Managing Secure Network Systems Melissa Peters COSC 481

Overview Introduction to Network Security Network Protocols Security Policy Network Attacks Intrusion Detection Systems Incident Response and Disaster Recovery

Network Security Brief Network Security consists of the provisions needed to effectively secure the infrastructure of the network to prevent unauthorized access of the network or its resources

Where Network Security Starts First step is authenticating the user After authentication, firewall enforces the rules Intrusion detection systems can detect what may have been missed because they examine network traffic ACL’s on a backup firewall can catch even more Honeypots look appealing to the unsuspecting hacker

Network Protocol: TCP/IP TCP/IP-Language of the Internet; links Network (IP) and Transport (TCP) layers in the OSI Model

Pros and Cons of TCP/IP PROS Open protocol; available to everyone Guaranteed packet delivery (‘syn/ack’) Our ultimate way to ‘map’ to each other via computer CONS Can easily be spoofed or hijacked Requires authentication and security at the Application level Not good for streaming media

UDP-User Datagram Protocol Although UDP is not as common as TCP/IP, it is much better suited for such tasks like streaming media simply because it doesn’t have to use the syn/ack like TCP/IP. It is not as robust as TCP/IP and is considered less reliable.

Security Policy Important part of managing a secure network system and should follow these steps: Identifying the assets Identify required security measures needed and the users responsibilities Identify who is responsible for implementing and maintaining the policy Include a training policy to improve employee awareness

When making critical systems design decisions regarding your network, management needs to identify exactly how the network will be used. Examples of these include: Groups of users who will be given Internet access The frequency in which they will be accessing The type of access required (i.e. email, web browser, file transfer, remote logons,etc.) The type of authentication method used The type of activity permitted, such as being monitored, hours of usage, or file transfers permitted. Following these steps can keep insider access limited as well as outsider access at a minimum

Network Attacks

Denial of Service One of the nastiest attacks on a network Easy to launch, difficult to track Floods host with incoming packets making it impossible to respond, shutting down the service and rendering it useless Becoming less popular now with better designed routers and rule bases

Other Attacks Teardrop Attack or the ‘Ping of Death’ Buffer overflow attacks Viruses, trojans, and worms Executing illicit commands Data diddling and data destruction

Ways to Prevent Network Attacks Use Packet Filtering IP Firewalling Update patches regularly Always backup your system Avoid systems with single points of failure Don’t put data where it doesn’t need to be!

Intrusion Detection Systems Can be protocol based, rate based, or behavior based Active or Passive Sensor, Console, Engine May catch potentially harmful things that may have slipped past firewall

Incident Response and Disaster Recovery

Can you handle it? Depending on your system, the amount of fault tolerance you allow depends on the level of security in your system If a product fails or if your system is breached, you must have an incident recovery and response plan in place to return things to normal

We’ve Covered… Network Security Basics Protocols Network Attacks and Defenses Intrusion Detection Systems Incident Recovery Any questions?