Auditing Cisco Routers and Firewalls

1. Auditing Cisco Routers and Firewalls Presented by Ken Fishkin The Cohn Consulting Group kfishkin@jhcohn.com 973 228-3500 ext. 6541 Microsoft Certified Systems Engineer Cisco Security Specialist 1 Cisco Certified Network Associate Citrix Certified Administrator November 7, 2002

2. Current Internet Security Threats that Cisco Firewalls Can Help Prevent • Denial of Service Attacks • Poorly secured remote access to a corporate network • Downloading malicious Java and Active x code from web sites • Internet address spoofing

5. Defining a Router

6. How does a Router Handle Incoming Data • Where is the final destination for the data? • What path makes the most sense for the data to take?

9. Defining a Firewall

10. How does a Firewall Handle Incoming Data • What type of data is it? • What server is the data trying to reach? • Does the data look legitimate? • What is the data’s origin?

11. Firewall Add-ons • Remote user / office support • Failover support • Load balancing • Web content filtering • Email filtering / blocking

12. Blurring the Lines • Cisco routers can be upgraded to perform the following: • Basic firewall support • Remote user and office support • Intrusion Detection System (IDS) support

13. What Advantages Does the Cisco PIX Have Over a Cisco Router With Firewall Software? • More rigorous security screening before allowing data through its network • Failover capabilities • Increased performance • More robust remote user / office capabilities • By design, all incoming Internet access is blocked.

14. Auditing your company’s needs • What is your company’s exposure to the Internet? • How much do the employees need to use it? • How much down time is acceptable? • Need for redundant hardware • What is the company’s budget? • Is remote access a luxury or a necessity? • Does administration need to monitor their employee’s web surfing?

15. Minimally Protecting Your Network

16. A More Secure Network

17. Common Questions to Ask when Auditing your Router and Firewall • Where can people gain physical access to them? • Where can people gain administrative access to them? • Who can gain remote access to them? • How are administrative users authenticated?

18. Common Questions… continued • Are the passwords secure, encrypted and given to a staff member other than someone from the MIS department? • Are logs securely stored when any configuration changes or unusual behavior occur? • Are the latest software and security measures installed and configured? • Can any exposed servers be more secure from hackers?

19. Auditing Tips for Routers • Since routers are not at all secure by default, review how tightly locked down they are. • Determine if the router’s internal clock is synchronized with a time server. • Analyze any router to router network traffic and determine if the proper encryption policies are enforced. • Examine if the Intrusion Detection System features are properly configured. • Review any warning messages to discourage any unauthorized access.

20. Auditing Tips for Firewalls • Determine if all services allowed through your network are still valid. • Review your remote access policy regarding encryption and authentication. • Monitor your incoming traffic to see if it can be improved. • Analyze your firewall’s visibility to hackers.

21. General Security Maintenance Tips • Keep current with the latest security bulletins, patches, etc.. • Every six months you should audit your network and make sure that your security policies are up-to-date. • Test your system regularly.