Practical connection assignment 500 WORD ( due in 4 hours MANDATORY ) NO PLAGIARISIM ).
anve5h.5p10
ISOL532Spring2017Week2.pptxISOL 532 Telecommunications and Network Security
Week 2: Network and Firewall Fundamentals, Network Security Threats and Issues
Network Models
Network models use layers to describe networks
Each layer describes the services provided to the layer above it and those required from the layer below it
It also describes the format of exchanges between peer layers on different network hosts
Because the layers “stack” on top of one another, we often refer to network protocol “stacks” when we talk about the implementation
Layer N
Layer N+1
Layer N-1
Layer N+1
Layer N
Layer N-1
Provides
Requires
Exchanges
OSI (pg 62)
The most well-known network model is the OSI (Open Systems Interconnect) Reference Model defined and maintained by the Organization for International Standardization (ISO)
It consists of seven layers, numbered from the bottom (closest the network) to the top (closest the user)
It is an educational model on how networking protocols work
It is also a framework for designing and building network protocols
Layer 1 – Physical
Layer 2 – Data Link
Layer 3 – Network
Layer 4 – Transport
Layer 5 – Session
Layer 6 – Presentation
Layer 7 – Application
Open System Interconnect (OSI) Reference Model
Physical Layer
Layer 1 – The Physical Layer
Works at bit level
Defines the type of media to be used
Defines representation of data on the medium
Is a ‘0’ “high” or “low”, “on” or “off”?
What order are bits transmitted (if serial)?
What speed will the bits be transmitted at?
Data Link Layer
Layer 2 – The Data Link Layer
The data link layer provides a reliable link between two directly connected nodes by detecting and possibly correcting errors that may occur at the physical layer.
The data link layer is divided into two sub layers:
Media Access Control (MAC) layer:
Responsible for controlling how computers in the network gain access to data and permission to transmit it.
Provides a unique physical address for the node
Logical Link Control (LLC) layer
Error checking
Frame synchronization
Network Layer
Layer 3 – The Network Layer
Provides end-host-to-end-host data transfer across (potentially) multiple data links
Defines higher-level structure of data (packets)
Defines logical “abstract” address structure for hosts
It provides for the concept of network routing
Transport Layer
Layer 4 – The Transport Layer
Provides process-to-process data transfer
May provide for reliable data transfer
Defines higher-level structure for data (datagrams, streams, etc.)
Defines “port” addresses for services (processes)
Session Layer
Layer 5 – The Session Layer
Provides a logically persistent connection between processes
Transmission Mode
Simplex – One way communication were the sender always transmits and receiver always receives (Ex, Remote controls and TV’s)
Half Duplex – A type of two way communication were both parties can be the sender and receiver but not at the same time (Ex, CB radio)
Full Duplex – A type of two way communication were both parties can be the sender and receiver at the same time (ex, telephones)
Session checkpoints
Presentation Layer
Layer 6 – The Presentation Layer
Defines the network representation of data
Converts between the network and host representations of data (ASCII/EBCDIC, byte order, encryption, compression, etc.)
Application Layer
Layer 7 – The Application Layer
Provides a portal for the application to access the network
Describes the dialog between two applications communicating across the network.
Strengths and Weaknesses of OSI
Strengths:
Established, widely accepted model
Published as an ISO standard
Flexible and generic
Weaknesses:
Generally considered complex
Layer definition too coarse on the lower layers, too detailed on the upper layers
TCP/IP Reference Model
Common Terms
Node – any device on the network
Host - a node that has a logical address (IP address)
IPv4 – most common IP addressing used currently; being phased out by IPv6
IPv6 – Defined in 1998 and slowly taking the place of IPv4; more secure but more complex.
NAT – Network Address Translation
PAT – Port Address Translation (more granular than NAT)
Private IP Addresses (pg 31)
DNS – Domain Naming System
FQDN – Fully Qualified Domain Name (i.e. mycomp.mydomain.com)
IDS – Intrusion Detection System; passive
IPS – Intrusion Prevention System; active
NAC – Network Access Control; verifies and enforces network security policy on connecting hosts
Multi-homed – system with more than one network connection
IP Networking - IP networking protocol is the most widely used protocol for routing data between various network systems.
Networking
What is a Network Security policy and why is it important?
Who is responsible for network security?
Senior Management has the ultimate and final responsibility
Network Administrators manage computer resources
Operators use the resources
i.e. Everyone is responsible at some level
Network Topologies
Network topology: is the name given to the way in which the devices (called nodes) are physically connected in a network.
The network topology chosen typically dictates:
the type of cabling used in the network
The scalability of the network
Bus Topology
Nodes are connected to a main (bus) cable. If data is being sent sent between nodes then other nodes cannot transmit. If too many nodes are connected then the transfer of data slows dramatically as the nodes have to wait longer for the bus to be clear.
Bus Topology
Advantages:
The simplest and cheapest to install and extend.
Well suited for temporary networks with not many nodes.
Very flexible as nodes can be attached or detached without disturbing the rest of the network.
Failure of one node does not affect the rest of the bus network.
