Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level
‹date/time›
‹footer›
‹#›
------=_NextPart_01C4C034.900DEA80
Content-Location: file:///C:/D5032654/ITE-II-ch14_files/master03.xml
Content-Transfer-Encoding: quoted-printable
Content-Type: text/xml; charset="utf-8"
![](3D"master03_background.gif")
![](3D"master03_image001.gif")
Chapter 14
Network Security
Network Security
14.1 - Develo=
ping
a Network Security Policy
14.2 - Threat=
s to
Network Security
14.3 -
Implementing Security Measures
14.4 - Appling
Patches and Upgrades
14.5 - Firewa=
lls
<=
span
style=3D'font-size:88%;visibility:hidden'>•
<=
span
style=3D'visibility:hidden'>•
Developing a Network Security Policy
------=_NextPart_01C4C034.900DEA80
Content-Location: file:///C:/D5032654/ITE-II-ch14_files/slide0003.htm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="us-ascii"
Access=
ing
Security Needs
•There must always be a delicate balance betwe=
en
security and accessibility.
•The more accessible a network is, the less secu=
re
it is.
•When it comes to a computer network, how =
much
security is enough?
•There are several factors to consider:
=
;
–The type of business in which =
the company
engages
–The type of data stored on the =
network
<=
/span>
–The management philosophy of the
organization
![](3D"slide0003_image003.jpg")
Accept=
able
Use Policy
•The first step in creating a security policy =
for
a =
company
network is to define an Acceptable Use Policy (AUP).
<=
/span>
•An AUP tells the users what is acceptable and=
allowed on the company
network.
•To view some examples of AUPs, visit these websites:
![](3D"slide0005_image005.jpg")
Userna=
me
and Password Standards
•<=
span
style=3D'font-family:Arial;mso-ascii-font-family:Arial;mso-bidi-font-famil=
y:
"Times New Roman";mso-hansi-font-family:Arial;font-size:71%'>Usually the
system administrator will define the naming convention for <=
span
style=3D'position:absolute;top:26.49%;left:10.67%;width:86.14%;height:4.5%=
'>the usernames=
on
a network.
•<=
span
style=3D'font-family:Arial;mso-ascii-font-family:Arial;mso-bidi-font-famil=
y:
"Times New Roman";mso-hansi-font-family:Arial;font-size:71%'>A common exam=
ple
is the first initial of the person's first name and then the enti=
re
last name.
<=
span
style=3D'font-size:71%;visibility:hidden'>•
<=
span
style=3D'font-size:71%;visibility:hidden'>•
<=
span
style=3D'font-size:71%;visibility:hidden'>•
<=
span
style=3D'font-size:71%;visibility:hidden'>•
<=
span
style=3D'font-size:71%;visibility:hidden'>•
<=
span
style=3D'font-size:71%;visibility:hidden'>•
•A complex
username naming convention is not as important as having a comp=
lex
password standard.
•<=
span
style=3D'font-family:Arial;mso-ascii-font-family:Arial;mso-bidi-font-famil=
y:
"Times New Roman";mso-hansi-font-family:Arial;font-size:71%'>When assigning
passwords, the level of password control should match the lev=
el
of protection required.![](3D"slide0006_image007.jpg")
Rules =
for
Network Access
•A system
administrator who assigns the proper permissions on the share drives=
and
directories defines the rules for network access.
=
•By assigning =
the
proper security permissions on the network, the system administrat=
or
should know who has access to specific directories.
=
•Proper
maintenance by the system administrator will be required to
examine auditing logs of attempts that have been mad=
e to
access the network shares. Policy=
for
Disposal of Materials
•<=
/span>Hardware,
software, and data should never just be thrown away.
•<=
/span>There are str=
ict
regulations that should be followed to control the
disposal of computer components.
•<=
/span>The system
administrator is responsible for developing a policy based on
environmental and safety guidelines for hardware that no longer works.
•<=
/span>To view some
examples of the disposal of materials policies visit
these websites:
![](3D"slide0008_image009.jpg")
Virus
Protection Standards
•<=
span
style=3D'font-family:Arial;mso-ascii-font-family:Arial;mso-bidi-font-famil=
y:
"Times New Roman";mso-hansi-font-family:Arial;font-size:86%'>Place proper
filters and access lists on all the incoming gateways to protect the
network from unwanted access.
