Infrastructure Security
Scheduler AllocateInterval
You can use the scheduler interval command to control the CPU time spent on processes versus interrupts. This is helpful when you are under attack or during a worm outbreak. When the router is handling thousands of packets per second, the console or Telnet SSH access may be slow and it may be almost impossible do anything. In the following example, process-level tasks will be handled no less frequently than every 500 milliseconds. myrouter(config) scheduler interval 500 In newer platforms, the...
On Wireless Networks
In Chapter 1, Technology Overview, you learned the basics of the 802.1X. As a refresher, 802.1x is a standard that defines the encapsulation methodologies for the transport of the Extensible Authentication Protocol (EAP) protocol. NOTE EAP was originally defined in RFC 2284, which is now obsolete due to RFC 3748. The 802.1X standard allows you to enforce access control when wired and wireless devices attempt to access the network. Figure 8-5 illustrates the main components of 802.1x. Figure 8-5...
Receive Access Control Lists rACLs
Receive access control lists (rACLs) are used to protect the Route Processor (RP) on highend routers from malicious or unwanted traffic that could degrade performance. NOTE From the time this rACLs feature was originally introduced in 12.0 (22S for the Cisco 12000 series routers), numerous service providers have taken advantage of it. However, it is now available on other high-end routing platforms including the Cisco 7500 Series Routers and the Cisco 10000 Series Routers. An rACL is just a...
Configuring Siteto Site VPN
Users at the office in Atlanta need to securely access resources in the Raleigh office. The security administrator configures a site-to-site IPsec tunnel between the Cisco ASA in Raleigh and the Cisco IOS router in Atlanta. The following are the steps that need to be completed to configure the Cisco IOS router in Atlanta to terminate a site-to-site IPsec tunnel with the Cisco ASA in Raleigh. Step 1 Log in to the router using SDM. Step 2 Navigate to Configure > VPN and choose Site-to-Site VPN,...
Configuring Load Balancing
The administrator configures load-balancing on each security appliance. The following are the steps to configure load-balancing for remote access VPN. Step 1 Log in to the Cisco ASA using ASDM. Step 2 On the main menu, choose Wizards. Step 3 Choose the High Availability and Scalability Wizard. Step 4 The High Availability and Scalability Wizard starts. The screen shown in Figure 12-69 is displayed. Click Configure VPN Cluster Load Balancing, as shown in Figure 12-69. Figure 12-69 High...
Configuring IPsec Remote Access VPN
The administrator completes the following steps to configure IPsec remote access VPN on the Cisco ASAs Step 1 Log in to the Cisco ASA using ASDM. Step 2 On the main menu, choose Wizards. Step 3 Select the IPsec VPN Wizard. Step 4 The IPsec VPN Wizard starts. Specify the tunnel type as shown in Figure 12-60. Figure 12-60 Configuring the Tunnel Type Figure 12-60 Configuring the Tunnel Type Step 5 All remote access VPN clients will be connecting to the outside interface. Choose the outside...
Linux Forensics Tools
Two of the most commonly used Linux forensics tools are Autopsy and the Sleuth Kit. These programs are intuitive and are a compilation of the following Despite the fact that Autopsy and the Sleuth Kit run on Linux, they support the NTFS, FAT, Ext2 3, and UFS1 2 file systems. You can download Autopsy and the Sleuth Kit free from http www.sleuthkit.org. Figure 5-2 is a screen shot of Autopsy. Figure 5-2 Autopsy Linux Forensics Tool Figure 5-2 Autopsy Linux Forensics Tool Figure 5-2 shows how you...
Protecting Cisco Unified Communications Manager Express CME
As previously discussed in this chapter, the Cisco Unified CME is an entry-level VoIP solution that runs on Cisco IOS Software routers. It is designed for small businesses and autonomous small enterprise branch offices. CME enables you to provide voice, data, and IP telephony services on a single platform. Because it is an integrated solution within Cisco IOS Software routers, all the best practices of router security that you learned in Chapter 2 apply when securing the Cisco Unified CME...
