Downloaded 344 times
![15
The growing Vulnerability gap
Vulnerability
]
1995 1997 1999 2001 2003 2005
HOSTILE
ACCESS
DENIAL OF
SERVICE
APPLICATION
LAYER
EMAIL SERVER
ATTACKS
EMAIL
VIRUSES
BUSINESS THREATS
RESPONSE CAPABILITY](https://image.slidesharecdn.com/nwsecurity-160316231408/75/Network-security-Defense-in-Depth-15-2048.jpg)
Uploaded byDilum Bandara
Network security - Defense in Depth
The document provides an overview of network security threats and countermeasures. It discusses various types of threats like viruses, denial of service attacks, and spoofing. It recommends a defense-in-depth approach using multiple layers of security like firewalls, intrusion detection systems, antivirus software, and encryption. Specific security measures are examined, including network monitoring, access control, and securing servers and applications.
More Related Content
![Overview of the Cyber Kill Chain [TM]](https://cdn.slidesharecdn.com/ss_thumbnails/cybersecuritykillchain8-161209191549-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Network security - Defense in Depth
More from Dilum Bandara
Network security - Defense in Depth
- 1.
- 2. 2 Objective To providean overview of security threats in a networked environment , countermeasures & relating technologies
- 3. 3 Threats Viruses/Worms BufferOverflow Denial of service (DoS) Spoofing & Sniffing Address/Port scanning Hacking Trojan horses Logic Bombs Trap Doors Covered Today
- 4. 4 Outline Security risk Defense-in-Depth Threats in more detail Counter measures Firewalls Server Protection Enterprise level antiviral solutions Security Vs Sri Lanka Demo
- 5. 5 Risk Hackers aregetting smarter They don’t need to be TCP/IP guru Enough tools are freely available More badly – they don’t have idea of what they are doing The security chain is only as strong as its weakest link - users
- 6. 6 Who should beconcerned? Any 1 who has access to Internet Regardless of their size Every 1 in 2 small business will be hacked in end of 2003 60% of companies won’t be aware until serious damage happens
- 7. 7 Defense-in-Depth No singleproduct could deliver all It is advisable to combine Awareness and Commitment Firewall Network and System Monitoring Access Control & Authentication Anti-Virus Encryption VPN Server Integrity Auditing
- 8. 8 Internet OS Firewalls Intrusion Detection Perimeter Anti-Viral Perimeter InternalUsers and Dial-up Access Users OS Authentication Trusted OS Access Control Host-Based Anti-ViralOS Security Server Security OS Files, Directories, Applications and Configuration Settings Secured Private Communications illustrated…
- 9. 9 Total access Vsno access User wants world to be at their fingertip Sys Admin want to stop as much as The best way to survive is to have no access We need a compromise Answer is : Security Policy
- 10. 10 Security Policy Ineed to protect things but how? Security policy is a compromise that organization decides to adopt between absolute security & absolute access Who can get in/out Where they can go When they can get in/out What they can bring in/carry out Physical access Protecting management station
- 11. Security should befrom your door step to the Internet gateway If there is a open door surely some one will probe in
- 12. 12 Benefits of apolicy User is the key Users gain a sense that the organization is looking out to protect their files and their livelihood Users often find that they have access freedoms they were not previously aware of Users gain an understanding that access limitations are implemented to protect the organization from disaster
- 13. 13 Done? I publishedthe policy I have all the necessary devices My virus guard gets updated automatically Hahaha….I’m Secure!!! No, wait I’ll show you another magic
- 14. 14 Why? Security isa dynamic process Its like a Cricket match When one hacker goes off another hacker of a different style comes to bat Not a 1 step solution So you are never done It needs lot of vigilance & maintenance
- 15. 15 The growing Vulnerabilitygap Vulnerability ] 1995 1997 1999 2001 2003 2005 HOSTILE ACCESS DENIAL OF SERVICE APPLICATION LAYER EMAIL SERVER ATTACKS EMAIL VIRUSES BUSINESS THREATS RESPONSE CAPABILITY
