Project Part 2: Vulnerabilities in Information Technology (IT) Security To begin, what’s security vulnerability? Most people think this would be an easy question to answer, but in fact it turns out not to be. This article discusses the definition used by the Microsoft Security Response Center (MSRC) to categorize the variety of issues we examine every day. An unintended flaw in software code or a system that leaves it open to the potential for exploitation in the form of unauthorized access or malicious behavior such as viruses, worms, Trojan horses and other forms of malware.
Also referred to as security exploits, security vulnerabilities can result from software bugs, weak passwords or software that’s already been infected by a computer virus or script code injection, and these security vulnerabilities require patches, or fixes, in order to prevent the potential for compromised integrity by hackers or malware.
Vulnerabilities a. re what information security and information assurance professionals seek to reduce. Cutting down vulnerabilities provides fewer options for malicious users to gain access to secure information. Computer users and network personnel can protect computer systems from vulnerabilities by keeping software security patches up to date. These patches can remedy flaws or security holes that were found in the initial release. Computer and network personnel should also stay informed about current vulnerabilities in the software they use and seek out ways to protect against them.

Charles Coley
IS4560
Project Part 3: Investigate Findings on the Malware When investigating an incident that involves malicious software, it helps to understand the context of the infection before starting to reverse the malware specimen. Some of the ways to accomplish this involves:
Security incident responders benefit from knowing how to reverse-engineer malware, because this process helps in assessing the event's scope, severity, and repercussions. It also assists in containing the incident and in planning recovery steps. Those who perform forensic investigations also benefit from mastering this topic, because they learn how to understand key characteristic of malware present on compromised systems.
How relevant malware has become in the context of computer intrusions! Almost every data breach announced publically, it seems, involves some form of malicious software, such as backdoors, Trojans, network worms, exploits, and so on. In this session, I will introduce you to the approaches for analyzing malware, so you can turn malicious executable inside out to understand their inner-workings. When such an intrusion occurs at your organization, will you be able to quickly assess the threat? Knowing how to analyze malware can help you understand the context of the incident, its severity and repercussions. It can help you plan your response to contain the incident’s scope and, in some cases, understand what entities might be behind the intrusion.

Charles Coley
IS4560:
Project Part 4: Analysis of Intrusion Detection System (IDS) Traffic with inbounds Attacks To begin, Information security is a serious issue especially in present age because a solo attack may cause a big harm in computer and network systems. Several intrusion detection approaches exist to tackle this critical issue but the problem is which one is more suitable in the field of intrusion. Further, these approaches are used in intrusion detection systems. Therefore, in this paper, we evaluated them so that a suitable approach may be advised to intrusion detection systems. This work describes the concepts, tool and methodology being used for evaluation analysis of different intrusion detection approaches using multi-criteria decision making technique. Moreover, conclusion on results is made and direction for future works is presented.

network traffic and data and will identify probes, attacks, exploits and other vulnerabilities. IDSs can respond to the suspicious event in one of several ways, which includes displaying an alert, Intrusion Detection is a major focus of research in the security of computer systems and networks. This paper presents an analysis of Artificial Neural Networks (ANN) being used in the development of effective Intrusion Detection Systems for computer systems and computer networks. The ANNs technologies, which are discussed, are designed to detect instances of the access of computer systems by unauthorized individuals and the misuse of system resources. A review of the foundations of Intrusion Detection Systems and other ANNs, which are the focus of current development efforts, is presented. The results of comparative analysis of different ANNs in Intrusion Detection are discussed. Finally, a discussion of the future ANN technologies, which guarantee to enhance the ability of computer systems to detect intrusions is provided.

Charles Coley
IS4560
Project Part 5: Malware Infection
Malware writers and attackers use a variety of methods, sophisticated techniques and malware vectors to spread their malicious programs. They rely heavily on social engineering in order to infect computers. Spam emails are used by attackers in an attempt to trick the user into opening the email and clicking on links within it or opening a malicious email attachment. Attackers have been known to use exploit packs in order to craft Web pages to exploit vulnerabilities in system and application software and spread the threat in a drive-by downloads.
Keep in mind that the severity of infection will vary from system to system, some causing more damage than others especially when dealing with rootkits. The longer malware remains on a computer, the more opportunity it has to download additional malicious files and/or install malicious extensions for Internet browsers which can worsen the infection so each case should be treated on an individual basis. Severity of system infection will also determine how the disinfection process goes. Rogue security programs are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. They typically use bogus warning messages and alerts to indicate that your computer is infected with spyware or has critical errors as a scare tactic to goad you into downloading a malicious security application to fix it. The alerts can mimic system messages so they appear as if they are generated by the Windows Operating System. It is not unusual for malware writers to use the names of popular and legitimate security programs as part of the name for a fake anti-virus software in order to trick people into using them. There are at least two rogue security programs that use part of or all of the Malwarebytes name. There are also rogues for SmitfraudFixTool, VundoFixTool, Spybot Search and Destroy, Avira AntiVir and many more. Even Microsoft has been targeted by attackers using such names as Microsoft Security Essentials, MS Anti-virus for their programs and incorporating the names Defender, XP, and Vista into naming schemes for other rogue applications.

Charles Coley
IS4560
Project Part 6: Defense Plan to Prevent Attacks

To begin, Install an antivirus program. Installing an antivirus program and keeping it up-to-date can help defend your computer against viruses. Antivirus programs scan for viruses trying to get into your email, operating system, or files. New viruses can appear daily, so check the antivirus manufacturer's website frequently for updates. Some antivirus programs are sold with annual subscriptions that can be renewed as needed, but many are also available for free. Microsoft offers Microsoft Security Essentials, a free antivirus program you can download from the Microsoft Security Essentials website. You can also visit the Windows Security software provider’s webpage to find a third-party antivirus program. Next, don’t open email messages from unfamiliar senders, or email attachments that you don't recognize. Many viruses are attached to email messages and will spread as soon as you open the email attachment. It's best not to open any attachment unless it is something you are expecting. Microsoft‌ Outlook and Windows Mail help block potentially dangerous attachments. Also, Use a firewall.‌ Windows Firewall or any other firewall program can help alert you to suspicious activity if a virus or worm attempts to connect to your computer. It can also block viruses, worms, and hackers from attempting to download potentially harmful programs to your computer. To learn more about Windows Firewall, see Understanding Windows Firewall settings.