1. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Infrastructure Security Chapter 10

2. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Objectives Construct networks using different types of network devices. Enhance security using NAC/NAP methodologies. Identify the different types of media used to carry network signals. Describe the different types of storage media used to store information. Use basic terminology associated with network functions related to information security.

3. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Key Terms Basic packet filtering Bridge Cloud computing Coaxial cable Collision domain Firewall Flood guard Hub Infrastructure as a Service (IaaS) Loop protection

4. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition (continued) Key Terms (continued) MAC limiting Modem Network access control Network Access Protection (NAP) Network Admission Control (NAC) Network Attached Storage Network interface card (NIC) Platform as a Service (PaaS) Private branch exchange (PBX)

5. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Key Terms (continued) Router Servers Shielded twisted-pair (STP) Software as a Service (SaaS) Switch Unshielded twisted-pair (UTP) Wireless access point Workstation

6. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionDevices Devices are needed to connect the clients and servers and to regulate the traffic between them. Devices come in many forms and with many functions, from hubs and switches, to routers, wireless access points, and special-purpose devices such as virtual private network (VPN) devices. Each device has a specific network function and plays a role in maintaining network infrastructure security.

7. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Securing a Workstation Keep the operating system (OS) patched and up to date. Remove all shares that are not necessary. Rename the administrator account, securing it with a strong password. Install an antivirus program and keep abreast of updates. If no corporate firewall exists between the machine and the Internet, install a firewall.

8. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Additional Precautions for Workstations Personal firewalls if the machine has an unprotected interface to the Internet. Turning off all services that are not needed. Removing methods of connecting additional devices to a workstation to move data. Restricting physical access to the workstation to only approved personnel.

9. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionServers Servers are the computers in a network that host applications and data for everyone to share. The key management issue behind running a secure server setup is to identify the specific needs of a server for its proper operation and enable only items necessary for those functions.

10. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Antivirus Software For workstations, this type of software is still a necessary component, particularly to prevent a PC from becoming part of a botnet. For servers, this type of software is most useful when users are allowed to place files on the machine.

11. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionVirtualization Allows multiple operating systems to operate concurrently on the same hardware. Allow for added security, as virtual machines can be deleted at the end of a session, thus preventing the spread of any malware to the other operating systems.

12. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Network Interface Card (NIC) It is the physical connection between a computer and the network. Each NIC has unique code built in, called a Media Access Control (MAC) address, that is assigned by the manufacturer. –48 bits long, with 24 bits representing the manufacturer and 24 bits being a serial number, guaranteeing uniqueness.

13. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionHubs Connects devices in a star configuration. Operates at the physical layer of the OSI model. Creates a single collision domain. Insecure—all PCs connected to a hub see all of the traffic that passes through it. Replaced by low-cost switches.

14. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionBridges Operate at the data link layer. Filter traffic based on MAC addresses. Reduces collisions by creating two separate collision domains. Have been replaced by switches.

15. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionSwitches Can operate at either the data link or network layers of the OSI model. Creates separate collision domains for each port. A sniffer can only see traffic for the connected port. Can be attacked due to vulnerabilities in both SNMP and Telnet. Subject to ARP poisoning and MAC flooding.

16. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionRouters Operates at the network layer of the OSI model Connects different network segments together Uses routing protocols to determine optimal paths across a network Forms the backbone of the Internet Can also be attacked due to vulnerabilities in both SNMP and Telnet

17. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionFirewalls Can be hardware, software, or a combination. Enforce network security policies across network connections. Different security policies will apply across the network, based on need. Security policies are rules that define what traffic is permissible and what traffic is to be blocked or denied. –Security policies should follow the principle of least access. –It is necessary to have a complete understanding of your network to develop a comprehensive security policy.

18. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Other Firewall Techniques Basic packet filtering –Checks each packet against rules pre-defined on the firewall –Fairly simple, fast, and efficient –Doesn’t detect and catch all undesired packets Stateful packet filtering –The firewall maintains the context of a conversation –More likely to detect and catch undesired packets –Due to overhead, network efficiency is reduced

19. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionWireless Specific precautions must be taken or you will have no control over who can see your data. It requires a wireless access point (WAP) to provide the network signal. WAPs and NICs must use the same protocol for proper operation.

20. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionModems Now used to describe high-speed Internet hardware. Cable modems provide shared arrangements. –Other people can sniff traffic between the user and the ISP. DSL modems provide a direct connection. –Traffic cannot be sniffed between the user and the ISP.

21. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Cable/DSL Security Both cable and DSL provide always-on connections. Should be secured with a firewall: –Can be a hardware firewall as part of a router –Can be a software router on the PC

22. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionTelecom/PBX Computer-based switching equipment that connects a company’s phones to the local phone system Should be protected by a telecommunications firewall –Enforce long-distance access code –Restrict service hours

23. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionVPN Provides a secure channel between users even though their signal is traveling on public networks Employs one of two types of encryption –Data encryption can be sniffed en route, but the contents cannot be read –Packet encryption uses tunneling and protects the data and the identities of the communicating parties Often done using IPsec

24. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Intrusion Detection Systems Detects, logs, and responds to unauthorized network or host use Can operate in real-time or after the fact Two categories –Network-based systems –Host-based systems

25. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Network Access Control Manages the endpoints on a case-by-case basis Two methodologies –Network Access Protection (NAP) Developed by Microsoft Measures the health of a host when it connects to the network –Network Admission Control (NAC) Developed by Cisco Enforces policies chosen by the network administrator –Both are still in early stages of implementation

26. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Network Monitoring/Diagnostic Simple Network Management Protocol (SNMP) provides management, monitoring, and fault resolution on a network. SNMP has holes in its implementation that should be taken into account when using it as part of a network monitoring solution.

27. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Mobile Devices These devices add several challenges for network administrators. –Can act as transmission vectors for viruses –Can be used to remove sensitive material offsite –Can be used as part of a Bluetooth attack

28. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Common Concerns in Device Security Default passwords are known to hackers, and frequently left unchanged

29. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionMedia Devices connect to the network at the physical layer of the OSI model via: –Coaxial cable –Twisted-pair cable –Fiber-optics –Wireless

30. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Coaxial Cable Has high-bandwidth and shielding capabilities Less prone to outside interference than other cabling methods Replaced by less-expensive and faster twisted-pair cabling alternatives Vulnerable to “vampire taps”

31. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionUTP/STP The least expensive type of cable to run. Unshielded twisted pair is less expensive than shielded twisted pair. Three different categories are currently in use. Is easy to splice into and difficult to detect rogue connections when they have been made.

32. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionFiber The most expensive cable option Used as the backbone medium of the Internet and large networks Has the longest possible cable runs Is the hardest cable to splice Not susceptible to EMI

33. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Unguided Media All transmission media not guided by a wire, fiber, or other constraints –Infrared –Radio Frequency/Microwave Must assume that unauthorized users have access to the signal

34. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Infrared (IR) A band of electromagnetic energy just beyond the red end of the visible color spectrum Used to connect to printers, wireless mice, wireless keyboards, and PDAs Slow compared to other wireless technologies Cannot penetrate solid objects

35. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionRF/Microwave Can carry signals over long distances and rough terrain. Used in home wireless networks. Signal is not line-of-sight. Can be used in point-to-multipoint links. Helps resolve the “last-mile” problem.

36. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Security Concerns for Transmission Media Things to avoid: –Access to a server by an unauthorized individual –Access to switches and routers by an unauthorized individual –Access to network connections by an unauthorized individual

37. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Physical Security Concerns Limiting access to physical media to avoid the use of sniffers Properly securing wireless networks Use of either authenticated firewalls or VPNs

38. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Removable Media Present a potential loss of control of the data on the movable media Risk introducing unwanted items (i.e., a worm) onto the network Has three categories: –Magnetic –Optical –Electronic

39. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Magnetic Media Includes hard drives, floppy disks, zip disks, and magnetic tape All are sensitive to external magnetic fields Affected by high temperatures and exposure to water

40. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Hard Drives Portable hard drives are physically small but have large capacities. They can be used with encryption technology to protect the data if the drive is lost or stolen (particularly important for laptops).

41. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionDiskettes Were the first attempt at portable media Have been rendered obsolete by recordable optical drives

42. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionTape Primarily used for backups and offline storage Should be encrypted, in case of theft or loss Inexpensive but slow to work with

43. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Optical Media Use a laser to write/read information from the disk Have larger storage capacities than diskettes Have faster read times than tape Can be read-write or read-only

44. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionCD-R/DVD CD-Rs are relatively inexpensive and easy to use for high-capacity storage. DVDs come in two types: Blu-ray and HD-DVD.

45. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Electronic Media High capacity, but small in size. Becoming ubiquitous: laptops and PCs have built-in card readers. Can be used to move information between machines.

46. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Network Attached Storage High-capacity devices are accessed via the network Susceptible to various attacks: –Sniffing of credentials –Brute-force attacks to access the data

47. Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Chapter Summary Construct networks using different types of network devices. Enhance security using NAC/NAP methodologies. Identify the different types of media used to carry network signals. Describe the different types of storage media used to store information. Use basic terminology associated with network functions related to information security.