Practical connection assignment 500 WORD ( due in 4 hours MANDATORY ) NO PLAGIARISIM ).
anve5h.5p10
ISOL532Spring2017Week4.pptxISOL 532 Telecommunications and Network Security
Week 4: Firewalls and IEEE Standards
Firewalls so far
Firewalls are at the outer edge (usually) of a network
Firewall are not the complete network security plan, only a part
Firewalls use rules to control\filter traffic
Two main philosophies on rules – Default Deny and Default Allow
There is no “one size fits all” plan that will work for every organization
Ports
Every IP address has 65,535 ports (arguably equaling a total of 131,070 since a port can be used by both TCP and UDP)
Not all ports are usable
Port 0 for TCP traffic is reserved and cannot be used
A port value of 0 for UDP is considered “no port”
The first 1,024 ports (0 – 1023) are called “well known” and are reserved for existing processes (i.e. port 21 for ftp, port 25 for SMTP, etc) as defined by convention by the Internet Assigned Numbers Authority (IANA)
Port lists are easily available
https:// www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
https:// en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports
When a protocol, port and IP address are defined it is called binding
When multiple programs attempt to use the same port it is called a port conflict
These are sometimes used in URLs as well if a webserver has defined it and looks like this: http://www.thiswebsite.com:8080/path/ so that to connect to that web server you have to connect by that port – just the site name will not work
Firewall Processes
Business processes dictate what the firewall should allow as a minimum
Most communication is two way – when this happens a virtual circuit (session) is created and that traffic needs to flow both inside and outside the network
Web traffic
Others (file transfer, messaging, etc)
Most rules should allow inbound responses to outbound requests but prevent external entities from initiating a connection
Firewall Rules
What is a rule\filter\ACL? (textbook, pg 216)
Rule: “A rule is a written expression of an item of concern and one or more actions to take when the item of concern appears in traffic”
Filter: similar to a rule but with the purpose of blocking or denying the item of concern
Access Control List (ACL): grants or denies traffic based on a user\client’s access to a protocol or port
Firewall Rule Guidelines
Keep the rule set simple
Fewer rules, fewer complications
Smaller chance of a loophole (flaw in the logic of filtering that will allow an unwanted action to occur)
Easier to test
Harder to attack and compromise
Document every rule
Should be included in the Security Policy
Along with documenting the rule and its structure, include the intention\purpose of the rule
Unintended consequences can evaluated and corrections made
Use a change control mechanism to track modifications
Always confirm the default deny before using changed or updated rules
Firewall Rule Creation
Rule sets are fairly simple but they do require focus on the specifics
While many modern firewalls have a graphical interface, they usually have a command line interface as well
Written rules will enable an administrator to track changes to the firewall for testing and documentation
Most rules tend to be Outbound rules and Inbound rules are usually modified from a Default Deny to allow Externally initiated connections to a specific type of server, such as one in a DMZ\Extranet
Examples of settings can be found in the textbook on pages 219 – 220
Firewall Rule Creation
Firewall rules are a first match system
Rules are ordered, so if at the top rule a certain type of traffic is denied, no further review of subsequent rules are performed to see if there is one that allows it
General rule of thumb for ordering rules:
Specific Deny rules first
Allow exceptions
Default Deny last
Understand overlap as the rules grow and become complex – it can lead to loopholes
Authentication, Authorization, Accounting
Authentication – verifying the digital identity; “who you are”
Not usually performed on the firewall; usually left up to internal hosts (RADIUS\TACACS\Kerberos – IEEE 802.1x to be discussed at a later date)
Limited options
Authorization – takes place after authentication; determines what you are allowed to do\access;
on a firewall, this usually is authorizing – or not – a connection\circuit
Accounting – monitoring and logging actions
Most devices natively support syslog ( a common centralized logging system)
Firewall Logging (pg 227)
Creates a historical record of activity for traffic and trend analysis as well as growth prediction
Tracks usage levels and times for load balancing, accounting and even back-charging users
Discovers new methods or techniques of attack, especially those based on network packet manipulation
Detects intrusions or attempts to breach security
Creates legally admissible evidence for use in prosecution
Logging
Log retention – usually determined by a written retention policy; if one does not exist, work have one – it is necessary to protect the organization
When limits are reached on network devices, the logs should be saved and backed up externally
