Network security

Network security

• 1.
  Network Security ABSTRACT The biggest threat to network security is underestimating the threat to network security. And as IP networks become the defector standard, ignoring this reality can extract a heavy price down the road. The truth of the matter is that current security technologies pose an unacceptable risk in protecting an organization’s data and intellectual property. Today’s firewall-based security technologies do not fully protect data resources. Only data protection throughout the network can safeguard critical and confidential data, regardless of the success or failure of other security technologies and policies. Therefore, data protection must be the primary layer of defense. As hacking and security threats grow in complexity and organizations face stringent requirements to document access to private data on the network, organizations require a new level of network visibility and surveillance. The world of network security has become an “arms race”. As organizations tighten their external defenses and install improved security tools, threats and attacks emerge to circumvent these security measures. Increasingly, this arms race is taking place in a regulated environment, where government rules such as HIPAA, Sarbanes-Oxley, and the EU Data Protection Directive require organizations to control access to private data and document security breaches. This includes the following. •Identify the need for a network security camera to capture and save all network transactions and activities •Illustrate how network security forensic appliances provide new visibility and evidence for security and compliance investigations •Highlight real-world examples from clients demonstrating the role network security forensics plays in identifying security and compliance violations •Providethekeycomponentstolookforinanynetworksecurityforensicssolution Network security helps investigation.  Network policy violation.  Compliance violation
• 2.
   Access violation  Security violation Where network security is needed: •Monitoring internal threats •Documenting evidence for investigations •Solving the “Who done it” mystery •Complying with government regulations such as HIPAA, SOX, and the EU data Protection Directive •Complying with corporate HR and network- use policies Data in motion: what’s the worst that could happen? Networks today are not the isolated, self-contained islands they once were. With internet gateways giving network access to remote employees, customers, contractors and partners, the network has opened up, increasing productivity and security risks. Network security has relied primarily on keeping the bad guys out. Hackers, thieves and other ne’er-do-wells seeking to do harm are prevented from getting in, most of the time. However, the nature of networks today is dynamic. While data may spend some time on any number of devices – servers, desktops, disk arrays – some of it is in motion, travelling across the network, all the time. That data zipping around the network is the same data that is thoroughly protected while static. And it is more often than not completely unprotected while in motion. Data residing on desktops, laptops and servers is usually protected with at least a password, if not more complex security. While always a good idea, it should not be enough to ensure a good night’s sleep for IT security. So much for perimeter defence and ID management as a comprehensive network security strategy. There are any numbers of reasons your information may be an attractive target: • Intellectual property – your organization’s “special sauce” that gives you critical market differentiation and a leg up on the competition. • Customer information – personal, financial and/or health information can be very valuable. In fact, protecting that information has spawned a growing number of federal and state regulations, including Gramm-Leach-Bliley, Sarbanes-Oxley and California Senate Bill 1386 • Employee information – personal information such as Social Security numbers, bank account numbers and health information
• 3.
  • Other secretinformation – including governmental information regarding homeland or national security, Department of Defense activities or communications, and personal, private data used by any number of agencies • Business-enabling information – customer and prospect opportunities, plans and interactions All networks are untrusted Most enterprises and organizations with far-flung offices, remote back-up data centers and multiple buildings in a campus setting have a complex network to meet all of their communication and business needs. more than a single network, it is usually a network of networks that must communicate and share data with one another. This creates a situation where data is physically leaving a protected facility and moving to another. Whether it’s going over the Internet, a service provider backbone or a wireless link between buildings, that data, which has been protected while at rest on servers, has moved out to where it is available to anyone with the motivation and means to get it. If we take a look at a layered approach to network security, data protection, along with ID management and perimeter technologies, provide the three anchors that protect all aspects of the network: data and intellectual property, networking infrastructure and people. Examples of common networks where data in transit is susceptible to unauthorized access. Broadband wireless link between buildings Many organizations have multiple networks in different facilities that must exchange information. When fibre is impossible or too cost-prohibitive, high-speed wireless provides
• 4.
  an inexpensive andeasy solution. However, all data transmitted over the air through the wireless links is at risk to anyone wanting to access it. Broadband wireless link between buildings Storage IP Networking It is becoming increasingly common for organizations to store and archive their data in a remote facility. Once again, however, this data must travel over entrusted networks to reach its destination, meaning it could be accessed without anyone knowing it. MPLS MPLS (multi-protocol label switching) networks are becoming more and more popular as service providers look for ways to enable multiple customers to have VPNs on the same network. However, the VPNs on the MPLS network simply separate user groups, they don’t protect the data.
• 5.
  Data protection –the primary layer of defense Your data is running around the network in packets that contain addresses, protocol ids, and the actual data. If you protect the packet from its source to its destination you have created an excellent foundation for a secure network. There are three main aspects of data protection on the network: • Confidentiality – Keep your data private • Authentication – Trust your sources • Integrity—Trust your data IP Security (IPSec), defined by the Internet Engineering Task Force (IETF), is the accepted standard for protecting data in transit over an untrusted network and provides the three levels of security. IPSec is a suite of security protocols that protects IP packets. IPSec works on Layer 3, the network layer of the Open Systems interconnection 7- layer networking model. By running on Layer 3, IPSec is able to function transparently to higher layer applications; the applications do not require any knowledge of IPSec in order to use it. By enabling IPSec everywhere on the network that sensitive data travels, the vulnerability of data traveling in the clear is eliminated. IPSec modes of protection IPSec protects IP packets by defining which traffic is to be protected, IPSec uses a protocol called Encapsulating Security Payload (ESP) that provides proof of data integrity, data source authentication and anti-replay by inserting a new IP address and ESP header in
• 6.
  front of thepacket to be protected. This protects the entire IP packet including the originating IP address. Using ESP controls both the encryption and authentication used to protect the IP payload. Tunnel mode ESP (encapsulating security payload) _ Data integrity + authentication _ Anti-replay service _ Confidentiality IPSec encryption IPSec encryption enables confidentiality of data as it travels on the network. • Uses symmetric keys (same keys are used for encryption and decryption) • Uses Diffie-Hellman algorithms and IKE/ISAKMP protocols to derive keys • Encryption algorithms such as AES(Advanced Encryption Standard) Cipher Optics enables IPSec everywhere There are several ways to enable IPSec on the network. The Cipher Optics approach is to use purpose-built appliances designed for Fast Ethernet and Gigabit Ethernet IP networks. With its proprietary TILEA™ architecture, Cipher Optics appliances are paving the way for IPSec everywhere.
• 7.
  To show howCipher Optics IPSec appliances provide data protection is shown in figure below, Internet Key Exchange (IKE) IKE is used to ensure security for virtual private network negotiation and remote host or network access. IKE defines an automatic means of negotiation and authentication for IPSec security associations (SA). Security associations are security policies defined for communication between two or more entities¾the relationship between the entities is represented by a key. The IKE protocol ensures security for SA communication without the pre-configuration that would otherwise be required.
• 8.
  Conclusion New security toolswill continue to emerge to combat constantly evolving security threats. There will never be a single “set it and forget it” security solution for stopping breaches on the network. To effectively address and prevent security breaches requires constant monitoring and adjusting of infrastructure and policy. If a successful attack is perpetrated against an organization, the monitoring solution becomes even more critical to ensure the attack is accurately identified and appropriate steps are taken to prevent future attacks. Network security forensic devices are uniquely positioned to provide a full view of all activities before, during, and after the event. These tools also have the ability to isolate the breach, identify software, scripts and exploits used; and locate potentially compromised infrastructure. The ability to capture all packet-level data is also critical to compliance enforcement and the documentation of potential violations. The ability to accurately diagnose the breach or policy violation through reports and reconstructing communications or web sessions provides evidence necessary for proving compliance.