Network Security: Pentingnya Keamanan Komputer Computer Network Research Group ITB

Perspective... zless then 200 security incident in zabout 400 in zabout 1400 in zestimated more than 2241 in zNobody knows the correct statistics on how many attacks are actually detected by the sites broken into.

Survey Dan Farmer (Dec96) z1700 web sites: y60% vurnelable. y9-24%terancam jika satu bug dari service daemon (ftpd, httpd / sendmail) ditemukan. ySerangan pada % sites di netralisir menggunakan denial-of-service

Statistik Serangan

Resiko Serangan

Sumber Serangan

Aktifitas Serangan

Serangan di Internet zApprox hosts are connected to Internet (end1996) zUS DoD serangan / tahun. zSerangan pada Rome Laboratory.

Network Security usaha untuk mencegah seseorang melakukan tindakan-tindakan yang tidak kita inginkan pada komputer, perangkat lunak, dan piranti yang ada di dalamnya sehingga semuanya tetap dalam keadaan ideal yang kita inginkan’

Layout Firewall

What are you trying to protect? zYour Data. zYour Resources. zYour Reputation.

What Are You Trying To Protect Against? zType of attacks zIntrusion. zDenial of Service. zInformation Theft.

Type of Attackers zJoyriders. zVandals. zScore Keepers. zSpies (Industrial & Otherwise). zStupidity & Accidents.

Security Policy ‘satu keputusan yang menentukan batasan- batasan tindakan-tindakan yang bisa dilakukan dan balasan apabila terjadi pelanggaran batasan-batasan yang ada untuk mencapai satu tujuan tertentu’

Objectives zSecrecy zData Integrity zAvailability

Step Security Policy zApa yang boleh / tidak boleh. zPrediksi resiko & biaya (start dengan bug). zTentukan objek yang di lindungi. zTentukan bentuk ancaman & serangan: yunauthorized access. yDisclosure information. yDenial of service.

Step... zPerhatikan kelemahan system: yauthentication. yPassword sharing. yPenggunaan password yang mudah di tebak. ySoftware bug. zOptimasi Cost / Performance.

Manusia... zTanggung Jawab. zKomitmen.

Design Security Policy zKerahasiaan (Secrecy) zIntegritas Data zAvailability zKonsistensi zKontrol Identifikasi & Authentikasi zMonitoring & Logging

Prinsip... zHak minimum zKurangi jumlah komponen

How Can You Protect Your Site zNo Security. zSecurity Through Obscurity. zHost Security. zNetwork Security. zNo Security Model Can Do It All.

What Can A Firewall Do? zA firewall is a focus for security decisions. zA firewall can enforce security policy. zA firewall can log Internet activity efficiently. zA firewall limits your exposure.

What Can’t A Firewall Do? zA firewall can’t protect you against malicious insiders. zA firewall can’t protect you against connections that don’t go through it. zA firewall can’t protect against completely new threats. zA firewall can’t protect against viruses.

List of A Must Secure Internet Services zElectronic mail (SMTP). zFile Transfer (FTP). zUsenet News (NNTP). zRemote Terminal Access (Telnet). zWorld Wide Web Access (HTTP). zHostname / Address lookup (DNS).

Security Strategies. zLeast Privilege. zDefense in Depth (multiple security mechanism). zChoke Point forces attackers to use a narrow channel. zWeakest Link. zFail-Safe Stance. zDiversity of Defense. zSimplicity.

Building Firewalls

Some Firewall Definitions zFirewall yA component or set of components that restricts access between a protected network and the Internet, or between other sets of networks. zHost yA computer system attached to a network.

Firewall Def’s Cont’.. zBastion Host yA computer system that must be highly secured because it is vulnerable to attack, usually because it is exposed to the Internet and is a main point of contact for users of internal networks. zDual-homed host yA general-purpose computer system that has at least two network interfaces (or homes).

Firewall Def’s Cont... zPacket. yThe fundamental unit of communication on the Internet. zPacket filtering. yThe action a device takes to selectively control the flow of data to and from a network. zPerimeter network. ya network added between a protected network and external network, to provide additional layer of security.

Firewall Def’s Cont... zProxy Server yA program that deals with external servers on behalf of internal clients. Proxy client talk to proxy servers, which relay approved client requests on to real servers,and relay answer back to clients.

Packet Filtering

Proxy Services

Screened Host Architecture

De-Militarized Zone Architecture

DMZ With Two Bastion Hosts

It’s OK zMerge Interior & Exterior Router zMerge Bastion Host & Exterior Router zUse Mutiple Exterior Router zHave Multiple Perimeter Network zUse Dual -Homed Hosts & Screened Subnets

It’s Dangerous zUse Multiple Interior Router zMerge Bastion Host and Interior Router

Private IP Address zUse within Internal Network zReference RFC 1597 zIP address alocation: yClass A:10.x.x.x yClass B: x.x x.x yClass C: x x

Bastion Host zIt is our presence in Internet. zKeep it simple. zBe prepared for the bastion host to be compromised.

Special Kinds of Bastion Hosts zNonrouting Dual-Homed Hosts. zVictim Machine. zInternal Bastion Hosts.

Choosing A Bastion Host zWhat Operating System? yUnix zHow Fast a Machine? y386-based UNIX. yMicroVAX II ySun-3

Proxy Systems zWhy Proxying? yProxy systems deal with the insecurity problems by avoiding user logins on the dual- homed host and by forcing connections through controlled software. yIt’s also impossible for anybody to install uncontrolled software to reach Internet; the proxy acts as a control point.

Proxy - Reality & Illusion

Advantages of Proxying zProxy services allow users to access Internet services “directly” zProxy services are good at logging.

Disadvantages of Proxying zProxy services lag behind non-proxied services. zProxy services may require different servers for each service. zProxy services usually require modifications to clients, procedures, or both. zProxy services aren’t workable for some services. zProxy services don’t protect you from all protocol weaknesses.

Proxying without a Proxy Server zStore-and-Forward services naturally support proxying. zExamples: y (SMTP). yNews (NNTP). yTime (NTP).

Internet Resources on Security Issues

WWW Pages zhttp:// tml zhttp:// ml

Mailing Lists yftp://ftp.greatcircle.com/pub/firewalls/ yhttp:// yftp://net.tamu.edu/pub/security/lists/academ ic-firewalls

Newsgroups zcomp.security.announce. zcomp.security.unix. zcomp.security.misc. zcomp.security.firewalls. zalt.security. zcomp.admin.policy. zcomp.protocols.tcp-ip. zcomp.unix.admin. zcomp.unix.wizards

Summary zIn these dangerous times, firewalls are the best way to keep your site secure. zAlthough you’ve got to include other tipes of security in the mix, if you’re serious about connecting to the Internet, firewall should be at the very center of your security plans.