Effective security policy

Writing effective security policy

Many organisations have security policies, these policies are designed to manage the company’s resources and help in keeping authorised users and resources secure and free from abuse. In the following series of articles we will cover how the security policy can be used as viable tool, and how the policy can be written to help with current challenges. 

On many occasions when consulting on information security, I ask the question; what does your security policy say? I normally get the dear in the headlights look. Well we do not really have one, or the one we have we got off the web, can you help us fix it up? I like to refer to the security policy as, whilst consulting, it is important to point the organisation to technical controls that they have already agreed on and the users have sight of. 

A recommendation is that the policy is written to be aligned and consistent with business goals and that IT governance objectives are achieved. Another key component is that policy can not stand alone, there will need to be supporting documentation that refers to guideline and procedural documents. This document will define the expected user behaviour so it needs to be written clearly and without ambiguous meaning. The intention of the policy is not to be counter productive but to influence user behaviour, so that a moderated outcome can be observed.

The Challenge

Most security policies that are written do not have teeth, this means that if the policy is breached no disciplinary action can be sought. This is primarily due to lack of management support and because the policy is not signed off as part of the terms and conditions of employment enforcement is challenging. Both senior management and HR involvement buy in is vital in keeping the living document enforced.

Writing an enforceable policy is also important, as many policies are difficult to understand and are left to interpretation. The key is to write a policy that has a good foundation, which is clear, enforceable and easy to read. This administrative control is often written in an unrealistic manner encompassing ideals and not really addressing the challenges of all business units. 

Already the user would have read multiple documents; highlighting different areas of the business, an effective policy can be concise and meaningful. The lifecycle of this document is between three to five years and the document needs to be reviewed on a yearly basis to ensure consistency and alignment with the business strategy. 

The challenge is that few security professionals have skill in this area and often the document is copied from a source that refers to ideals, this is done in order to fill in a compliance gap. Although some of the best practices are covered, you will find when it comes to implementing the technical controls little attention to realistic goals and practicality has been considered.

Authority

The policy should have the full buy in from senior management or business ownership, without this support the document will not be enforceable and will only be another piece of paper. Clear cause and effect (consequences) should be documented so that all are aware of the repercussions of not following the guideline. 

Adding requirements without approval will result in departments needing budgets for technical controls. Technical controls cost money and thus management approval of the policy is crucial.

Framework: 

Know that you will keep adding to the policy as time goes on, as the business goals change the adoption of the policy needs to be considered and the user behaviour will change. Ensuring that the flock is going to be led out of harms way is our primary concern, but, protecting the company’s information assets is critical. 

Keep your companies budget in mind, this also allows for the organisation to plan on the technical controls that will be implemented and in the stages that the technical controls are implemented. If the policy advises behavioural requirements and there are no technical controls to enforce the policy user avoid policy enforcement.

Do not try to mitigate all eventualities, this a clear guide that is to be read as an overview or what should or should not be done. You may find that more detail is needed. (Rather than confusing the issue refer to an appendix and document the detail there.) 

A comprehensive security policy will require the involvement of all business units, carefully co-ordinating this policy will result in less risk exposure. Similarly mergers with other organisations may expose yours as now new uncharted waters are included. 

Always apply the rule of least privilege. This will ensure that the smallest attack surface area is exposed, the lower the exposure the lower the risk. 

Note the guidelines, and note the mandatory parts of the policy. If this is not clear then users may feel that parts are optional when in fact they are not. Colour coding this or italicising the optional components might be useful. 

Some policies may have portions that exclude certain users; these exclusions should be in the appendix and not in the body of the document as it could be confused.

Optional:
Compartmentalise the policy so different parts of the policy apply to different departments, in a more restrictive manner. Although this highly complicates the policy, a general policy may be too loose and increase the exposure. For this reason it might be best to append more detail to each department and inform the line managers only, HR can help in keeping track of the policy elements. Different departments will have different security postures; this is why this approach may work for your organisation. 

Make the elements of the policy achievable, if they are unrealistic then the whole policy could be ignored, or taken less seriously by the users.

