Chapter 3: Security Architecture

Knowledge Statements

• 2.1 Knowledge of network design processes, to include understanding of security objectives, operational objectives and trade offs
• 2.2 Knowledge of security system, design methods, tools and techniques
• 2.3 Knowledge of network access, identity and access management
• 2.4 Knowledge of information technology security principles and methods e.g. firewalls, DMZ and encryption
• 2.5 Knowledge of network security architecture concepts including topology, protocols, components and principles
• 2.6 Knowledge of malware analysis concepts and methodology
• 2.7 Knowledge of intrusion detection methodologies and techniques for detecting host and network intrusions
• 2.8 Knowledge of defence in depth principles and network security architecture
• 2.9 Knowledge of encryption algorithms, IPSEC, AES and Generic Routing Encapsulation (GRE)
• 2.10 Knowledge of cryptography
• 2.11 Knowledge of encryption methodologies
• 2.12 Knowledge of how traffic flows across the network (transmission and encapsulation
• 2.13 Knowledge of network protocols e.g. TCP/IP, DHCP and DNS

Security Perimeter

• The structure, components, connections and layout of security controls in IT infrastructure.
• Perimeter
• Well defined boundary between organisation and external
• System Centric
• Places controls at network and system
• Data Centric
• Protect data regardless of location
• Internet Perimeter
• Routes traffic between enterprise and internet
• Prevent executable files from transfer through email
• Monitors network ports for rogue activity
• Detect and block traffic from infected end points
• Control user traffic bound toward internet
• Identify and block malicious packets
• Eliminate email, spam, viruses and worms
• Block websites containing malware

VPN/WAN

• Virtual Private Network (VPN)
• VPN traffic is filtered at EGRESS to specific IP addresses.
• Remote users can only gain access after being authenticated.
• VPN protection includes:
• Terminate VPN traffic from remote users
• Provide hub for terminating VPN traffic from remote sites
• Terminate traditional dial in users
• Security Architecture
• Articulate processes a business performs
• How processes are executed and secured
• Organisation roles and responsibilities
• PROCESS MODEL: directive approach
• FRAMEWORK MODEL: flexible approach
• Wide Area Network (WAN)
• Network extends over a large distance
• Wireless Local Area Network (WLAN) using wireless connection
• WAN protection:
• Provided by input/output system (IOS)
• Can block unwanted traffic using input access lists
• IP Spoofing can be mitigated through Layer 3 filtering
• Interdependencies
• Increase in decentralised platforms such as cloud & BYOD increase potential attacks
• Increase in third party risks
• Security architecture must ensure elements all work together

SABSA & Zachman Framework

• Sherwood Applied Business Security Architecture (SABSA)
• Explains the 5 Why's:
• Assets (what)
• Motivation (why)
• Process (how)
• People (who)
• Location (where)
• Time (when)
• Key Categories:
• Contextual
• Conceptual
• Logical
• Physical
• Component
• Operational

The Open Group Architecture Framework

• TOGAF is high level and holistic approach
• Security is an essential component of overall enterprise design
• Ensures new projects meet business objectives, are systematic and results are repeatable
• 
• Caption: PG 46: TOGAF Enterprise Architecture Framework

Open Systems Interconnection Model (OSI)

• 1. APPLICATION: mediates software and network layers
• 2. PRESENTATION: formats, encrypts and compresses data
• 3. SESSION: co-ordinate and manage user connections
• 4. TRANSPORT: ensure data is transferred reliably
• 5. NETWORK: translates network address and routes from sender to receiver
• 6. DATA LINK: divides data into to frames transmitted by physical layer
• 7. PHYSICAL: manage signals among network systems
• OSI Model Process
• Upper layer data is passed to transport (Layer 4) as segments and wrapped with a header for identification
• Segments are passed to network (Layer 5) as packets
• Data is broken down to frames at Data Link (Layer 6) and control information is added
• Physical (Layer 7) takes form of bits to deliver to destination network
• At file destination receiver passes up ISO stack until delivered (decapsulation)

