Chapter 1 Network Security Concepts and Policies

Chapter 1 Network Security Concepts and Policies

1. Chapter 1 Network Security Concepts and Policies

   • CIA
     • confiability, integrity and availability
   • designer must be aware
     • When designing network security, a designer must be aware of the following: • The threats (possible attacks) that could compromise security • The associated risks of the threats (that is, how relevant those threats are for a particular system) • The cost to implement the proper security countermeasures for a threat • A cost versus benefit analysis to determine whether it is worthwhile to implement the security countermeasures
   • Palavras chaves de security
     • An asset is anything of value to an organization.
     • A vulnerability is a weakness in a system or its design that could be exploited by a threat.
     • A threat is any potential danger to assets
     • A risk is the likelihood that a particular threat using a specific attack will exploit a particular vulnerability of a system that results in an undesirable consequence.
     • An exploit happens when computer code is developed to take advantage of a vulnerability. For example, suppose that a vulnerability exists in a piece of software, but nobody knows about this vulnerability. Although the vulnerability exists theoretically, there is no exploit yet developed for it. Because there is no exploit, there really is no problem yet.
     • A countermeasure (safeguard) is the protection that mitigates the potential risk.
   • main vulnerabilities
     • • Policy flaws • Design errors • Protocol weaknesses • Software vulnerabilities • Misconfiguration • Hostile code • Human factor
   • controls fall into one of three categories
     • Controls are also categorized by the type of control they are: • Preventive: The control prevents access. • Deterrent: The control deters access. • Detective: The control detects access. All three categories of controls can be any one of the three types of controls; for example, a preventive control can be administrative, physical, or technical.
     • A security control is any mechanism that you put in place to reduce the risk of compromise of any of the three CIA objectives: confidentiality, integrity, and availability.
     • Administrative
       • Some of these controls are as follows: • Security-awareness training • Security policies and standards • Change controls and configuration controls • Security audits and tests • Good hiring practices • Background checks of contractors and employees
     • Technical
       • The following are examples of technical controls: • Firewalls • Intrusion prevention systems (IPS) • Virtual private network (VPN) concentrators and clients • TACACS+ and RADIUS servers • One-time password (OTP) solutions • Smart cards • Biometric authentication devices • Network Admission Control (NAC) systems • Routers with ACLs
     • Physical
       • While trying to secure an environment with good technical and administrative controls, it is also necessary that you lock the doors in the data center. This is an example of a physical control. Other examples of physical controls include the following: • Intruder detection systems • Security guards • Locks • Safes • Racks • Uninterruptible power supplies (UPS) • Fire-suppression systems • Positive air-flow systems
   • Dealing with Risk
     • Reduce
       • This is where we IT managers evolve and it is the main focus of this book. We are responsible for mitigating the risks. Four activities contribute to reducing risks:
       • Limitation/avoidance: Creating a secure environment by not allowing actions that would cause risks to occur, such as installing a firewall, using encryption systems and strong authentication, and so on • Assurance: Ensuring policies, standards, and practices are followed • Detection: Detecting intrusion attempts and taking appropriate action to terminate the intrusion • Recovery: Restoring the system to operational state
     • Ignore
       • Ignore: This is not an option for an IT manager. The moment you become aware of a risk, you must acknowledge that risk and decide how to deal with it: accept this risk, transfer this risk, or reduce this risk.
     • Accept
       • Accept: This means that you document that there is a risk, but take no action to mitigate that risk because the risk is too far-fetched or the mitigation costs are too prohibitive.
     • Transfer
       • Transfer: This is buying insurance against a risk that cannot be eliminated or reduced further.
       • Business needs: What does your organization want to do with the network? Risk analysis: What is the risk and cost balance? • Security policy: What are the policies, standards, and guidelines that you need to address business needs and risks? • Industry best practices: What are the reliable, well-understood, and recommended security best practices? • Security operations: These operations include incident response, monitoring, maintenance, and auditing the system for compliance.
