ITEC 275 Computer Networks – Switching, Routing, and WANs

1. ITEC 275 Computer Networks – Switching, Routing, and WANs Week 8 Robert D’Andrea Some slides provide by Priscilla Oppenheimer and used with permission

2. Agenda • Learning Activities • Security • Threats and Risks • Security Policy • Security Mechanisms • Wireless Security • SNMP

3. Network Security DesignThe 12 Step Program • Identify network assets • Analyze security risks • Analyze security requirements and tradeoffs • Develop a security plan • Define a security policy • Develop procedures for applying security policies

4. The 12 Step Program (continued) • Develop a technical implementation strategy • Achieve buy-in from users, managers, and technical staff • Train users, managers, and technical staff • Implement the technical strategy and security procedures • Test the security and update it if any problems are found • Maintain security

5. Network Assets Obvious Network Assets • Hardware (Routers, internetworking devices, and switches) • Software(Operating systems, applications, and data) Less Obvious Network Assets • Intellectual property The collective wisdom of your employees or customers is vast and waiting to be tapped. Bloomfire is a knowledge base built to capture, archive, and grow the knowledge that already exists within or about your organization.

6. Network Assets Trade secrets is any confidential business information which provides an enterprise a competitive edge may be considered a trade secret. Trade secrets encompass manufacturing or industrial secrets and commercial secrets. The unauthorized use of such information by persons other than the holder is regarded as an unfair practice and a violation of the trade secret. Company’s reputation the reputation of a business is essential to its survival. The trust and confidence of the consumer can have a direct and profound effect on a company's bottom ...

7. Security Risks • Hacked network devices • Data can be intercepted, analyzed, altered, or deleted • User passwords can be compromised • Device configurations can be changed • Reconnaissance attacks (are used to gather information about a target network or system. At first glance, seem harmless). • Denial-of-service (DoS) attacks are increasing

8. Security Tradeoffs • Tradeoffs must be made between security goals and other goals: • Affordability • Usability • Performance • Availability • Manageability The cost of protecting yourself against a threat should be less than the cost of recovering if the threat were to strike you.

9. A Security Plan • High-level document that proposes what an organization is going to do to meet security requirements • Specifies time, people, and other resources that will be required to develop a security policy and achieve implementation of the policy

10. A Security Plan • Should reference the network topology and include a list of network services that will be provided. The list should specify who provides the services, who has access to the services, how access is provided, and who administers the services.

11. A Security Policy • Informs users, managers, and technical staff of their obligations for protecting technology and information assets.

12. A Security Policy • Per RFC 2196, “The Site Security Handbook,” a security policy is a • “Formal statement of the rules by which people who are given access to an organization’s technology and information assets must abide.” • The policy should address • Access, accountability, authentication, privacy, and computer technology purchasing guidelines

13. Security Mechanisms • Physical security ( Limited access to resources ) • Authentication (Who is requesting network services) • Authorization (Who can access network resources) • Accounting (Auditing – collecting data) • Data encryption (a process of scrambling data to protect it’s integrity)

14. Security Mechanisms • Packet filters (can be set up on routers, firewalls, and servers to accept or deny packets from a particular address or service) • Firewalls (a device that enforces security policies at the boundary between two or more networks).

15. Security Mechanisms • Intrusion Detection Systems (IDS) (detects malicious events and notifies an administrator using email, paging, or logging of the occurrences). • Intrusion Prevention Systems (IPS) (blocks traffic by adding rules to a firewall or by being configured to inspect traffic as it enters a firewall).

16. Encryption for Confidentiality and Integrity • Public/Private key encryption - Asymmetric key system - All devices use the public key to encrypt data to be sent. - Receiving devices decrypt the data using a private key • Digital signature • Encrypt part of your document with a private key - Receiver decrypts document using your public key

17. Encryption for Confidentiality and Integrity After encrypting your document with your private key, you can encrypt the document with another public key (IRS). The IRS decrypts the document twice.