- 16. 16 Vulnerability Window Isthe time gap between 1st attack and until you get ready to face it Indicate how vulnerable you are Higher the window size more vulnerable you are
- 17. 17 Illustration – Timein GMT 1st attack – 2:30 am Security Partner get noticed 5:30 am Patch is available 11:45 am Ready to face the challenge 3:50 pm Vulnerability window 13:20
- 18. 18 Narrowband Vs Broadband Narrowband Dial-up Dynamic IPs Broadband Always connect Static IPs Door is always open
- 19. 19 But…. Neither issecure Because Example: FBI’s Carnivore machine
- 20. 20 Terminology Hacker –people who get in but no harm (or help for better security) Cracker – people who get in & do harm Hacking – unauthorized probing Cracking – applying patches to software for illegal registration
- 21. 21 DoS attacks Denialof Service Degrade performance or crash the server Ping of Death SYN Flooding Ping Flood Smurf Attacks Buffer Overflow Exploiting the CGI
- 22. 22 Ping of Death Exploits bugs on UNIX, Windows, MacOS Host crashes when large Ping packet arrives (ICMP Echo > 64KB) Solution OS patch can correct the problem No longer an attack
- 23. 23 SYN Flooding Makeuse of TCP 3 way handshaking Use unavailable IP address Solution No solution Minimize the no of uncompleted connections the validation timeout
- 24. 24 Ping Flood &Smurf Attacks Send large number of Pings to the host same time Send large number of pings as coming from the host Solution Configure routers, NATing device or Firewall
- 25. 25 Buffer Overflow Causedwhen more data is given to a program than that it can handle Extra data contains malicious code If overwrite system memory area could execute easily E.g. Nimda, Code Red II Solution Protect the stack buffer
- 26. 26 Exploiting the CGI If program blindly accept request from browser, could provide access to shell With privileges of CGI program E.g. http://fake.name.com/cgi- bin/name.cgi?fgdn=%Acat%20/etc/passwd Solution Filter unwanted commands Remove the shell
- 27. 27 Address/Port probing Sequentialsearch of IP address with open ports Then exploit vulnerabilities of programs Make use of running Trojan horses Back Orifice Solution Stateful packet filtering
- 28. 28 Port scanning how? TCP SYN scanning Send a packet with SYN to initiate a connection If reply comes with SYN ACK port is open TCP FIN Scanning Send a FIN (finish) to host If reply with RST (reset) comes port is open
- 29. 29 Use of IPOptions Use of Optional header in IP header Used for testing purposes Source routing If any authentication is done according to the path ??? Solution Block all packet with optional header
- 30. 30 Spoofing attacks Useof false identity to cheat the server, router or firewall and gain access E.g. sending external packet with internal source IP Solution Block at the router, NAT or firewall Both incoming & outgoing
- 31. 31 Solutions ID (IntruderDetection) Firewalls NAT VPN URL filtering DMZ Server Protection Antiviral solutions
- 32. 32 ID (Intruder Detection) Use all sorts of login to check for vulnerabilities Cannot prevent attack but could detect after or when immerging Too complicated, need lot of vigilance Passive security
- 33. 33 IP (Intruder Prevention) Prevent before it happens Active security Need more processing power Methods Protocol anomaly detection Signature based detection Behavior based detection Prevention is better than detection
- 34. 34 NAT (Network AddressTranslation) IP masquerading or port forwarding Take address from one network & translate to a IP address of another Hides hosts of one network from others Dynamic NAT 1-to-1 NAT Static NAT
- 35. 35 VPN (Virtual PrivateNetwork) Gives you a private path (channel) in a public path End to end encrypted Use IPSec, L2TP or PPTP ? ?
- 36.
- 37. 37 VPN Cont…. Overheadof encryption is too much – need lot of processing power Bandwidth of high speed connections would drop dramatically If VPN server to be use it should be dedicated Firebox® 4500 200 Mbps firewall/100Mbps VPN Firebox® 2500 200 Mbps firewall/75Mbps VPN Firebox® 1000 200 Mbps firewall/60Mbps VPN Firebox® 700 150 Mbps firewall/5Mbps VPN
- 38. 38 URL Filtering Filteringof web pages against a filtering database Database is controlled by 3rd party You can add your own sites or exceptions Filtering is based on user, user group, time of the day, etc.