The policy should enforce legal and compliance regulations, this reinforces the elements and gives the document a more authoritative focus; using references to these writings will be useful so that users can refer to the legal documentation.

Conclusion

In this article we covered important factors that need to be considered when writing an effective security policy. At the end of this series, a security professional should be able to collate the information and write their own security policy. Professional help is always available but hopefully the articles will identify areas that you as a security professional should look out for.

Ethical hacking

The purpose of this research paper is to discuss the Teaching Ethical Hacking. As the use of the internet increased the need of computer security also increase due to hackers. The knowledge of Ethical Hacking is also become essential for the security of the website, web-server, organization server, government companies and even individual internet user. Internet should be reliable and secure. In this research paper I discuss about the teaching Ethical Hacking and its issues, some people are against its teaching and some are in its favor, I also conduct a questionnaire and try to find why people do not want that Ethical Hacking be taught as a course. Functionalities and responsibilities of ethical hacker and his limitation while he or she doing the testing of the system. In the end I give the conclusion, which critically analyzes the research paper.  

1.0 Introduction  

Development in computer changes whole world and bring uncountable good things for human like E-Commerce, collaborative computing, email easy access to information, advertising, name of a few. But the problem is that computer also has some dark sides as every new technology did in past. This is known as hacking. But the original meaning of hacking is “to do the computer programming at depth level” the term hacker was used for the people who have very deep knowledge of computer programming, but later this word started using in different meanings. The new meaning of hacker is a person who inter in someone web site or in company server or someone personal computer to stole or destroy the information. There are many kind of hacker who hacking like some people do it just for fun, game or as a challenge and they really don’t have any interest to stole or destroy the useful information. Some people did it to stole information or delete the useful information. So the need there is need for computer security so that we can safe and use this technology and don’t let it to go down due to this reason. For computer security we started to search some way to get rid of this then the Ethical Hacking with many other methods come in mind to stop hacking. Ethical Hacking is phenomena trough witch we call some to hack our computer or web site or server in order to remove those whole so that after this there should no threat later or at least threat in this concern.

Then question arise who will do Ethical Hacking for us. Did we train some professional for this purpose if not then what should we teach to those ethical hackers. Is it right to teach someone hacking for the purpose to stop hacking, ho! Isn’t it interesting? Education in Microchip millennium is really difficult art as well as very interesting too. You have to teach people bad thing for good purposes. No gentleman likes word “hacker” with his or her name, but I don’t think anyone dislike word “ethical hacker” with his or name. Teaching Ethical Hacking is as important as the computer itself because one day people start hating internet due to hacking and to stop hacker from hacking we should educate people in this regard beside other techniques.

I divide my research paper into three main section first section is all about the teaching Ethical Hacking and try to give the answer of some question e.g. what is ethical hacking, why we do Ethical Hacking, what are the benefits and flaws of teaching Ethical Hacking,what should be taught in this course, and methodologies to teach Ethical Hacking. In second section I try to explain who ethical hacker is, what does he or she do, what are their boundaries and responsibilities? And in the last section I give the conclusion of this research paper. 

2.0 Ethical Hacking

Ethical Hacking is same phenomena as hacking but it will do for the safety of you are company web server or website or a software. It is a method or mechanism to stop hacker from hacking by removing the hole from a system or from a website or from a server so that no hacker can inter in a system or in a website or in a server by using those hole. Ethical Hacking is done in the end product development when product is developed and ready to use. To check the security level of the product and if they are some problem then for removing those from the developed product we do Ethical Hacking. So that when final product is inter in market it should have very less question regarding to the security point of view. Ethical Hacking should be a part of every software product development like planning designing etc.

Ethical hacker use same techniques to hack software or website or server as the original hacker do but not for destructive purposes. They try find out the hole in developed product and told to the responsible people of the organization about those holes and also suggest how to remove those holes from the system. As computer machinery grows, the individual, companies, and the big organization want to use it because no big company can survive without offering these services to its customer and vendor. But these Government organizations, companies and even individual remain under threat to be hacked. Big companies use internet for different purpose but they are always remain under threat that some one may break into their web server, implant software that will spread organization top secret data to the open internet and read their emails. Even individual are worried about their data like credit card number etc. they are not assure of internet security.  

