Other Security Issues Multi-Layer Security Firewalls Total Security Intrusion Detection Trust

2 Multi-Layer Security zSecurity Can be Applied at Multiple Layers Simultaneously yApplication layer security for database, e- mail, etc. yTransport layer: SSL yInternet layer: IPsec (Chapter 9, Module F) yData link layer: PPTP, L2TP (Module F) yPhysical layer: locks

3 Multi-Layer Security zApplying security at 2 or more layers is good yIf security is broken at one layer, the communication will still be secure zHowever, ySecurity slows down processing yMulti-Layer security slows down processing at each layer

4 Firewalls zFirewall sits between the corporate network and the Internet yPrevents unauthorized access from the Internet yFacilitates internal users’ access to the Internet OK No Firewall Access only if Authenticated

5 Firewalls zPacket Filter Firewalls yExamine each incoming IP packet yExamine IP and TCP header fields yIf bad behavior is detected, reject the packet yNo sense of previous communication: analyzes each packet in isolation IP Firewall IP Packet

6 Firewalls zApplication (Proxy) Firewalls yFilter based on application behavior yDo not examine packets in isolation: use history xIn HTTP, for example, do not accept a response unless an HTTP request has just gone out to that site Application

7 Firewalls zApplication (Proxy) Firewalls yHide internal internet addresses yInternal user sends an HTTP request yHTTP proxy program replaces user internet address with proxy server’s IP address, sends to the webserver HTTP Request Request with Proxy Server’s IP Address

8 Firewalls zApplication (Proxy) Firewalls yWebserver sends response to proxy server, to proxy server IP address yHTTP proxy server sends the IP packet to the originating host yOverall, proxy program acts on behalf of the internal user Response to Proxy Server’s IP Address HTTP Response

9 Firewalls zWhy Hide Internal IP Addresses? yThe first step in an attack usually is to find potential victim hosts ySniffer programs read IP packet streams for IP addresses of potential target hosts yWith proxy server, sniffers will not learn IP addresses of internal hosts False IP Address Host IP Address Sniffer

10 Firewalls zApplication Firewalls yNeed a separate program (proxy) for each application yNot all applications have rules that allow filtering

11 Total Security zNetwork Security is Only Part zServer Security yHackers can take down servers with denial- of-service attack yHacker can log in as root user and take over the server ySteal data, lock out legitimate users, etc.

12 Total Security zServer Security yOccasionally, weakness are discovered in server operating systems yThis knowledge is quickly disseminated yKnown security weaknesses

13 Total Security zServer Security yServer operating system (SOS) vendors create patches yMany firms do not download patches yThis makes them vulnerable to hackers, who quickly develop tools to probe for and then exploit known weaknesses

14 Total Security zClient PC Security yKnown security weaknesses exist but patches are rarely downloaded yUsers often have no passwords or weak passwords on their computer yAdversaries take over client PCs and can therefore take over control over SSL, other secure communication protocols

15 Total Security zApplication Software yMay contain viruses xMust filter incoming messages yDatabase and other applications can add their own security with passwords and other protections

16 Total Security zManaging Users yOften violate security procedures, making technical security worthless ySocial engineering: attacker tricks user into violating security procedures

17 Intrusion Detection zIntrusion detection software to detect and report intrusions as they are occurring zNeeded yLets organization stop intruders so that intruders do not have unlimited time to probe for weaknesses yHelps organization assess security threats yAudit logs list where intruder has been: vital in legal prosecution

18 Trust zSystem A may trust System B yNot check closely for security problems yThis reduces security processing costs yIf trusted system is taken over, disaster xCan exploit systems that trust it System A System B No Close Check Trust

19 Trust zIf System A trusts System B and System B trusts System C, System A often trusts system C yExtreme disaster if highly trusted system is taken over xCan exploit many trusting systems A B C Trust