kimmo Kasslin Antti Tikkanen Attacks on Kerberos V in a Windows 2000 Environment [Electronic Resource]. Mode of access : URL : www.hut.fi/~autikkan/kerberos/docs/phase1/pdf/LATEST_final_report. - .

17. Frank O'Dwyer Feasibility of attacking Windows 2000 Kerberos Passwords [Electronic Resource]. Mode of access : URL : http://www.brd.ie. - .

18. [Electronic Resource]. Mode of access : URL : http://lasecwww.epfl.ch/php_code/publications/search.php?ref=Oech03. - .

19. [Electronic Resource]. Mode of access : URL : http://www.antsight.com/zsl/rainbowcrack. - .

20. Microsoft [ ]. Mode of access : URL : Internet URL http://www.izone.kiev.ua . - .

21. [Electronic Resource]. Mode of access : URL : http://www.microsoft.com/technet/security/bulletin/ms03-026.mspx. - .

22. Daiji Sanai Detection of Promiscuous Nodes Using ARP Packets [Electronic Resource]. Mode of access : URL : http://securityfriday.com. - .

23. SANS Bulletin Why your switched network isn't secure [Electronic Resource]. Mode of access : URL : http://www.sans.org. - .

24. Tom King Packet Sniffing In a Switched Environment [Electronic Resource]. Mode of access : URL : http://www.sans.org. - .

25. arp_antidote - arpoison [ ]. : URL : http://www.securitylab.ru/33493. - .

26. IP Smart Spoofing - ARP [ ]. : URL : http://www.securitylab.ru/34607 - .

27. . Window / : [ ]. : URL : http://www.securitylab.ru/29827 - .

28. . . / [ ]. : URL : http://www.securitylab.ru/40572.html - .

%

100

=

(

)

(

)

C

B

+

+

+

=

1

1

.

.

(

)

(

)

C

B

+

+

=

1

1

B

=

=

1

=