Network hardening Chapter 14

objectives Upon completion of this chapter, you should be able to: Identify different types of Intrusion Detection Systems and Prevention Systems Describe how an IDS responds, detects threats and where it runs Describe how to perform a vulnerability assessment Harden a network and its devices Identify switch port security methods

Detection & prevention 14.1 Detection & prevention

Intrusion detection & prevention After implementing security, you don’t wait for an attack Use an IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) Two types of IDS’ Passive (IDS) Active (IPS) Classified by how they detect & respond to attacks

Classifying an ids: how it responds Passive IDS Monitors network for threats Alert if threat is found ONLY DETECTS - DOES NOT TRY TO STOP THREAT Active IDS AKA Intrusion Prevention System (IPS) Detects attack – Takes action! Example: A port is attacked; it closes the port until the attack stops

Classifying an ids: How it detects Signature Recognition Has a list of known attacks MATCH= take action Can only detect identified/listed attacks Anomaly Recognition Identifies typical network traffic Then looks for abnormal traffic Uses a measurement above normal values to determine if action should be taken Anomaly: If there is a sudden increase of ICMP traffic, it will take action.

Classifying an ids: where it runs Host-based Runs on a single PC Monitors application activity & system files Anti-virus software Uses list of virus definitions to detect; SIGNATURE-BASED IDS Network-based Acts like a firewall Put AV on the device so it can scan all PCs Centralized admin point This is called a Detection Scope. Don’t let the equipment do all of the work. YOU still need to monitor the network.

More ways to prevent attacks Create fake resources Honeypot Device or virtual machine that entices intruders by having an obvious vulnerability Distracts hackers from valuable resources You can observe them, gather info about them, prosecute them

Vulnerability assessment Identifies vulnerabilities in a network Vulnerability scanner Scans open ports, software holes, missing patches, misconfigurations, default passwords Ping scanner Detects incoming ICMP requests Allows you to block them on each device’s firewall Port scanner Scans for open ports Password Cracker Identifies weak passwords by trying to crack them Can scan a device or the whole network.

activity TestOut 14.1.2- DEMO Configuring an IDS/IPS TestOut 14.1.5- LAB Configure Intrusion Prevention TestOut 14.1.6- LAB Enable Wireless Intrusion Prevention TestOut 14.1.9- Practice Questions (15Q)

Penetration testing Test that simulates an attack on a network Hire someone to do it; shows any vulnerabilities Black Box Testing Testers have no knowledge of network “see what you can find” White Box Testing Testers have knowledge of network Simulates someone who has details of network Grey Box Testing Testers have some knowledge of network Simulates someone who has done some research

activity TestOut 14.2.3- Explore Penetration Testing Video (DEMO)

14.3 Network hardening Process of securing devices

Hardening devices Switches, routers, firewalls Switches & routers Installed in secure location; locked doors Change default admin username/complex password Limit admin user access Switches & routers Use VLANs to isolate traffic ACLs Port security/MAC address SSH (not Telnet)

More Hardening Servers User Accounts Passwords Install only needed software (no extras) Install anti-malware software Apply patches & service packs Avoid using one server for everything User Accounts Multi-factor; username/password & smartcard Account lockout Time of day restrictions Passwords Aging- change password every so often Can’t reuse old passwords Un-needed software still installed can increase chance of an attack Remove old accounts; account expiration

Switch port security Switches have CAM table with MAC addresses learned & port they are on Two security methods: Restrict each port to a specific MAC address Set max # of MAC addresses a port can learn Switch learns the MAC on a port & puts it in the table. If a PC disconnects and a new PC connects, it will remove the old entry and put the new one in. You can lock down the switch so this does not happen. Specify which devices can connect to a switch & the maximum amount of devices that can connect.

Switch port security actions Protect Discards frames; Disallows unknown MAC Restrict Discards frames; Disallow unknown MAC Creates a log message Shut down Port disabled & admin must reactivate it

Dhcp snooping On a switch Filters out untrusted DHCP messages Prevents rogue DHCP servers (possibly from outside the network) from offering clients an IP address

activity PT Lab- Configure Port Security TestOut 14.3.5- LAB Configure Port Security

Review & study Complete the study guide handout Complete TestOut Practice in Packet Tracer Jeopardy review

Network hardening Chapter 14