1 Copyright © 2005, Cisco Systems, Inc. All rights reserved. Applying Security Principles to Networking Applications Mark Enright Dec 08, 2005

222 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS What is Security in Computer Development Projects What are you protecting Why are you protecting it From whom are you protecting it How are you going to protect it What is the cost of protecting it

333 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Wired Access Topology V V Internet Access Device Local Area Network (LAN) Wide Area Network (WAN)

444 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Wireless Access Topology Internet Access Device Local Area Network (LAN) Wide Area Network (WAN)

555 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Wireless Access Topology Internet Access Device Local Area Network (LAN) Wide Area Network (WAN)

666 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Wireless Access Security Complication Physical Access to Local Area Network no longer exists – Anyone can intercept your conversations – Anyone can utilize your network resources

777 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Security Solution For Wireless Access Authentication Encryption

888 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Typical Solution for Wireless Access Internet 1) Where is Access Point “MyAP” 2) I am here. Prove you know my secret

999 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Typical Solution for Wireless Access Internet 3) Here is my proof 4) OK. Here are session keys

10 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS So Whats The Problem? Wireless Access is a huge Consumer Market People are beoming concerned with Wireless Security My GrandMother cant use it

11 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS What Can We Do To Help Make it easy for Grandma to set up Wireless Security

12 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 1. Configure Security Parameters Automatically Internet When Access Point is booted 1 st time: Configures Random Secure SSID Configures Random WPA Shared Secret Waits for Wireless Association on Secure SSID SSID: 55ID WPA-PSK:

13 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. How Can We Transfer Security Parameters Securely?

14 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One SSID: Well Known SSID Open Authentication 1) Where is my Access Point “Well Known SSID” 2) Here I am. Come on in

15 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One SSID: Well Known SSID Open Authentication 3) Give me Security Parameters 4) Here They Are

16 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One 1) Where is my Access Point 55ID” 2) I am here. Prove you know my secret SSID: 55ID WPA-PSK:

17 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One 3) Here is my proof 4) OK. Here are session keys SSID: 55ID WPA-PSK:

18 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One Attack SSID: Well Known SSID Open Authentication 1) Where is my Access Point “Well Known SSID” 2) Here I am. Come on in

19 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One Attack SSID: Well Known SSID Open Authentication 3) Give me Security Parameters 4) Here they are

20 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial Two What Authentication is possible given constraints – something we know – something we have – something we are – something we do If we can’t be sure, at least be safe

21 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial Two SSID: Well Known SSID Open Authentication Where is my Access Point “Well Known SSID” Here I am. Come on in Where is my Access Point “Well Known SSID” Here I am. Come on in

22 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial Two SSID: Well Known SSID Open Authentication 1) Give Me Security Parameters Hang on a sec Give Me Security Parameters Unable to guarantee unique access Access to all denied

23 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial 2 Attack Attacker just Associates and Listens

24 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Trial 3. Use Trial 2 Method for Authentication Use SSL for Encryption

25 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS So Whats The Problem with IPSec? Network Protection is a huge Consumer Market People are beoming concerned with Security and look to IPSec for help My GrandMother cant use it

26 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Network Address Translation Internet Local Area Network (LAN) Wide Area Network (WAN)

27 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS The RoadWarrior IPSec Problem With common implementations the IP Address need to be known a priori or else a global shared secret is used for Authentication Mobility and NAT make it hard to predict the IP Address

28 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS RoadWarrior Solution 2. Client configured Web Install client software Configure address of Home Gateway 3. Client software connects Logs on to HTTPS Initiates the IPSec VPN 1. Gateway configured SSL Username, password 4. Gateway accepts Authenticates Client by password Figures out current Client IP Address Provisions IPSec for Client IP Address Joins Client to Protected Network using IPSec VPN Home Gateway Internet Protected Network IPSec VPN Tunnel HTTPS Road Warrior Client

29 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS