Network Security

Network Security

1. Two Threat Models

   • Passive attackers
     • eavesdropping/ wiretapping / sniffing
     • traffic analysis
   • active attackers
     • spoofing attacks
       • phishing / email
     • squatting attacks (phishing)
       • attacker claims to be at victims location#

2. SYN flooding

   • attacker initiates connection and then immediately breaks it
     • attacker never finishes 3 way handshake
     • victim is busy with timeout
     • attacker then initiates a large number of SYN requests
       • results in denial of service

3. Protection of networks

   • OSI Open systems interconnection model
   • framework for layering network protocols - IP security

4. IP security

   • IPv4 is connectionless and stateless
     • no guaranteed security protection
   • IPv6 - security architecture
     • mandatory security
     • 2 major security mechanisms
       • AH - IP Authentication Header
         • protects integrity and auhenticity of IP packets
         • integrity checksum includes Ip header
           • checksum- checking if number of bits is same as sent out
       • IP Encapsulation Security Payload - ESP
         • this provides confidentiality
         • achieved by encryption of payload
         • does not protect original IP header though
         • ESP transport mode encapsulates upper layer frame (TCP/UDP)
         • ESP tunnel mode (end-end encryption)
         • entire datagram treated as new payload including header
         • can be thought of as a 'IP within an IP'
   • use encryption
     • not tied to one particular key management protocol
   • host - host security
     • but loss of overhead - not that goooood

5. Secure Socket Layer

   • In between application layer and TCP in IP stack
   • contains a handshake protocol where the client and the server agree on cipher suite
   • most widely used internet security protocol

6. Domain Name System

   • dns lookup - to translate to ip address and there is dns reverse look up
   • attacker can corrupt DNS info
     • make site seem unavailable
     • can redirect users to fake sites
   • worse when corruption is propagated between dns servers

7. Intrustion Detection Systems

   • consists of a number of sensors (network or host)
     • sensors collect data
       • data is analysed
         • intrustion reported through alert generation
           • reactions triggered - research
   • classification of ids
     • Misuse Detection
       • looks for attack signatures
         • signatures - patterns of network traffic
       • number of failed login attempts
       • only as good as its database of attack signatures
         • cannot detect zero day attacks
         • new attacks require a new signature to be created
     • anomaly detection
       • statistical behaviour-based detection
       • first normal behaviour is established as baseline
       • if behaviour of monitored system deviates from baseline and exceeds a threshold an alarm is issues
       • drawbacks
         • only detects anomalies
         • anomlay is not necessarily an attack
         • false positives/ negatives
   • network based vs host based
     • network based
       • attack signatures of network traffic
       • Firestorm
     • host based
       • attack signatures from system activity
     • most effective combine host and network based

8. cryptographic mechanisms help but

   • cant prevent all attacks - such as DOS attacks

9. Vulnerability Assesment

   • examines the security state of a network or a host
   • pen tools used for info on open ports

10. HoneyPots

    • fake machine which should never normally be accessed
      • good to catch botmasters
      • track attackers and learn/ gather evidence about their activities
    • Honeynets
      • fake networks which should have no traffic or login attempts

11. Packet filters

    • filter of all traffic based on source and destination IP address
    • rules based on TCP and UDP port numbers
    • can be implemented in a router examining packet headers only
    • basic packet filter issues
      • only basic rules
      • cant have dynamically defined rules
      • certain protocols are difficult to handle
    • stateful packet filters
      • understand requests and replies
      • can support policies for a wider range of protocols
      • FTP client

12. Proxies

    • application level proxies
      • client - proxy - server - proxy - client
      • run on a hardened pc
      • high level security
      • close control over content provided
    • mail proxy - filter emails for spam and viruses
    • larger overhead per connection
    • more expensive than packet filters
    • separate proxy server required for each service to be protected

13. DMZ

    • demilitarised zone
      • partition your network so that the internal LAN is behind a nicely placed firewall
    • logical subnet which exposes the eternally facing services
    • attack on DMZ would not affect the whole network
    • policies
      • permissive - allow everything except dangerous services
        • easy to make a mistake or forget something
      • restrictive - block everything except designated useful services
        • more secure but if something that is needed is blocked - DOS