Network Security Evaluation and Training Based on Real World Scenarios of Vulnerabilities Detected in Portuguese Municipalities’ Network Devices

Abstract

Nowadays, public and private organizations have demonstrated some sensibility in maintenance and security updates of their equipment. However, their main focus are servers and workstations, leaving network devices, such as routers and switches often forgotten in this process. This research addresses the vulnerabilities on network equipment, intending to evaluate their dimension, in Portugal’s City Halls and, after that, analyze and rate their impact according to taxonomies, such as CAPEC. This study also aims to set of vulnerabilities to reply, elucidate and sensitize not just City Halls ITs, but also other type of public and private organizations about the risks related to outdate network devices. The vulnerability demonstrations were done through the design of different scenarios, with real devices, installed in a mobile rack, called “Hack Móvel” and using network simulators. Each scenario was documented with multimedia contents, allowing teaching hacking techniques in network devices. As methodology, the study adopts the quantitative method, through the application of questionnaires applied to each City Hall, in order to collect relevant information about the device models and brands, as well as the firmware version they are really using. It is also adopted the quantitative method in order to perform tests with real users and evaluate the scenarios that were designed. Results show a really good acceptance of the “Hack Móvel” by users and their motivation to increase their knowledge on the computer security and hacking techniques field.