2.1 Should Ethical Hacking Taught As career Course  

Company has so tight security and still they are hacked and they do not know any thing more in this regard to stop hacking. Most of the company hire best security available to safe there domain, but still they were hacked. Some times it happened due to company less knowledge of its system. What can be the best solution of this problem is that we train student and professional to save themselves and other world from hackers. It is the responsibility of true computer professional to secure the company web server, software or a Government organization from hacker. For this purpose we should have a profession which is known as ethical hacker same as software engineer or network engineer. These ethical hackers should be trained in universities. This problem was possible to get a tooth and nail response and it did when I asked some of my fellow who are doing M.Sc software engineering and Networks System about their views on introducing a profession in Ethical Hacking. Some of them are against and arguing that if Universities trained students for Ethical Hacking and if he or she did not get a job then he or she might go against the cause. But most of them are in favor by saying if we trained people like this they will help a lot to get rid of hacker. I am giving the point of view of only two students. I am very thankful to these student and other who give there precious time for my question and give the answer of my question and there important point of view regarding to ethical hacking.

Syed Shahab Hyder, currently student of software engineering in the University of Sunderland. He said Ethical Hacking should not be taught as a career course. Teaching Ethical Hacking will produce more people who can do hacking and if the trained students do not get a desire able job then, they use their skill for negative purpose and this create more problems for computer industries.

Rauf Khan a certified Cisco teacher and currently doing M.Sc Network System from the University of Sunderland responded my question of should Ethical Hacking taught as a course or not, in following thoughts that Ethical Hacking should be taught as a profession. We can prevent hacking by simply using the hacker techniques and it is easier and less costly then from the company useful information or individual information such as credit card number.

I believe that if there are very strict criteria for this type of education or training then the skillful Ethical Hacker will not go astray and definitely helps organization and individual to safe there data from the hackers. This will develop and increase the interest of people on the computer technology.

2.2 Teaching Material for Ethical Hackers

The basic knowledge that an Ethical Hacker should have about different field, is as following:
Should have basic knowledge of ethical and permissible issues
Should have primary level knowledge of session hijacking
Should know about hacking wireless networks
Should be good in sniffering
Should know how to handle virus and worms
Should have the basic knowledge of cryptography
Should have the basic knowledge of account 
Should know how to perform system hacking
Should have the knowledge of physical infrastructure hacking
Should have the primary knowledge of social engineering
Should know to how to do sacking of web servers
Should have the basic knowledge of web application weakness
Should have the knowledge of web based password breaking procedure
Should have the basic knowledge of SQL injection
Should know how to hack Linux
Should have the knowledge of IP hacking
Should have the knowledge of application hacking

As every one knows that there isn’t any boundary of any knowledge exist but still an Ethical Hacker should at least have the knowledge of above mention things. So when some one is going to designing a course for Ethical hacking should keep the above mention thing in mind for a better course design for ethical hackers.  

2.3 Teaching Methodology to Teach Ethical Hacking
As I write earlier that Ethical Hacking should be taught as a professional course. So we can use common way of teaching to teach Ethical Hacking. As technologies came into existence new ways of teaching also came into being. As earlier there is no concept of distance teaching or no one knew about teaching through internet but with the invention of internet now many student started getting their lectures through internet. Ethical Hacking is also been taught through internet as well as on campus. Off campus (learning through distance) and on campus both have there advantages and limitations. 

Whether we are teaching Ethical Hacking on campus or off campus the purpose goal of teaching is same though they are quite different way of teaching. On campus teaching is more suiteable for regular student and gives a real environment of study. Students have supplementary chances to learn more during on campus study. They also have the opportunity to learn the behavior of other students that help him a lot to gain experience of behavior.

