Internal Security

Strongly protecting the internal Enterprise Campus by including security functions in each individual element is important for the following reasons:

■ If the security established at the Enterprise Edge fails, an unprotected Enterprise Campus is vulnerable. Deploying several layers of security increases the protection of the Enterprise Campus, where the most strategic assets usually reside.

■ Relying on physical security is not enough. For example, as a visitor to the organization, a potential attacker could gain physical access to devices in the Enterprise Campus.

■ Often external access does not stop at the Enterprise Edge; some applications require at least indirect access to the Enterprise Campus resources. Strong security must protect access to these resources.

Figure 3-15 shows how internal security can be designed into the Cisco Enterprise Architecture.

Figure 3-15 Designing Internal Security into the Network

Use authentication ■ servers, OTPs, IPS, and logging to minimize security threats.

Figure 3-15 Designing Internal Security into the Network

Use authentication ■ servers, OTPs, IPS, and logging to minimize security threats.

Use switch port security to control access to the network.

Use access lists to provide security

Do not implement packet manipulation here.

Use host- and network-based IDS and IPS, private VLANs, access control lists, and secure password.

Internal E-Mail

Corporate Server

Use switch port security to control access to the network.

Use access lists to provide security

Do not implement packet manipulation here.

Use host- and network-based IDS and IPS, private VLANs, access control lists, and secure password.

Internal E-Mail

Corporate Server

□ I Cisco Unified Communications Manager

The following are some recommended security practices in each module:

■ At the Building Access layer, access is controlled at the port level using the data link layer information. Some examples are filtering based on media access control addresses and IEEE 802.1X port authentication.

■ The Building Distribution layer performs filtering to keep unnecessary traffic from the Campus Core. This packet filtering can be considered a security function because it does prevent some undesired access to other modules. Given that switches in the Building Distribution layer are typically multilayer switches (and are therefore Layer 3-aware), this is the first place on the data path in which filtering based on network layer information can be performed.

■ The Campus Core layer is a high-speed switching backbone and should be designed to switch packets as quickly as possible; it should not perform any security functions, because doing so would slow down the switching of packets.

■ The Server Farm module's primary goal is to provide application services to end users and devices. Enterprises often overlook the Server Farm module from a security perspective. Given the high degree of access that most employees have to these servers, they often become the primary goal of internally originated attacks. Simply relying on effective passwords does not provide a comprehensive attack mitigation strategy. Using host-based and network-based IPSs and IDSs, private VLANs, and access control provides a much more comprehensive attack response. For example, onboard IDS within the Server Farm's multilayer switches inspects traffic flows.

NOTE Private VLANs provide Layer 2 isolation between ports within the same broadcast domain.

■ The Server Farm module typically includes network management systems to securely manage all devices and hosts within the enterprise architecture. For example, syslog provides important information on security violations and configuration changes by logging security-related events (authentication and so on). An authentication, authorization, and accounting (AAA) security server also works with a one-time password (OTP) server to provide a high level of security to all local and remote users. AAA and OTP authentication reduces the likelihood of a successful password attack.

IPS and IDS

IDSs act like an alarm system in the physical world. When an IDS detects something it considers an attack, it either takes corrective action or notifies a management system so that an administrator can take action.

HIDSs work by intercepting operating system and application calls on an individual host and can also operate via after-the-fact analysis of local log files. The former approach allows better attack prevention, and the latter approach is a more passive attack-response role.

Because of their specific role, HIDSs are often more effective at preventing specific attacks than NIDSs, which usually issue an alert only on discovering an attack. However, this specificity does not allow the perspective of the overall network; this is where NIDS excels.

Intrusion prevention solutions form a core element of a successful security solution because they detect and block attacks, including worms, network viruses, and other malware through inline intrusion prevention, innovative technology, and identification of malicious network activity.

Network-based IPS solutions protect the network by helping detect, classify, and stop threats, including worms, spyware or adware, network viruses, and application abuse. Host-based IPS solutions protect server and desktop computing systems by identifying threats and preventing malicious behavior.

This information was derived from the SAFE Blueprint for Small, Midsize, and Remote-User Networks, available at http://www.cisco.com/go/safe/, and the Cisco Intrusion Prevention System Introduction, available at http://www.cisco.com/en/US/products/sw/secursw/ps2113/index.html.

Authentication, Authorization, and Accounting

AAA is a crucial aspect of network security that should be considered during the network design.

An AAA server handles the following:

■ Authentication—Who? Authentication checks the user's identity, typically through a username and password combination.

■ Authorization—What? After the user is authenticated, the AAA server dictates what activity the user is allowed to perform on the network.

■ Accounting—When? The AAA server can record the length of the session, the services accessed during the session, and so forth.

The principles of strong authentication should be included in the user authentication. Strong authentication refers to the two-factor authentication method in which users are authenticated using two of the following factors:

■ Something you know: Such as a password or personal identification number (PIN)

■ Something you have: Such as an access card, bank card, or token

■ Something you are: For example, some biometrics, such as a retina print or fingerprint

■ Something you do: Such as your handwriting, including the style, pressure applied, and so forth

As an example, when accessing an automated teller machine, strong authentication is enforced because a bank card (something you have) and a PIN (something you know) are used.

Tokens are key-chain-sized devices that show OTPs, one at a time, in a predefined order. The OTP is displayed on the token's small LCD, typically for 1 minute, before the next password in the sequence appears. The token is synchronized with a token server, which has the same predefined list of passcodes for that one user. Therefore, at any given time, only one valid password exists between the server and a token.

This information was derived from Cisco Press's Campus Network Design Fundamentals by Diane Teare and Catherine Paquet, 2006.

Continue reading here: Designing Route Redundancy

Was this article helpful?

0 0