•To prevent
viruses, e-mail policies also need to be developed that
state what may be sent and received.
•These websites
provide sample e-mail policy standards:
![](3D"slide0004_image011.jpg")
Online
Security Resources
•Web-based
resources offer critical information and powerful tools that can be used to protec=
t a
network. Some of the be=
st
online security resources are the NOS manufacturer websites
•&=
#13;
•To view exampl=
es
of the online
• security resources visit these
• websites:
![](3D"slide0009_image013.jpg")
Server
Room Security
•=
To protect
computing resources, make sure that there is a lo=
cked
door and four walls between the server and the
rest of the area.
•There are a
variety of ways to permit or deny access to that area aft=
er
it has been secured.
•<=
/span>The lock and =
key
is a tried and true method for physically securing the server
environment.
•<=
/span>This method w=
orks
great if there are a limited number of people who ne=
ed
access.
=
![](3D"slide0010_image015.jpg")
Server
Room Security
•Using a combination locking mechanism is similar to a lock =
and key. The
advantages to this method:
–Keys no longer have to be distributed
–Key control lists no longer have to be maintained
=
;
–Combinations can also be reset when needed
•The one drawback to this model is that it is very easy to s=
hare
a combination with someone not authorized.
=
•Card readers are the most common of the access control mechanisms. &=
#13;
•They work by reading a magnetic signature off an access car=
d or
token.
•A biometrics based access control system uses measurable physical
characteristics to authenticate users into an environment (fingerprints,
retinal patterns, or speech).
Anti-T=
heft
Devices
for Server Hardware =
for Server Hardware =
•A common security measures is the locking mechanism =
included as p=
art
of the server itself.
•Most high end servers enable the case to be locked, and in =
many cases to
lock the drives into the server chassis.
•Almost all rack systems include locking front and back
doors.
•Removable media drive locks are locking
devices.
–These devices=
fit
over the floppy drive, zip drive, and CD-ROM drive to
prevent unauthorized access.
•Some servers are shipped with holes in the cases, which are=
predrilled fo=
r a
padlock.
=
•Alarms are the final add-on, and best suited for the shared=
office
environment.
Securi=
ng
Removable Media
•Security of removable media includes the following:&#=
13;
–Removable disks, floppy, Zip, Jaz, LS120, CD-RW
=
–Removable hard drives
–Backup media, tapes
•Several methods are used to ensure the security of <=
/span>removable med=
ia:
–Lock the media in an office
–Place the media in a locked cabinet with strict key
control
–Place the media in a safe, or a fire-resistant safe&#=
13;
–Engage a third-party firm to store the tapes in their
secure facility
Threat=
s to
Network Security
Overvi=
ew:
Internal/External Security
•The Internet
essentially works by following rules that are open=
to
the public.
•If one studies
the rules enough, one is bound to find loopholes
and weaknesses that can be exploited. &#=
13;
•<=
/span>The number of
individuals, organizations, and institutions
connected to the Internet are growing.
•<=
/span>Connecting to=
the
Internet opens the door to network intruders.
![](3D"slide0015_image017.jpg")
Outside
Threats
<=
span
style=3D'font-size:75%'>•Several outsi=
de
sources can cause attacks:
•Hackers - the true hacker desires to dissect systems Denial=
of
Service (DoS)
•A DoS attack
occurs when the targeted system cannot service
legitimate network requests effectively.
•As a result, =
the
system has become overloaded by illegitimate messages.
•DoS attacks
originate from one host or a group of hosts.
<=
/span>•When the atta=
ck
comes from a coordinated group of hosts, such attacks are called
Distributed DoS (DDoS).
•A common DoS
attack is to overload a target system by sending mo=
re
data than it can handle.
Denial=
of
Service (DoS)
•<=
/span>There are sev=
eral
specific types of DoS attacks:
–A buffer over=
flow
attack is designed to overwhelm the software runn=
ing
on the target system.
–The so-called
ping of death is a well known buffer overflow DoS
attack.
–<=
/span>The TCP
synchronization (SYN) attack exploits the =
TCP protocol
three-way handshake.
•<=
/span>The attacker
sends a large volume of TCP synchronization requests (SYN requests=
).
![](3D"slide0018_image019.jpg")
Distri=
buted
Denial of Service (DDoS)
•<=
/span>Before the ha=
cker
can attack the ultimate target, a "fleet" of "zombies=
"
(unsecure host with a permanent Internet connection) must be
coordinated for the attack.
