Security+ Guide to Network Security Fundamentals, Third Edition

1. Security+ Guide to Network Security Fundamentals, Third Edition Chapter 5 Network Defenses

2. Objectives • Explain how to enhance security through network design • Define network address translation (NAT) and network access control • List the different types of network security devices and explain how they can be used Security+ Guide to Network Security Fundamentals, Third Edition

3. Crafting a Secure Network • A common mistake in network security • Attempt to patch vulnerabilities in a weak network that was poorly conceived and implemented from the start • Securing a network begins with the design of the network and includes secure network technologies Crafting صياغة Conceived : تصور

4. Security through Network Design • Subnetting • IP addresses are actually two addresses: one part is a network address and one part is a host address • Classful addressing • The split between the network and host portions of the IP address originally was set on the boundaries between the bytes • Subnetting or subnet addressing • Allows an IP address to be split anywhere • Networks can essentially be divided into three parts: network, subnet, and host

5. Security through Network Design: Please see https://www.youtube.com/watch?v=QoQmv2VNuX0&feature=related https://www.youtube.com/watch?v=XFB33GKQdOs https://www.youtube.com/watch?v=QoQmv2VNuX0&feature=related https://www.youtube.com/watch?v=VWxGtl5J7WM&feature=related

7. Quiz: What is subnetting ?

8. Security through Network Design (continued)

9. Security through Network Design (continued) • Security is enhanced by subnetting a single network • Multiple smaller subnets isolates groups of hosts • Network administrators can utilize network security tools • Makes it easier to regulate who has access in and out of a particular subnetwork • Subnets also allow network administrators to hide the internal network layout

10. Security through Network Design (continued) • Virtual LAN (VLAN) • In most network environments, networks are divided or segmented by using switches • A VLAN allows scattered users to be logically grouped together even though they may be attached to different switches • Can reduce network traffic and provide a degree of security similar to subnetting: • VLANs can be isolated so that sensitive data is transmitted only to members of the VLAN

13. Security through Network Design (continued) • VLAN communication can take place in two ways • All devices are connected to the same switch • Traffic is handled by the switch itself • Devices are connected to different switches • A special “tagging” protocol must be used, such as the IEEE 802.1Q-2005 • A VLAN is heavily dependent upon the switch for correctly directing packets • Attacks on the switch that attempt to exploit vulnerabilities such as weak passwords or default accounts are common

14. Security through Network Design (continued) • Convergence • One of the most visible unification efforts is a process known as convergence of voice and data traffic over a single IP network • Advantages • Cost savings • Management • Application development • Infrastructure requirements • Reduced regulatory requirements • Increased user productivity

15. Security through Network Design (continued)

16. Security through Network Design (continued) • Demilitarized Zone (DMZ) • A separate network that sits outside the secure network perimeter • Outside users can access the DMZ but cannot enter the secure network

17. Security through Network Design (continued)

18. Security through Network Design (continued)

19. Security through Network Technologies • Network Address Translation (NAT) • Hides the IP addresses of network devices from attackers • Private addresses • IP addresses not assigned to any specific user or organization • Function as regular IP addresses on an internal network • Non-routable addresses

20. Security through Network Technologies (continued) • NAT removes the private IP address from the sender’s packet • And replaces it with an alias IP address • When a packet is returned to NAT, the process is reversed • An attacker who captures the packet on the Internet cannot determine the actual IP address of the sender

21. Security through Network Technologies (continued) Security+ Guide to Network Security Fundamentals, Third Edition

22. Security through Network Technologies (continued) • Port address translation (PAT) • A variation of NAT • Each packet is given the same IP address but a different TCP port number • Network Access Control (NAC) • Examines the current state of a system or network device before it is allowed to connect to the network • Any device that does not meet a specified set of criteria is only allowed to connect to a “quarantine” network where the security deficiencies are corrected

23. Security through Network Technologies (continued) • Goal of NAC • Prevent computers with sub-optimal security from potentially infecting other computers through the network • Methods for directing the client to a quarantine VLAN • Using a Dynamic Host Configuration Protocol (DHCP) server • Using Address Resolution Protocol (ARP) poisoning

24. Security through Network Technologies (continued)

26. Security through Network Technologies (continued)

27. Applying Network Security Devices • Devices include: • Firewalls • Proxy servers • Honeypots • Network intrusion detection systems • Host and network intrusion prevention systems • Protocol analyzers • Internet content filters • Integrated network security hardware Security+ Guide to Network Security Fundamentals, Third Edition

28. Firewall • Firewall • Typically used to filter packets • Sometimes called a packet filter • Designed to prevent malicious packets from entering the network • A firewall can be software-based or hardware-based • Hardware firewalls usually are located outside the network security perimeter • As the first line of defense