18. Encryption for Confidentiality and Integrity

19. Encryption for Confidentiality and Integrity Figure 8-1. Public/Private Key System for Ensuring Data Confidentiality Figure 8-2. Public/Private Key System for Sending a Digital Signature

20. Modularizing Security Design • Cisco supports reputation filtering and global correlation services so that an IPS can keep-up-to-date on global security trends and more accurately deny traffic from networks known to be currently associated with botnets, spam, and other malware.

21. Modularizing Security Design • Security defense in depth • Network security should be multilayered with many different techniques used to protect the network.

22. Modularizing Security Design • Belt-and-suspenders approach • Don’t get caught with your pants down. Each mechanism should have a backup mechanism. The belt and suspender ensure security of the pants staying up. Use a dedicated firewall to limit access to resources and a packet-filtering router that adds another line of defense.

23. Modularizing Security Design • Secure all components of a modular design: • Internet connections • Public servers and e-commerce servers • Remote access networks and VPNs • Network services and network management • Server farms • User services • Wireless networks

24. Cisco SAFE • Cisco SAFE Security Reference Model addresses security in every module of a modular network architecture.

25. Securing Internet Connections • Physical security • Firewalls and packet filters • Audit logs, authentication, authorization • Well-defined exit and entry points • Routing protocols that support authentication Internet routers should be backed up with additional filters to prevent DoS (Denial of Service) and other attacks. In turn, these filters should be backed up additional filters placed on firewall devices. Monitor Internet

26. Securing Public Servers • Place servers in a DMZ that is protected via firewalls • Run a firewall on the server itself • Enable DoS protection • Limit the number of connections per timeframe • Use reliable operating systems with the latest security patches • Maintain modularity • Front-end Web server doesn’t also run other services

27. Security Topologies DMZ Enterprise Network Internet Web, File, DNS, Mail Servers

28. Security Topologies Internet Firewall DMZ Enterprise Network Web, File, DNS, Mail Servers

29. Securing Remote-Access and Virtual Private Networks • Physical security • Firewalls • Authentication, authorization, and auditing • Encryption • One-time passwords

30. Securing Remote-Access and Virtual Private Networks • Security protocols • Remote users and routers should authenticate with CHAP • Authentication, authorization, and accounting is RADIUS. The database includes authentication and configuration information. Specifies types of services a user is permitted to implement (PPP, FTP, Telnet). • IPsec is an IETF standard that provides confidentiality, data integrity, and authentication between participating peers at the IP layer, IPsec provides a secure path between remote users and a VPN concentrator, and between remote sites and a VPN site-to-site gateway.

31. Securing Network Services • Treat each network device (routers, switches, and so on) as a high-value host and harden it against possible intrusions • Require login IDs and passwords for accessing devices • Require extra authorization for risky configuration commands • Use SSH (Secure Shell) rather than Telnet • Change the welcome banner to be less welcoming

32. Securing Network Services • Routing protocols should be selected that support authentication, including RIPv2, OSPF, EIGRP, and BGP4. • Static and default routes are good choices because they eliminate the need to accept routing updates. • Execute minimal necessary services and establish trust in only authenticated partners.

33. Securing Server Farms • Deploy network and host IDSs to monitor server subnets and individual servers • Configure filters that limit connectivity from the server in case the server is compromised • Fix known security bugs in server operating systems • Require authentication and authorization for server access and management • Limit root password to a few people • Avoid guest accounts

34. Securing User Services • Specify which applications are allowed to run on networked PCs in the security policy • Require personal firewalls and antivirus software on networked PCs • Implement written procedures that specify how the software is installed and kept current • Encourage users to log out when leaving their desks • Consider using 802.1X port-based security on switches

35. Securing Wireless Networks • Place wireless LANs (WLANs) in their own subnet or VLAN • Simplifies addressing and makes it easier to configure packet filters • Require all wireless (and wired) laptops to run personal firewall and antivirus software • Disable beacons that broadcast the SSID, and require MAC address authentication • Except in cases where the WLAN is used by visitors