•<=
/span>The hacker ta=
kes
advantage of the zombie's lack of security.
•<=
/span>The hacker br=
eaks
in to the system either directly or through an e-mail vir=
us.
•<=
/span>The goal of t=
he
break in or virus is to install software on the zombie system.
•The hacker us=
es
the zombies to launch a DDoS attack on the ultimate targ=
et.
![](3D"slide0019_image021.jpg")
Well K=
nown
Exploits
•<=
/span>Each combinat=
ion
of NOS and application software contains it’s own unique se=
t of
vulnerabilities and weaknesses.
•<=
/span>Threats to
network security comes from individuals with sophisticated
tools.
•<=
/span>Some of these
individuals are often called "script kiddies".
=
•Script kiddy =
is a
negative term used to describe immature individuals t=
hat
use scripts, software programs, or techniques
created by other, more skilled crackers.
![](3D"slide0020_image023.jpg")
Trojan Horse Programs
•A Trojan horse is a program that presents=
itself as another program to obtain
information. For example, there is a Trojan horse that emulates the system login screen.
•When users type in their account name and=
password, the information is stored or transmitted to the originator of the Troj=
an =
horse. The username and password can
then be used to g=
ain
access to the system.
<=
span
style=3D'font-size:88%;visibility:hidden'>•
Inside Threats
•<=
span
style=3D'font-family:Arial;mso-ascii-font-family:Arial;mso-bidi-font-famil=
y:
"Times New Roman";mso-hansi-font-family:Arial;font-size:71%'>Corporate
espionage is the most sophisticated type of internal security thre=
at.
•Employees can=
be
approached by competing companies.
•There are
freelance corporate spies who take assignments on a contract basi=
s.
•Internal secu=
rity
breaches can also be the result of rebellious users who
disagree with security policies.
•<=
span
style=3D'font-family:Arial;mso-ascii-font-family:Arial;mso-bidi-font-famil=
y:
"Times New Roman";mso-hansi-font-family:Arial;font-size:71%'>While not
accidental, these breaches are not designed to cause harm.
![](3D"slide0021_image025.jpg")
Implem=
enting
Security Measures
File
Encryption
•File encryption is a way of encrypting da=
ta
stored on a computer disk so that it is unreadable to
anyone but the creator of the data.
•Windows 2000
includes a file encryption function.
•Windows 9x and Windows NT do not.
<=
/span>
•Third party
encryption programs are available for OSs:
–PC Guardian,
Deltacrypt, Winzap
![](3D"slide0023_image027.jpg")
IP
Security
•<=
/span>IPSec secures
data at the packet level.
•<=
/span>It works at t=
he
network layer of the OSI model.
•<=
/span>The
Authentication Header (AH) enables verification of the sender
identity.
•<=
/span>Encapsulating
Security Payload (ESP) ensures the confidentiali=
ty
of the data itself.
•IPSec can ope=
rate
in either the transport mode or the tunnel mode.<=
/span>
![](3D"slide0024_image029.jpg")
Secure
Sockets Layer (SSL)
•SSL was developed by Netscape to provide =
security for its web browser.
•It uses public and private key encryption.
•SSL operates at the application layer and must be supported by the user application.
![](3D"slide0025_image031.jpg")
E-mail
Security
•<=
/span>E-mail users
think they have the same expectation of privacy when
sending e-mail as they do when sending a letter through
the postal service.
•<=
/span>A more accura=
te
expectation would be to assume that the e-mail is like a
postcard that can be read by anyone who handles it du=
ring
its journey from sender to recipient.
•<=
/span>They often tr=
avel
through dozens of nodes or servers on their way from
sender to recipient.
![](3D"slide0026_image033.jpg")
![](3D"slide0026_image035.jpg")
Public=
/Private
Key Encryption
•<=
/span>One key is
published and is widely available.
•<=
/span>The other key=
is
private and known only to the user.
•<=
/span>Both keys are
required to complete the secure communication.
•<=
/span>This type of
encryption, is also referred to as asymmetric encryption.
•<=
/span>With this typ=
e of
encryption, each user has both a public and a private key, calle=
d a
key pair.
![](3D"slide0027_image037.jpg")
Appling
Patches and Upgrades
Finding
Patches and Upgrades
<=
span
style=3D'font-size:86%'>•Patches are f=
ixes
to existing software code.