Logs should be protected; Logs are attack targets as they can be used to find\thwart attackers; some tools exist for that purpose alone
What is being logged should be defined in the network Security Policy
If you do not log all events, a good minimum guideline can be found on page 228
Alerts
Alert – an automatic notification of a specific event; can be email, text, phone;
Firewall alerts are specific to its area
Firewall reboot
Detection of attacks\intrusion
Specific IP address connections
Alerting aids in tracking problems or attempts at breaching the network
Intrusion Detection Systems (IDS)
System that monitors traffic for known threats or suspicious network activity
When configured properly, works well with firewalls (Firewalls are considered a type of Intrusion Prevention System, or IPS, although the book refers to a different appliance when discussing an IPS in Chapter 7)
IDS discovers malicious traffic\behavior, informs the firewall which then responds to block\prevent\stop the breach
Note: All-in-one appliances (Jack of all Trades) tend not to be as proficient as systems specifically built for one purpose (example – Multifunction printers); firewalls are no exception to this
Intrusion Detection Systems (IDS)
IDS systems can have problems
False Positives – valid traffic flagged as malicious
False Negatives – malicious traffic not flagged as such
IDS systems use different methodologies
Signature database (AKA Signature-based detection, database-based detection or knowledge-based detection)
similar to antivirus methodology
Anomaly-based detection(AKA Statistical Anomaly-Based detection)
Normal defined by rules\filters; anomalies are not always malicious
Behavioral-based detection (AKA Stateful Protocol Analysis Detection)
Records a baseline of normal activity (could be over any period of time)
Drawback – possible that a detected activity did not occur during the baseline timeframe
It must be stressed that an IDS\IPS + Firewall combination is not the total network security package and is only a part of the overall strategy; do not fall into a false sense of security just because there no alarms\alerts or start to ignore alarms\alerts because you get them all the time
Firewall Limitations
Encryption – Read pages 238-239
Firewalls cannot filter encrypted data traffic
The header is readable and therefore can be filtered
Human programming of the firewall’s OS
Coding bugs lead to exploits
Buffer overflow exploits
Patches must be kept up to date
Human configuring of the rules\filters
Fragmentation attacks
Overlapping
Overrun
Firewalking
Internal code planting
DoS\DDoS
Countering limitations
Keep systems patched
Use a hardened configuration
Monitor environment
Be aware of new exploits
Improving Firewall Performance
Firewalls should operate at wirespeed (the speed that the connection allows)
Firewall that is in place should be physically able to meet the speed of the network (i.e the connections on the firewall should be 1 Gbps if the network is 1 Gbps, not 100 Mbps)
Caching – similar to how a proxy server operates; often-accessed content is kept in memory\storage of the firewall for faster access; Limitation: only works well for Web and file transfer
Load Balancing – traffic is distributed across multiple firewalls running in parallel; also aids in redundancy and fault tolerance
Point to remember: The more jobs that a firewall is tasked with doing uses more processor and memory; Malware scanning, IDS, and other add-ons – such as in Unified threat management (UTM) solutions - not only use resources but also tend to make the firewall a single point of failure
Management Interfaces
Must be kept secure – both physically and logically
Access should be encrypted
Strong authentication – multifactor if possible
Disable unused management connections
Enable logging on the management interface
IEEE
IEEE stands for the "Institute of Electrical and Electronics Engineers".
composed of computer scientists, software developers, information technology professionals, physicists, and medical doctors, in addition to IEEE's electrical and electronics engineering core.
For this reason the organization no longer goes by the full name, except on legal business documents, and is referred to simply as IEEE.
The IEEE is dedicated to advancing technological innovation and excellence. It has about 425,000 members in about 160 countries.
The IEEE is one of the leading bodies to produce standards relating to networking.
IEEE 802 Standards
IEEE 802 refers to a family of standards dealing with local area networks (LAN), wide-area networks (WAN) and metropolitan area networks (MAN).
The 802 number is the name of the IEEE committee that deals with networking standards
Various subcommittees have been created to deal with specific standards. They are denoted by 802.x where x is the number of the subcommittee.
For instance, 802.11 deals with WiFi.
802 typically deals with OSI layers 2 and 1.
802.1
802.1 Bridging and Network Management
802.1q Virtual Local Area Networks (VLAN)
In computer networking, a single layer-2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them via one or more routers.
Traffic is marked (or tagged) to be a part of a specific VLAN
Traffic stays within its own VLAN and must be routed to other VLANs.
