Securing the Local Area Network

Securing the Local Area Network

1. Securing LAN Elements

   • Endpoints
     • laptops
     • desktops
     • servers
     • IP phones
     • Protection
       • Antivirus
       • Antimalware
       • Host based-firewall
       • IPS scanning devices
     • Borderless Network
       • iPhones
       • Android devices
       • tablets
       • New protection
         • Advanced Antimalware Protection
           • alerting with
             • File Reputation
             • File Sandboxing
             • File Retrospection
           • accesses
             • Cisco Talos Security Intelligence
         • Email Security Appliance
           • Cisco solutions
             • block spam and threats
             • Flexible Cloud
             • Outbound message control
             • Global threat intelligence
         • Web Security Appliances
           • Cisco solutions
             • Talos Security Intelligence
             • Cisco Web Usage Controls
             • Advanced Malware Protection (AMP)
             • Data Loss Prevention (DLP)
         • Network Admission Control
           • Cisco solutions
             • NAC framework
             • Cisco NAC appliance
         • encrypt the disk
   • Network infrastructure
     • switches
     • wireless devices
     • IP telephony devices
     • Protection

2. Layer 2 Security Considerations

   • Basic Switch Operation
     • CAM
       • stores MAC addresses and associated VLAN parameters
       • Operations
         • 1 ) The CAM table is currently empty
           • show mac-address-table
         • 2)records the source MAC address before reboot
       • Attack
         • CAM table overflow
           • bombarding the switch with fake source MAC addresses
           • the attacker can capture all of the frames
       • Attack Tools
         • macof
           • flood a switch with up to 8,000 bogus frames per second
         • Yersinia
           • exploit weaknesses in protocols
       • prevent
         • enable port security
           • switchport port-security
           • switchport mode access
         • Port Security Options
           • switchport port-security maximum
           • show sdm prefer
           • Manually configured
             • switchport port-security mac-address
           • Dynamically learned
             • switchport port-security mac-address sticky
     • DHCP Spoofing Attack
       • Wrong default gateway
       • Wrong DNS server
       • Wrong IP address
       • starvation attack
       • Mitigating
         • port security
         • uses a unique MAC address
         • DHCP snooping
           • Step 1. Enable DHCP snooping
             • ip dhcp snooping
           • Step 2. On trusted ports
             • ip dhcp snooping trust
           • Step 3. Enable DHCP snooping
       • DHCP
     • ARP atatck
       • an attacker can send a gratuitous ARP message containing a spoofed MAC address to a switch, and the switch would update its CAM table accordingly.
       • prevent
         • Dynamic ARP inspection
           • packet is verified for valid IP-to-MAC
           • coming from invalid devices are either dropped
           • configuration
             • enabling DHCP snooping globally
             • Enable DHCP snooping on VLANs
             • nable DAI on selected VLANs
             • Configure trusted interfaces for DHCP snooping
     • Address
       • Source IP address filter
       • Source IP and MAC address filter
       • Configuring IP Source Guard
         • ip verify source
   • Spanning Tree Protocol
     • ensures that redundant physical links are loop-free
     • Manipulation Attacks
       • Attackers can make their hosts appear as root bridges
       • prevent
         • PortFast
           • spanning-tree portfast default
         • BPDU Guard
           • spanning-tree portfast bpduguard default
         • Root Guard
           • spanning-tree guard root
         • Loop Guard
           • spanning-tree guard loop