On the other hand off campus student get the almost same teaching without any geographical and time zone constraints. They are part time student and cannot afford to complete there studies as a regular student. What ever the situation is teaching methodologies almost same with a very little difference. Some of the methodologies to teaching Ethical Hacking can be depicted as below,
Use of Case Study

A fictitious Ethical Hacking topic must be given to the students to discuss. They are divided into groups, and then they should be asked to give their understanding for that situation.
Conferences

Lecturers of different Universities and professional of different organization should be asked to give their point of view on Ethical Hacking.
Written Essay

Students should be asked to submit an essay or a report on the different aspects of the Ethical Hacking.
Exams

An exam should be conducted on the Ethical Hacking.
Discussion Groups

Students should be divided into small groups and they should be asked to give there points of view in favor or against the Ethical Hacking.
Interviews

Student should be asked to take interviews from different organization. A questionnaire should be developed to cover the different aspect of the Ethical Hacking. The results should be considered by using statistical inferences. The report should be given to the teacher of their analysis.
Multimedia

Student must be given the audio and video visuals in them hacking issues should be depicted. Student should be asked to how they can counteract the circumstances.
Chats 

Students of different Universities should be interacted via internet that what they think about Ethical Hacking issues. It can be done through hippocampus mechanism, where MUD (multi user dimension) and MOO (object oriented multi user) is used.
Book Reports

Student should be provided with the material from different book regarding to Ethical Hacking for the critical understanding.
Role Playing

Students must be asked to personify the different act in the CASE study. The students that are viewing them in the class rooms will give them the points on the basis of there anti pacifist act.
There many more methodologies that we can use to teach effectively Ethical Hacking.

3.0 Ethical Hacker 

Ethical hacker should be an honest and trusted person because he or she knows the secret of the system most of the time when they do hacking for security purposes and it is in his or her responsibility that not use the information of the system for destructive purpose. An ethical hacker is just like a code tester or like a developer, code tester check the code standards and developer develop the software while Ethical Hacker check the security of software as a hacking point of view and then suggest how to remove those hole from the system. Ethical Hacker should a part of software development team. Ethical Hacker is just an employer or a contracted person to check the security of the system. They have the written permission to check the network but they have some limitation to check network. They should have a written authority letter which clearly describe that they can perform testing as well as their boundaries within that system.

3.1 Main Functions of Ethical Hacker 

When an ethical hacker evaluate the security of system seeks the three basic answer
What he want to get from target system
Does any one have the knowledge of hacker’s attack on target system
What a hacker do after getting the information from the target system

These three question have there important you cannot say that this question more important than the other. Hacker may spent to hack a system during this he or she may attacks the system several times so if some one have the knowledge of this thing then hacking can be stopped.

Before starting the evaluation of the system he or she may ask some question to client like what he or she want to safe, what the factor against he or she trying to safe, how much money and how much time she or he can expend for this cause. The answer of same question varies from customer to customer and from field to field. But the most of the answer you found from the client may be not sufficient for ethical hacker so it is the responsibility of ethical hacker to properly guide the customer about its security that he or she must do to safe his or her system. Ethical hacker may also need some more information about the company like the employer names and there designation, networks information, data flow information and about the organizations with whom business is run most of the time. Because many time attacker use the alternative path to attack the system.

3.2 Type of Test That an Ethical Hacker Performed

 There are many kind of method or function or test that an Ethical Hacker can be performed while testing the security of the system. But the more basic testing functions or tests are as followings:
Testing of local network
Testing of remote network
Social engineering test
Physical entry test
Testing of remote dialup network

After doing all these test ethical hacker should produce a final report which describe what he or she found in the system during the evaluation. Where are the holes which can be used for attack and how those holes can be removed from the system? This final report is very sensitive and should be handled with care. A hacker can easily use it for hacking and a competitor can use it for company intelligence. Most of the time ethical was asked this question that if the organization did all the suggested action, is it free from these threats. But unfortunately, the answer cannot be yes because people are working in organization and they make mistakes and organization had to pay for their mistake in the form of hacking. Ethical hacking is another tool for security, and if you have the security it does not mean now you’re secure. It is not a magic potion. So what should these firms do then? I think Time to time auditing, alert interference recognition, good system administration performance and computer security knowledge are all very important part of a firm’s or company’s security system. A single failure in any of the above mention thing may lead to a serious harm. Every new technology always has its benefit along with some disadvantages. But these disadvantages always overcome with the passage of time. Every organization should be alert all the time for these types of attack and have the second line of defense to handle them.