OSI Model

• Encapsulation
• Process of adding to data as it is transmitted down the OSI stack
• Each layer relies on services provided by the layer below
• Each layer only communicates with its destination peer using Protocol Data Units (PDU)
• Defence in Depth (DiD)
• Process of layering controls
• Essential in the security strategy
• Multiple controls provide many opportunities for monitoring and detecting attacks
• May create a delay so attack can be prevented
• Number of layers is dependent on the value of an asset
• HORIZONTAL: controls placed in various places using concentric ring model
• VERTICAL: control placed at system layers, Hardware, OS, application, database and user layers
• Concentric Rings
• Series of nested layers that must be bypassed to complete an attack
• Each layer delays attack to allow detection and response
• DETECT - DELAY - RESPOND
• Overlapping Redundancy
• Two or more controls that work in parallel to protect an asset
• Multiple, overlapping points of detection
• Most effective when each controls is different
• Segregation
• Compartmentalised access to an asset
• Requires two or more processes, controls or individuals to access
• Used for high value assets

Firewalls

• A system or combination of systems that enforces a boundary between two or more networks
• Forms a barrier between secure and open environment such as t he internet
• Applies rules to control type of network traffic flowing in and out
• Firewall Benefits
• Blocks access to a particular site
• Limit traffic on an org's public services segment to relevant addresses and ports
• Prevents defined users from accessing certain servers or services
• Monitors and records communications between internal and external networks
• Monitor network penetrations or detect internal subversions
• Encrypt packets sent between different physical locations in an organisation using VPN
• Network Firewalls
• Packet Filtering
• Application Firewall Systems
• Stateful Inspection
• Next Generation Firewall (NGFW)

1. Packet Filtering

• Screening router examines header of every packet between internet and corporate networks
• Router uses information to pass/block packets
• Best suited for smaller networks
• Packet Header: IP address of sender/receiver and port numbers
• Advantages:
• Simplicity of one network 'choke point'
• Minimal impact on network performance
• Inexpensive/free
• Disadvantages:
• Vulnerable to attacks for misconfigured filters
• Private networks vulnerable when a single packet filtering router is compromised
• Common Attacks - IP Spoofing:
• Attacker fakes IP of an internal network or trusted perimeter
• Enables packet to pass rule and bypasses firewalls
• Source Routing:
• Focuses on the route an IP packet must take from source to destination
• Attacker defines route to bypass the firewall
• Attacker needs to know IP address, subnet mask and default gateway to succeed
• Only successful if default is set to pass residual packets
• Can be defended against by configuring firewalls to drop all packets where IP fragmentation is enabled
• Miniature Fragment
• Attacker fragments IP packets into smaller ones & pushes through firewall
• Works where default set to pass subsequent packets

2. Application Firewall Systems

• Provides greater protection capabilities than packet filtering routers
• Allows information to flow between systems but do not allow direct exchange of packets
• Application Level Gateways
• Analyse packets through proxies
• Implement multiple proxies may impact network performance
• Circuit Level Gateways
• Uses one proxy server for all services
• More efficient and operates at application level
• TCP/UDP sessions validated using general proxy server before opening a connection
• Bastion Hosting
• Handles all incoming requests from internet to corporate networks
• Heavily fortified against attacks
• Only compromises firewall if breached (not networked)
• Advantages
• Secures common protocols
• Hides network from untrusted networks
• Limits break ins so network isn't compromised
• Can examine and secure programme code
• Disadvantages
• Poor performance and scalability as internet usage grows

3. Stateful Inspection Firewalls

• Also known as Dynamic Packet Filtering
• Tracks destination IP of each packet that leaves the organisations internal network
• Maps source IP of incoming packet with list of destination IP addresses
• Prevents attacks originated by an outsider
• Advantage
• Control over flow of IP traffic
• More efficient than firewalls with CPU intensive requirements
• Disadvantages
• Complex to administrate

4. Next Generation Firewalls (NGFW)

• Addresses two key limitations of earlier variants:
• Inability to inspect packet payload
• Inability to distinguish between types of web traffic
• Adaptive and capable of detecting and blocking sophisticated attacks
• Deep Packet Inspection (DPI) integrates threat protection such as DLP, IPS, SSL/SSH and web filtering

