1 / 58

Chapter 7: Protecting Advanced Communications

Chapter 7: Protecting Advanced Communications. Security+ Guide to Network Security Fundamentals Second Edition. Objectives. Harden File Transfer Protocol (FTP) Secure remote access Protect directory services Secure digital cellular telephony Harden wireless local area networks (WLAN).

kueng
Download Presentation

Chapter 7: Protecting Advanced Communications

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Chapter 7: Protecting Advanced Communications Security+ Guide to Network Security Fundamentals Second Edition

  2. Objectives • Harden File Transfer Protocol (FTP) • Secure remote access • Protect directory services • Secure digital cellular telephony • Harden wireless local area networks (WLAN)

  3. Hardening File Transfer Protocol (FTP) • Three ways to work with FTP: • Web browser • FTP client • Command line • FTP servers can be configured to allow unauthenticated users to transfer files (called anonymous FTP or blind FTP) • Anonymous connections use any email address as the password

  4. Hardening File Transfer Protocol (FTP) • Vulnerabilities associated with using FTP • FTP does not use encryption • Files being transferred by FTP are vulnerable to man-in-the-middle attacks • Use secure FTP to reduce risk of attack • Secure FTP is a term used by vendors to describe encrypting FTP transmissions • Most secure FTP products use Secure Socket Layers (SSL) to perform the encryption

  5. Hardening File Transfer Protocol (FTP) • FTP active mode • Client connects from any random port >1,023 (PORT N) to FTP server’s command port, port 21 (Step 1) • Client starts listening to PORT N+1 and sends the FTP command PORT N+1 to the FTP server • FTP passive mode • Client initiates both connections to server • When opening an FTP connection, client opens two local random unprivileged ports >1,023

  6. ephemeral port number File Transfer Protocol Process http://slacksite.com/other/ftp.html

  7. Active FTP Example

  8. Passive FTP Example

  9. Secure Remote Access • Windows NT includes User Manager to allow dial-in access, while Windows 2003 uses Computer Management for Workgroup access and Active Directory for configuring access to the domain • Windows 2003 Remote Access Policies can lock down a remote access system to ensure that only those intended to have access are actually granted it

  10. Tunneling Protocols • Tunneling: technique of encapsulating one packet of data within another type to create a secure link of transportation

  11. Tunneling Protocols (continued)

  12. Point-to-Point Tunneling Protocol (PPTP) • Most widely deployed tunneling protocol • Connection is based on the Point-to-Point Protocol (PPP), widely used protocol for establishing connections over a serial line or dial-up connection between two points • Client connects to a network access server (NAS) to initiate connection • Extension to PPTP is Link Control Protocol (LCP), which establishes, configures, and tests the connection

  13. Point-to-Point Tunneling Protocol (PPTP)

  14. Layer 2 Tunneling Protocol (L2TP) • Represents a merging of features of PPTP with Cisco’s Layer 2 Forwarding Protocol (L2F), which itself was originally designed to address some of the weaknesses of PPTP • Unlike PPTP, which is primarily implemented as software on a client computer, L2TP can also be found on devices such as routers

  15. Authentication Technologies • Authenticating a transmission to ensure that it comes from an approved sender can provide an increased level of security for remote access users

  16. IEEE 8021x • Based on a standard established by the Institute for Electrical and Electronic Engineers (IEEE) • Gaining wide-spread popularity • Provides an authentication framework for 802-based LANs (Ethernet, Token Ring, wireless LANs) • Uses port-based authentication mechanisms • Switch denies access to anyone other than an authorized user attempting to connect to the network through that port

  17. IEEE 8021x (continued) • Network supporting the 8021x protocol consists of three elements: • Supplicant: client device, such as a desktop computer or personal digital assistant (PDA), which requires secure network access • Authenticator: serves as an intermediary device between supplicant and authentication server • Authentication server: receives request from supplicant through authenticator

  18. 802.1x • 802.1x is a standardized framework defined by the IEEE that is designed to provide port-based network access. • The 802.1x framework defines three roles in the authentication process: • Supplicant = endpoint that needs network access • Authenticator = switch or access point • Authentication Server = RADIUS, TACACS+, LDAP • The authentication process consists of exchanges of Extensible Authentication Protocol (EAP) messages between the supplicant and the authentication server.

  19. IEEE 8021x (continued)

  20. Authentication Server Authenticator Supplicant 802.1x Roles Microsoft Windows XP includes 802.1x supplicant support

  21. Authentication Server (RADIUS) End User (client) Catalyst 2950 (switch) 802.1x RADIUS How 802.1x Works Actual authentication conversation occurs between the client and Authentication Server using EAP. The authenticator is aware of this activity, but it is just a middleman.