4.0 Conclusion

To test the security and the other functionalities of product is not new. But in the early stages of Internet no one know about Ethical Hacking even about hacking, but with the passage of time people are more concern about the security of their data, especially due to hackers. Ethical Hacking is just a security system or tool for security to safe your data it is not an ultimate solution of problem. You can not sit relax against the hacker after using this tool. To teach more people about hacking you produce more people who are eligible to stop hacker from hacking and they will give more ideas and solution to stop hacking. Time to time assessment, prepared interference recognition, good system administration performance and computer safety knowledge are all very vital part of a firm’s or company’s security system. Failure in any of above may cast to the company or to the organization in the form of tangible or intangible loss. Its may include revenue, top secret or any thing that is very special for particular organization. Ethical hacker can only help the user to the better understanding of their security system, but its up to the organization that he palace its guards in right palace.

The Problem With Universal Plug and Play

The Problem With  Universal Plug and Play(UPnP) 

Allowing legitimate programs to alter your router settings as they need makes Joe User's life much easier - unfortunately, it also makes Joe Hacker's life easier, too. In order for UPnP to be truly "plug-n-play", there is no authentication built into the protocol; any program can use UPnP to alter a router's (or other UPnP device's) settings. 

At the beginning of this year, PDP (of GNUCITIZEN fame) published research he had performed regarding the security of UPnP. While security problems with UPnP are nothing new, it is a protocol that is normally only run inside a LAN, forcing an attacker to infiltrate the network before exploiting any UPnP vulnerabilities. However, PDP showed that it was possible to use Flash to send UPnP requests from within a client's browser to a UPnP enabled router and change the router's firewall settings. Given that the Flash file can be embedded inside a malicious page, or injected into a trusted page via XSS or SQL injection, an attacker could leverage this to remotely alter a router's configuration. What's worse is that in most cases, these configuration changes are not reflected in the router's administrative interface, leaving the victim completely un-aware that anything has happened. 

Of course, for wireless networks UPnP is dangerous even without the Flash attack, as an attacker can maintain physical distance from the network while still gaining access to the internal network. Once inside, he can begin altering the router's configuration settings via UPnP. 

How Serious is This? 

The seriousness of this attack depends on the UPnP implementation used by the router, as well as the router's configuration. For example, the configuration-altering Flash attack described above has to guess what a router's IP address is; this is usually fairly predictable, but some routers also assign themselves their own host names which takes any IP address guess work out of the picture. However, even if a router does not resolve to a host name, security through obscurity is not good practice, and simply changing a router's default IP address should not be considered a sufficient defense against such an attack. 

In addition, some UPnP implementations are at more risk than others; several UPnP-enabled IGDs allow the DNS settings to be directly altered via UPnP, which is just begging for a MITM/phishing attack. Still others, particularly those devices that use some form of embedded Linux, actually use the un-sanitized values they receive via UPnP requests as part of executed shell commands, leaving them open to command-injection attacks. A list of some known vulnerable routers can be found here. 

OK, so let's say that no host name resolves to the router IP, and its UPnP implementation is not vulnerable to DNS-hijacking or command injection. Unfortunately, we're not out of the woods yet; remember that the most common use of UPnP is to open up ports on a router. Because of this, almost all routers that support UPnP also support the AddPortMapping action; this essentially allows a device or piece of software to tell a router "forward traffic coming to port X on the WAN to internal host Y who is listening on port Z". Well what if we forward traffic from port 8080 on the WAN to yahoo.com on port 80? I know, I know, yahoo.com isn't an internal host! But some UPnP implementations don't verify that they are forwarding to an actual internal host, thus allowing an attacker to bounce his traffic through the router. Further, if the attacker knows the router's internal IP or host name, he may be able to forward any port on the WAN side of the router to port 80 on the LAN side of the router, effectively opening up the router's administrative interface to the world. 

