IPS50SL01

Lesson 1
Defining Security
Fundamentals
© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—1-1

Need for Network Security

The Closed Network
Closed Network
Frame
Relay X.25
Leased Line
Remote Site Frame Relay

X.25 Leased
Line
PSTN
© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-3

The Network Today
Open Network
Mobile
and
Remote
Internet-Based
Users Intranet (VPN)
Internet-Based
Intranet (VPN)
Internet-Based
Extranet (VPN)
Remote Remote
Site Site Partner
Mobile PSTN Site
and
Remote
Users

Threat Capabilities: More Dangerous and
Easier to Use
Sophistication
High of Hacker Tools
Stealth Diagnostics
Packet Forging and Spoofing
Sniffers
Scanners
Hijacking Sessions
Back Doors
Exploiting Known Vulnerabilities

Disabling Audits
Self-Replicating
Code Password
Cracking
Technical
Knowledge
Password
Guessing Required
Low 1980 1990 2000

The Role of Security Is Changing
As businesses become
more open to supporting
Internet-powered initiatives
such as
e-commerce, customer
care, supply-chain
management, and extranet
collaboration, network
security risks are also
increasing.

The E-Business Challenge
Internet E- Supply Chain Customer

Commerce Care
Business
Value
Business security
Workforce E-Learning
requirements:
Optimization • Defense in depth
• Multiple
components
Internet
Presence • Integration into
Corporate e-business
Internet Intranet infrastructure
Access • Comprehensive
blueprint
Expanded access, heightened security risks

Legal and Governmental Policy Issues
• Many governments have

formed cross-border task
forces to deal with privacy
issues.
• The outcome of
international privacy
efforts is expected to take
several years to develop.
• National privacy laws are
expected to continue to
evolve worldwide.

Network Security Is a Continuous Process
Network security is a Secure

continuous process
built around a security
policy. Manage Corporate Monitor
• Step 1: Secure and Improve Security and Respond
Policy
• Step 2: Monitor
• Step 3: Test
• Step 4: Improve Test

Network Security Policy

What Is a Security Policy?
“A security policy is a formal statement of the

rules by which people who are given access
to an organization’s technology and
information assets must abide.”
– RFC 2196, Site Security Handbook

Why Create a Security Policy?
• To create a baseline for your current security

posture
• To set the framework for security implementation
• To define allowed and not-allowed behaviors
• To help determine necessary tools and procedures
• To communicate consensus and define roles
• To define how to handle security incidents
• To inform users of their responsibilities
• To define assets and the way to use them
• To state the ramifications of misuse

What Should the Security Policy Contain?
• Statement of authority and scope

• Acceptable use policy
• Identification and authentication policy
• Internet use policy
• Campus access policy
• Remote access policy
• Incident handling procedure

Primary Network Threats
and Attacks

Variety of Attacks
Internal
Internet Exploitation
Dial-In
Ex
Ex tern Exploitation
plo al
ita
ti o
n
Network attacks can

be as varied as the
systems that they attempt Compromised
Host
to penetrate.

Network Security Threats
There are four general categories of security

threats to the network.
• Unstructured threats
• Structured threats
• External threats
• Internal threats

The Four Primary Attack Categories
All of the following can be used to

compromise your system.
• Reconnaissance attacks
• Access attacks
• Denial of service attacks
• Worms, viruses, and Trojan horses

Reconnaissance Attacks
and Mitigation

Reconnaissance Attacks
Reconnaissance refers to
the overall act of learning
about a target network by
using readily available
information and
applications.

Packet Sniffers
Host A Host B
Router A Router B
A packet sniffer is a software application that uses a network adapter card in

promiscuous mode to capture all network packets. These are the features of
packet sniffers.
• Packet sniffers exploit information passed in clear text. Protocols that
pass information in clear text include the following:
– Telnet
– FTP
– SNMP
– POP
– HTTP
• Packet sniffers must be on the same collision domain.
• Packet sniffers can be general purpose or designed specifically for
attack.
Packet Sniffer Attack Mitigation
Host A Host B
Router A Router B
Here are techniques and tools that can be used to mitigate sniffer attacks:
• Authentication: A first option for defense against packet sniffers is to
use strong authentication, such as one-time passwords.
• Switched infrastructure: Deploy a switched infrastructure to counter the
use of packet sniffers in your environment.
• Antisniffer tools: These tools to consist of software and hardware
designed to detect sniffers on a network.
• Cryptography: The most effective method for countering packet sniffers
does not prevent or detect them but rather renders them irrelevant.

