© 2009 Pearson Education, Inc. Publishing as Prentice Hall Chapter 9 Pankos Business Data Networks and Telecommunications, 7th edition © 2009 Pearson Education,

© 2009 Pearson Education, Inc. Publishing as Prentice Hall

Chapter 9

Panko’sBusiness Data Networks and Telecommunications, 7th edition © 2009 Pearson Education, Inc. Publishing as Prentice Hall

May only be used by adopters of the book

Security

© 2009 Pearson Education, Inc. Publishing as Prentice Hall 9-2

9-1: Security

• A Major Threat

• Intelligent Adversaries– Not just human error to content with

– Adapt to defenses

• Recap from Chapter 1– Authentication

– Cryptography for messages

– Firewalls

– Host hardening

2


9-3: Malware

• Malware– A general name for evil software

• Viruses– Pieces of code that attach to other programs

– Virus code executes when infected programs execute

– Infect other programs on the computer

– Spread to other computers by e-mail attachments, IM, peer-to-peer file transfers, etc.

– Antivirus programs are needed to scan arriving files• Also scan for other malware

3


9-3: Malware

• Worms

– Stand-alone programs that do not need to attach to other programs

– Can propagate like viruses through e-mail, etc.• This requires human gullibility, which is unreliable

and slow

4


9-3: Malware

• Worms– Vulnerability-enabled worms jump to victim hosts directly

• Can do this because hosts have vulnerabilities

– Vulnerability-enabled worms can spread with amazing speed

– Vendors develop patches for vulnerabilities, but companies often fail or are slow to apply them

5

InfestedComputer

Computerwith

Vulnerability


9-3: Malware

• Payloads

– After propagation, viruses and worms execute their payloads

– Payloads erase hard disks or send users to pornography sites if they mistype URLs

– Trojan horses are exploitation programs that disguise themselves as system files

– Spyware Trojans collect sensitive data and send the data it to an attacker

6


9-4: Attacks on Individuals

• Social Engineering– Tricking the victim into doing something against his or

her interests

• Spam– Unsolicited commercial e-mail

• Fraud– Deceiving individuals to get them to do things against

their interests

• Taking the Reader to a Website with Malware

7


9-4: Attacks on Individuals

• Credit Card Number Theft– Performed by carders

• Identity theft– Involves collecting enough data to impersonate the

victim in large financial transactions

• Phishing– A sophisticated social engineering attack in which an

authentic-looking e-mail or website entices the user to enter his or her username, password, or other sensitive information

8


9-5: Human Break-Ins

• Human Break-Ins

– Viruses and worms rely on one main attack method

– Humans can keep trying different approaches until they succeed

• Hacking

– Hacking is breaking into a computer

– More precisely, hacking is intentionally using a computer resource without authorization or in excess of authorization

9



• Scanning Phase

– Send attack probes to map the network and identify possible victim hosts

– The Nmap program is popular for scanning attacks (Figure 9-6)

10


Figure 9-6: Nmap Scanning Output

11

IP Range to Scan

Type of Scan

Identified Host and

Open Ports



• The Break-In

– Uses an exploit—a tailored attack method that is often a program

– Normally exploits a vulnerability on the victim computer

– Often aided by a hacker tool

– The act of breaking in is called the exploit

– The hacker tool is also called an exploit

12



• After the Break-In– The hacker downloads a hacker tool kit to automate

hacking work

– The hacker becomes invisible by deleting log files

– The hacker creates a backdoor (way to get back into the computer)• Backdoor account—account with a known password

and full privileges• Backdoor program—program to allow reentry; usually

Trojanized

13



• After the Break-In– The hacker can then do damage at his or her leisure

• Download a Trojan horse to continue exploiting the computer after the attacker leaves

• Manually give operating system commands to do damage

14


9-7: Distributed Denial-of-Service (DDoS) Attack Using Bots

15

In a distributed denial-of-service attack,the attacker floods the victim computer(or network) with more traffic than the

victim can handle. Legitimate users aredenied service from the unavailable server.



16

The attackerinstalls Bot programs

on many PCs.

This is calleda botnet.



17

When it istime to attack

the victim,the attackersends attackcommands toall of the Bots.



