Security Policy

Security Policies are important in companies as it is the scale of how secure the system should be for a system, organization or other entity.In organizations,it determines/shows the authority constraints of the members,it also applies to physical security devices,for example doors,locks and keys.

If there is truly a need for the security,it is fairly obvious that the security policies should be implemented and followed properly.In more complicated systems,these policies are also usually broken down to smaller and simplified sub-policies.Although having sub-policies is not the perfect choice,as it gives others a false sense that it is mentioning about the overall definition of security when it does not.Also,in cases where sub-policies are implemented with no super-policy usually ends up as a useless rule where it is incapable of enforcing anything.

Similarly,top level security policies are needed when there are confidential schemes being carried out,else it would totally meaningless without them.Security Policies are also known to be "living documents" which means that the policy is never completed,and it will keep on changing the contents as the environment changes,for example,the improvement in IT technology,changing of employees,equipment and even at times,their trade secrets.

For example in business industries,security policies are implement to states how the company decides to protect their physical and IT assets.And as the time changes,the main focus of the company will change the employees over the years,improving the technologies used within the company and also they might be changing their method of business approach as their target market changes.

References: http://en.wikipedia.org/wiki/Security_policy
http://searchsecurity.techtarget.com/definition/security-policy  

Common Networking Attacks Threats and Solution

Everyday,everywhere,you will also be able to see IT technology influences,and behind the technology,networking is essential for us to communicate with other everyone living in the world,including those living at the other end of Earth.
But do you know that despite the normal peaceful looking days,there are numerous of networking attacks going on around the world,for example,according to the Department of Homeland Security Official in United States,there are close to 15,000 networking attacks purely on federal sites,which means that there are at least one networking attack on federal sites every 10 seconds!! So at this point,I will be going through some common networking attack and also solutions to them.
Among all the networking attack methods,these seven methods are the most common; Spoofing,Sniffing,Mapping,Hijacking,Trojans,DoS & DDoS (Denial-of-Service & Distributed Denial-of-Service) and Social Engineering. And I will be talking about Spoofing,Trojans,Dos & DDoS. Since these are the most common networking attack threats known to everyone.


1.Spoofing
Spoofing is the process where the attacker modifies a device's protocol to plant a random IP address in the data packet's source address field,this way it will be able to conceal the payload's original source and allows the attacker to avoid being detected.
One countermeasure that is commonly used to prevent spoofing is ingress filtering which usually involves the Routers. During this process,the Routers will check the incoming IP address and determine whether the source address are reachable via the interface or not. If the source is from an unreachable range, the packets will be discarded.


2.Trojans
As most of us knows,Trojans is one of the more common type of networking attack known to everyone. Trojans are programs that appears like usual software in the systems,yet they are used to perform unintended and malicious actions when launched.An infected file will look,function and similar in the file size as the affected file.
The only way to prevent Trojan attacks is to use a crytographic checksum or binary digital signature.


3.DoS&DDoS
Commonly known as Denial-of-Service and Distributed Denial-of-Service. As most of us are aware of the hacking group,Anonymous,which hacked several U.S federal sites last year during the event where the SOPA (Stop Online Piracy Act) and PIPA (Protect IP Act) act were carried out. This hacking group,Anonymous,launched a series of DoS & DDoS attacks on the different U.S federal sites after several file sharing sites were either forced to shut down or being limited in the files they are able to share,for example,megaupload and some other commonly known online video streaming sites.
And thus,from what most of us should know if we have read the news,DoS&DDoS are actually attacks that floods the network with useless traffic so that it will disrupt the computation resources such as bandwidth,disk space and CPU time.The purposes of DoS&DDoS attack are usually to slow down the network's performance,prevents the site to be accessed by any other users.
Sadly,there isn't much ways to prevent DoS&DDoS attacks,however,ingress filtering were commonly used to control  DoS&DDoS attacks to a small extent.


Last but not least,I just hope that everyone reading this post will be able to get a fresh new idea about common networking attacks and also some countermeasures especially for these three common networking attacks.


Reference: http://ayurveda.hubpages.com/hub/Types-of-Network-Attacks