Network Security
Authentication and Authorization
Because authentication and authorization are critical parts of secure communications, they must be emphasized. Authentication establishes the identity of the sender and or the receiver of information. Any integrity check or confidential information is often meaningless if the identity of the sending or receiving party is not properly established. Authorization is usually tightly coupled to authentication in most network resource access requirements. Authorization establishes what you are...
Transport Layer Security Protocols
The following sections describe the security protocols that operate over TCP IP or some other reliable but insecure transport. They are categorized as Transport layer security protocols because their intent is to secure the Transport layer as well as to provide methods for implementing privacy, authentication, and integrity above the Transport layer. The Secure Socket Layer (SSL) is an open protocol designed by Netscape it specifies a mechanism for providing data security layered between...
Network Layer Security
Network layer security pertains to security services at the IP layer of the TCP IP protocol stack. Many years of work have produced a set of standards from the IETF that, collectively, define how to secure services at the IP Network layer. The IP Security (IPsec) protocol suite comprises a set of standards used to provide privacy and authentication services at the IP layer. The current ratified IPsec standards include four algorithm-independent base specifications RFC 2401, the IP Security...
Disables access to minor TCP services such as echo
chargen, discard, and daytime no service udp-small-servers disable access to minor UDP services such as echo, chargen, and discard enable secret 5 1 dLOD QR.onv68q3326pzM.Zexj1 no service finger no service pad configure TACACS+ authentication as default - for users logging in as staff, there is a local database authentication in the event that the TACACS+ server is unavailable aaa new-model aaa authentication login default tacacs+ aaa authentication login staff tacacs+ local aaa authorization...
Line vty 0 4 exectimeout 2
The example in Figure 10-9 shows the remote connection of a remote branch office in Toronto and a remote branch office in New York connecting back to the corporate network in Denver. Both connections are done through local ISPs and use the Internet as the way to transport the data back to the corporate network in Denver. Mobile users also have access to the corporate network using local ISP dial-up connections. Figure 10-9 Virtual Dial-In Using L2TP with IPsec The following security policy is...
Routerconfigaccesslist 101 permit tcp any any
Eq Match only packets on a given port number established established Match established connections gt Match only packets with a greater port number lt Match only packets with a lower port number neq Match only packets not on a given port number precedence Match packets with a given precedence value range Match only packets in the given range of port numbers tos Match packets with the given TOS value Here is a list of the more commonly used TCP port numbers (operands) Router(config) access-list...
PPP Authentication Protocols
Passwords are incorporated into many protocols that provide authentication services. For dial-in connections, the Point-to-Point Protocol (PPP) is most often used to establish a dial-in connection over serial lines or ISDN. PPP authentication mechanisms include the Password Authentication Protocol (PAP), the Challenge Handshake Protocol (CHAP), and the Extensible Authentication Protocol (EAP). In all these cases, the peer device is being authenticated rather than the user of the device. PPP is...
TCPIP Session Hijacking
Session hijacking is a special case of TCP IP spoofing, and the hijacking is much easier than sequence number spoofing. An intruder monitors a session between two communicating hosts and injects traffic that appears to come from one of those hosts, effectively stealing the session from one of the hosts. The legitimate host is dropped from the connection and the intruder continues the session with the same access privileges as the legitimate host. Session hijacking is very difficult to detect....
Subnet Boundaries
A characterization is sometimes made that traffic on different subnets is secure because the traffic is constrained to a single subnet domain. The thinking is that there is a logical separation between different groups of addresses that make up the different network access domains. You can provide filters to permit or deny traffic based on subnet addresses. However, as was pointed out in the preceding section, IP addresses are easy to spoof other security measures should always be used in...
Basic Cryptography
This chapter details the basic building blocks and fundamental issues you need to understand before moving on to more complex security technologies. Cryptography is the basis for all secure communications it is, therefore, important that you understand three basic cryptographic functions symmetric encryption, asymmetric encryption, and one-way hash functions. Most current authentication, integrity, and confidentiality technologies are derived from these three cryptographic functions. This...
Table 11 Brute Force Attack Combinations
A natural inclination is to use the longest key available, which makes the key more difficult to break. However, the longer the key, the more computationally expensive the encryption and decryption process can be. The goal is to make breaking a key cost more than the worth of the information the key is protecting. Note If confidential messages are to be exchanged on an international level, you must understand the current government policies and regulations. Many countries have controversial...
The X509 Standard
The X.509 standard constitutes a widely accepted basis for a PKI infrastructure, defining data formats and procedures related to the distribution of public keys using certificates digitally signed by CAs. RFC 1422 specified the basis of an X.509-based PKI, targeted primarily at satisfying the needs of Internet privacy-enhanced mail (PEM). Since RFC 1422 was issued, application requirements for an Internet PKI have broadened tremendously, and the capabilities of X.509 have greatly advanced. Much...
Protocols Using Authentication Mechanisms
Many protocols require authentication verification before providing authorization and access rights to the user or device. TACACS+, RADIUS, Kerberos, DCE, and FORTEZZA are examples of such protocols. TACACS+ and RADIUS are often used in dial-in environments to provide a scalable authentication database and can incorporate a variety of authentication methods. Kerberos is a protocol used in some campus environments to first verify that users and the network services they use are really who and...