   • Recentes tipos de invasões
     • Cognitive threats via social networks (likejacking):
       • Social engineering takes a new meaning in the era of social networking. From phishing attacks that target social network accounts of high-profile individuals, to information exposure due to lack of policy, social networks have become a target of choice for malicious attackers.
     • PDA and consumer electronics exploits
       • The operating systems on consumer devices (smartphones, PDAs, and so on) are an option of choice for high-volume attacks. The proliferation of applications for these operating systems, and the nature of the development and certification processes for those applications, augments the problem.
     • Widespread website compromises
       • Malicious attackers compromise popular websites, making the sites download malware to connecting users. Attackers typically are not interested in the data on the website, but use it as a springboard to infect the users of the site.
     • Disruption of critical infrastructure
       • The Stuxnet malware, which exploits holes in Windows systems and targets a specific Siemens supervisory control and data acquisition (SCADA) program with sabotage, confirmed concerns about an increase in targeted attacks aimed at the power grid, nuclear plants, and other critical infrastructure
     • Virtualization exploits
       • Device and service virtualization add more complexity to the network. Attackers know this and are increasingly targeting virtual servers, virtual switches, and trust relationships at the hypervisor level.
     • Memory scraping
       • Increasingly popular, this technique is aimed at fetching information directly from volatile memory. The attack tries to exploit operating systems and applications that leave traces of data in memory. Attacks are particularly aimed at encrypted information that may be processed as unencrypted in volatile memory.
     • Hardware hacking
       • These attacks are aimed at exploiting the hardware architecture of specific devices, with consumer devices being increasingly popular. Attack methods include bus sniffing, altering firmware, and memory dumping to find crypto keys.
     • IPv6-based attacks
       • These attacks could become more pervasive as the migration to IPv6 becomes widespread. Attackers are focusing initially on covert channels through various tunneling techniques, and man-in-the middle attacks leverage IPv6 to exploit IPv4 in dualstack deployments.
   • Many titles are assigned to hackers
     • Hackers
       • Hackers are computer enthusiasts who break into networks and systems to learn more about them.
     • Crackers (criminal hackers)
       • Crackers are hackers with a criminal intent to harm information systems. Crackers are generally working for financial gain and are sometimes called black hat hackers.
     • Phreakers
       • Phreakers pride themselves on compromising telephone systems. Phreakers reroute and disconnect telephone lines, sell wiretaps, and steal longdistance services.
   • threat categories
     • Enumeration and fingerprinting
       • Enumeration and fingerprinting are types of attacks that use legitimate tools for illegitimate purposes. Some of the tools, such as port-scan and ping-sweep applications, run a series of tests against hosts and devices to identify vulnerable services that need attention. IP addresses and port or banner data from both TCP and UDP ports are examined to gather information.
     • Spoofing and impersonation
       • The prime goal of an IP spoofing attack is to establish a connection that allows the attacker to gain root access to the host and to create a backdoor entry path into the target system. IP spoofing is a technique used to gain unauthorized access to computers whereby the intruder sends messages to a computer with an IP address that indicates the message is coming from a trusted host.
       • To mount an IP spoofing attack, the hacker listens to communications between two systems. The hacker sends packets to the target system with the source IP address of the trusted system
       • To engage in IP spoofing, hackers must first use a variety of techniques to find an IP address of a trusted host and then modify their packet headers to appear as though packets are coming from that trusted host. Further, the attacker can engage other unsuspecting hosts to generate traffic that appears as though it too is coming from the trusted host, thus flooding the network
     • Man-in-the-middle
       • A complex form of IP spoofing is called man-in-the-middle attack, where the hacker monitors the traffic that comes across the network and introduces himself as a stealth intermediary between the sender and the receiver
       • Hackers use man-in-the-middle attacks to perform many security violations: • Theft of information • Hijacking of an ongoing session to gain access to your internal network resources • Analysis of traffic to derive information about your network and its users • DoS • Corruption of transmitted data • Introduction of new information into network sessions
     • Overt and covert channels
       • Overt and covert channels refer to the capability to hide information within or using other information: • Overt channel: A transmission channel that is based on tunneling one protocol inside of another. It could be a clear-text transmission inserted inside another clear-text protocol header. • Covert channel: A transmission channel that is based on encoding data using another set of events. The data is concealed.