  22. Authentication Server (RADIUS) End User (client) Catalyst 2950 (switch) EAPOL - Start Port Unauthorized EAP – Request Identity RADIUS Access - Request EAP – Response/Identity RADIUS Access - Challenge EAP – Request/OTP RADIUS Access - Request EAP – Response/OTP EAP – Success RADIUS Access - Accept Port Authorized EAPOL – Logoff Port Unauthorized How 802.1x Works (Continued)

  23. 802.1x and EAP • Prior to the client authentication, the port will only allow 802.1x protocol, CDP, and STP traffic. • EAP is the transport protocol used by 802.1x to authenticate supplicants against an authentication server such as RADIUS. • RFC 3748 updated EAP to support IEEE 802 • On LAN media, the supplicant and authenticator use the EAP over LANs (EAPOL) encapsulation.

  24. EAP Characteristics • EAP – The Extensible Authentication Protocol • Extension of PPP to provide additional authentication features • A flexible protocol used to carry arbitrary authentication information. • Typically rides on top of another protocol such as 802.1x or RADIUS. EAP can also be used with TACACS+ • Specified in RFC 2284 • Support multiple authentication types : • EAP-MD5: Plain Password Hash (CHAP over EAP) • EAP-TLS (based on X.509 certificates) • LEAP (EAP-Cisco Wireless) • PEAP (Protected EAP)

  25. Cisco Secure ACS AAA Radius Server 4500/4000 Series 3550/2950 Series Host device attempts to connects to Switch 6500 Series Access Points 802.1x Capable Ethernet LAN Access Devices Switch Request ID Switch Forward credentials to ACS Server Send ID/Password or Certificate applies policies and enables port. Authentication Successful 4 1 3 7 5 6 2 Client now has secure access Actual authentication conversation is between client and Auth Server using EAP. RADIUS 802.1x How Does Basic Port Based Network Access Work? The switch detects the 802.1x compatible client, forces authentication, then acts as a middleman during the authentication, Upon successful authentication the switch sets the port to forwarding, and applies the designated policies.

  26. IEEE 8021x (continued) • Several variations of EAP can be used with 8021x: • EAP-Transport Layer Security (EAP-TLS) • Lightweight EAP (LEAP) • EAP-Tunneled TLS (EAP-TTLS) • Protected EAP (PEAP) • Flexible Authentication via Secure Tunneling (FAST)

  27. Remote Authentication Dial-In User Service (RADIUS) • Originally defined to enable centralized authentication and access control and PPP sessions • Requests are forwarded to a single RADIUS server • Supports authentication, authorization, and auditing functions • After connection is made, RADIUS server adds an accounting record to its log and acknowledges the request • Allows company to maintain user profiles in a central database that all remote servers can share

  28. Terminal Access Control Access Control System (TACACS+) • Industry standard protocol specification that forwards username and password information to a centralized server (TACACS) • Whereas communication between a NAS and a TACACS+ server is encrypted, communication between a client and a NAS is not • TACACS+ utilizes TCP port 49. • It is a Cisco proprietary enhancement to original TACACS protocol.

  29. Secure Transmission Protocols • PPTP and L2TP provide a secure mechanism for preventing eavesdroppers from viewing transmissions

  30. Secure Shell (SSH) • One of the primary goals of the ARPANET (which became today’s Internet) was remote access • SSH is a UNIX-based command interface and protocol for securely accessing a remote computer • Suite of three utilities—slogin, ssh, and scp • Can protect against: • IP spoofing • DNS spoofing • Intercepting information

  31. Secure Shell (SSH) (continued)

  32. IP Security (IPSec) • Different security tools function at different layers of the Open System Interconnection (OSI) model • Secure/Multipurpose Internet Mail Extensions (S/MIME) and Pretty Good Privacy (PGP) operate at the Application layer • Kerberos functions at the Session layer

  33. IP Security (IPSec) (continued)

  34. IP Security (IPSec) (continued) • IPSec is a set of protocols developed to support the secure exchange of packets • Encapsulating Security Payload (ESP) • Authentication Header (AH) • Internet Security Association and Key Management Protocol (ISAKMP/IKE) • Considered to be a transparent security protocol • Transparent to applications, users, and software because resides on Layer 3 of OSI • Provides three areas of protection that correspond to three IPSec protocols: • Authentication • Confidentiality • Key management

  35. IP Security (IPSec) (continued) • Supports two encryption modes: • Transport mode encrypts only the data portion (payload) of each packet, yet leaves the header unencrypted • Tunnel mode encrypts both the header and the data portion • IPSec accomplishes transport and tunnel modes by adding new headers to the IP packet • The entire original packet is then treated as the data portion of the new packet