Configuring AAA on the Infrastructure Devices
The network administrator configures authentication, authorization, and accounting (AAA) for administrative access to all routers within the network. The network administrator uses command authorization to enforce which commands users can invoke and execute in the routers. Example 12-11 shows a AAA configuration template used for all routers within the organization Example 12-11 AAA Configuration on Routers aaa authentication login default group tacacs+ local tacacs-server host 172.18.85.181...
Proactive Security Framework
Many network security frameworks are in the marketplace and most of them have the common goal of providing a methodical and efficient approach to network security. No framework is perfect, you should choose an approach that can help reduce the time, cost, and resources needed to plan and deploy your security strategy. This chapter highlights best practices and benefits of different security frameworks. A framework can help you establish a view of your entire security landscape, identify...
Cisco IOS Auto Secure
Cisco AutoSecure disables the unnecessary global services previously discussed in this chapter. It also enables certain services that help further secure global services that are often necessary. In addition, Cisco AutoSecure hardens administrative access by enabling appropriate security-related logging features. It is recommended in most environments because it implements a range of best practices that help secure any organization. It also reduces the time required to configure each item by...
Wireless Intrusion Prevention System Integration
You can integrate Cisco IPS sensors with the Cisco Unified Wireless Solution. This includes the Cisco IPS sensors, the Cisco Adaptive Security Appliance (ASA), Advanced Inspection and Prevention Security Services Module (AIP-SSM), the Catalyst 6500 Intrusion Detection Prevention Services Module Version 2 (IDSM-2), and the IPS modules for Cisco IOS routers. When you integrate IPS with the Cisco Unified Wireless Solution, the WLC talks to the Cisco IPS sensor via its management port using the...
SYN Cookies in Firewalls and Load Balancers
A commonly used distributed denial of service (DDoS) attack is known as SYN-flooding. In this type of attack, the attacker sends a series of TCP SYN packets that typically originate from spoofed IP addresses. The constant flood of SYN packets can prevent servers within the data center from handling legitimate connection requests. You can use firewalls and security appliances such as the Cisco ASA and the Cisco PIX enabled with the SYN cookies algorithm to combat SYN flood attacks. In large data...
Case Study of a Small Business
This section uses Company-A as an example. Company-A is a small web development company based in Raleigh, North Carolina. Its office in Raleigh hosts 35 employees. The user population is composed of sales, marketing, finance personnel, and several web developers. Figure 12-1 illustrates the network architecture and topology of the Raleigh office of Company-A. The Raleigh office has a simple network architecture. Client workstations are connected to an access switch and then connected to the...
Authentication and Authorization of Wireless Users
The 802.11 standard supports different types of authentication. The two most generic types are open and shared-key authentication. In most wireless networks, a service set ID (SSID) is specified to identify the wireless network. The basic mechanisms of 802.11 augment the identification by using SSIDs with authentication mechanisms that prevent the client from sending data to and receiving data from the access point unless the client has the correct shared key. One of the most basic wireless...
Interactive Access Control
You have already learned that you can access network devices via several interactive methods such as Telnet, rlogin, SSH, and local asynchronous, even modem connections for out-of-band access. On Cisco IOS devices, these interactive access methods have two basic types of lines (or sessions). The first type is the use of standard lines used by console and dialup modem connections. The first type of these connections are known as TTYs. TTY stands for Text Telephone. The Y has a historical value...
Overview of Cisco Unified Wireless Network Architecture
The Cisco Unified Wireless Architecture is a multiservice solution designed for any type of organization. It can be deployed in your corporate offices, branches, retail stores, hospitals, manufacturing plants, warehouses, educational institutions, financial institutions, government agencies, and any other type of organization that needs wireless connectivity. Industry standards including the IEEE 802.11 and the draft IETF Control and Provisioning of Wireless Access Points (CAPWAP) are...