- 39. 39 DMZ (Demilitarized Zone) Place where you keep your publicly available servers Separate from other local hosts and application servers Provides better security
- 40. 40 Firewalls Device whichprotects resources of private network from outside intrusions Firewall examines each packet passes through it against assigned set of rules Not a virus guard Stance Stance dictates what firewall does when absence of a rule Stance is to block everything unless specifically allowed
- 41. 41 Where does itfits in
- 42. 42 Interfaces External Interface connection to external interface (typically Internet) Trusted Interface connection to internal interface which needs maximum protection Optional Interface connection to DMZ or free areas. Public Web, e-mail FTP, DNS servers could be connected here
- 43. 43 Firewall Security Policy Which hosts send/receive which kinds of traffic communication links require authentication and/or encryption users are authorized to use various services through the Firewall What communication protocols and content types are allowed times of day organization members are able to browse the Web types of Web sites organization members can visit
- 44. 44 Technology – Packetfiltering Based on the header information Incoming & outgoing packets are treated separately Filter packets bases on IP address, Port, Protocol, Type of service Works on Network & Transport layers Very effective but can not detect (stateless) attacks like DoS
- 45. 45 Technology – CircuitRelay Use none header information User, time of day Dynamic packet filtering Keep track of states Really effective when both packet filtering & circuit relay are combined together
- 46. 46 Application Presentation Session Transport Network Data Link Physical Transport Internet Host tonetwork Application Security Proxy Circuit Relay Packet Filter OSI TCP/IP Layer Comparison
- 47. 47 Security Proxy Proxyis a program which intercepts packets, examine content, take some action to safeguard the server Firewall goes beyond packet filtering & circuit relay Detect forbidden contents Each packet is stripped of its wrapping, analyzed, processed, re-wrapped & forwarded Add some delay as well
- 48.
- 49. 49 Proxies - Advantages make networks harder to hack by blocking entire categories of commonly used attacks concealing details about internal network servers from the public Internet help to use network bandwidth more effectively by preventing unwanted or inappropriate traffic entering to the network Proxies reduce corporate liability by preventing a hacker from using networks as a launch point for further attacks Simplify the management of networks by providing administrator with tools and defaults that can be applied broadly, rather than desktop by desktop
- 50. 50 Drop-in & RoutedNetworks
- 51.
- 52. 52 Software Vs Hardware Server based – dedicated Insecure OS Not a real-time OS Pay for things that are not necessary 3 vendors Frequent patches Licensed based Although initial cost is low TCO is high Dedicated box Hardened OS Single vender Product based Hard to apply firmware updates No hard disk (not in all firewalls) Initial cost is bit high but TCO is significantly lower
- 53. 53 ASIC (Application SpecificIC) Hardware beats software because of ASIC Software is hard coded to chip CPU Packet Classification Firewall rule enforcement IPSec (AH, ESP) 3DES NAT SNMP Management Interface (GUI, CLI) Statistics Logs Alarms QoS PKI Load Balancing NICNIC Data Path L2TP PPTP System Bus DES MD5/SHA
- 54. 54 ASIC… System Bus becomesthe bottleneck NICNIC CPU Packet Classification Firewall rule enforcement IPSec (AH, ESP) 3DES NAT SNMP Management Interface (GUI, CLI) Statistics Logs Alarms QoS PKI Load Balancing System Bus Data Path Encryption Accelerator DES MD5/SHA
- 55. 55 Intelligent ASIC SYSTEM BUS Logs Alarms PKI Statistics SNMP Interface(GUI, CLI) Management CPU Qos NAT Load Balancing Firewall Rule Inforcement IPSec DES 3DES MD5, SHA1 Packet Classification Custom Security ASIC DATA PATH 3) Following packets of flow are cut through, bypassing CPU 1) First Packet of flow forwarded to CPU for classifications and security policy lookup Logs NAT QoS Packet Classification Firewall rule Enforcement Load Balancing DES 3DES SHA MD5 IPSec L2TP PPTP 2) Policy for flow forwarded to custom security ASIC cache memory
- 56.
- 57. 57 Features QoS ActiveActive Active Passive Server load balancing Centralized management Value added service No hard disk Hardened Linux (Proprietary Vs Open)
- 58.
- 59.
- 60.
