ACTIVE DEFENSE: A COMPREHENSIVE GUIDE TO NETWORK SECURITY
INTRODUCTION 1 CHAPTER 1 WHY SECURE YOUR NETWORK 3 CHAPTER 2 HOW MUCH SECURITY DO YOU NEED 9 CHAPTER 3 UNDERSTANDING HOW NETWORK SYSTEMS COMMUNICATE 22 CHAPTER 4 TOPOLOGY SECURITY 57 CHAPTER 5 FIREWALLS 76 CHAPTER 6 CONFIGURING CISCO ROUTER SECURITY FEATURES 111 CHAPTER 7 CHECK POINT S FIREWALL 1 138 CHAPTER 8 INTRUSION DETECTION SYSTEMS 163 CHAPTER 9 AUTHENTICATION AND ENCRYPTION 182 CHAPTER 10 VIRTUAL PRIVATE NETWORKING 197 CHAPTER 11 VIRUSES TROJANS AND WORMS OH MY 213 CHAPTER 12 DISASTER PREVENTION AND RECOVERY 228 CHAPTER 13 NETWARE 251 CHAPTER 14 NT AND WINDOWS 2000 268 CHAPTER 15 UNIX 304 CHAPTER 16 THE ANATOMY OF AN ATTACK 329 CHAPTER 17 STAYING AHEAD OF ATTACKS 347 CONTENTS INTRODUCTION OVERVIEW SOME OF US CAN REMEMBER A TIME WHEN SECURING A NETWORK ENVIRONMENT WAS A FAR EASIER TASK THAN IT SEEMS TO BE TODAY AS LONG AS EVERY USER HAD A PASSWORD AND THE CORRECT LEVELS OF FILE PERMISSIONS HAD BEEN SET WE COULD GO TO SLEEP AT NIGHT CONFIDENT THAT OUR NETWORK ENVIRONMENT WAS RELATIVELY SECURE THIS CONFIDENCE MAY OR MAY NOT HAVE BEEN JUSTIFIED BUT AT LEAST WE FELT SECURE THEN ALONG CAME THE INTERNET AND EVERYTHING CHANGED THE INTERNET HAS ACCELERATED AT AN AMAZING RATE THE PACE AT WHICH INFORMATION IS DISSEMINATED IN THE EARLY 1990S MOST OF US WOULD NOT HEAR ABOUT A SECURITY VULNERABILITY UNLESS IT MADE IT INTO A MAJOR MAGAZINE OR NEWSPAPER EVEN THEN THE NEWS RELEASE TYPICALLY APPLIED TO AN OLD VERSION OF SOFTWARE THAT MOST OF US NO LONGER USED ANYWAY THESE DAYS HUNDREDS OF THOUSANDS OF PEOPLE CAN BE MADE PRIVY TO THE DETAILS OF A SPECIFIC VULNERABILITY IN LESS THAN AN HOUR THIS IS NOT TO SAY THAT ALL THIS DISCUSSION OF PRODUCT VULNERABILITIES IS A BAD THING ACTUALLY QUITE THE OPPOSITE IS TRUE INDIVIDUALS WITH MALICIOUS INTENT HAVE ALWAYS HAD PLACES TO EXCHANGE IDEAS PIRATE BULLETIN BOARDS HAVE BEEN AROUND SINCE THE 1980S TYPICALLY IT WAS THE REST OF US WHO WERE LEFT OUT IN THE COLD WITH NO MEANS OF DISPERSING THIS INFORMATION TO THE PEOPLE WHO NEEDED IT MOST THE NETWORK ADMINISTRATORS ATTEMPTING TO MAINTAIN A SECURE ENVIRONMENT THE INTERNET HAS BECOME AN EXCELLENT MEANS TO GET VULNERABILITY INFORMATION INTO THE HANDS OF THE PEOPLE RESPONSIBLE FOR SECURING THEIR ENVIRONMENTS INCREASED AWARENESS ALSO BRINGS INCREASED RESPONSIBILITY THIS IS NOT ONLY TRUE FOR THE SOFTWARE COMPANY THAT IS EXPECTED TO FIX THE VULNERABILITY IT IS ALSO TRUE FOR THE NETWORK ADMINISTRATOR OR SECURITY SPECIALIST WHO IS EXPECTED TO DEPLOY THE FIX ANY END USER WITH A SUBSCRIPTION TO A MAILING LIST CAN FIND OUT