Configuring Active Standby Failover on the Cisco ASA
Maintaining appropriate redundancy mechanisms within infrastructure devices is extremely important for any organization. The Cisco ASA supports active-active and active-standby failover. NOTE When the active unit fails, it changes to the standby state while the standby unit changes to the active state. The unit that becomes active takes ownership of the IP addresses and MAC addresses of the failed unit. The unit that is now in standby state takes over the standby IP addresses and MAC addresses....
Authentication Authorization and Accounting AAA and Identity Management
AAA offers different solutions that provide access control to network resources. This section introduces AAA and identity management concepts. Authentication is the process of validating users based on their identity and predetermined credentials, such as passwords and other mechanisms like digital certificates. Authentication is widely used in many different applications, from a user attempting to log in to the network, web server, and wireless access point to an administrator logging in to a...
Raleigh Office Cisco ASA Configuration
The following sections cover the steps necessary to complete the goals listed earlier. Configuring IP Addressing and Routing This section demonstrates how to configure the interfaces and default gateway on the Cisco ASA using the Adaptive Security Device Manager (ASDM). The following are the configuration steps Step 1 Working with a new Cisco ASA installation, the administrator logs in via the command-line interface (CLI) and sets the management interface IP address (10.10.30.1) and other...
IP Source Guard
IP Source Guard is a Layer 2 feature that works in conjunction with DHCP snooping. When IP Source Guard is enabled, all IP traffic on the port is initially blocked, with the exception of DHCP packets that are processed by the DHCP snooping feature (if enabled). After the end host receives a valid IP address from the DHCP server, or when a user configures a static IP source binding, a Port Access Control List (PACL) is applied on the port to restrict the client IP traffic to specific source IP...
Access Control Lists ACL
When you react to a DDoS or to a worm outbreak, one of the most important matters is how fast you can quarantine and isolate the problem. Quarantining is the process of identifying all infected machines and blocking them from the network to prevent them from infecting other systems (in case of a worm outbreak). The easiest way to quarantine or block systems is by using router and firewall access control lists (ACL) and VLAN ACLs (or VACL) on Cisco switches. VACLs allow port-level filtering on a...
Header Manipulation and Fragmentation
IPv6 is susceptible to fragmentation and other header manipulation attacks. With these types of attacks, the attacker uses fragmentation to evade network intrusion detection systems (IDS), intrusion prevention systems (IPS), and firewalls. An attacker can also use out-of-order fragments to try to avoid an IDS IPS device that is deployed to detect attacks based on the enabled signatures on the system. RFC 2460 prohibits fragmentation of IPv6 packets by intermediary network devices. As is the...
Configuring the Cisco Secure ACS Server for 8021x and Eapfast
Complete the following steps to configure the Cisco Secure ACS server for 802.1x authentication using the EAP-FAST method. You first add the WLC as AAA client on the Cisco Secure ACS server. To add the WLC as a AAA client on Cisco Secure ACS, click the Network Configuration radio button. You can create a network device group to maintain a collection of AAA clients and AAA servers, or you can use the default Not Assigned network device group. In this example, the WLC is added to the Not Assigned...
Management Frame Protection MFP
Management Frame Protection (MFP) enables authentication of all 802.11 management frames between the WLC and wireless access points. MFP protects against direct and man-in-the-middle attacks. It also detects and reports potential phishing attacks. MFP has three main functions Frame protection This enables the wireless access point to protect the management frames by adding a message integrity check information element (MIC-IE) to each frame. Frame validation The wireless access point validates...
Root Cause Analysis and Lessons Learned
Always remember that lessons learned is knowledge or understanding gained by experience (in this case, by the experience during the security incident). The Lessons Learned section in your postmortem should focus on identifying incremental and innovative improvements that will measurably improve the following areas of the organization Technology and configurations The postmortem should include both negative and positive experiences. You should highlight the recurrence of successful outcomes...