       • There are numerous ways that Internet protocols and the data that is transferred over them can provide overt and covert channels. The bad news is that firewalls generally cannot detect these channels; therefore, attackers can use them to receive confidential information in an unauthorized manner.
       • With an overt channel, one protocol is tunneled within another to bypass the security policy; for example, Telnet over FTP, instant messaging over HTTP, and IP over Post Office Protocol version 3 (POP3). Another example of an overt channel is using water-marks in JPEG images to leak confidential information.
       • SOLUÇÃO You can use the advanced protocol inspection in the Cisco IPS products and Cisco ASA 5500 series appliances to counter attacks such as a hidden IM session being sent inside HTTP.
     • Blended threats and malware
       • Blended Threats The actual breach and vulnerability exploit is often accomplished using a combination of malware that infects, propagates, and delivers its payload following different techniques associated with traditional malware. Known as blended threats, these attack mechanisms combine the characteristics of viruses, worms, Trojan horses, spyware, and other malware.
     • Exploitation of privilege and trust
     • Confidentiality and Integrity Attacks
       • Confidentiality breaches can occur when an attacker attempts to obtain access to read-sensitive data. These attacks can be extremely difficult to detect because the attacker can copy sensitive data without the knowledge of the owner and without leaving a trace.
       • Attackers can use many methods to compromise confidentiality, the most common of which are as follows: • Ping sweeps and port scanning: Searching a network host for open ports. • Packet sniffing: Intercepting and logging traffic that passes over a digital network or part of a network. • Emanations capturing: Capturing electrical transmissions from the equipment of an organization to deduce information regarding the organization. • Overt channels: Listening on obvious and visible communications. Overt channels can be used for covert communication. • Covert channels: Hiding information within a transmission channel that is based on encoding data using another set of events. • Wiretapping: Monitoring the telephone or Internet conversations of a third party, often covertly. • Social engineering: Using social skills or relationships to manipulate people inside the network to provide the information needed to access the network. • Dumpster diving: Searching through company dumpsters or trash cans looking for information, such as phone books, organization charts, manuals, memos, charts, and other documentation that can provide a valuable source of information for hackers. • Phishing: Attempting to criminally acquire sensitive information, such as usernames and passwords, by masquerading as trustworthy entities. • Pharming: Redirecting the traffic of a website to another, rogue website.
       • Many of these methods are used to compromise more than confidentiality. They are often elements of attacks on integrity and availability.
     • Password attacks
       • Password attacks can be implemented using several methods, including brute-force attacks, Trojan horse programs, IP spoofing, keyloggers, packet sniffers, and dictionary attacks. Although packet sniffers and IP spoofing can yield user accounts and passwords, password attacks usually refer to repeated attempts to identify a user account, password, or both. These repeated attempts are called brute-force attacks.
       • Hackers use many tools and techniques to crack passwords: • Word lists: These programs use lists of words, phrases, or other combinations of letters, numbers, and symbols that computer users often use as passwords. Hackers enter word after word at high speed (called a dictionary attack) until they find a match. • Brute force: This approach relies on power and repetition. It compares every possible combination and permutation of characters until it finds a match. Brute force eventually cracks any password, but it might take a long, long time. Brute force is an extremely slow process because it uses every conceivable character combination. • Hybrid crackers: Some password crackers mix the two techniques. This combines the best of both methods and is highly effective against poorly constructed passwords.