- 61. 61 Why? Risk comesfrom out side so why do I bother about internal servers? In reality risk comes from inside than outside Either planned or unplanned None of the commercial OSs are secure It is a separate layer not a integrated part of the system
- 62. 62 A legitimate user Any one who get access as the power user can do anything Change the content of a web page to divert credit card information to a different location Create a user account as a backdoor Delete all the log entries that could indicate a system hack System reconfiguration
- 63. 63 ServerLock An immergingconcept Operating under the belief that protecting your data from unauthorized change is more effective than detecting attacks Locks It self Critical OS files & configurations Registry User defined resources
- 64.
- 65. 65 Policy Denies writeor delete access based on The resource Not on the user Even Sys Admin cannot do anything If need to change any protected resource first unlock the resource
- 66. 66 Location Resides betweenuser space & kernel space As a device driver in Windows As a loadable kernel module in Solaris Intercept all the system calls
- 67.
- 68. 68 Internal Security PKI +239 bit ECC
- 69. 69 Protecting it self Protects itself from being altered, disabled, or removed by unauthorized individuals, by securing: Hardware profiles File System Registry
- 70.
- 71. 71 Can guard against Changes to existing files or registry keys Creation of new files or registry keys Other resources IIS Metabase User Accounts Date & Time Stack Buffer Custom rules can be added to protect other resources
- 72. 72 ServerLock Vs AppLock/Web Server Lock protects the entire server while AppLock protects only specific application Applock/Web is designed to protect web servers (IIS only) AppLock/Web $595 per server ServerLock $1295-1695 per server ServerLock Manager $5,000 – 15,000
- 73. 73 Demo Service Incoming Outgoing Properties From ToFrom To HTTP Any Web server Any Any Port 80 FTP HQ only 170 & Dinky Any Any Port 21 SMTP Any Mail server Any Any Port 25 DNS Any 170 Any Any Multi protocol on ports using client ports Telnet HQ only 170 & Dinky Any Any Port 23 Ping Dinky Any Any Any Do Lotus Notes HQ only 170 Any Any TCP on port 1352 WatchGuard None None Trusted Any Multi protocol on port 4103 Virus Scan None None Any 64.75.31.197 TCP on port 80 Authority Admin PC Firewall Any Any TCP on port 113
- 74.
- 75.
- 76. 76 Viruses & Worms Is the most destructive in terms of data losses, time to recover & money New destructive threat immerge in every 11 hours Safeguard requires frequently updating of virus patterns & applying patches
- 77.
- 78. 78 Definitios VirusWall Residesjust after the firewall (internet gateway) All traffic (SMTP, HTTP, FTP) must pass through the Viruswall Stops viruses, worms, spam at the entry point Files are download to the VirusWall Server before sending to clients
- 79. 79 Server Protection Serverbased virus guards are different than a PC based ones
- 80. 80 Server Protection Cont… Everything depends on the type of server Mail servers must use specialized mail scanning software Centralized management of all servers allow one station to update virus definitions & deploy to others Preserves bandwidth
- 81. 81 Desktop Protection Standalonesolutions or centralized solution? All PCs having same policy Ease of management & policy enforcement Preserve bandwidth Extensive login User state Corporate image
- 82.
- 83. 83 What makes agood Network Security System Simplicity If it is complex in design & configuration, hard to manage would course more security holes Simple designs are more likely to be used consistently & correctly Scalability When you (business) grow it should grow with you
- 84. 84 Good Security SystemCont… High uptime & quick recovery High meantime between failure Failover recovery Distributed architecture Different tasks on different locations (or PCs) Dynamically secured Cannot be static & one time product
- 85. 85 Good Security SystemCont… Economy of IP addresses Hiding internal IPs Reducing the number of public IPs Secure connection VPN, management station, subcomponents Authentication
- 86. 86 Good Security SystemCont… Login & notification Keep you informed Summarized & reports of NW activity Physically secured
- 87. 87 Security Vs SriLanka Not aware of the threat Every one is searching for low cost anti-virus solution that could protect everything I am not having anything to loose so why do I? Should I invest more on security? If you spend more on Coffee (Tea) than security you are deserved to be hacked! By advice for defense for US president
- 88. 88 Conclusion Security isa dynamic process which you have a role to play (loose or winner) Third world countries should not be a playground for hackers Awareness is the best way of protection
- 89.
- 90.
- 91.