18

The Bots then beginflooding the victim

with attack packets,rendering the victimunavailable to users


9-8: Bots

19

Bots can be updatedby their human master

to fix bugs or togive new functionality—for instance, to change

the Bot from a DOSattacker to a spambot.


9-9: Types of Attackers

• Traditional Attackers

– Traditional Hackers• Hackers break into computers• Driven by curiosity, a desire for power, and peer

reputation

– Virus writers

20



• Traditional Attackers

– Script kiddies use scripts written by experienced hackers and virus writers• They have limited knowledge and abilities• But large numbers of script kiddies make them

dangerous

– Disgruntled employees and ex-employees

21



• Criminal Attackers

– Most attacks are now made by criminals

– Crime generates funds that criminal attackers need to increase attack sophistication

22


9-9: Types of Attackers (Cont.)

• On the Horizon

– Cyberterror attacks by terrorists

– Cyberwar by nations

– Potential for massive attacks

23


9-10: Security Planning

• Security Is a Management Issue, Not a Technical Issue

– Without good management, technology cannot be effective

– A company must have good security processes

24



25

Plan

Protect• Consumes most

of security management

time

Respond• To compromise

s



• Security Planning Principles

– Risk analysis

• Risk analysis is the process of balancing threats and protection costs for individual assets

• Cost of protection should not exceed the cost of likely damage

• Absolute protection is impossible. Financially reasonable protection is not.

26



• Security Planning Principles

– Comprehensive security

• An attacker has to find only one weakness

• A firm needs comprehensive security to close all avenues of attack

27



• Security Planning Principles– Access control

• Limit access to resources to legitimate users

• Give legitimate users minimum permissions (things they can do)

28



• Security Planning Principles– Defense in depth

• Every protection breaks down sometimes

• An attacker should have to break through several lines of defense to succeed

• Providing this protection is called defense in depth

29

Countermeasure2

Stops the Attack

Countermeasure1

(fails)



• Access Control Planning for Individual Resources– Enumerating and Prioritizing Resources

• Firms must enumerate and prioritize the resource they have to protect

• Otherwise, security planning is impossible

30



• Access Control Planning for Individual Resources– Companies Must Then Develop an Access Control Plan

for Each Resource

• The plan includes the AAA protections

• Authentication is proving the identity of the person wishing access

• Authorization is determining what the person may do if he or she is authenticated

• Auditing is logging data on user actions for later appraisal

31


9-11: Authentication with a Central Authentication Server

32

1.The supplicant sends its credentials to the verifier.



33

2.The verifier passes the credentials to

a central authentication server.

3.The central authentication server

checks the credentials.If the credentials are correct, the

authentication server sends an OK tothe verifier, along with authorizations.

1



34

Central authentication servers bring consistency.

All supplicants are evaluated exactly the same wayNo matter what verifiers they connect to.


9-12: Password Authentication

• Passwords– Passwords are strings of

characters

– They are typed to authenticate the use of a username (account) on a computer

• Benefits– Ease of use for users (familiar)

– Inexpensive because they are built into operating systems

35



• Often Weak (Easy to Crack)

– Word and name passwords are common

– They can be cracked quickly with dictionary attacks

– Hybrid dictionary attacks can crack simple variations, such as “Processing1” almost as fast.

36



• Passwords should be complex– Mix case (A and a), digits (6), and other keyboard

characters ($, #, etc.)

– Can only be cracked with brute force attacks (trying all possibilities)

• Passwords should be long– Eight characters minimum

– Each added character increases the brute force search time by a factor of about 70



• Tell what attack can break it fastest, and tell how difficult it will be for the attacker to guess the password.

– swordfish

– Processing1

– SeAtTLe

– R7%t&

– 4h*6tU9$^l



• Other Concerns

– If people are forced to use long and complex passwords, they tend to write them down

– People should use different passwords for different sites• Otherwise, a compromised password will give access

to multiple sites

39


9-13: Digital Certificate Authentication

• Public and Private Keys– Each party has both a public key and a

private key

– A party makes its public key available to everybody

– A party keeps its private key secret

• If there are 12 employees, how many private keys will there be?

• How many public keys will there be?

40



• Digital Certificate– Tamper-proof file that gives a

party’s public key

41

Name: Smith

Public Key: 8m27cj$leo62@lj*^l18dwk...

Other field

…

Tamper Checking Field



Calculation Digital Certificate

AuthenticationTest

2.Public key ofthe person

the applicantclaims to be

1.Applicant

does a calculationwith his or her

Private key

3.

Verifier tests the calculation with the public key of theclaimed party (not of the sender).

If the test succeeds, the applicant mustknow the secret private key of the claimed party, which

only the claimed party should know.

2



• Perspective

– Digital certificate authentication is very strong

– However, it is very expensive because companies must set up the infrastructure for distributing public–private key pairs

– The firm must do the labor of creating, distributing, and installing private keys

43


9-14: Biometric Authentication

• Biometric Authentication– Authentication based on bodily measurements

– Promises to eliminate passwords

• Fingerprint Scanning– Dominates biometrics use today

– Simple and inexpensive

– Substantial error rate (misidentification)

– Often can be fooled fairly easily by impostors

44



• Iris Scanners– Scan the iris (colored part of the eye)

– Irises are complex, so iris scanning gives strong authentication

– Expensive

• Face Recognition– Camera: allows analysis of facial structure

– Can be done surreptitiously—that is, without the knowledge or consent of the person being scanned

– Very high error rate and easy to fool

45



• Error and Deception Rates– Error and deception rates are higher than vendors claim

– The effectiveness of biometrics is uncertain

46


Figure 9-15: Firewall Operation

47

The border firewall examinesEach packet passing through it.

Ingress filteringEgress filtering



48

If the firewall identifies aPROVABLE attack packet,the firewall drops and logs

the packet in a log file.



49

If the firewall identifies aPROVABLE attack packet,the firewall drops and logs

the packet in a log file.

If the firewall identifies a packetThat is not a provable attack packet,

The firewall passes the packet.

Even if the packet is suspicious,the firewall passes it.


9-16: Stateful Firewall Filtering

• Stateful Firewall Filtering

– There are several types of firewall filtering

– Stateful inspection is the dominant filtering method today

– Stateful firewalls often use other filtering mechanisms as secondary mechanisms

50



• States

– Connections often go through several states

– Connection opening, going communication, closing, etc.

– Different security actions are appropriate for different states

51

ConnectionOpening

State

OngoingCommunication

State

ConnectionClosingState



• Connection Initiation State

– State when packets attempt to open a connection

• Example: packets with TCP segments whose SYN bits are set

52

ConnectionOpening

State


State



9-17: Default Stateful Firewall Behavior for a Connection-Opening Attempt

53

Stateful firewalls have simple default behavior.

If an outside host attempts to open a connection,the firewall prevents the connection by default.

If an inside host attempts to open a connection,the firewall permits it by default.



• Connection Initiation State

– Access control lists can create exceptions to the default behaviors

– Access control lists (ACLs) (see Figure 9-18)

• ACLs modify the default behavior for ingress or egress

• Ingress ACL rules allow access to selected internal servers

• Egress ACL rules prevent access to certain external servers

54


9-18: Ingress Access Control List (ACL) for a Stateful Inspection Firewall

• 1. If protocol = TCP AND destination port number = 25, PASS and add connection to connection table.– This rule permits external access to all internal mail

servers.

55



• 2. If IP address = 10.47.122.79 AND protocol = TCP AND destination port number = 80, PASS and add connection to connection table.– This rule permits access to a particular webserver

(10.47.122.79).

56



• 3. Deny All AND LOG.– If earlier rules do not result in a pass or deny decision,

this last rule enforces the default rule of banning all externally initiated connection-opening attempts.

57



• Packets in the Ongoing Communication State– If the packet does not attempt to open a connection,

• Then if the packet is part of an established connection– It is passed without further inspection– (However, these packets can be filtered if desired)

• If the packet is not part of an established connection, it must be an attack

– It is dropped and logged

58

ConnectionOpening

State


State




• Packets in the Ongoing Communication State

– This simplicity makes the cost of processing most packets minimal

– Nearly all packets are part of the ongoing communication state

59

ConnectionOpening

State


State




• Perspective– Simple operation for most packets leads to inexpensive

stateful firewall operation

– However, stateful inspection firewall operation is highly secure

60


9-19: Firewalls, Intrusion Detection Systems (IDSs), and Intrusion Prevention Systems (IPS)

61

Firewalls IDSs IPSsInspect Packets?