ABOUT VULNERABILITIES AS QUICKLY AS THE NETWORKING STAFF THIS GREATLY INCREASES THE URGENCY OF DEPLOYING SECURITY RELATED FIXES AS SOON AS THEY ARE DEVELOPED AS IF WE DIDN T HAVE ENOUGH ON OUR PLATES ALREADY SO ALONG WITH ALL OF OUR OTHER RESPONSIBILITIES WE NEED TO MAINTAIN A GOOD SECURITY POSTURE THE FIRST PROBLEM IS WHERE TO BEGIN SHOULD YOU PURCHASE A BOOK ON FIREWALLS OR ON SECURING YOUR NETWORK SERVERS MAYBE YOU NEED TO LEARN MORE ABOUT NETWORK COMMUNICATIONS IN ORDER TO BE ABLE TO UNDERSTAND HOW THESE VULNERABILITIES CAN EVEN EXIST SHOULD YOU BE WORRIED ABOUT RUNNING BACKUPS OR REDUNDANT SERVERS ONE LESSON THAT HAS BEEN DRIVEN HOME SINCE THE PUBLICATION OF THE FIRST EDITION OF THIS BOOK IS THE NEED TO VIEW SECURITY NOT AS A STATIC PACKAGE BUT RATHER AS A CONSTANT PROCESS INCORPORATING ALL FACETS OF NETWORKING AND INFORMATION TECHNOLOGY YOU CANNOT FOCUS ON ONE SINGLE ASPECT OF YOUR NETWORK AND EXPECT YOUR ENVIRONMENT TO REMAIN SECURE NOR CAN THIS PROCESS BE DONE IN ISOLATION FROM OTHER NETWORKING ACTIVITIES THIS BOOK PROVIDES SYSTEM AND NETWORK ADMINISTRATORS WITH THE INFORMATION THEY WILL NEED TO RUN A NETWORK WITH MULTIPLE LAYERS OF SECURITY PROTECTION WHILE CONSIDERING ISSUES OF USABILITY PRIVACY AND MANAGEABILITY WHAT THIS BOOK COVERS CHAPTER 1 STARTS YOU OFF WITH A LOOK AT WHY SOMEONE MIGHT ATTACK AN ORGANIZATION S NETWORK RESOURCES YOU WILL LEARN ABOUT THE DIFFERENT KINDS OF ATTACKS AND WHAT AN ATTACKER STANDS TO GAIN BY LAUNCHING THEM AT THE END OF THE CHAPTER YOU LL FIND A WORKSHEET TO HELP YOU GAUGE THE LEVEL OF POTENTIAL THREAT TO YOUR NETWORK CHAPTER 2 INTRODUCES RISK ANALYSIS AND SECURITY POLICIES THE PURPOSE OF A RISK ANALYSIS IS TO QUANTIFY THE LEVEL OF SECURITY YOUR NETWORK ENVIRONMENT REQUIRES A SECURITY POLICY DEFINES YOUR ORGANIZATION S APPROACH TO MAINTAINING A SECURE ENVIRONMENT THESE TWO DOCUMENTS CREATE THE FOUNDATION YOU WILL USE WHEN SELECTING AND IMPLEMENTING SECURITY PRECAUTIONS IN CHAPTER 3 YOU LL GET AN OVERVIEW OF HOW SYSTEMS COMMUNICATE ACROSS A NETWORK THE CHAPTER LOOKS AT HOW THE INFORMATION IS PACKAGED AND DESCRIBES THE USE OF PROTOCOLS YOU LL READ ABOUT VULNERABILITIES IN ROUTING PROTOCOLS AND WHICH PROTOCOLS HELP TO CREATE THE MOST SECURE ENVIRONMENT FINALLY THE CHAPTER COVERS SERVICES SUCH AS FTP HTTP AND SMTP WITH TIPS ON HOW TO USE THEM SECURELY CHAPTER 4 GETS INTO TOPOLOGY SECURITY IN THIS CHAPTER YOU LL LEARN ABOUT THE SECURITY STRENGTHS AND WEAKNESSES OF DIFFERENT TYPES OF WIRING AS WELL AS DIFFERENT TYPES OF LOGICAL TOPOLOGIES SUCH AS ETHERNET AND FRAME RELAY FINALLY YOU LL LOOK AT DIFFERENT