No service finger
Securing the Corporate Network Infrastructure disables access to minor TCP services such as echo, chargen, discard and daytime no service tcp-small-servers disables access to minor UDP services such as echo, chargen and discard prevents client applications from using source routes no ip source-route configure TACACS+ authentication as default - for users logging in as staff, there is a local database authentication in the event that the TACACS+ server is unavailable aaa new-model aaa...
Physical Media Selection
From a security point of view, the type of cable chosen for various parts of the network can depend on the sensitivity of the information traveling over that cable. The three most common cable types used in networking infrastructures are twisted pair, coax, and optical fiber. Optical fiber is most often used in high-bandwidth and long-haul environments. Unlike either twisted pair or coax, optical fiber does not radiate any energy and, therefore, provides a very high degree of security against...
Public Versus Private IP Addresses
The question of whether to use private addressing is becoming a part of network design for many corporate TCP IP application users. The Internet has grown beyond anyone's expectations. With this growth came concerns about Internet address depletion and, more importantly, address allocation procedures and their impact on the Internet routing system. There are a few reasons why private address space could and should be used (such as for environments where external connectivity may not be required...
The Layer 2 Forwarding Protocol
The Layer 2 Forwarding (L2F) protocol was created by Cisco Systems. It permits the tunneling of the link layer that is, High-Level Data Link Control (HDLC), async HDLC, or Serial Line Internet Protocol (SLIP) frames---of higher-level protocols. Figure 2-25 shows the format of the tunneled packet. Figure 2-25 The Format of a Tunneled Packet Using such tunnels, it is possible to decouple the location of the initial dial-up server from the location at which the dial-up protocol connection is...
Impersonation
Impersonation is closely related to unauthorized access but is significant enough to be discussed separately. Impersonation is the ability to present credentials as if you are something or someone you are not. These attacks can take several forms stealing a private key, gaining access to a cleartext user name password pair, or even recording an authorization sequence to replay at a later time. In large corporate networks, impersonation can be devastating because it bypasses the trust...
The Pointto Point Tunneling Protocol
The Point-to-Point Tunneling Protocol (PPTP) was initiated by Microsoft. It is a client server architecture that allows the Point-to-Point Protocol (PPP) to be tunneled through an IP network and decouples functions that exist in current NASs. Decoupling Traditional NAS Functionality Traditionally, the following functions are implemented by a NAS Providing a physical native interface to PSTN or ISDN networks and controlling external modems or terminal adapters. Providing the logical termination...
Other Common Application Protocols
Many multimedia applications used for videoconferencing---for example CU-SeeMe, H.323 (for NetMeeting and ProShare), and RealAudio---use the TCP control channel to establish media channels. This control channel contains information that opens new media channels. Firewalls should have the capability to watch these control channels, to identify those ports that media channels use, and to open additional channels on a dynamic basis. Table 9-1 lists the most common applications that should be...
The Fortezza
Multilevel Information Systems Security Initiative (MISSI) is a network security initiative, under the leadership of the National Security Agency (NSA). MISSI provides a framework for the development and evolution of interoperable, complementary security products to provide flexible, modular security for networked information systems across the Defense Information Infrastructure (DII) and the National Information Infrastructure (NII). These MISSI building blocks share a common network security...
Legal Proof of Authenticity
Authentication of an original document is fundamental to the admissibility of the original document in a court of law. Any copying or conversion process (photocopy, microfilm, electronically scanned image, and so on) must be proven reliable---as must the authenticity of the original document. If there is no capability to authenticate the original document, no amount of reliability evidence with respect to the conversion process will serve to support credibility. If a court admits a record into...
Logical Security Controls
Logical security controls create boundaries between network segments. As such, they control the flow of traffic between different cable segments. When traffic is logically filtered between networks, logical access controls provide security. The example in Figure 6-6 shows three university buildings each connected by a router. The administration building has a LAN that allows only specific IP addresses from the engineering building (144.254.3.3 and 144.254.3.4) and the liberal arts building...
The Layer 2 Tunneling Protocol
Because both L2F and PPTP provide similar functionality, Cisco and Microsoft, along with other vendors, have collaborated on a single standard a track protocol within the IETF, which is now called Layer 2 Tunneling Protocol (L2TP). This protocol is considered a work in progress and addresses the following end user requirements End system transparency. Neither the remote end system nor the home site hosts should require any special software to use this service in a secure manner. Authentication...
The Ping of Death
The Ping of Death is an attack that exploits the fragmentation vulnerability of large ICMP ECHO request (that is, ping) packets. A sample ICMP ECHO request packet is shown in Figure 4-11. Figure 4-11 An ICMP ECHO Request Packet The ICMP ECHO request packet consists of eight octets of ICMP header information followed by the number of data octets in the ping request. The maximum allowable size of the data area is therefore calculated this way The problem is that it is possible to send an illegal...
Risk Mitigation and the Cost of Security
When all the risks have been assessed, the corporation must determine how much risk it is willing to accept and to what degree the assets should be protected. Risk mitigation is the process of selecting appropriate controls to reduce risk to an acceptable level. The level ofacceptable risk is determined by comparing the risk of security hole exposure to the cost of implementing and enforcing the security policy. If some threats are highly unlikely, it may not be worth the cost of creating a...