Simpler than a ring topology to troubleshoot if there is a cable failure because sections can be isolated and tested independently.
Disadvantages:
If the bus cable fails then the whole network will fail.
Performance of the network slows down rapidly with more nodes or heavy network traffic.
The bus cable has a limited length and must be terminated properly at both ends to prevent reflected signals.
Slower than a ring network as data cannot be transmitted while the bus is in use by other nodes.
Ring Topology
In a ring topology, the nodes are connected in a ring and data travels in one direction using a control signal called a 'token'.
Ring Topology
Advantages:
Not greatly affected by adding further nodes or heavy network traffic as only the node with the 'token' can transmit data so there are no data collisions.
Relatively cheap to install and expand.
Disadvantages:
Slower than a star topology under normal load.
If the cable fails anywhere in the ring then the whole network will fail.
If any node fails then the token cannot be passed around the ring any longer so the whole network fails..
The hardest topology to troubleshoot because it can be hard to track down where in the ring the failure has occurred.
Harder to modify or expand because to add or remove a node you must shut down the network temporarily.
In order for the nodes to communicate with each other they must all be switched on.
Star Topology
In this type of network, a central computer (server) usually forms the main node and the subsidiary nodes are connected to it and to each other through a switch or hub.
Star Topology
Advantages:
The most reliable because the failure of a node or a node cable does not affect other nodes.
Simple to troubleshoot because only one node is affected by a cable break between the switch and the node.
Adding further nodes does not greatly affect performance because the data does not pass through unnecessary nodes.
Easily upgraded from a hub to a switch for higher performance. Easy to install and to expand with extra nodes.
Disadvantages:
Uses the most cable which makes it more expensive to install than the other two topologies.
The extra hardware required such as hubs or switches further increases the cost.
As the central computer controls the whole system, the whole system will be affected if it breaks down or if the cable link between it and the switch fails.
If the switch, the link to the server or the server itself fails then the whole network fails.
Network Topologies Summary
Mesh Topology
Tree Topology
Firewalls
Firewall: a software or hardware-based network security system that controls the incoming and outgoing network traffic based on applied rule set.
A firewall establishes a barrier between a trusted, secure internal network and another network (e.g., the Internet) that is not assumed to be secure and trusted.
Firewalls
Firewalls typically classifies all data via “security zones”.
Types of zones
Internal Network (aka inside): Trusted network holding resources to be protected
External Network (aka outside): Untrusted network.
The Internet should always be considered untrusted.
DMZ (Demilitarized zone): Can be used for two different purposes.
Place outside facing servers that must interact with the untrusted network.
Place honeypot servers
Honeypot: a trap set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored.
Firewalls
Firewalls
Bastion Host: Firewall software installed as an operating system platform (it’s a border sentry; sometimes called a sacrificial host)
The operating system must be hardened as much as possible
Can be turned into almost any type of hardware
Can incorporate routing functions
Note: if it doesn’t it’s just a normal host-based firewall.
Firewalls are typically multi-homed devices.
NAT typically happens on firewalls not routers.
Firewalls
Three general types of firewalls
Packet filter
Proxy
Application filter
(the books lists generic types – Personal, commercial and appliance firewalls as well as dividing them up to software and hardware firewalls; pgs 66 – 67 break these down ably but, in essence, all firewalls are hardware of some sort with software running\managing them)
Firewalls
Packet filter:
allows only those packets to pass, which are allowed as per your firewall policy.
Each packet passing through is inspected and then the firewall decides to pass it or not.
The information may or may not be remembered by the firewall.
Two type of packet filter firewalls
Stateless
Stateful
Firewalls
Two Types of packet filtering firewalls
Stateless packet filter:
The information about the passing packets is not remembered by the firewall.
This type of firewalls can be fooled very easily by the hackers.
These are especially dangerous for UDP type of data packets. The reason is that, the allow/deny decisions are taken on packet by packet basis and these are not related to the previous allowed/denied packets.
Stateful packet filter:
The firewall remembers the information about the previously passed packets.
This type of filtering is also known as Dynamic packet filtering.
Firewall
Proxy-based firewalls: Proxy firewalls act as middlemen
they accept all traffic requests coming into the network by impersonating the true recipient of the traffic within the network.
After an inspection, if it decides to grant access, the proxy firewall sends the information to destination computer.
The destination computer’s reply is sent to the proxy, which repackages the information with the source address of the proxy server.
Through this process, the proxy firewall breaks (or terminates) the connection between two computers so that it is the only machine on the network that talks to the outside world.
Firewall
Application firewall
Form of firewall which controls input, output, and/or access from, to, or by an application or service.
It operates by monitoring and potentially blocking the input, output, or system service calls which do not meet the configured policy of the firewall.
The application firewall is typically built to control all network traffic on any OSI layer up to the application layer.
