1. OV 12 - 1 Copyright © 2011 Element K Content LLC. All rights reserved. Network Security  Network Perimeter Security  Intrusion Detection and Prevention  Protect Network Traffic Using IPSec

2. OV 12 - 2 Copyright © 2011 Element K Content LLC. All rights reserved. NAT 192.168.12.20192.168.12.30192.168.12.100 24.96.83.120 NAT Server

3. OV 12 - 3 Copyright © 2011 Element K Content LLC. All rights reserved. The NAT Process 192.168.12.40:80 Port# NAT Server Web ServerClient 23040 Internal Address 192.168.12.40:80 24.96.83.120:23040

4. OV 12 - 4 Copyright © 2011 Element K Content LLC. All rights reserved. IP Filtering Packets meeting the filter criteria are allowed to pass Packets not meeting the filter criteria are dropped Filter by:  Protocol type  Source IP address  Destination IP address Screening router

5. OV 12 - 5 Copyright © 2011 Element K Content LLC. All rights reserved. MAC Filtering MAC address: 00 00-86-47-F6-65 MAC address: 00-09-6D-07-FF-C3 MAC address: 00-06-25-BC-3F-27 Permitted MAC addresses: 00-00-86-47-F6-65 00-50-04-B4-61-96 00-06-25-BC-3F-27 00-0B-CD-3D-DE-83

6. OV 12 - 6 Copyright © 2011 Element K Content LLC. All rights reserved. Firewalls Firewall Approved Traffic Unapproved Traffic Administrator

7. OV 12 - 7 Copyright © 2011 Element K Content LLC. All rights reserved. Firewall Types There are four common types of firewalls:  Packet filter:  Works at the Network layer.  Each packet being passed along the network is compared to a set of default criteria.  Stateful inspection firewall:  Works at the Session layer.  Monitors the condition or state of the connection.  Proxy firewall:  Works at the Application layer.  Logs user activity and logons.  Stateful multilayer inspection firewall:  Works at the Network, Session, and Application layers  Combines the functions of a packet filter, a stateful inspection firewall, and a proxy firewall.

8. OV 12 - 8 Copyright © 2011 Element K Content LLC. All rights reserved. Common Firewall Features Common firewall features include:  Scanning services - Provides the ability to scan incoming and outgoing packets.  Content filtering - Blocks restricted websites or content.  Signature identification - Signifies that data in question is not legitimate.  Zones - Creates a virtual or physical network topology architecture that creates separate areas (zones) with differing security levels.

9. OV 12 - 9 Copyright © 2011 Element K Content LLC. All rights reserved. DMZs Web server DMZ

10. OV 12 - 10 Copyright © 2011 Element K Content LLC. All rights reserved. Proxy Servers Web request New request Web cache Proxy server

11. OV 12 - 11 Copyright © 2011 Element K Content LLC. All rights reserved. Web Proxy Features  User security – Enables an administrator to grant or deny Internet access.  Gateway services – Enables proxies to translate traffic between protocols.  Auditing – Enables administrators to generate reports on users’ Internet activity.  Remote access services – Provides access to the internal network for remote clients.  Content filtering – Evaluates the content of websites based on words or word combinations.

12. OV 12 - 12 Copyright © 2011 Element K Content LLC. All rights reserved. Website Caching Client request Packet intercepted Download content If the client requests the same data Verifies that the data is current Sends data to client Content update Purges cache Yes No

13. OV 12 - 13 Copyright © 2011 Element K Content LLC. All rights reserved. NAC Scans systems for policy conformance Scans systems for policy conformance

14. OV 12 - 14 Copyright © 2011 Element K Content LLC. All rights reserved. Physical Network Security Measures Building and grounds:  Location  Fire risks  Electrical shielding  Physical access control Devices:  Servers  Laptops/PDAs  Cell phones Communications:  Telecommunications  Service providers  Wireless cells

15. OV 12 - 15 Copyright © 2011 Element K Content LLC. All rights reserved. Intrusion Detection Intrusion detection:  Monitors the events occurring on a computer.  Analyzes events to detect possible security policy violations.  Creates a log of events, and alerting you to the incident.

