1. Managing Secure Network Systems
Melissa Peters
COSC 481

2. Overview Introduction to Network Security Network Protocols
Security Policy
Network Attacks
Intrusion Detection Systems
Incident Response and Disaster Recovery

3. Network Security Brief
Network Security consists of the provisions needed to effectively secure the infrastructure of the network to prevent unauthorized access of the network or its resources

4. Where Network Security Starts
First step is authenticating the user
After authentication, firewall enforces the rules
Intrusion detection systems can detect what may have been missed because they examine network traffic
ACL’s on a backup firewall can catch even more
Honeypots look appealing to the unsuspecting hacker

5. Network Protocol: TCP/IP
TCP/IP-Language of the Internet; links Network (IP) and Transport (TCP) layers in the OSI Model

6. Pros and Cons of TCP/IP PROS Open protocol; available to everyone
Guaranteed packet delivery (‘syn/ack’)
Our ultimate way to ‘map’ to each other via computer
CONS Can easily be spoofed or hijacked
Requires authentication and security at the Application level
Not good for streaming media

7. UDP-User Datagram Protocol
Although UDP is not as common as TCP/IP, it is much better suited for such tasks like streaming media simply because it doesn’t have to use the syn/ack like TCP/IP. It is not as robust as TCP/IP and is considered less reliable.

8. Security Policy
Important part of managing a secure network system and should follow these steps:
Identifying the assets
Identify required security measures needed and the users responsibilities
Identify who is responsible for implementing and maintaining the policy
Include a training policy to improve employee awareness

9. When making critical systems design decisions regarding your network, management needs to identify exactly how the network will be used. Examples of these include:
Groups of users who will be given Internet access
The frequency in which they will be accessing
The type of access required (i.e. , web browser, file transfer, remote logons,etc.)
The type of authentication method used
The type of activity permitted, such as being monitored, hours of usage, or file transfers permitted.
Following these steps can keep insider access limited as well as outsider access at a minimum

10. Network Attacks

11. Denial of Service One of the nastiest attacks on a network
Easy to launch, difficult to track
Floods host with incoming packets making it impossible to respond, shutting down the service and rendering it useless
Becoming less popular now with better designed routers and rule bases

12. Other Attacks Teardrop Attack or the ‘Ping of Death’
Buffer overflow attacks
Viruses, trojans, and worms
Executing illicit commands
Data diddling and data destruction

13. Ways to Prevent Network Attacks
Use Packet Filtering
IP Firewalling
Update patches regularly
Always backup your system
Avoid systems with single points of failure
Don’t put data where it doesn’t need to be!

14. Intrusion Detection Systems
Can be protocol based, rate based, or behavior based
Active or Passive
Sensor, Console, Engine
May catch potentially harmful things that may have slipped past firewall

15. Incident Response and Disaster Recovery

16. Can you handle it?
Depending on your system, the amount of fault tolerance you allow depends on the level of security in your system
If a product fails or if your system is breached, you must have an incident recovery and response plan in place to return things to normal

17. We’ve Covered… Network Security Basics Protocols
Network Attacks and Defenses
Intrusion Detection Systems
Incident Recovery
Any questions?