Port Scans and Ping Sweeps
What these attacks attempt to do:

• Identify all services on the network
• Identify all hosts and devices on the network
• Identify the operating systems on the network
• Identify vulnerabilities on the network

Port Scan and Ping Sweep Attack Mitigation
• Port scans and ping sweeps cannot be prevented

entirely.
• IDSs at the network and host levels can usually
notify an administrator when a reconnaissance
attack such as a port scan or a ping sweep is
underway.

Internet Information Queries
Sample IP address query
Sample Domain Name Query

Access Attacks and
Mitigation

Access Attacks
Main purpose of
access attacks on
networks or systems:
• Retrieve data
• Gain access
• Escalate access
privileges

Password Attacks
Hackers can
implement password
attacks by using
several methods:
• Brute-force attacks
• Trojan horse
programs
• IP spoofing
• Packet sniffers

Password Attack Mitigation
Password attack mitigation techniques:

• Do not allow users to have the same password on
multiple systems.
• Disable accounts after a certain number of unsuccessful
login attempts.
• Do not use plain text passwords. An OTP or a
cryptographic password is recommended.
• Use “strong” passwords. Strong passwords are at least
eight characters long and contain uppercase letters,
lowercase letters, numbers, and special characters.
• Force periodic password changes.

Trust Exploitation
• A hacker leverages
existing trust System A trusts System B.
relationships. System B trusts everyone.
• Several trust System A trusts everyone.
models exist. System A

User = psmith; Pat Smith
– Windows
• Domains Hacker System B compromised by hacker.
gains User = psmith; Pat Smith
• Active access to
System A.
directory
– Linux and UNIX
• NFS
Hacker
• NIS+ User = psmith; Pat Smithson NFS=Network File System
NIS+=Network Information Service Plus

Trust Exploitation Attack Mitigation
• Systems on the
outside of a
firewall should
never be
absolutely trusted System A
User = psmith; Pat Smith
by systems on the
inside of a firewall. System B
Hacker
• Such trust should Blocked.
compromised
by hacker.
be limited to User = psmith; Pat
Smith
specific protocols
and should be
validated by Hacker
something other User = psmith; Pat Smithson
than an IP address
where possible.
Port Redirection
• Port redirection is a
type of trust- Source: Attacker Source: Attacker
exploitation attack that Attacker
Destination: A
Port: 22
Destination: B
Port: 23
uses a compromised
host to pass traffic that Compromised
would otherwise be Host A
dropped through a
firewall
• It is mitigated primarily
through the use of
proper trust models. Source: A
• Antivirus software and Destination: B
Port: 23
host-based IDS can
help detect and
prevent a hacker from
installing port Host B
redirection utilities on
the host.
Man-in-the-Middle Attacks
Host A Host B
Data in Clear Text
Router A Router B
• A man-in-the-middle attack requires that the hacker have access to network
packets that come across a network.
• A man-in-the-middle attack is implemented by using the following:
– Network packet sniffers
– Routing and transport protocols
• Possible uses of a man-in-the-middle attack include the following:
– Theft of information
– Hijacking of an ongoing session
– Traffic analysis
– DoS
– Corruption of transmitted data
– Introduction of new information into network sessions
Man-in-the-Middle Attack Mitigation
A man-in-the-middle attack
can see only cipher text.
IPSec Tunnel
Host A Host B
Router A ISP Router B
Man-in-the-middle attacks can be effectively mitigated

only through the use of cryptography (encryption).

Denial of Service Attacks
and Mitigation

Denial of Service Attacks
Denial of service attacks

occur when an intruder
attacks your network in a
way that damages or
corrupts your computer
system or denies you and
others access to your
networks, systems, or
services.