Yes Yes Yes

Action Taken Drop and log individual proven attack packets based on individual packet or connection inspections.

Log multipacket attacks based on deep (multilayer) packet inspections of streams of packet flows Notify an administrator of severe attacks but do not stop the attacks .

Applies IDS processing methods—deep packet inspection and packet stream inspection But actually stops some attacks that have high confidence but are not provably attacks.


9-19: Firewalls, Intrusion Detection Systems (IDSs), and Intrusion Prevention Systems (IPS)

62

Firewalls IDSs IPSsInspect Packets?

Yes Yes Yes

Processing Power Required

Modest Heavy Heavy

Maturity Fairly mature Still immature with too many false positives (false alarms) Tuning can reduce false positives, but this takes a great deal of labor.

New. Only used to stop attacks that can be identified fairly accurately.


9-20: Cryptographic Systems

• Cryptographic Systems– Provide security to multi-message dialogues

• At the Beginning of Each Communication Session– The two parties usually mutually authenticate each other

Party A Party B

Initial Authentication

A’s CredentialsTo B

B’s CredentialsTo A


• Message-by-Message Protection

– After this initial authentication, cryptographic systems provide protection to every message

– Encrypt each message for confidentiality so that eavesdroppers cannot read it


Party A Party BMessages Encrypted for Confidentiality

EavesdropperCannot Read Messages


9-21: Symmetric Key Encryption for Confidentiality

Message“Hello”

Cipher &Key

SymmetricKey

Party A

Party B

Network

Encrypted Message

Encryption uses anon-secret cipher

(encryption method )and a secret key



Encrypted Message

SymmetricKey

Party A

Party B

InterceptorNetwork

Interceptor cannot readencrypted messages en route

Encrypted Message



Encrypted Message Message“Hello”

Cipher &Key

SymmetricKey

SameSymmetric

KeyParty A

Party B

InterceptorNetwork

Receiver decrypts the messageusing the same cipher

and the same symmetric key




– Adds an electronic signature to each message

• The electronic signature authenticates the sender

• It also provides message integrity: receiver can tell if a message has been changed in transit

Party A Party BElectronic Signature




– Digital signatures use digital certificate authentication• Very strong authentication, but also very expensive

– HMACs (key-hashed message authentication codes) are less expensive• They are not quite as secure as digital signatures, but

are still quite secure• The most widely used electronic signature method

69


9-22: Other Aspects of Protection

• Hardening Servers and Client PCs– Setting up computers to protect themselves

• Server Hardening– Back up so that restoration is possible

– Patch vulnerabilities

– Use host firewalls

70



• Client PC Hardening

– As with servers, patching vulnerabilities, having a firewall, and implementing backup

– Also, a good antivirus program that is updated regularly

– Client PC users often make errors or sabotage hardening techniques

– In corporations, group policy objects (GPOs) can be used to centrally manage security on clients

71



• Vulnerability Testing

– Protections are difficult to set up correctly

– Vulnerability testing is attacking your system yourself or through a consultant

– There must be follow-up to fix vulnerabilities that are discovered

72


9-23: Incident Response

• Even with the best security, successful attacks sometimes happen

1. Detect the Attack

2. Stop the Attack

3. Repair the Damage

4. Punish the Attacker



• Major Attacks and CSIRTs

– Major incidents are those the on-duty staff cannot handle

– Computer security incident response team (CSIRT)

– Must include members of senior management, the firm’s security staff, members of the IT staff, members of functional departments, and the firm’s public relations and legal departments

74



• Disasters and Disaster Recovery

– Natural and humanly-made disasters

– IT disaster recovery for IT• Dedicated backup sites and transferring personnel• Having two sites that mutually back up each other

– Business continuity recovery• Getting the whole firm back in operation• IT is only one player

75



• Rehearsals

– Rehearsals are necessary for speed and accuracy in response

– Time literally is money

76

© 2009 Pearson Education, Inc. Publishing as Prentice Hall Chapter 9 Pankos Business Data Networks and Telecommunications, 7th edition © 2009 Pearson Education,

Documents

pearson education

prentice hall chapter

vulnerability slide

victim computer

malware malware

book security slide

service attack

malware payloads