An Overview of the UPnP Protocol 

The UPnP protocol uses a multicast address of 239.255.255.250 and TCP port 1900. Devices that offer UPnP services will periodically send out SSDP NOTIFY messages to 239:255:255:250:1900, announcing themselves to any UPnP clients that are listening. If you watch the traffic on your LAN with a UPnP router attached, you will likely notice that it sends out a burst of SSDP NOTIFY messages every few seconds; this is because most routers actually advertise themselves as multiple UPnP devices, and send one notification per device type. 

Likewise, UPnP clients can send SSDP M-SEARCH requests to 239:255:255:250:1900 to see if any UPnP devices respond. Clients can send an M-SEARCH request looking for any UPnP device, or they can specify that they are looking for a particular UPnP device, or they can query only for a device that supports a specific UPnP service. UPnP hosts that match the devices/services requested will respond with a SSDP RESPONSE message, which contains the same information sent in an SSDP NOTIFY message. 

An SSDP NOTIFY message sent by a UPnP host contains a 'Location' header which specifies the location of an XML file. This file contains XML data indicating, among other things, the UPnP device type(s) and services supported by the host, as well as paths to additional XML documents that describe the various services in detail. In order to discover the full UPnP capabilities of an IGD, you must parse through all the XML files to extract the devices types, services, and actions offered by the IGD. 

UPnP devices support various services that advertise what actions they support. A UPnP client can send a UPnP device an action request at any time; this could be a request to open up a port, change the default DNS server, or anything else that the UPnP device supports. Input/output data for action requests and responses are sent using SOAP, which uses XML to structure information sent between two parties. SOAP requests are essentially HTTP POST requests with some additional SOAP headers included in the HTTP headers. 

Auditing UPnP Devices Manually 

To discover if a router supports UPnP, you can go to the router's administrative interface and check to see if there is an option to enable/disable UPnP; while most routers have UPnP enabled by default, some do not. 

To actually audit a device's UPnP configuration, you can fire up Wireshark and look for SSDP NOTIFY packets being sent to the multicast address of 239.255.255.250 on port 1900; these notifications will be UPnP devices announcing themselves to the network. Once the SSDP NOTIFY messages are captured, you can examine Wireshark's dump of the SSDP headers to obtain the location of the root XML file. Once you retrieve that file (simply via an HTTP GET request), you can examine it to see what devices and services the UPnP host supports. Then, you can request additional XML files from the host (one file for each service) and parse those XML documents to determine what actions each service supports, and then correlate any related state variables (input/output variables) used for each action, as well as identifying which variables are used for input, and which are used for output (one action may use one variable as an input parameter, while another uses the same variable as an output parameter). 

Obviously, auditing UPnP hosts manually can become extremely time consuming and forces us to manually generate SSDP requests to UPnP devices in order to run UPnP actions against them. Using a tool to automate the process makes life much easier.

Russian hackers are the best in the world'

Speaking at the e-Crime Congress in London on Tuesday, Miroshnikov said that the casual teenaged hackers of the past developed their techniques as they grew older.

"It used to be naughty boys [doing this]," he said. "But now they've grown up. They realise if you are clever at something then you should use it to earn a living. They are hacking to get rich and uniting over networks."

Miroshnikov called for unified international laws for Internet crime that would make it easier for the police to carry out arrests and charges around the world.

On Tuesday the National Hi-Tech Crime Unit's said that cybercrime cost UK firms £2.4bn last year as consequence of online crime last year. Miroshnikov said this was alarming, but that the international police effort was starting to take effect.

"The statistics are really very worrying," he said. "If you look at 2001, 2002 and 2003, computer crime was doubling. It's only this year that we've started to hold back the growth. That's because we've worked so hard.

"When governments get [ISPs], law enforcement, public and private sector cooperating, then and only then will we be able to succeed in holding back this type of crime."
Russian hackers have been blamed for a series of distributed denial-of-service attacks against UK gambling Web sites, who are now urging ISPs to provide all their customers with better security.

10 Best Hackers

The good computer hackers are similar to war veterans in that they spend hours talking about how great the scene used to be “back in the day”. I first heard similar stories way back in 1995 but today it is actually somewhat true as the final HOPE conference has now been held, Black Hat is now a corporate event, the good e-zines are long gone and hacking is now associated with Russian crime gangs.
Now is a good time to go back and list the top 10 hackers who shaped both the computer and security industries and who have left their mark.