  36. IP Security (IPSec) (continued) Tunnel Mode

  37. IP Security (IPSec) (continued) • Both Authentication Header (AH) and Encapsulating Security Payload (ESP) can be used with Transport or Tunnel mode, creating four possible transport mechanisms: • AH in transport mode • AH in tunnel mode • ESP in transport mode • ESP in tunnel mode • Usually use a combination of the four for each VPN policy/transform set

  38. Virtual Private Networks (VPNs) • Takes advantage of using the public Internet as if it were a private network • Allow the public Internet to be used privately • Prior to VPNs, organizations were forced to lease expensive data connections (leased lines) from private carriers so employees could remotely connect to the organization’s network

  39. Virtual Private Networks (VPNs) • Two common types of VPNs include: • Remote-access VPN or virtual private dial-up network (VPDN): user-to-LAN connection used by remote users • Site-to-site VPN: multiple sites can connect to other sites over the Internet • VPN transmissions achieved through communicating with endpoints • An endpoint can be software on a local computer, a dedicated hardware device such as a VPN concentrator, or even a firewall

  40. Virtual Private Networks (VPNs)

  41. Hardening WLANs • By 2007, >98% of all notebooks will be wireless-enabled • Serious security vulnerabilities have also been created by wireless data technology: • Unauthorized users can access the wireless signal from outside a building and connect to the network • Attackers can capture and view transmitted data • Employees in the office can install personal wireless equipment and defeat perimeter security measures • Attackers can crack wireless security with kiddie scripts

  42. IEEE 802.11 Standards • A WLAN shares same characteristics as a standard data-based LAN with the exception that network devices do not use cables to connect to the network • RF is used to send and receive packets • Sometimes called Wi-Fi for Wireless Fidelity, network devices can transmit 11 to 108 Mbps at a range of 150 to 375 feet • 802.11a has a maximum rated speed of 54 Mbps and also supports 48, 36, 24, 18, 12, 9, and 6 Mbps transmissions at 5 GHz

  43. IEEE 802.11 Standards • In September 1999, a new 802.11b High Rate was amended to the 80211 standard • 802.11b added two higher speeds, 5.5 and 11 Mbps • 802.11b operates at 2.4 GHz • 802.11b had greater range and was more widely adapted than 802.11a despite its slower max throughput

  44. IEEE 802.11 Standards • 802.11g features the best of both worlds with the max through put of 802.11a and the greater range of 802.11b and transmits at 2.4 GHz • 802.11g is also backward compatible with 802.11b http://en.wikipedia.org/wiki/802.11

  45. WLAN Components • Each network device must have a wireless network interface card installed • Wireless NICs are available in a variety of formats: • PCI card for your Desktop • PCMCIA for your laptop • USB stick for either

  46. WLAN Components (continued) • An access point (AP) consists of three major parts: • An antenna and a radio transmitter/receiver to send and receive signals • An RJ-45 wired network interface that allows it to connect by cable to a standard wired network • Special bridging software or bridge virtual interface (BVI) to bridge from the radio interface to the Ethernet interface

  47. Basic WLAN Security • Two areas: • Basic WLAN security • Enterprise WLAN security • Basic WLAN security uses two new wireless tools and one tool from the wired world: • Service Set Identifier (SSID) beaconing • MAC address filtering • Wired Equivalent Privacy (WEP)

  48. Service Set Identifier (SSID) Beaconing • A service set is a technical term used to describe a WLAN network • SSID Beaconing means to broadcast your SSID (usually the default) • Three types of service sets: • Independent Basic Service Set (IBSS) is used for ad hoc wireless networks • Basic Service Set (BSS) is used by an AP to send signals to other wireless devices • Extended Service Set (ESS) use multiple APs to cover a large area • Each WLAN is given a unique SSID

  49. MAC Address Filtering • Another way to harden a WLAN is to filter MAC addresses • The MAC address of approved wireless devices is entered on the AP • A MAC address can be spoofed • When wireless devices and the AP first exchange packets, the MAC address of the wireless device is sent in plaintext, allowing an attacker with a sniffer to see the MAC address of an approved device

  50. Wired Equivalent Privacy (WEP) • Optional configuration for WLANs that encrypts packets during transmission to prevent attackers from viewing their contents • Uses shared keys― the same key for encryption and decryption must be installed on the AP, as well as each wireless device • A serious vulnerability in WEP is that the Initialization Vector (IV) is not properly implemented • Every time a packet is encrypted it should be given a unique IV

More Related