© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE I Chapter 6 1 Enterprise Network Security Accessing the WAN – Chapter 4

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 2 Objectives  Describe the general methods used to mitigate security threats to Enterprise networks  Configure Basic Router Security  Explain how to disable unused Cisco router network services and interfaces  Explain how to use Cisco SDM  Manage Cisco IOS devices

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 3

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 4

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 5

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 6 Reconnaissance (also scouting) is a military and medical term denoting exploration conducted to gain information.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 7

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 8

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 9

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 10 What is a Security Policy?  A statement of rules by which people are given access to an organization’s technology and information assets to which they must abide

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 11 Functions of a Security Policy  Protects people and information  Sets rules for specific behavior by users, system administrators, management and security personnel  Authorizes security personnel to monitor, probe and investigate  Defines and authorizes the consequences of violators

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 12

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 13

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 14 Applying Cisco IOS Security Features to Routers 1.Manager router security 2.Secure remote administrative access to routers 3.Logging router activity 4.Secure venerable router services and interfaces 5.Secure router protocols 6.Control and filter network traffic

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 15 Passphrase Examples “All people seem to need data processing” Apstndp “My favourite spy is James Bond 007” Mfsijb007 “It was the best of time, it was the worst of times” iwtbotiwtwot “Fly me to the moon and let me play among the start” fmttmalmpats

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 16

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 17

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 18 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 19 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 20 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 21 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 22 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 23 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 24 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 25 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 26 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 27 Venerable Router Services

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 28

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 29 SNMP, NTP, and DNS Vulnerabilities Protocol  SNMP  NTP  DNS Vulnerability Versions 1 & 2 pass management information & community strings (passwords) in clear text Leaves listening ports open and vulnerable Can help attackers connect IP addresses to domain names

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 30

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 31

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 32 Security Device Manager (SDM)

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 33 Cisco SDM Features  Imbedded web-based management tools  Intelligent wizards  Tools for more advanced users ACL VPN Crypto map editor Cisco IOS CLI preview

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 34

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 35

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 36

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 37

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 38

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 39

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 40

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 41

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 42

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 43

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 44

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 45 Cisco IOS Troubleshooting Commands SHOW Static Low overhead Gather facts DBUG Dynamic High overhead Observe Processes Processing Characteristic Processing load Primary use

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 46

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 47 Summary  Security Threats to an Enterprise network include: –Unstructured threats –Structured threats –External threats –Internal threats  Methods to lessen security threats consist of: –Device hardening –Use of antivirus software –Firewalls –Download security updates

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 48 Summary  Basic router security involves the following: –Physical security –Update and backup IOS –Backup configuration files –Password configuration –Logging router activity  Disable unused router interfaces & services to minimize their exploitation by intruders  Cisco SDM –A web based management tool for configuring security measures on Cisco routers

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 49 Summary  Cisco IOS Integrated File System (IFS) –Allows for the creation, navigation & manipulation of directories on a cisco device

© 2006 Cisco Systems, Inc. All rights reserved.Cisco PublicITE 1 Chapter 6 50