       • Password cracking attacks any application or service that accepts user authentication, including the following: • NetBIOS over TCP (TCP 139) • Direct host (TCP 445) • FTP (TCP 21) • Telnet (TCP 23) • Simple Network Management Protocol (SNMP) (UDP 161) • Point-to-Point Tunneling Protocol (PPTP) (TCP 1723) • Terminal services (TCP 3389)
     • Availability attacks
       • DoS
         • DoS attacks attempt to compromise the availability of a network, host, or application. They are considered a major risk because they can easily interrupt a business process and cause significant loss. These attacks are relatively simple to conduct, even by an unskilled attacker.
         • DoS attacks are usually the consequence of one of the following: • The failure of a host or application to handle an unexpected condition, such as maliciously formatted input data or an unexpected interaction of system components. • The inability of a network, host, or application to handle an enormous quantity of data, which crashes the system or brings it to a halt. Even if the firewall protects the corporate web server sitting on the DMZ from receiving a large amount of data and thus from crashing, the link connecting the corporation with its service provider will be totally clogged, and this bandwidth starvation will itself be a DoS.
         • Hackers can use many types of attacks to compromise availability: • Botnets Botnet is a term for a collection of software robots, or bots, that run autonomously and automatically. They run on groups of “zombie” computers controlled by crackers.
         • DoS attacks are the most publicized form of attack. They are also among the most difficult to eliminate. A DoS attack on a server sends an extremely large volume of requests over a network or the Internet. These large volumes of requests cause the attacked server to slow down dramatically. Consequently, the attacked server becomes unavailable for legitimate access and use. A DDoS attack generates much higher levels of flooding traffic by using the combined bandwidth of multiple machines to target a single machine or network. The DDoS attack enlists a network of compromised machines that contain a remotely controlled agent, or zombie, attack program. A master control mechanism provides direction and control. When the zombies receive instructions from the master agent, they each begin generating malicious traffic aimed at the victim. DDoS attacks are the “next generation” of DoS attacks on the Internet.
         • Hackers can use many types of attacks to compromise availability: • Botnets • DoS • DDoS • SYN floods • ICMP floods • Electrical power • Computer environment
       • Botnet
     • Physical security attacks
     • Forces of nature

2. Chapter 1 Network Security Concepts and Policies - CONTINUAÇÃO

   • Principles of Secure Network Design
     • Cisco has always been a proponent of defense in depth. This was made clear in 2000 when it released its Cisco SAFE Blueprint for enterprise (SAFE is not an acronym), where it laid out its vision for defense in depth.
     • Defense in depth:
       • This is an umbrella term that encompasses many of the other guidelines in this list. It is defined by architectures based on end-to-end security, using a layered approach. The objective is to create security domains and separate them by different types of security controls. The concept also defines redundancy of controls, where the failure of one layer is mitigated by the existence of other layers of controls.
     • Compartmentalization:
       • Creating security domains is crucial. Different assets with different values should reside in different security domains, be it physically or logically.
     • Least privilege
       • In network security, this results in restrictive policies, where access to and from a security domain is allowed only for the required users, application, or network traffic. Everything else is denied by default.
     • Weakest link
       • This is a fundamental concept—a security system is as effective as its weakest link. A layered approach to security, with weaker or less protected assets residing in separated security domains, mitigates the necessary existence of these weakest links. Humans are often considered to be the weakest link in information security architectures.
     • Separation and rotation of duties
       • This is the concept of developing systems where more than one individual is required to complete a certain task. The
     • Hierarchically trusted components and protection
       • This principle applies a hierarchical approach to the compartmentalization and least privilege ideas, aiming at providing a more structured approach to data classification and security controls.
     • Mediated access
       • This principle is based on centralizing security controls to protect groups of assets or security domains. In that sense, firewalls, proxies, and other security controls act on behalf of the assets they are designed to protect, and mediate the trust relationships between security domains.
     • Accountability and traceability
       • This concept implies the existence of risk and the ability to manage and mitigate it, and not necessarily avoid or remove it.
   • security policy
     • security policy is a set of objectives for the company, rules of behavior for users and administrators, and requirements for system and management that collectively ensures the security of network and computer systems in an organization.