Creating a Computer Security Incident Response Team CSIRT
It is unfortunate when large Fortune 500 companies do not have a Computer Security Incident Response Team (CSIRT). In some occasions, their CSIRT consists of one parttime employee. This is why it is extremely important to have management support when creating CSIRTs. It is difficult and problematic to create a CSIRT without management approval and support. Also, the support needed goes beyond budget and money. It includes executives, managers, and their staffs committing time to participate in...
Network Admission Control NAC in Wireless Networks
Network Admission Control (NAC) was initially designed as two separate solutions the NAC Framework and NAC Appliance (formerly known as Cisco Clean Access). The most commonly deployed NAC solution for wireless networks is the NAC Appliance. This section covers how to integrate the Cisco NAC Appliance into the Cisco Unified Wireless solution. As mentioned in previous chapters, the NAC Appliance has three major components In the example illustrated in Figure 8-26, the CAS is configured inline and...
Locking Down the Cisco IOS Router
The security administrator at Company-A must configure the router appropriately to increase the security of the Atlanta office network. The administrator uses the Security Device Manager (SDM) to configure the router and perform a security audit. Using SDM, the administrator can configure the router quickly using the best practices recommended in Chapter 2, Preparation Phase. You can complete the following steps to perform a security audit and fix any discrepancies found on the Cisco IOS...
The Importance of Signatures Updates
Traditionally, IPS and IDS systems depend on signatures to operate. Because of this, it is extremely important to tune the IPS IDS device accordingly and to develop policies and procedures to continuously update the signatures. The Cisco IPS software allows you to automatically download signatures from a management station. Signature updates are posted to Cisco.com almost on a weekly basis. In Chapter 2, you learned about the Cisco Security Center (historically named mySDN or my Self Defending...
Anomaly Detection Within Cisco IPS Devices
When you configure a Cisco IPS device running Versions 6.x and later with anomaly detection services, the IPS device initially goes through a learning process. This is done to configure a set of policy thresholds based on the normal behavior of your network. Three different modes of operation take place when an IPS device is configured with anomaly detection The initial learning mode is performed over a period of 24 hours, by default. The initial baseline is referred to as the knowledge base...
Configuring the Aipssm on the Cisco ASA
Two Cisco ASAs protect the Chicago office internal network. The IP address configuration of both Cisco ASAs is illustrated in Figure 12-51. Figure 12-51 Cisco ASAs at the Chicago Office Figure 12-51 Cisco ASAs at the Chicago Office The following are the IP addresses of each of the interfaces of the primary Cisco ASA (ASA-1) AIP-SSM Management interface 10.200.30.3 The following are the IP addresses of each of the interfaces of the secondary Cisco ASA (ASA-2) AIP-SSM management interface...
Unicast Reverse Path Forwarding Unicast RPF
Unicast Reverse Path Forwarding (Unicast RPF) is a feature that can replace the use of RFC 2827 ingress traffic filtering techniques. Unicast RPF is configured and enabled on a perinterface basis. The main purpose of Unicast RPF is to verify that all packets received from a specific interface have a source address that is reachable via that same interface. The router drops all packets that do not comply. NOTE You must turn on Cisco Express Forwarding (CEF) for Unicast RPF to work. Two Unicast...
Lightweight Access Point Protocol LWAPP
In the Cisco Unified Wireless Architecture, a wireless LAN controller (WLC) is used to manage the wireless access point configuration and firmware creating an LWAPP tunnel. LWAP provides the control messaging protocol and data encapsulation. In other words, the wireless client data packets are encapsulated between the access point and the WLC. Figure 8-21 illustrates how a WLC controls a wireless access point over an LWAPP tunnel. The following steps are illustrated in Figure 8-21 1 The...