IP Spoofing
• IP spoofing occurs when a hacker inside or outside a network

impersonates the conversations of a trusted computer.
• Two general techniques are used during IP spoofing:
– A hacker uses an IP address that is within the range of
trusted IP addresses.
– A hacker uses an authorized external IP address that is
trusted.
• Here are uses for IP spoofing:
– IP spoofing is usually limited to the injection of malicious
data or commands into an existing stream of data.
– If a hacker changes the routing tables to point to the
spoofed IP address, then the hacker can then receive all the
network packets that are addressed to the spoofed address
and reply, just as any trusted user can.

IP Spoofing Attack Mitigation
The threat of IP spoofing can be reduced, but not

eliminated, through these measures:
• Access control: The most common method for
preventing IP spoofing is to properly configure access
control.
• RFC 2827 filtering: Prevent any outbound traffic on
your network that does not have a source address in
your organization’s own IP range.
• Require additional authentication that does not use
IP-based authentication. Examples of this technique
include the following:
– Cryptography (recommended)
– Strong, two-factor, one-time passwords
DoS and DDoS Attacks
DoS attacks focus on making a service

unavailable for normal use. They have the
following characteristics:
• Differ from most other attacks because they are
generally not targeted at gaining access to your
network or the information on your network
• Require very little effort to execute
• Are among the most difficult to completely eliminate

DoS and DDoS Attack Mitigation
The threat of DoS attacks can be reduced by

three methods.
• Antispoof features: Proper configuration of
antispoof features on routers and firewalls
• Anti-DoS features: Proper configuration of
anti-DoS features on routers, firewalls, and
intrusion detection systems
• Traffic rate limiting: Implementation of traffic rate
limiting with the ISP of the network

Worm, Virus, and Trojan
Horse Attacks and
Mitigation

Worm, Virus, and Trojan Horse Attacks
The primary threats for end-user

workstations are worm, virus, and
Trojan horse attacks.
• A worm executes arbitrary code and
installs copies of itself in the infected
computer’s memory, which infects
other hosts.
• A virus is malicious software that is
attached to another program to
execute a particular unwanted
function on a user's workstation.
• A Trojan horse differs from the other
two only in that the entire application
is written to look like something else,
when, in fact, it is an attack tool.
Worm Attacks
1. The Enabling
Vulnerability
2. Propagation
Mechanism
3. Payload

Worm Attack Mitigation
• Containment: Contain the worm inside your network

and within your network. Compartmentalize parts of
your network that have not been infected.
• Inoculation: Start patching all systems and, if
possible, scanning for vulnerable systems.
• Quarantine: Track down each infected machine
inside your network. Disconnect, remove, or block
infected machines from the network.
• Treatment: Clean and patch each infected system.
Some worms may require complete core system
reinstallations.

Virus and Trojan Horse Attacks
• Viruses are malicious software that is attached to

another program to execute a particular unwanted
function on a user’s workstation. End-user
workstations are the primary targets.
• A Trojan horse is different only in that the entire
application is written to look like something else,
when, in fact, it is an attack tool.

Virus and Trojan Horse Attack Mitigation
Four ways to contain these kinds of

applications:
• Effective use of antivirus software
• Keeping up-to-date with the latest developments in
these sorts of attacks
• Keeping up-to-date with the latest antivirus software
and application versions
• Effective use of intrusion protection

Application-Layer Attacks
Application-layer attacks have the

following characteristics: 7 Application
• Exploit well-known weaknesses,
such as those in protocols, that 6 Presentation
are intrinsic to an application or
system (for example, sendmail, 5 Session
HTTP, and FTP)
4 Transport
• Often use ports that are allowed
through a firewall (for example, 3 Network
TCP port 80 used in an attack
against a web server behind a 2 Data Link
firewall)
• Can never be completely
1 Physical
eliminated because new
vulnerabilities are always being
discovered
Application-Layer Attack Mitigation
Measures you can take to reduce your risks:

• Read operating system and network log files or have
them analyzed by log analysis applications.
• Subscribe to mailing lists that publicize
vulnerabilities.
• Keep your operating system and applications current
with the latest patches.
• Use IDSs, which can scan for known attacks,
monitor and log attacks, and, in some cases, prevent
attacks.