•A NOS manufacturer typically provides security patches.
![](3D"slide0029_image039.jpg")
Select=
ing
Patches and Upgrades
•<=
span
style=3D'font-family:Arial;mso-ascii-font-family:Arial;mso-bidi-font-famil=
y:
"Times New Roman";mso-hansi-font-family:Arial;font-size:79%'>Software make=
rs
recommend installing software security patches
immediately.
• This is done =
to
reduce exposure to known vulnerabilities.
•Software vend=
ers
release security updates as soon as they are available.
•Understanding=
the
effect on the system will help determine if an update,
fix, or patch is necessary.
![](3D"slide0030_image041.jpg")
Applyi=
ng
Patches and Upgrades
•Periodically, NOS vendors issue updates to their netw=
ork operating
systems. These updates have various names:
–Microsoft Service Packs
–IBM Fixpacs
–Novell Patches
•These updates
usually fix bugs or close security holes that have been fou=
nd
in the released version of the OS.
•Download the
updates from the network operating system vendor’s
website.
![](3D"slide0031_image043.jpg")
Firewa=
lls
Introd=
uction
to Firewalls and Proxies
•<=
/span>A proxy is
software that interacts with outside networks on
behalf of a client host.
•<=
/span>Typically, cl=
ient
hosts on a secure LAN request a web page from a
server running proxy services.
•<=
/span>The proxy ser=
ver
then goes out on the Internet to retrieve the =
web
page.
•<=
/span>The web page =
is
then copied to the proxy server, this is referred to as
caching.
![](3D"slide0033_image045.jpg")
![](3D"slide0033_image047.jpg")
Introd=
uction
to Firewalls and Proxies
•Administrators
use Network Address Translation (NAT) to alter the sou=
rce
address of packets originating from a secure LAN. &=
#13;
•<=
/span>This allows
secure LANs to be addressed using private IP addresses.=
3;
•<=
/span>Private IP
addresses are not routed on the Internet.
•An outside ha=
cker
cannot directly reach a computer with a private
address.
•Some experts =
make
a distinction between NAT and a firewall. Oth=
ers
look at NAT as part of a comprehensive firewall solution.
![](3D"slide0034_image049.jpg")
Packet
Filtering
•The most basic
firewall solution is an IP packet filter.
•<=
/span>To configure a
packet filter, a network administrator must define the ru=
les
that describe how to handle specified packets.
=
•The most basic
firewall solution is an IP packet filter.
•<=
/span>To configure a
packet filter, a network administrator must define the ru=
les
that describe how to handle specified packets.
![](3D"slide0035_image051.jpg")
Packet
Filtering
•Both TCP and =
UDP
use port numbers to address specific applications running on a
host.
•Both TCP and =
UDP
use port numbers to address specific applications running on a
host.
•Firewall soft=
ware
must guess at what connectionless traffic is invited and
what connectionless traffic is not.
•The most
comprehensive form of packet filtering examines layer 3 and 4
headers and the layer 7 application data as well.
•Layer 7 firew=
alls
look for patterns in the payload of the packet.
=
•This is done =
in
an effort to determine what application is being used, s=
uch
as HTTP, FTP, and so on.
Firewa=
ll
Placement
•<=
/span>A boundary ro=
uter
connects the enterprise LAN to its ISP or the
Internet.
•<=
/span>The boundary
router should only allow HTTP, FTP, mail, and DNS relat=
ed
traffic to the DMZ.
•<=
/span>The DMZ is
designed to keep the inside network clean.
<=
/span>
•<=
/span>The NOS serve=
rs
in the DMZ should be tightly configured.
![](3D"slide0037_image053.jpg")
Common
Firewall Solutions
•<=
/span>The PIX Firew=
all
515 uses TFTP for image download and upgrade.
•It has a low
profile design, 128,000 simultaneous sessions, and 170 =
Mbps thru-put.
•The PIX Firew=
all
520 uses a 3.5-inch floppy disk drive to load the image and
upgrade.
•<=
/span>It has an
enterprise chassis design, 256,000 simultaneous sessions, and=
240
Mbps thru-put.
•<=
/span>The PIX Firew=
all
is secure right out of the box.
•<=
/span>Default setti=
ngs
allow all connections from the inside interface acc=
ess
to the outside interface.
![](3D"slide0038_image055.jpg")
![](3D"slide0038_image057.jpg")