1. Shawn Fanning - What was once an IRC handle became synonymous with the free exchange of music files. Along with Jordan Ritter and Shaun Parker changed the music industry forever and set the course for the next decade of online media. Managed to turn a cool rock metal band into a bunch of whining babies and had his high moment when he appeared on the MTV music awards wearing a Metallic t-shirt. ADM were also the best and most consistent group ever

2. Robert Morris - Discovered the buffer overflow and exploited both sendmail and fingerd with the first ever internet worm - now known as the Morris Worm. Went on to become a co-founder of ViaWeb with Paul Graham. Downside is that his story was responsible for Dade Murphy and the Gibson OS, but it also bought us Angelina Jolie

3. VallaH - jolt.c and the ping-of-death kept kids around the world amused for years and big corporations on their knees. The first smart denial-of-service attack.

4. Gordon Lyon / Fyodor - Created Nmap, thefirst tool in every hackers arsenal that has since gone on to make cameo appearances in both The Matrix and the Bourne Ultimatum. Nmap pioneered OS and service fingerprinting. Also behind insecure.org.

5. Kevin Mitnick - Most famous real-life hacker who could have used a few tips on how cellular triangulation works. Imprisoned by the government without charge for years and restricted with a gag order thereafter. FREE KEVIN became a hacker freedom call for years.

6. The Mentor - Wrote the Hacker Manifesto which was published in Phrack magazine. Inspired kids worldwide to hack to learn (myself included). Phrack magazine deserves a mention as it was the best and most consistant e-zine in the past two decades. Ran for 65 issues until 2005.

7. Karl Koch / August Diehl - German hacker in the 80s who drove himself insane with cocaine abuse, obsession over the number 23 and paranoia over the Illuminatus.

8. Electron / Richard Jones - Aussie kid who wrecked havoc all over the world with nothing more than a modem. Arrested by the Australian Federal Police in 1990. Went on to become a security researcher and consultant.

9. Kevin Poulson / Dark Dante - Phreaked his way to a new Porsche with a radio contest on an LA station. Arrested and jailed and went on to become a journalist and editor at Wired.

10. Adrian Lamo - showed the world (literally) that you can take down large websites with just URLs (such as Worldcom). Now also a journalist.

What is amazing is just how many of the same guys who used to sit on IRC day and night discovering security holes and breaking into servers for fun ended up shaping and influencing the IT industry as a whole. There are hundreds of thousands of hackers who you have never heard about, mostly because they never got caught, who went on to start companies and attain high positions within corporations.

20 Best Hacker Films

20) The Net (1995)Sandra Bullock plays a software engineer who loses her identity to digital thieves. Filmed during the fanatic years of the then-novel World Wide Web, this film is now cliched. Nevertheless, fans of Sandra Bullock will still enjoy watching this B movie.

19) Takedown (2000)This is the sensationalized story of famous phone phreaker, Kevin Mitnick. This is a cult classic that is very hard to find in rental stores.

18) Pirates of Silicon Valley (1999)This is the flawed storytelling of how Apple and Microsoft came to be. While this movie got mixed reviews, many people have commented they loved it. Three dollars at your video store, and you can decide for yourself if this was a good film.

17) The Matrix (1999)This was such a groundbreaking adventure in reality and existentialism. No, you will not learn how to break into a Linux server by watching Trinity port-scanning with "nmap". But this movie is definitely cool, nonetheless.

16) Hackers (1995)Well, this story was really weak, and the hacking scenes were nowhere near reality. But you have to watch this just to say you did. Plus: Angelina Jolie is reason enough for some males to rent this.

15) The Conversation (1974)While you won't see computers in this classic film, the theme of surveillance and the violation of people's privacy is so masterfully explored here. **Related movie: The Conversation was re-imagined as Will Smith's Enemy of the State in 2001. The 2001 treatment of the story was designed as a modern techno thriller, and has some tremendous special effects and satellite surveillance sequences. Having Gene Hackman star with Will Smith makes it worth the price of a DVD rental.

