Section 10: Security CSIS 479R Fall 1999 “Network +” George D. Hickman, CNI, CNE

Objectives Describe Network security modelsDescribe Network security models List the elements of secure password and user account policiesList the elements of secure password and user account policies

Objectives (Con’t) Describe how encryption worksDescribe how encryption works Describe how firewalls workDescribe how firewalls work Describe how proxy servers workDescribe how proxy servers work

Network Security Models Share-level securityShare-level security –Decentralized security –Used on peer-to-peer networks –Resources shared, password protected User-level securityUser-level security –Centrally managed security structure –Used on Client-server networks –Network Administrator manage access to network resources –NetWare, Windows NT, UNIX, Linux

Password Security Policies Do not let users use names of their Spouse, Children, birthdatesDo not let users use names of their Spouse, Children, birthdates Use passwords with Alpha and Numeric/punctuation marksUse passwords with Alpha and Numeric/punctuation marks Use MiXeD cAsE (if supported)Use MiXeD cAsE (if supported) Use multi-word passwordUse multi-word password

Password Security Policies Require unique passwordsRequire unique passwords Direct users to not share/write down their passwordsDirect users to not share/write down their passwords Require passwordsRequire passwords Force periodic password changesForce periodic password changes Set a minimum length passwordSet a minimum length password

User Account Security Default Administrative UsersDefault Administrative Users –NetWare 4.x + AdminAdmin –NetWare 3.x SupervisorSupervisor –Windows NT Server AdministratorAdministrator –UNIX / Linux RootRoot

Administrative Users Limit additional accounts with (full) administrative rightsLimit additional accounts with (full) administrative rights Assign only rights needed to perform needed tasksAssign only rights needed to perform needed tasks –Password Management –File System Backups

User Accounts Enable intruder detection/lockoutEnable intruder detection/lockout –Prevents guessing passwords Use account expiration dates for temporary workersUse account expiration dates for temporary workers Use time restrictions for loginUse time restrictions for login Set workstation restrictionsSet workstation restrictions –Allows login only from specified computers Limit concurrent loginsLimit concurrent logins

Encryption The non-random process of scrambling informationThe non-random process of scrambling information Secret-KeySecret-Key –The same key is used to encrypt/decrypt –DES, 56-bit key, widely used, fast Private-Public KeyPrivate-Public Key –Private Key kept secret, Public key published –Keys are related, but different. Digital EnvelopesDigital Envelopes –Message encrypted with secret-key (faster) –The Secret-key is encrypted using private/public key encryption

Digital Signature Electronic signature that cannot be forgedElectronic signature that cannot be forged “A computed summary of the message... Encrypted and sent with message.”“A computed summary of the message... Encrypted and sent with message.” Summary is decrypted and compared.Summary is decrypted and compared. This guarantees the message has not been alteredThis guarantees the message has not been altered

Firewalls “hardware or software that keeps a network secure by filtering packets as they pass through the system.”“hardware or software that keeps a network secure by filtering packets as they pass through the system.” Used to allow users Internet access, while protecting the company from outside attacksUsed to allow users Internet access, while protecting the company from outside attacks

Firewalls Work by filtering PacketsWork by filtering Packets Filtered by IP AddressFiltered by IP Address –Examines source and destination addresses, accepts or rejects packets based on rules Filtered by Port NumberFiltered by Port Number –HTTP, FTP, TELNET, etc. use different ports –You can allow and disallow traffic by port

Proxy Servers A proxy server sends requests for workstations in a company, using the IP address of the proxyA proxy server sends requests for workstations in a company, using the IP address of the proxy –This hides the internal IP addresses from outside users Generally employ Network Address Translation (NAT)Generally employ Network Address Translation (NAT)

Proxy Services Proxy servers available for common Internet servicesProxy servers available for common Internet services –HTTP –SMTP –Web Caching Novell BorderManagerNovell BorderManager Microsoft Proxy ServerMicrosoft Proxy Server Netscape Proxy ServerNetscape Proxy Server