TYPES OF NETWORKING HARDWARE SUCH AS SWITCHES ROUTERS AND LAYER 3 SWITCHING TO SEE HOW THESE DEVICES CAN BE USED TO MAINTAIN A MORE SECURE ENVIRONMENT CHAPTER 5 DISCUSSES PERIMETER SECURITY DEVICES SUCH AS PACKET FILTERS AND FIREWALLS YOU WILL CREATE AN ACCESS CONTROL POLICY BASED ON THE SECURITY POLICY CREATED IN CHAPTER 2 AND EXAMINE THE STRENGTHS AND WEAKNESSES OF 1 ACTIVE DEFENSE DIFFERENT FIREWALLING METHODS ALSO INCLUDED ARE SOME HELPFUL TABLES FOR DEVELOPING YOUR ACCESS CONTROL POLICY SUCH AS A DESCRIPTION OF ALL OF THE TCP FLAGS AS WELL AS DESCRIPTIONS OF ICMP TYPE CODE IN CHAPTER 6 WE LL DISCUSS CREATING ACCESS CONTROL LISTS ON A CISCO ROUTER THE CHAPTER BEGINS WITH SECURING THE CISCO ROUTER ITSELF AND THEN GOES ON TO DESCRIBE BOTH STANDARD AND EXTENDED ACCESS LISTS YOU LL SEE WHAT CAN AND CANNOT BE BLOCKED USING PACKET FILTERS AND TAKE A LOOK AT A NUMBER OF ACCESS LIST SAMPLES THE END OF THE CHAPTER LOOKS AT CISCO S NEW REFLEXIVE FILTERING WHICH ALLOWS THE ROUTER TO ACT AS A DYNAMIC PACKET FILTER YOU LL SEE HOW TO DEPLOY A FIREWALL IN YOUR ENVIRONMENT IN CHAPTER 7 SPECIFICALLY YOU LL WALK THROUGH THE SETUP AND CONFIGURATION OF CHECK POINT S FIREWALL 1 SECURING THE UNDERLYING OPERATING SYSTEM INSTALLING THE SOFTWARE AND IMPLEMENTING AN ACCESS CONTROL POLICY CHAPTER 8 DISCUSSES INTRUSION DETECTION SYSTEMS IDS YOU LL LOOK AT THE TRAFFIC PATTERNS AN IDS CAN MONITOR AS WELL AS SOME OF THE TECHNOLOGY S LIMITATIONS AS A SPECIFIC IDS EXAMPLE YOU WILL TAKE A LOOK AT INTERNET SECURITY SYSTEMS REALSECURE THIS INCLUDES OPERATING SYSTEM PREPARATION SOFTWARE INSTALLATION AND HOW TO CONFIGURE REALSECURE TO CHECK FOR SPECIFIC TYPES OF VULNERABILITIES CHAPTER 9 LOOKS AT AUTHENTICATION AND ENCRYPTION YOU WILL LEARN WHY STRONG AUTHENTICATION IS IMPORTANT AND WHAT KINDS OF ATTACKS EXPLOIT WEAK AUTHENTICATION METHODS YOU LL ALSO READ ABOUT DIFFERENT KINDS OF ENCRYPTION AND HOW TO SELECT THE RIGHT ALGORITHM AND KEY SIZE FOR YOUR ENCRYPTION NEEDS READ CHAPTER 10 TO LEARN ABOUT VIRTUAL PRIVATE NETWORKING VPN INCLUDING WHEN THE DEPLOYMENT OF A VPN MAKES SENSE AND WHAT OPTIONS ARE AVAILABLE FOR DEPLOYMENT AS A SPECIFIC EXAMPLE YOU WILL SEE HOW TO USE TWO FIREWALL 1 FIREWALLS TO CREATE A VPN YOU WILL ALSO SEE BEFORE AND AFTER TRACES SO YOU WILL KNOW EXACTLY WHAT A VPN DOES TO YOUR DATA STREAM CHAPTER 11 DISCUSSES VIRUSES TROJAN HORSES AND WORMS THIS CHAPTER ILLUSTRATES THE DIFFERENCES BETWEEN THESE APPLICATIONS AND SHOWS EXACTLY WHAT THEY CAN AND CANNOT DO TO YOUR SYSTEMS YOU WILL SEE DIFFERENT METHODS OF PROTECTION AND SOME DESIGN EXAMPLES FOR DEPLOYING