29. Firewall (continued)

30. Firewall (continued) • The basis of a firewall is a rule base • Establishes what action the firewall should take when it receives a packet (allow, block, and prompt) • Stateless packet filtering • Looks at the incoming packet and permits or denies it based strictly on the rule base • Stateful packet filtering • Keeps a record of the state of a connection between an internal computer and an external server • Then makes decisions based on the connection as well as the rule base

31. Firewall (continued)

32. Firewall (continued)

33. Firewall (continued) • Personal software firewalls have gradually improved their functionality • Most personal software firewalls today also filter outbound traffic as well as inbound traffic • Protects users by preventing malware from connecting to other computers and spreading

35. Proxy Server • Proxy server • A computer system (or an application program) that intercepts internal user requests and then processes that request on behalf of the user • Goal is to hide the IP address of client systems inside the secure network • Reverse proxy • Does not serve clients but instead routes incoming requests to the correct server

37. Proxy Server (continued) Security+ Guide to Network Security Fundamentals, Third Edition

38. Honeypot • Honeypot • Intended to trap ( فخ) or trick attackers • A computer typically located in a DMZ that is loaded with software and data files that appear to be authentic • Yet they are actually imitations (مقلدة)of real data files • Three primary purposes of a honeypot: • Deflect تشتيت))attention • Early warnings of new attacks • Examine attacker techniques

39. Honeypot (continued) • Types of honeypots • Production honeypots • Research honeypots • Information gained from honeypots can be both useful as well as alarming • Information gained from studies using honeypots can be helpful in identifying attacker behavior and crafting defenses

40. Please see the following videos • NAT • https://www.youtube.com/watch?v=BI5ml-lcKU8 • PAT • https://www.youtube.com/watch?v=63Q7s5CjMDg&feature=related • Proxy Sever • https://www.youtube.com/watch?v=ZIqWHHgdnXE • Honeypot • https://www.youtube.com/watch?v=76iHn5MH2IY

41. Network Intrusion Detection Systems (NIDS) • Network intrusion detection system (NIDS) • Watches for attempts to penetrate a network • NIDS work on the principle of comparing new behavior against normal or acceptable behavior • A NIDS looks for suspicious patterns

42. Network Intrusion Detection Systems (NIDS) (continued)

43. Network Intrusion Detection Systems (NIDS) (continued) • Functions a NIDS can perform: • Configure the firewall to filter out the IP address of the intruder • Launch a separate program to handle the event • Play an audio file that says “Attack is taking place” • Save the packets in a file for further analysis • Send an entry to a system log file • Send e-mail, page, or a cell phone message to the network administrator • Terminate the TCP session by forging a TCP FIN packet to force a connection to terminate

44. Host and Network Intrusion Prevention Systems (HIPS/NIPS) • Intrusion prevention system (IPS) • Finds malicious traffic and deals with it immediately • A typical IPS response may be to block all incoming traffic on a specific port • Host intrusion prevention systems (HIPS) • Installed on each system that needs to be protected • Rely on agents installed directly on the system being protected • Work closely with the operating system, monitoring and intercepting requests in order to prevent attacks

45. Host and Network Intrusion Prevention Systems (HIPS/NIPS) (continued) • Most HIPS monitor the following desktop functions: • System calls • File system access • System Registry settings • Host input/output • HIPS are designed to integrate with existing antivirus, anti-spyware, and firewalls • HIPS provide an additional level of security that is proactive instead of reactive

46. Host and Network Intrusion Prevention Systems (HIPS/NIPS) (continued) • Network intrusion prevention systems (NIPS) • Work to protect the entire network and all devices that are connected to it • By monitoring network traffic NIPS can immediately react to block a malicious attack • NIPS are special-purpose hardware platforms that analyze, detect, and react to security-related events • Can drop malicious traffic based on their configuration or security policy

47. Quiz ? • What is the difference between proactive and reactive? • What is the meaning of intrusion in grand mother principle ?

48. Protocol Analyzers • Three ways for detecting a potential intrusion • Detecting statistical anomalies • Examine network traffic and look for well-known patterns of attack • Use protocol analyzer technology • Protocol analyzers • Can fully decode application-layer network protocols • Different parts of the protocol can be analyzed for any suspicious behavior Suspicious: مشبوه , مشكوك فيه Anomalies شاذ او غريب او مختلف

49. Quiz ? • How the protocol analyzers works.

50. Internet Content Filters • Internet content filters • Monitor Internet traffic and block access to preselected Web sites and files • A requested Web page is only displayed if it complies with the specified filters • Unapproved Web sites can be restricted based on the Uniform Resource Locator (URL) or by matching keywords