In computer networking, a single layer-2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them via one or more routers
802.1x
802.1x Port Based Security
It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.
defines the encapsulation of the Extensible Authentication Protocol (EAP) over IEEE 802
802.1X authentication involves three parties: a supplicant, an authenticator, and an authentication server.
The supplicant is a client device (such as a laptop) that wishes to attach to the LAN
The authenticator acts like a security guard to a protected network. The supplicant (i.e., client device) is not allowed access through the authenticator to the protected side of the network until the supplicant’s identity has been validated and authorized.
The authentication server determines if the supplicants credentials provided to the authenticator are valid. If they are valid, the supplicant (client device) is allowed to access resources located on the protected side of the network.
802.1x
802.1x Process
On detection of a new supplicant, the port on the switch (authenticator) is enabled and set to the "unauthorized" state. In this state, only 802.1X traffic is allowed; other traffic, such as the Internet Protocol (and with that TCP and UDP), is dropped.
To initiate authentication the authenticator will periodically transmit EAP-Request Identity frames to a special Layer 2 address on the local network segment. The supplicant listens on this address, and on receipt of the EAP-Request Identity frame it responds with an EAP-Response Identity frame containing an identifier for the supplicant such as a User ID. The authenticator then encapsulates this Identity response in a RADIUS Access-Request packet and forwards it on to the authentication server. The supplicant may also initiate or restart authentication by sending an EAPOL-Start frame to the authenticator, which will then reply with an EAP-Request Identity frame.
The authentication server sends a reply (encapsulated in a RADIUS Access-Challenge packet) to the authenticator, containing an EAP Request specifying the EAP Method (The type of EAP based authentication it wishes the supplicant to perform). The authenticator encapsulates the EAP Request in an EAPOL frame and transmits it to the supplicant. At this point the supplicant can start using the requested EAP Method, or do an NAK ("Negative Acknowledgement") and respond with the EAP Methods it is willing to perform.
If the authentication server and supplicant agree on an EAP Method, EAP Requests and Responses are sent between the supplicant and the authentication server (translated by the authenticator) until the authentication server responds with either an EAP-Success message (encapsulated in a RADIUS Access-Accept packet), or an EAP-Failure message (encapsulated in a RADIUS Access-Reject packet). If authentication is successful, the authenticator sets the port to the "authorized" state and normal traffic is allowed, if it is unsuccessful the port remains in the "unauthorized" state. When the supplicant logs off, it sends an EAPOL-logoff message to the authenticator, the authenticator then sets the port to the "unauthorized" state, once again blocking all non-EAP traffic.
802.2 Logical Link Control
Defines Logical Link Control (LLC), which is the upper portion of the data link layer of the OSI Model.
The LLC sublayer presents a uniform interface to the user of the data link service, usually the network layer.
Beneath the LLC sublayer is the Media Access Control (MAC) sublayer, which is dependent on the particular medium being used (Ethernet, token ring, FDDI, 802.11, etc.).
802.3 Ethernet
A group of standards that define the physical network media and bandwidth of the network.
Bandwidth: The amount of data that can be transmitted over a given period of time. Examples: 100Mbps or 1Gbps
Type of cable supported: Twisted Pair Cabling (Cat5,6), Fiber optic cable (multimode and single mode) and coax.
Cat 6:1Gbps at 100M, 10Gbps at 33M
Implements Carrier Sense Multiple Access with Collision Detection (CSMA/CD)
802.4 Token Bus
Network implementing the token ring protocol over a "virtual ring" on a coaxial cable.
Disbanded and standard withdrawn
802.5 Token Ring
Defines the MAC layer for token ring networks.
Initially token ring was a proprietary technology of IBM
Maximum bandwidth 15Mbps.
No current research being conducted.
802.6 MAN
A Metropolitan Area Network (MAN) is computer network larger than a local area network, covering an area of a few city blocks to the area of an entire city.
MAN links between local area networks have been built with wireless links using either microwave, radio, or infra-red laser transmission.
Most companies rent or lease circuits from common carriers because laying long stretches of cable is expensive.
Some wired technologies used in MANs include
Fiber Distributed (FDDI): provides a 100 Mbit/s optical standard for data transmission in local area network that can extend in range up to 200 kilometers (120 mi). Although FDDI logical topology is a ring-based token network, it did not use the IEEE 802.5 token ring protocol as its basis; instead, its protocol was derived from the IEEE 802.4 token bus timed token protocol.
Asynchronous Transfer Mode (ATM):developed to meet the needs of the Broadband Integrated Services Digital Network, as defined in the late 1980s, and designed to unify telecommunication and computer networks.