Management Protocols
and Functions

Configuration Management
• Configuration management protocols include SSH,

SSL, and Telnet.
• Telnet issues include the following:
– The data within a Telnet session is sent as clear
text and may be intercepted by anyone with a
packet sniffer located along the data path
between the device and the management server.
– The data may include sensitive information,
such as the configuration of the device itself,
passwords, and so on.

Configuration Management
Recommendations
When possible, the following practices are

advised:
• Use IPSec, SSH, SSL, or any other encrypted and
authenticated transport.
• ACLs should be configured to allow only
management servers to connect to the device. All
attempts from other IP addresses should be
denied and logged.
• Use RFC 2827 filtering at the perimeter router to
mitigate the chance of an outside attacker
spoofing the addresses of the management hosts.

Management Protocols
The following management protocols can be

compromised:
• SNMP: The community string information for
simple authentication is sent in clear text.
• Syslog: Data is sent as clear text between the
managed device and the management host.
• TFTP: Data is sent as clear text between the
requesting host and the TFTP server.
• NTP: Many NTP servers on the Internet do not
require any authentication of peers.

Management Protocol Recommendations
• SNMP recommendations:
– Configure SNMP only with read-only community strings.
– Set up access control on the device you wish to manage.
– Use SNMP version 3 or above.
• Logging recommendations:
– Encrypt syslog traffic within an IPSec tunnel.
– Implement RFC 2827 filtering.
– Set up access control on the firewall.
• TFTP recommendations:
– Encrypt TFTP traffic within an IPSec tunnel.
• NTP recommendations:
– Implement your own master clock.
– Use NTP version 3 or above.
– Set up access control that specifies which network devices
are allowed to synchronize with other network devices.
Summary

Summary
• The need for network security has increased as networks have

become more complex and interconnected.
• These are the components of a complete security policy:
– Statement of authority and scope
– Acceptable use policy
– Identification and authentication policy
– Internet use policy
– Campus access policy
– Remote access policy
– Incident handling procedure
• The security wheel details the view that security is an ongoing
process.
• The security wheel comprises four phases: secure, monitor,
test, and improve.
Summary (Cont.)
• These are four types of security threats:
– Structured
– Unstructured
– Internal
– External
• These are the four primary attack categories:
– Reconnaissance attacks
– Access attacks
– Denial of service attacks
– Worms, viruses, and Trojan horses
• Configuration management and management protocols
are an important part of securing a network.

IPS50SL01

Cargado por

Información del documento

Descripción original:

Derechos de autor

Formatos disponibles

Compartir este documento

Compartir o incrustar documentos

Opciones para compartir

¿Le pareció útil este documento?

¿Este contenido es inapropiado?

Copyright:

Formatos disponibles

IPS50SL01

Cargado por

Copyright:

Formatos disponibles

Lesson 1

© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—1-1

© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—1-2

Remote Site Frame Relay

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-3

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-4

Exploiting Known Vulnerabilities

Low 1980 1990 2000

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-5

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-6

Internet E- Supply Chain Customer

Expanded access, heightened security risks

• Many governments have

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-8

Network security is a Secure

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-9

© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—1-10

“A security policy is a formal statement of the

– RFC 2196, Site Security Handbook

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-11

• To create a baseline for your current security

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-12

• Statement of authority and scope

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-13

© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—1-14

Network attacks can

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-15

There are four general categories of security

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-16

All of the following can be used to

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-17

© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—1-18

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-19

A packet sniffer is a software application that uses a network adapter card in

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-21

What these attacks attempt to do:

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-22

• Port scans and ping sweeps cannot be prevented

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-23

Sample IP address query

Sample Domain Name Query

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-24

© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—1-25

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-26

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-27

Password attack mitigation techniques:

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-28

relationships. System B trusts everyone.

• Several trust System A trusts everyone.

models exist. System A

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-29

Router A ISP Router B

Man-in-the-middle attacks can be effectively mitigated

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-33

© 2005 Cisco Systems, Inc. All rights reserved. IPS v5.0—1-34

Denial of service attacks

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-35

• IP spoofing occurs when a hacker inside or outside a network

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-36

The threat of IP spoofing can be reduced, but not

DoS attacks focus on making a service

© 2005 Cisco Systems, Inc. All rights reserved. IPS 5.0—1-38

The threat of DoS attacks can be reduced by