Protecting Cisco Unity Express
As mentioned previously in this chapter, Cisco Unity Express is a Linux-based application that runs on Cisco IOS Software routers with either an NM or an AIM. No external interfaces exist on the Cisco Unity Express hardware. In reality, a physical Fast Ethernet interface does exist however, it is software disabled. All traffic to the Cisco Unity Express hardware must pass through the router. On the other hand, you can access Cisco Unity Express via the router command-line interface (CLI) using...
Wireless Security
Wireless networks are becoming more and more popular. Not only can you take advantage of wireless networking at the office, home, a hotel, and coffee shops, but also at airports, train stations, and many other places. Wireless networks increase productivity. Your employees can save time by sending and receiving e-mail or accessing information on network servers from a conference room or any location within your organization that has wireless connectivity. You can also implement a voice over...
Atlanta Office Cisco IOS Configuration
Company-A opened a small branch office in Atlanta, Georgia. This new office has only 4 salesmen and 12 web developers. The Atlanta office network topology is simple. A Cisco IOS Software router with the IOS Firewall features set is configured to protect the internal network. This is illustrated in Figure 12-20. Figure 12-20 Atlanta Office Network Topology Figure 12-20 Atlanta Office Network Topology The router has only two interfaces enabled. The inside interface resides on the 10.100.10.0 24...
Protecting Against Eavesdropping Attacks
Eavesdropping attacks are also known as phone tapping attacks. The main goal is for an attacker to listen, copy, or record a conversation. An example of an eavesdropping attack is an incident reported back in 2006. The phones of about 100 Greek politicians and offices (including the U.S. embassy in Athens and the Greek prime minister) were compromised by a malicious code embedded in Vodafone mobile phone software. The attackers tapped into their conference call system. Basically, by using...
Cisco Traffic Anomaly Detectors and Cisco Guard DDoS Mitigation Appliances
The Cisco traffic anomaly detectors and DDoS mitigation appliances provide a new approach that not only detects increasingly complex and unrepresentative denial of service attacks but also mitigates their effect to ensure business continuity and resource availability. The Cisco DDos solution has two distinct appliances Cisco Traffic Anomaly Detector (TAD) XT This solution is also available in the form of two individual modules for the Catalyst 6500 series switches and the Cisco 7600 Internet...
Cisco Net Flow in the Data Center
Cisco NetFlow provides network traffic visibility that can help in identifying and classifying potential DDoS attempts and other security threats. In addition, it provides valuable information about application usage that can be beneficial for network planning and traffic engineering. You can enable NetFlow in data center infrastructure devices, such as your distribution switches or routers. A new version of NetFlow called Flexible NetFlow is now available on Cisco IOS routers starting with IOS...
CSA Architecture
In the CSA solution architecture, a central management center maintains a database of policies and information about the workstations and servers on which the CSA software is installed. Agents register with the Cisco Security Agent Management Center (CSA-MC). Subsequently, the CSA-MC checks its configuration database and deploys a configured policy for that particular system. NOTE Starting with CSA Version 5.1, the CSA-MC is a standalone system. Prior to Version 5.1, CSA-MC was part of the...
CPU Protection
Attackers already know that targeting CPUs and network processors can affect more than just one server within an organization. Worms and DDoS can bring network infrastructure devices onto their knees costing thousands of dollars. Attackers typically follow two strategies when targeting a CPU. The first tactic that attackers employ is generating large volumes of traffic to the CPU or network processor because CPUs always have a finite capacity for processing packets. All processors have a limit...
Cisco ASA Antispoofing Configuration
The Company-A security administrator wants to protect the infrastructure from spoofed sources. The administrator enables Unicast Reverse Path Forwarding (Unicast RPF) to protect against IP spoofing attacks by ensuring that all packets have a source IP address that matches the correct source interface according to the routing table. To enable Unicast RPF, navigate to Configuration > Firewall > Advanced > Anti-spoofing. Select the desired interface, and click Enable, as illustrated in...