Some of the newest models are called Next Generation Firewalls. (not in textbook, specifically)
Firewalls
Next Generation Firewalls (NGFW)
Third generation (more or less)
Operates at wire speed and at multiple layers of the OSI model
Integrated platform that integrates traditional firewall abilities with some (or all, I suppose) of the following:
malware protection
SSL and\or SSH interception
Website filtering
Antivirus inspection
Application firewall with in-line deep packet inspection (inspects payloads, not just the header)
IDS
Quality of Service (QoS)\bandwidth management
Inspection of encrypted traffic
3rd Party (such as Active Directory) integration
Traditional firewall abilities
Packet filtering
NAT\PAT
Stateful Inspection
VPN Support
What firewalls can’t do
Not all of network security; only a part
Not an authentication system (NGFWs are the exception)
Primarily packet filtering; can’t usually inspect encrypted packets (NGFWs offer some exception to this)
Not a malicious code scanner; (NGFWs offer some exception to this; only very generally on certain firewalls)
Not an intrusion detection system (again, NGFWs are the exception)
No protection against an inside attack\removable media
No protection against social engineering
No protection against physical attacks
No protection against bad administration\configuration\bad security policy
Firewall chapter parts to read again
Pgs 54 and 55 – Risk Assessment\Risk Management
Pg 72 Software vs hardware firewalls
Pg 74 Placement of firewalls
Network security threats and Issues
What is a hacker?
The most common threats to network security
Disgruntled employees (or ex-employees)
Contract workers
Recreational hackers
Opportunistic hackers
Professional hackers
Favorite Targets of hackers
Low hanging fruit –i.e. easy\unsecured assets
Assets that pay of quickly – either fame or monetary rewards
Some target hard-to-compromise assets to prove their abilities
Hacking Process
Reconnaissance
Information gathering about target
Scanning
Verify information gleaned during reconnaissance and discover new details (Wardialing\wardriving, ping sweeps, port scans)
Enumeration
Determine vulnerabilities
Attacking
Target is attacked; modifications to attack(s) are made to compensate for unknowns
Fallback Attacks
Other attacks to either cover the hacker’s tracks or just to create confusion
Post Attack Activities
If the attack is successful, these actions will be taken determined by what the hacker’s objective was
Hacking Process
Common IT Infrastructure Threats
Hardware Failure
Heat
Vibration
Liquids
Humidity (too low or too high)
Static Electricity Discharge (SED)
Electromagnetic Interference
Natural Disasters
Accidents
Intentional Damage
Zero-Day exploits
Fast growth\overuse
Threat Examples
Buffer overflow: an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.
Exploitations:
Stack overflow: by overwriting a local variable that is near the buffer in memory on the stack to change the behavior of the program - which may benefit the attacker.
Heap Exploitation: Memory on the heap is dynamically allocated by the application at run-time and typically contains program data. Exploitation is performed by corrupting this data in specific ways to cause the application to overwrite internal structures such as linked list pointers. Ex, Microsoft’s GDI vulnerability in handling JPEGs.
Covert Channel: creates a capability to transfer information objects between processes that are not supposed to be allowed to communicate
Data Remanence: residual representation of digital data that remains even after attempts have been made to remove or erase the data.
Dumpster Diving
Eavesdropping
Threat Examples
Emanations: The release of interference from electronic equipment to their surrounding environment
TEMPEST is an unclassified short name referring to investigations and studies of compromising emanations.
TEMPEST equipment can essentially remotely mirror what is being done on a remote device.
The cost of Tempest eavesdropping equipment can vary from $5000 to $250,000, and the costs of protection against these devices varies according to the sophistication of the eavesdropper.
Impersonations
Internal Intruders
Malicious Code
Man in the middle (masquerading): a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker.
Examples: unencrypted wireless access point, DNS, DHCP
Threat Examples
Password crackers
Physical access
Replay: is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed.
Shoulder surfing
Sniffers: computer software or hardware that can intercept and log traffic passing over a digital network
Social engineering: refers to psychological manipulation of people into performing actions or divulging confidential information.
Spoofing: is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage.
Examples, email spoofing, IP address spoofing and ARP spoofing (creates man in the middle attack)
Data mining: First phase for a hacker is reconnaissance.
Tunneling
Threat Examples
Denial of Service: is an attempt to make a machine or network resource unavailable to its intended users.
Methods of attack:
Internet Control Message Protocol (ICMP) flood: ICMP protocol is TCP/IP layer 3 protocol that test connectivity.
Ping of death; based on sending the victim a malformed ping packet, which might lead to a system crash.
Ping flood: based on sending the victim an overwhelming number of ping packets
Distributed Denial of Service
Smurf attack: It relies on misconfigured network devices that allow packets to be sent to all computer hosts on a particular network via the broadcast address of the network, rather than a specific machine. The network then serves as a smurf amplifier. In such an attack, the perpetrators will send large numbers of IP packets with the source address faked to appear to be the address of the victim.
Syn flood: occurs when a host sends a flood of TCP/SYN packets, often with a forged sender address. Each of these packets is handled like a connection request, causing the server to spawn a half-open connection, by sending back a TCP/SYN-ACK packet (Acknowledge), and waiting for a packet in response from the sender address (response to the ACK Packet).
Zombies
For Next Week
Finish reading\re-reading Chapters 1, 2 and 4
Finish Labs 1, 2 and 3
Post your Introduction – It’s free points!