16. OV 12 - 16 Copyright © 2011 Element K Content LLC. All rights reserved. IDSs Sensors scan for signs of attack Sensors scan for signs of attack

17. OV 12 - 17 Copyright © 2011 Element K Content LLC. All rights reserved. Types of IDSs  Network-based  Host-based  Pattern- or signature-based  Anomaly- or behavior-based  Protocol-based  Application protocol-based

18. OV 12 - 18 Copyright © 2011 Element K Content LLC. All rights reserved. Passive and Active IDSs Passive IDS:  Detects  Logs  Alerts Active IDS:  Detects  Logs  Alerts  Blocks

19. OV 12 - 19 Copyright © 2011 Element K Content LLC. All rights reserved. IPSs IPS

20. OV 12 - 20 Copyright © 2011 Element K Content LLC. All rights reserved. Port Scanners Network host to be scanned Network host to be scanned Lists of open TCP and UDP ports

21. OV 12 - 21 Copyright © 2011 Element K Content LLC. All rights reserved. Vulnerability Assessment Tools Honeypot Scan attack logged Scan attack logged Attacker Launches scanning attack Launches scanning attack

22. OV 12 - 22 Copyright © 2011 Element K Content LLC. All rights reserved. Network Scanners Network scanner Scans networks for usernames Scans networks for usernames

23. OV 12 - 23 Copyright © 2011 Element K Content LLC. All rights reserved. IPSec  Data security in transit  Data authenticity and integrity  Anti-replay protection  Non-repudiation  Eavesdropping and sniffing protection IPSec Standards Provides data authenticity and integrity Provides data authenticity and integrity

24. OV 12 - 24 Copyright © 2011 Element K Content LLC. All rights reserved. IPSec Protection Mechanisms IPSec can protect your network communication in several ways:  Provides data authenticity and integrity  Protects against replay attacks  Prevents repudiation  Protects against eavesdropping and sniffing

25. OV 12 - 25 Copyright © 2011 Element K Content LLC. All rights reserved. IPSec Modes ModeDescription Transport Packet contents are encrypted. IP header used for routing. Used for host-to-host communication. Tunnel Entire packet is encrypted and wrapped in an unencrypted packet. Used for creating VPNs.

26. OV 12 - 26 Copyright © 2011 Element K Content LLC. All rights reserved. IPSec Transport Protocols IPSec uses two transport protocols:  Authentication Header (AH):  Provides data integrity  Uses MD5 and SHA  Encapsulating Security Payload (ESP):  Provides data integrity and confidentiality  Uses DES or 3DES

27. OV 12 - 27 Copyright © 2011 Element K Content LLC. All rights reserved. IKE IPSec Master Key Data encryption keys

28. OV 12 - 28 Copyright © 2011 Element K Content LLC. All rights reserved. Security Associations Phase 1 Phase 2 Phase 1 Phase 2 Negotiation on authentication and encryption Negotiation on authentication and encryption Data transmission

29. OV 12 - 29 Copyright © 2011 Element K Content LLC. All rights reserved. IPSec Policies Security settings in policy Security settings in policy Assigned to both computers Assigned to both computers

30. OV 12 - 30 Copyright © 2011 Element K Content LLC. All rights reserved. IPSec Policy Rules  IP filters – Describe the protocol, port, and source or destination computer the rule applies to.  Filter action – Specifies how the system should respond to a packet that matches a particular filter.  Authentication method – Enables computers to establish a trust relationship.  Tunnel setting – Enables computers to encapsulate data in a tunnel inside the transport network.  Connection type – Determines if the rule applies to local network connections, remote access connections, or both.

31. OV 12 - 31 Copyright © 2011 Element K Content LLC. All rights reserved. Windows IPSec Components  IPSec policy agent  IPSec driver  Microsoft Management Console (MMC)  IP security monitor

32. OV 12 - 32 Copyright © 2011 Element K Content LLC. All rights reserved. Reflective Questions 1. Which of the security measures discussed in this lesson are you most familiar with? Which ones are you most likely to implement or support in your network environment? 2. What intrusion detection systems do you think will suit your organization’s network?