PREVENTION SOFTWARE CHAPTER 12 IS ALL ABOUT DISASTER PREVENTION AND RECOVERY PEELING AWAY THE DIFFERENT LAYERS OF YOUR NETWORK TO SEE WHERE DISASTERS CAN OCCUR THE DISCUSSION STARTS WITH NETWORK CABLING AND WORKS ITS WAY INSIDE YOUR NETWORK SERVERS YOU LL EVEN LOOK AT CREATING REDUNDANT LINKS FOR YOUR WAN THE CHAPTER ENDS BY DISCUSSING THE SETUP AND USE OF QUALIX GROUP S CLUSTERING PRODUCT OCTOPUSHA NOVELL S NETWARE OPERATING SYSTEM IS FEATURED IN CHAPTER 13 IN THIS CHAPTER YOU LL LEARN ABOUT WAYS TO SECURE A NETWARE ENVIRONMENT THROUGH USER ACCOUNT SETTINGS FILE PERMISSIONS AND NDS DESIGN WE LL DISCUSS THE AUDITING FEATURES THAT ARE AVAILABLE WITH THE OPERATING SYSTEM FINALLY YOU LL LOOK AT WHAT VULNERABILITIES EXIST IN NETWARE AND HOW YOU CAN WORK AROUND THEM CHAPTER 14 DISCUSSES MICROSOFT WINDOWS NETWORKING TECHNOLOGIES SPECIFICALLY NT SERVER AND WINDOWS 2000 SERVER YOU LL LOOK AT DESIGNING A DOMAIN STRUCTURE THAT WILL ENHANCE YOUR SECURITY POSTURE AS WELL AS HOW TO USE POLICIES WE LL DISCUSS WORKING WITH USER ACCOUNTS LOGGING AND FILE PERMISSIONS AS WELL AS SOME OF THE PASSWORD INSECURITIES WITH WINDOWS NT 2000 FINALLY YOU LL READ ABOUT THE IP SERVICES AVAILABLE WITH NT AND SOME OF THE SECURITY CAVEATS IN DEPLOYING THEM CHAPTER 15 IS ALL ABOUT UNIX AND THE UNIX CLONES LINUX AND FREEBSD SPECIFICALLY YOU LL SEE HOW TO LOCK DOWN A SYSTEM RUNNING THE LINUX OPERATING SYSTEM YOU LL LOOK AT USER ACCOUNTS FILE PERMISSIONS AND IP SERVICES THIS CHAPTER INCLUDES A DETAILED DESCRIPTION OF HOW TO REBUILD THE OPERATING SYSTEM KERNEL TO ENHANCE SECURITY EVEN FURTHER EVER WONDER HOW AN EVIL VILLAIN MIGHT GO ABOUT ATTACKING YOUR NETWORK RESOURCES READ CHAPTER 16 WHICH DISCUSSES HOW ATTACKERS COLLECT INFORMATION HOW THEY MAY GO ABOUT PROBING FOR VULNERABILITIES AND WHAT TYPES OF EXPLOITS ARE AVAILABLE YOU LL ALSO LOOK AT SOME OF THE CANNED SOFTWARE TOOLS THAT ARE AVAILABLE TO ATTACKERS CHAPTER 17 SHOWS YOU HOW YOU CAN STAY INFORMED ABOUT SECURITY VULNERABILITIES THIS CHAPTER DESCRIBES THE INFORMATION AVAILABLE FROM BOTH PRODUCT VENDORS AND A NUMBER OF THIRD PARTY RESOURCES VULNERABILITY DATABASES WEB SITES AND MAILING LISTS ARE DISCUSSED FINALLY THE CHAPTER ENDS WITH A LOOK AT AUDITING YOUR ENVIRONMENT USING KANE SECURITY ANALYST A TOOL THAT HELPS YOU TO VERIFY THAT ALL OF YOUR SYSTEMS ARE IN COMPLIANCE WITH YOUR SECURITY POLICY WHO SHOULD READ THIS BOOK THE BOOK IS SPECIFICALLY GEARED TOWARD THE INDIVIDUAL WHO DOES NOT HAVE TEN YEARS OF EXPERIENCE IN THE SECURITY FIELD BUT IS STILL EXPECTED TO RUN A TIGHT SHIP IF YOU ARE A SECURITY GURU WHO IS LOOKING TO FILL