36. Securing Wireless Networks • IEEE802.11 Specifies Two Forms of Authentication - Open key the client is always authenticated. used for guest access. - Shared key authentication, a WEP (Wired Equivalent Privacy) static key must be properly configured in both the client and the access point. Man-in-the-middle is another form of eavesdropping

37. WLAN Security Options • Wired Equivalent Privacy (WEP) vulnerable to passive attacks and inductive key derivations. If the key is determined, it must be changed on the access point and every client. • IEEE 802.11i • Wi-Fi Protected Access (WPA) • IEEE 802.1X Extensible Authentication Protocol (EAP) • Lightweight EAP or LEAP (Cisco) • Protected EAP (PEAP) • Virtual Private Networks (VPNs) • Any other acronyms we can think of?) • Service Set Identifier (SSID)

38. Wired Equivalent Privacy (WEP) • Defined by IEEE 802.11 • Users must possess the appropriate WEP key that is also configured on the access point • 64 or 128-bit key (or passphrase) • WEP encrypts the data using the RC4 stream cipher method • Infamous for being crackable

39. WEP Alternatives • Vendor enhancements to WEP • Temporal Key Integrity Protocol (TKIP) • Every frame has a new and unique WEP key • Advanced Encryption Standard (AES) • IEEE 802.11i • Wi-Fi Protected Access (WPA) from the Wi-Fi Alliance

40. Extensible Authentication Protocol (EAP) • With 802.1X and EAP, devices take on one of three roles: • The supplicant resides on the wireless LAN client • The authenticator resides on the access point - An authentication server resides on a RADIUS server EAP authenticates users. 802.11 authenticates device based (wireless LAN devices)

41. EAP (Continued) • An EAP supplicant on the client obtains credentials from the user, which could be a user ID and password • The credentials are passed by the authenticator to the server and a session key is developed • Periodically the client must re-authenticate to maintain network connectivity • Re-authentication generates a new, dynamic WEP key

42. Cisco’s Lightweight EAP (LEAP) • Standard EAP plus mutual authentication • The user and the access point must authenticate • Used on Cisco and other vendors’ products • Mutual authentication means the client authenticates the server and the server authenticates the client.

43. Other EAPs • EAP-Transport Layer Security (EAP-TLS) was developed by Microsoft • Requires certificates for clients and servers. • Protected EAP (PEAP) is supported by Cisco, Microsoft, and RSA Security • Uses a certificate for the client to authenticate the RADIUS server • The server uses a username and password to authenticate the client • EAP-MD5 has no key management features or dynamic key generation • Uses challenge text like basic WEP authentication • Authentication is handled by RADIUS server

44. VPN Software on Wireless Clients • VPN is the safest way to do wireless networking for corporations • Wireless client requires VPN software • Connects to VPN concentrator at HQ • Creates a tunnel for sending all traffic • VPN security provides: • User authentication • Strong encryption of data • Data integrity

45. Network Management • Helps an organization achieve availability, performance, and security goals • Helps an organization measure how well design goals are being met and adjust network parameters if they are not being met • Facilitates scalability • Helps an organization analyze current network behavior, apply upgrades appropriately, and troubleshoot any problems with upgrades

46. Network Management Design • Consider scalability, traffic patterns, data formats, cost/benefit tradeoffs • Determine which resources should be monitored • Determine metrics for measuring performance • Determine which and how much data to collect

47. Proactive Network Management • Plan to check the health of the network during normal operation, not just when there are problems • Recognize potential problems as they develop • Optimize performance • Plan upgrades appropriately

48. Network Management Processes According to the ISO • Fault management • Configuration management • Accounting management • Performance management • Security management

49. Fault Management • Detect, isolate, diagnose, and correct problems • Report status to end users and managers • Track trends related to problems

50. Configuration Management • Keep track of network devices and their configurations • Maintain an inventory of network assets • Log versions of operating systems and applications