Firewall Implementation

• Screened Host Firewall
• Uses packet filtering router and bastion host
• Implements basic networking security (packet filtering) and application server security (proxy server)
• Intruders must penetrate 2 separate systems
• Router filtering allows inbound traffic access only to bastion host and blocks access to internal systems
• Dual Homed Firewall
• Has two or more network interfaces connected to a different network
• Blocks or filters traffic between network
• More restrictive than screened host
• Demilitarised Zone (DMZ)
• Also known as Screened Subnet Firewall
• Small isolated network for an orgs public servers, bastion host and modem pools
• Connects trusted and untrusted networks
• External systems can only access bastion host
• Routers manage access to private network and accepts traffic from bastion host
• Intruders must penetrate 3 separate devices
• Private networks addresses must not be disclosed
• Internal systems do not have direct access to the internet

Firewall Issues

• Configuration Errors
• Can allow dangerous services to pass through
• Monitoring Demands
• Must review log settings on a regular basis
• Policy Maintenance
• Policies must be maintained continuously
• Input Based Attacks
• May not stop SQL attacks or buffer overflows, NGFW can inspect traffic at application layer

Firewall Platforms

• Can be implemented using hardware or software
• When server based firewalls are used OS in servers
• Can be vulnerable to attack
• Appliance firewalls are faster to set up and recover
• HARDWARE:
• Provides performance with minimal system overheads
• Faster but not as flexible/scalable
• SOFTWARE:
• Generally slower with significant system overhead
• More flexible

Application Awareness

• "capacity of a system to maintain information about connected applications to optimise their operation and that of any sub systems that they run or control"
• Deep Packet Inspection (DPI):
• Payload interrogation against known exploit signatures
• Effective anomaly detection
• ISOLATION AND SEGMENTATION
• VLAN can segment network security to separately control, monitor and protect
• VLAN are groups of devices on one of more logically segmented LAN
• Configures ports on a switch, attached devices can communicate as if on the same physical network
• Allows an organisation to keep data separate
• SECURITY ZONES AND DMZ
• Controls can be applied on systems, info and apps
• Creates defence in depth where additional layers of access control, authentication and monitoring takes place
• DMZ limits systems, apps and data in public segments
• Small isolated network
• Utilises two packet filtering routers and bastion host to create most secure firewall
• DMZ Steps
• Configured to limit access from internet and orgs private network
• Incoming traffic restricted by outside router
• External systems can only access bastion host and info server in the DMZ
• Key Benefits:
• Intruders must penetrate 3 separate devices
• Private NW not disclosed and internal system don't access internet

Monitoring, Logging & Detection

• INGRESS: network communications in
• EGREE: network communication out
• DATA LOSS PREVENTION: protects information and prevents exfiltration of data
• DLP covers three states of information:
• DATA AT REST: stored data logs
• DATA IN MOTION: data travelling through network
• DATA IN USE: data in use at workstation level

Anti-Virus & Anti-Malare

• Restriction of outbound traffic to prevent malware from exfiltration of data
• Use of policies and training to ensure staff are aware
• Software scans URL for malicious code
• Intrusion Detection System (IDS)
• Works with routers and firewalls by monitoring network usage anomalies
• Operates continuously on the system
• Notifies administrators when a threat is detected
• Network IDS (NIDS)
• Identifies attacks in the monitored network and issues a warning to operator
• Placed between internet and firewall to detect attempts
• Placed between firewall and corporate network detects attacks that enter firewall
• Host Based IDS
• Configured for a specific environment
• Monitors internal resources on OS to warn of attack
• Can detect:
• Modification of executable programs
• Detect deletion of files
• Issue warnings when attempts to use privilege commands

Intrusion Detection Systems (IDS)

• IDS Components
• Signature Based: protects against detected intrusion patterns stored as signatures
• Statistical Based: defines known and expected behaviour of systems
• Neutral Networks: monitors general patterns of activity and traffic on network and creates a database
• IDS Features
• Intrusion detection
• Gathers evidence on activity
• Automated response
• Security policy
• Interface with system tools
• Security policy management
• IDS Limitations
• Weaknesses in policy definitions
• Application vulnerabilities
• Backdoors in applications
• Weaknesses in identification and authentication
• IDS Policy
• Establishes actions taken by security personnel
• Terminates access
• Trace access

Intrusion Prevention System (IPS)

• Predicts an attack before it occurs
• Monitors systems for bad behaviour such as worms, trojans, spyware, malware and hackers
• Compliments firewalls, anti-virus and anti-spyware
• Can block new (zero day) threats that bypasses security measures
• Advantages:
• Protection at application layer
• Prevention of attacks rather than simply reacting
• Defence in depth
• Real time event correlation