IN THAT LAST FIVE PERCENT OF YOUR KNOWLEDGE BASE THIS MAY NOT BE THE BOOK FOR YOU IF HOWEVER YOU ARE LOOKING FOR A PRACTICAL GUIDE THAT WILL HELP YOU TO IDENTIFY YOUR AREAS OF GREATEST WEAKNESS YOU HAVE COME TO THE RIGHT PLACE THIS BOOK WAS WRITTEN WITH THE TYPICAL NETWORK OR SYSTEM ADMINISTRATOR IN MIND THOSE ADMINISTRATORS WHO HAVE A PRETTY GOOD HANDLE ON NETWORKING AND THE SERVERS THEY ARE EXPECTED TO MANAGE BUT WHO NEED TO FIND OUT WHAT THEY CAN DO TO AVOID BEING VICTIMIZED BY A SECURITY BREACH NETWORK SECURITY WOULD BE A FAR EASIER TASK IF WE COULD ALL AFFORD TO BRING IN A 350 PER HOUR SECURITY WIZARD TO AUDIT AND FIX OUR COMPUTER ENVIRONMENT FOR MOST OF US HOWEVER THIS IS WELL BEYOND OUR BUDGET CONSTRAINTS A 2 ACTIVE DEFENSE STRONG SECURITY POSTURE DOES NOT HAVE TO BE EXPENSIVE BUT IT DOES TAKE TIME AND ATTENTION TO DETAIL THE MORE HOLES YOU CAN PATCH WITHIN YOUR NETWORKING ENVIRONMENT THE HARDER IT WILL BE FOR SOMEONE TO RUIN YOUR DAY BY LAUNCHING A NETWORK BASED ATTACK IF YOU HAVE ANY QUESTIONS OR COMMENTS REGARDING ANY OF THE MATERIAL IN THIS BOOK FEEL FREE TO E MAIL US AT CBRENTON SOVER NET OR CAM CAMERONHUNT COM CHAPTER 1 WHY SECURE YOUR NETWORK YOU ONLY HAVE TO LOOK AT THE DAILY NEWSPAPER TO SEE THAT COMPUTER BASED ATTACKS ARE ON THE RISE NEARLY EVERY DAY WE HEAR THAT SYSTEMS RUN BY GOVERNMENT AND PRIVATE ORGANIZATIONS HAVE BEEN DISRUPTED OR PENETRATED EVEN HIGH PROFILE ENTITIES LIKE THE U S MILITARY AND MICROSOFT HAVE BEEN HACKED YOU MIGHT WONDER WHAT YOU CAN DO TO PROTECT YOUR COMPANY WHEN ORGANIZATIONS LIKE THESE CAN FALL PREY TO ATTACK TO MAKE MATTERS WORSE NOT ALL ATTACKS ARE WELL PUBLICIZED WHILE ATTACKS AGAINST THE FBI MAY MAKE THE FRONT PAGE MANY LOWER PROFILE ATTACKS NEVER EVEN REACH THE PUBLIC EYE REVEALING TO THE PUBLIC THAT A COMPANY HAS HAD ITS FINANCIAL INFORMATION OR LATEST PRODUCT DESIGNS STOLEN CAN CAUSE SERIOUS ECONOMIC EFFECTS FOR EXAMPLE CONSIDER WHAT WOULD HAPPEN IF A BANK ANNOUNCED THAT ITS COMPUTER SECURITY HAD BEEN BREACHED AND A LARGE SUM OF MONEY STOLEN IF YOU HAD ACCOUNTS WITH THIS BANK WHAT WOULD YOU DO CLEARLY THE BANK WOULD WANT TO KEEP THIS INCIDENT QUIET FINALLY THERE MAY WELL BE A LARGE NUMBER OF ATTACKS THAT GO COMPLETELY UNDOCUMENTED THE MOST COMMON ARE INSIDER ATTACKS IN SUCH CASES AN ORGANIZATION MAY NOT WISH TO PUSH THE ISSUE BEYOND TERMINATING THE EMPLOYEE FOR EXAMPLE A WELL KNOWN MUSEUM ONCE ASKED ME TO EVALUATE ITS CURRENT NETWORK SETUP THE MUSEUM DIRECTOR SUSPECTED THAT THE NETWORKING STAFF MAY HAVE BEEN INVOLVED IN SOME UNDERHANDED ACTIVITIES I FOUND THAT THE NETWORKING STAFF HAD