14) Antitrust (2001)This movie has some strong points about it. Two idealistic computer whiz kids graduate from Stanford, and one of them enters the world of private sector programming. Sure enough, these two programmers find themselves in the middle of cybercrime scandals. Definitely worth renting for three bucks.

13) Real Genius (1985)There is only about 5 minutes of actual "hacking" in this comedy, where Laslo "brute-forces" his way into the defense network, and Kent and Mitch do phone bugging. But there are laughs aplenty in this fun B movie. Definite smile factor if you like playful and quirky humor movies.

12) Mission Impossible (1996)While many people no longer like Tom Cruise, his first MI movie did have I.T. and computer hacking sequences. Some good action, too.

11) The Thirteenth Floor(1999)A very extreme version of "The Sims", this movie is about scientists who create a virtual world where participants plug in and take over a computer character's life. The characters are unaware of their puppet existence, but then a real life murder shakes the foundation of the game


10) Swordfish (2001)Over-the-top violence, preposterous situations, sexy women, and outstanding special effects make this a great popcorn rental. No, don't bring your brain to watch this, but if you like techno-thrillers, definitely rent this. John Travolta is the slimy villain, Hugh Jackman is the studly hero hacker, and Halle Berry is the mysterious damsel.

9) The Italian Job (2003)Modern heist movies always involve some sort of hacking. This particular heist movie is extremely entertaining, especially when the supposed true inventor of "Napster" is the main hacker. At least 20 minutes of hacking footage in this actioner. Definitely worth renting if you haven't seen it.

8) Foolproof (2003)A lower-budget movie about hobby bank robbers, this was a delightful surprise to many viewers. Ryan Reynolds and his friends "virtually" rob banks for fun, but are blackmailed into doing a heist for real. This is a good action rental.

7) eXistenZ (1999)A David Cronenberg film, this is the creepiest entry in the list. A game designer creates an artificial reality game that plugs directly into people's minds. The line between reality and game then blurs in a violent and gruesome way. This is very much a powerful art film, and not for everyone.

6) The Score (2001)Edward Norton and Robert De Niro are fabulous in this heist flick. In a clever plot to rob a Montreal customs house of some royal artifacts, Norton and De Niro must break into the security systems with the help of a socially-awkward hacker who lives in his mother's basement. Ten minutes of hacking, and 100 minutes of phenomenal robbery storytelling!

5) Sneakers (1992)While dated, this movie was groundbreaking at the time, and is still charming to this day. The story revolves around two college buddies who take different paths in life. One becomes an ethical hacker, and the other...well, he is not quite so noble. Some great plot twists and comic scenes make this a good way to spend a Saturday afternoon at home.

4) Revolution OS (2001)This documentary tells the story about the Linux operating system, and how it forwarded the philosophy of "open source" and free intellectual property. Not an action movie, but definitely interesting for people who want to learn more about why computer culture is the way it is. If you can find a copy of this, definitely rent it.

3) Die Hard 4: Live Free or Die Hard (2007)Leave it to Bruce Willis to save the world from uber hackers. Macintosh advertising personality, Justin Long, plays the reluctant programmer caught up in an digital terrorism scheme. Like Swordfish, this movie has over-the-top violence and outrageous action sequences, but if you liked the Die Hard series, definitely see this .

2) Wargames (1983)Yes, this movie is very old, but it is still a pivotal film in many viewers' minds. A young man finds a back door into a military computer that is linked to the nuclear defense grid of the United States. A preposterous plot, but a compelling commentary on nuclear war and the destruction of the human race. You have to see this movie just to say you have seen it.

1) Tron (1982)A classic! A hacker is transported into the digital universe inside a computer, and must survive combat as a cyber gladiator in order to stop the villanous Master Control. The imagination behind this movie made big ripples in the science fiction world, and today, Tron is a cult classic that every computer user should see at least once.

Network security

Network security consists of the provisions made in an underlying computer network infrastructure, policies adopted by the network administrator to protect the network and the network-accessible resources from unauthorised access and consistent and continuous monitoring and measurement of its effectiveness.