Precise Location Tracking
The Cisco Wireless Location Appliance uses RF fingerprinting technology to track mobile devices to within a few meters. This allows you to gain visibility into the location of people and assets. In addition, RF fingerprinting technology enables you to respond to security issues and thereby gain insight into the location and movement of people and assets, as well as locating rogue wireless access points. The Cisco Wireless Location Appliance supports two location tracking options On-demand...
Network Device Virtualization
Several networking devices support virtualization. You can take advantage of device virtualization to segment and apply different policies within your infrastructure, while saving money in hardware. For example, you can partition a single hardware device into multiple virtual devices. In most cases, each virtual device acts as an independent device. The following devices support virtualization Cisco Firewall Services Module (FWSM) for the Catalyst 6500 series switches Cisco IPS sensors running...
Authentication
Authentication is now available on most routing protocols. You can configure routing devices with a predefined shared secret key that is used to validate each routing update. Most routing protocols support two types of neighbor authentication plaintext and MD5. With plaintext authentication, a secret key is included inside each routing update message. This does not provide much security because an attacker can easily read keys. MD5 authentication works by processing each routing update with an...
Resource Thresholding Notification
Always monitor the resource usage of infrastructure devices for unusual sustained high levels of CPU utilization, low free memory, and large volumes of dropped packets. These practices ease the detection and classification of attacks and outbreaks. NOTE Chapter 3, Identifying and Classifying Security Threats, details numerous techniques to successfully identify and classify network attacks and outbreaks. Several Cisco platforms provide automatic notification mechanisms that are generally based...
Filtering Access Control Lists ACL
You can configure the filters or ACLs using Layer 3 and Layer 4 information. You can configure an IPv6 ACL in a Cisco IOS router using the ipv6 access-list command. The command uses the permit and deny subcommands with the following options ipv6 access-list command and its subcommands permit protocol source-ipv6-prefix prefix-length I any I host source-ipv6-address operator port-number destination-ipv6-prefix prefix-length I any I host destination-ipv6-address operator port-number...
Timeto Live TTL Security Check
TTL Security Check is a security feature implemented in BGP. It helps protect BGP peers from multihop attacks. This feature is based on the Generalized TTL Security Mechanism (GTSM) defined in RFC 3682 and applies only to external BGP (eBGP). NOTE Several organizations are working to implement this feature for other routing protocols, such as OSPF and EIGRP. You can configure a minimum acceptable TTL value for the packets exchanged between two eBGP peers when you use the TTL Security Check...
Infrastructure Protection Access Control Lists iACLs
Using iACLs is a technique that was developed by ISPs, however, it is now a common practice by enterprises and other organizations. Employing iACLs involves the use of ACLs that prevent direct attacks to infrastructure devices. You configure these ACLs to specifically allow only authorized traffic to the infrastructure equipment while allowing transit traffic. Cisco recommends that you configure iACLs into four different sections or modules 1 On the Internet edge, deny packets from illegal...
Arbor Peakflow SP and Peakflow X
Arbor Peakflow SP (for service providers) and Peakflow X (for enterprises) are excellent tools that allow you to obtain network visibility. Based on information collected from routers, such as interface statistics and NetFlow, Peakflow SP and Peakflow X can show you details of the traffic traversing throughout your network. NOTE For more information about these tools, go to http www.arbor.net. Arbor has excellent white papers about anomaly detection and combating day-zero threats at
Open Source Monitoring Tools
You can use several open source monitoring tools in conjunction with NetFlow. If your organization is small, or if you do not have the budget for more sophisticated monitoring tools, you can take advantage of any of these open source tools that are freely available. Table 3-1 includes the most commonly used open source monitoring tools. Table 3-1 Open Source Monitoring Tools Table 3-1 Open Source Monitoring Tools My Netflow Reporting System by Dynamic Networks Most of these tools are designed...