INFILTRATED EVERY USER S MAILBOX INCLUDING THE DIRECTOR S THE PAYROLL DATABASE AND THE CONTRIBUTORS DATABASE THEY WERE ALSO USING THE MUSEUM S RESOURCES TO RUN THEIR OWN BUSINESS AND TO DISTRIBUTE SOFTWARE TOOLS THAT COULD BE USED TO ATTACK OTHER NETWORKS DESPITE ALL THESE INFRACTIONS THE MUSEUM CHOSE TO TERMINATE THE EMPLOYEES WITHOUT PURSUING ANY LEGAL ACTION ONCE TERMINATED THESE EX EMPLOYEES ATTEMPTED TO UTILIZE A NUMBER OF BACK DOORS THAT THEY HAD SET UP FOR THEMSELVES INTO THE NETWORK EVEN IN LIGHT OF THIS CONTINUED ACTIVITY THE MUSEUM STILL CHOSE NOT TO PURSUE CRIMINAL CHARGES BECAUSE IT DID NOT WISH TO MAKE THE INCIDENT PUBLIC THERE ARE NO CLEAR STATISTICS ON HOW MANY SECURITY INCIDENTS GO UNDOCUMENTED MY OWN EXPERIENCE SUGGESTS THAT MOST IN FACT ARE NOT DOCUMENTED CLEARLY SECURITY BREACHES ARE ON THE RISE AND EVERY NETWORK NEEDS STRATEGIES TO PREVENT ATTACK TIP YOU CAN REPORT SECURITY INTRUSIONS TO THE COMPUTER EMERGENCY RESPONSE TEAM CERT COORDINATION CENTER AT CERT CERT ORG CERT ISSUES SECURITY BULLETINS AND CAN ALSO FACILITATE THE RELEASE OF REQUIRED VENDOR PATCHES BEFORE WE GET INTO THE MEAT OF HOW TO BEST SECURE YOUR ENVIRONMENT WE NEED TO DO A LITTLE HOMEWORK TO START WE WILL LOOK AT WHO MIGHT ATTACK YOUR NETWORK AND WHY THINKING LIKE AN ATTACKER IN ORDER TO DETERMINE HOW TO BEST GUARD YOUR RESOURCES YOU MUST IDENTIFY WHO WOULD WANT TO DISRUPT THEM MOST ATTACKS ARE NOT CONSIDERED RANDOM THE PERSON STAGING THE ATTACK USUALLY BELIEVES THERE IS SOMETHING TO GAIN BY DISRUPTING YOUR ASSETS FOR EXAMPLE A CROOK IS MORE LIKELY TO ROB SOMEONE WHO APPEARS WEALTHY BECAUSE THE APPEARANCE OF WEALTH SUGGESTS LARGER FINANCIAL GAIN IDENTIFYING WHO STANDS TO GAIN FROM STEALING OR DISRUPTING YOUR RESOURCES IS THE FIRST STEP TOWARD PROTECTING THEM ATTACKER HACKER AND CRACKER PEOPLE FROM TRADE MAGAZINE WRITERS TO HOLLYWOOD MOVIEMAKERS OFTEN USE THE WORDS ATTACKER HACKER AND CRACKER INTERCHANGEABLY THE PHRASE WE GOT HACKED HAS COME TO MEAN WE WERE ATTACKED HOWEVER THERE ARE SOME STRONG DISTINCTIONS BETWEEN THE THREE TERMS AND UNDERSTANDING THE DIFFERENCES WILL HELP YOU TO UNDERSTAND WHO IS TRYING TO HELP REINFORCE YOUR SECURITY POSTURE AND WHO IS TRYING TO INFILTRATE IT AN ATTACKER IS SOMEONE WHO LOOKS TO STEAL OR DISRUPT YOUR ASSETS AN ATTACKER MAY BE TECHNICALLY ADEPT OR A RANK AMATEUR AN ATTACKER BEST RESEMBLES A SPY OR A CROOK THE ORIGINAL MEANING OF A HACKER WAS SOMEONE WITH A DEEP UNDERSTANDING OF COMPUTERS AND OR NETWORKING HACKERS ARE NOT SATISFIED WITH SIMPLY EXECUTING A PROGRAM THEY NEED TO UNDERSTAND ALL THE NUANCES OF HOW IT 3 ACTIVE DEFENSE