802.11 WiFi
Standards relating to communication via radio frequency.
Standard Bandwidth Frequency Distance
802.11a 54Mbps 5Ghz 30M
802.11b 10Mbps 2.4Ghz 100M
802.11g 54Mbps 2.4Ghz 100M
802.11n 600Mbps 2.4/5Ghz 250M
802.11ac 6.77Gbps 2.4/5Ghz 250M
802.11 Privacy
Wired Equivalent Privacy (WEP)
Designed to approximate wired hub-based Ethernet environment.
Key entered into both the access point and the clients.
All participants in the WiFi LAN.
Uses a stream cipher to protect data
Key length is the initialization vector (IV) plus the WEP key
128 bit WEP = 104b key + 24 bit IV
64 bit WEP = 40b key + 24b IV
Because RC4 is a stream cipher, the same traffic key must never be used twice. The purpose of an IV, which is transmitted as plain text, is to prevent any repetition, but a 24-bit IV is not long enough to ensure this on a busy network. The way the IV was used also opened WEP to a related key attack. For a 24-bit IV, there is a 50% probability the same IV will repeat after 5000 packets.
Depending on the amount of network traffic, and thus the number of packets available for inspection, a successful key recovery could take as little as one minute.
Possible to use a passphrase
Only used to create static keys
Static keys only use the hex characters 0-9 and A-F
802.11 Privacy
WiFi Protected Access (WPA) replaced WEP.
Firmware upgrade
Improved implementation of RC4
Improved implementation of IVs. (TKIP)
TKIP employs a per-packet key, meaning that it dynamically generates a new 128-bit key for each packet and thus prevents the types of attacks that compromised WEP.
WPA2 replaced WPA
Uses AES encryption instead of RC4
WPA2 is mandatory for a device to bear the WiFi trademark.
WPA2-PSK (WiFi Protected Access 2 – Pre-Shared Key)
AKA WPA2 Personal
WPA2 with the use of optional Pre-shared Key authentication
Uses a plain-English passphrase between 8 and 63 characters in length
Passphrase combined with SSID to create encryption keys for each wireless client which are constantly changed
802.11 Privacy
Just a quick note:
WPAWPA2-PSK (TKIP/AES)
AKA WPA2-PSK Mixed Mode
Creates the greatest range of compatibility for legacy WiFi devices
Enables WPA and WPA2 with TKIP and AES
Risky as it makes it possible for a would be attacker to only have to break the weakest encryption scheme to get access
Not advisable to use
Good article: http://www.howtogeek.com/204697/wi-fi-security-should-you-use-wpa2-aes-wpa2-tkip-or-both /
From 2014, but still appicable
802.15 Bluetooth
Bluetooth
Low power, short distances
Operates at the ISM (Industry, Scientific, Medical) band at 2.45Ghz
10Meter range
721Kbps bandwidth
Not secure
Homework 1
Below are 5 interesting TED or TED-type talks that relate to security.
Your assignment is to pick one of the videos and write a response to it. It doesn’t have to be long but should be about 2 – 4 paragraphs. It can be for, against or just a general, thoughtful response to the topic\video.
You do not need to spend a lot of time explaining what the video is about – since I have seen them – but I do want you to spend the majority of the assignment explaining your perspective and thoughts about it.
Since IT security personnel need to not only know what actions we need to implement, we need to understand why we need to take them and well as the any related background topics
I have to mention: do not cut and paste information from other sources – I always want your view and your words.
James Lyne: Everyday cybercrime -- and what you can do about it
https://www.youtube.com/watch?v=fSErHToV8IU&feature=youtu.be
Mikko Hypponen: Fighting viruses, defending the net
https://www.youtube.com/watch?v=cf3zxHuSM2Y&feature=youtu.be
Misha Glenny: Hire the hackers!
https://www.youtube.com/watch?v=6gSwRHScq6M&feature=youtu.be
Guy-Philippe Goldstein: How cyberattacks threaten real-world peace
https://www.youtube.com/watch?v=zI0_fSD6GPY&feature=youtu.be
Governments don't understand cyber warfare. We need hackers | Rodrigo Bijou
https://www.youtube.com/watch?v=_nSHsb5xKPo&feature=youtu.be
Next Week
Work on Labs 4 and 5
Read\re-read chapters 2 and 7 of the textbook
Next lecture will start to cover Chapters 3, 11 and 12
Homework 1 assignment