Encryption Fundamentals

• "encryption is the process of converting a plaintext message into a secure coded form of text - ciphertext"
• Ciphertext - can't be understood without decrypting to plaintext
• Key: required to complete decryption process
• Cryptography Uses - Confidentiality
• Protect information stored in computers
• Protect data in transit
• Deter and detect accidental changes
• Verify authenticity of documentation
• Cryptographic Systems
• Encryption Algorithms
• Mathematical calculations that encrypt or decrypt data
• Encryption Key
• User needs the correct key to access or decipher a message
• Key Length
• Predetermined length of a key, the longer the key the more effective

Key Systems

• Symmetric Key System: single, secret, bi-directional keys
• Asymmetric Key System: pairs of un-directional, complementary keys that only encrypt/decrypt
• A public key system is symmetric
• Most encrypted transactions use a combination of private/public keys, secret keys, hash functions and digital signatures
• Aims to achieve CIA triad
• Authenticates sender/receiver
• Provides non-repudiation

Key Encryption

• Symmetric Key Encryption (Private)
• Secret key encrypts plaintext to ciphertext
• Same key decrypts back to plaintext
• DES based on public algorithm (64 bits)
• DES replaced by AES (128-256 bits)
• Advantages:
• One key for encryption and decryption
• Uses less processing power
• Suited to bulk encryption
• Disadvantages:
• Difficult to distribute keys
• Limited by a shared secret
• Cant be used to sign digital documents
• Asymmetric Key Encryption (Private)
• Two keys work together as a pair - only partner can decrypt
• Used for short messages and digital signatures
• Only sender knows encryption keys
• Provides valuation, authentication and non repudiation
• Elliptical Curve Cryptography (ECC)
• Variant on public key
• Less power requirements and more security per bit
• 160 bits offers same security as RSA1024 bits
• Works well with networked computers
• Advanced Encryption Standard (AES)
• Symmetric block cipher (128, 192 & 256 bits)
• Substitution cipher and round keys
• Each round 128 bits

Digital Signatures

• Electronic identifier created by using public key
• Allows recipient to verify integrity of information and identity of sender
• Common digest algorithm: SHA1, SHA2, MD2, MD4, MD5
• Verify Integrity:
• checksum computed against message (128 bits)
• Verify Identity:
• encrypt message digest with senders private key (sign document)
• Digital signatures ensure that:
• Data Integrity:
• Any change to plaintext results in recipient failing to compute same message hash
• Authentication:
• Recipient can verify sender using secret key (known only to sender)
• Non Repudiation
• Ensures sender can't later deny generating and sending the message

Wireless Network Protection

• If wireless connections are not protected it can lead to:
• Emails being intercepted and read or changed
• Hackers can replace users credentials resulting in blocked access for genuine users (DOS)
• Unauthorised users can access resources
• Common protection methods:
• Wired Equivalency Protocol (WEP)
• Wi-Fi Protected Access (WPA)
• Uses dynamic keys and authentication server with credentials to increase protection

Public Key Infrastructure (PKI)

• Allows trusted parties to issue, maintain and revoke public key certificates
• Digital Certificates
• composed of a public key and identifying information about owner of the key
• Associates public key with senders identity
• Digitally signed by trusted entity (private) and contains information about the sender (public)
• Certificate includes:
• Distinguishes user name
• Public key
• Certificate of validity period
• Algorithm used to compute digital signatures inside certificate
• Certificate Authority (CA)
• Issues and manages security credentials and public keys for message signature verification or encryption
• CA checks Registration Authority (RA) to verify information provided by the requestor
• CA Types:
• Organisationally Empowered: authoritative control over individuals in their organisation
• Liability Empowered: choosing commercially available options e.g. verisign to obtain digital certificates

Registration Authority

• Registration Authority (RA)
• Verifies user requests for a digital certificate
• CA uses to delegate some admin functions
• Admin functions:
• Verify information supplied by the subject
• Verify right of subject to requested certificate
• Verify subject has valid private key (Proof of Possession)
• Report key compromises or termination (revocation)
• Assign identifiers e.g. name
• Generate shared secrets for initialisation and pick up
• Initiate key recovery process
• Maintain Certificate Revocation List (CRL)
• Maintain Certificate Practice Statement (CPS)