SYSTEM ADMINISTRATION Chapter 10 Public vs. Private Networks

The most precious assets of a company are the data it has amassed by doing business, and those assets must be protected. The boundary between the private network and the public network (Internet) is defined as the point where the LAN may access the Internet. That might be through a router, or some kind of telephony device.

Assessing Risk Consider the stakeholders: –Network administrators –IT managers –Security managers –Technicians –Financial managers –Upper management. Identify the two types of risk: internal risk and external risk. –Internal risks: employees, contractors, and consultants. –External risk: hackers (continued)

Assessing Risk (continued) The value of the private network resources must be clarified. The value includes the cost of data loss as well as service interruption for employees and customers. Once the risks and value of assets have been determined, write a security policy to protect the network. Stakeholders in the organization must agree to enforce this policy from top down and bottom up. All employees must be subject to the same policy. (continued)

Assessing Risk (continued) Recommendations are then made to enforce the policy. These may include training, identification of unacceptable external resources and Web sites, and remote access to the network. All policies must be tested before they are implemented to assure that employees can still do the job for the company. After the implementation of the security policies takes place, the boundaries must be continuously monitored for attempted invasion.

Firewalls A firewall is defined as a system (or group of systems) that prevents unauthorized access to private network resources from Internet users. Firewalls are often a combination of hardware and software that form the boundary. All firewalls implement some kind of access control list or policy. The most common firewall is the router. (continued)

Firewalls (continued) Routers have the ability to make decisions about whether a packet may enter the network based on: oSource and destination addresses oSource and destination port oThe TCP, IP, UDP, or ICMP protocol type oStatus of the packet as inbound or outbound from the network This decision-making is known as packet filtering. The business security policy is the foundation of the access control list on the router.

What the Firewall Can Do The firewall takes one of two actions against a packet that does not comply with the access control list on a particular interface: it silently discards the packet or it generates an error message that is sent back to the source address on the packet. By silently discarding the packet, the intruder concludes that the device he or she was trying to attack is not available on the network. When an error message is sent back to the source address, the intruder is alerted to the fact that the system is alive, but not at the IP address in the destination portion of the header. The hacker may try other IP addresses to get into the network. (continued)

What the Firewall Can Do (continued) With firewalls, only those ports that are necessary for services will remain open, such as mail (port 25) or http services (port 80). Firewalls are often called the “choke point” for the network because all incoming and outgoing traffic must be scrutinized in one central location.

What Firewalls Cannot Do A firewall cannot protect from an internally generated attack against resources. A firewall cannot protect against any attack that is initiated through a modem connected to an individual workstation within the private network. Firewalls cannot protect against social engineering attacks like password giveaway or impersonation to a helpdesk representative. Firewalls cannot protect against viruses. Certain types of traffic may be denied because of the access control list, but many viruses are not using extraordinary protocol types to do damage.

The Network Layer Firewall The network layer firewall makes decisions to allow or deny packets on the basis of source and destination address, and port address. The network layer firewall cannot explore content within the payload of the packet. The “screened host firewall” is a single device through which all traffic passes on its way to a single host within the private network. (continued)

The Network Layer Firewall (continued) The “screened subnet firewall” is usually a router (or two routers) through which all traffic passes on its way to the private network (allowed traffic) or to a subnet that is not part of the private network, but holds resources belonging to the network (Web servers, mail servers, etc.). Both types of screening firewalls use a bastion host. This machine will have two or more NICs.

Application Layer Firewalls Use some type of software as well as hardware to screen incoming requests and packets to the network. Often provide extensive logging and auditing of traffic as well as payload scrutiny for incoming packets. Additional services may include proxy services, NAT, and content caching. A proxy firewall creates a table of outgoing packets with source addresses belonging to the private network that are mapped (or assigned) to a public IP address for routing on the Internet. This type of firewall acts on behalf of the internal client. (continued)

Application Layer Firewalls (continued) Dual-homed hosts use two NICs installed on the host machine. Traffic is routed between the two NICs. Site-blocking firewalls have the capacity to prevent packets from certain public resources, including specific IP addresses or DNS names, or sites with certain key words in the site name. Proxy firewalls require additional configuration at the client workstation Proxy firewalls are application-specific and require that a proxy exist for the application type. Examples include maintaining proxies for services such as HTTP, FTP, and SMTP.

The Demilitarized Zone (DMZ) Many network administrators choose to create a subnet that contains an organization’s resources, but is outside the boundary of the private network. This is referred to as the Demilitarized Zone or DMZ. Resources such as Web servers, FTP servers, and mail servers can be placed in the DMZ, where they will create no harm to the private network should there be an attack to the resources.

The Extranet The extranet is outside the boundary of the private network but contains resources owned by the private network. It hosts shared resources to known business partners, suppliers, vendors, other businesses, or customers. Those services include data, storage for collaborative projects, and/or technical reference material. The extranet requires additional resources that a DMZ does not require. Routers acting as firewalls and digital certificates for authentication may be required. Other protection mechanisms may also be required.

Network Attacks: Denial of Service Denial of service attacks are called the “PING of Death.” A normal PING packet is a packet that uses ICMP to determine the viability of a host. Four return messages are generated that track the response from the destination host. With denial of service attacks, one very large ICMP packet is sent from the source host to the destination host flooding the buffer, and causing any other requests to be blocked. The destination host will hang or reboot, causing service disruption to other requests coming into the machine. Block ICMP packets to prevent this attack.

Network Attacks: IP Spoofing IP spoofing uses a false source address to get into a network. The source address is often one that belongs to the private network. A packet-filtering firewall cannot determine that this is an unwanted packet because the source address seems in order. Some types of firewalls can block this type of attack

Network Attacks: SYN Flood A SYN flood looks like a denial of service attack. The method: –The first packet in a conversation between two hosts has the SYN flag set to on. –This signals the request for a new conversation. In a SYN flood, huge numbers of packets will be sent to a destination host. –The host will attempt to answer all incoming requests, thus preventing the machine from answering valid requests. This creates a type of denial of service. Some operating systems provide patches to prevent this type of attack.

Implementation of Network Security The implementation of security measures can have adverse as well as beneficial results. –Access control lists, if written incorrectly, may prevent private network users from doing their jobs adequately. The lists must also be maintained for changes in the network. –Proxy firewalls are really gateways or translators. All gateway mechanisms impact network performance negatively. All firewall implementations require constant monitoring, logging, auditing, maintenance, and updating to keep performance at the best levels possible.