Chapter 11 - Review

Network+ Guide to Networks, Chapter 11 Review

Network Security

In the early days of computing, when secured mainframes acted as central hosts and data repositories were accessed only by dumb terminals with limited rights, network security was all but unassailable. As networks have become more geographically distributed and heterogeneous, however, the risk of their misuse has also increased. Consider the largest, most heterogeneous network in existence: the Internet. Because it contains millions of points of entry, millions of servers, and millions of miles of transmission paths, it leads to millions of attacks on private networks every day. The threat of an outsider accessing an organization’s network via the Internet, and then stealing or destroying data is very real. In this chapter, you will learn about numerous threats to your network’s data and infrastructure, how to manage those vulnerabilities, and, perhaps most important, how to convey the importance of network security to the rest of your organization through an effective security policy. If you choose to specialize in network security, consider attaining CompTIA’s Security+ certification, which requires deeper knowledge of the topics covered in this chapter.

Security Assessment

Before spending time and money on network security, you should examine your network’s security risks. As you learn about each risk facing your network, consider the effect that a loss or breach of data, programs, or access would have on your network. The more serious the potential consequences, the more attention you need to pay to the security of your network. Different types of organizations have different levels of network security risk. For example, if you work for a large savings and loan institution that allows its clients to view their current loan status online, you must consider a number of risks associated with data and access. If someone obtained unauthorized access to your network, all of your customers’ personal financial data could be vulnerable. On the other hand, if you work for a local car wash that uses its internal LAN only to track assets and sales, you may be less concerned if someone gains access to your network because the implications of unauthorized access to your data are less dire. When considering security risks, the fundamental s are: “What is at risk?” and “What do I stand to lose if it is stolen, damaged, or eradicated?” Every organization should assess its security risks by conducting a posture assessment, which is a thorough examination of each aspect of the network to determine how it might be compromised. Posture assessments should be performed at least annually and preferably quarterly. They should also be performed after making any significant changes to the network. For each threat listed in the following sections, your posture assessment should rate the severity of its potential effects, as well as its likelihood. A threat’s consequences may be severe, potentially resulting in a network outage or the dispersal of top-secret information, or it may be mild, potentially resulting in a lack of access for one user or the dispersal of a relatively insignificant piece of corporate data. The more devastating a threat’s effects and the more likely it is to happen, the more rigorously your security measures should address it. If your IT Department has sufficient skills and time for routine posture assessments, they can be performed in-house.

A qualified consulting company can also assess the security of your network. If the company is accredited by an agency that sets network security standards, the assessment qualifies as a security audit. Certain customers—for example, a military agency—might require your company to pass an accredited security audit before they’ll do business with you. Regulators require some types of companies, such as accounting firms, to host periodic security audits. But even if an audit is optional, the advantage of having an objective third party analyze your network is that he might find risks that you overlooked because of your familiarity with your environment. Security audits might seem expensive, but if your network hosts confidential and critical data, they are well worth the cost. In the next section, you will learn about security risks associated with people, hardware, software, and Internet access.

Security Risks

To understand how to manage network security, you first need to know how to recognize threats that your network could suffer. And to do that, you must be familiar with the terms coined by network security experts. A hacker, in the original sense of the word, is someone who masters the inner workings of computer hardware and software in an effort to better understand them. To be called a hacker used to be a compliment, reflecting extraordinary computer skills. Today, hacker is used more generally to describe individuals who gain unauthorized access to systems or networks with or without malicious intent. A weakness of a system, process, or architecture that could lead to compromised information or unauthorized access is known as a vulnerability. The means of taking advantage of a vulnerability is known as an exploit. For example, in Chapter 8 you learned about the possibility for unauthorized, or rogue, access points to make themselves available to wireless clients. Once unsuspecting clients associate with such access points, the hacker can steal data in transit or access information on the client’s system. When the rogue access point masquerades as a valid access point, using the same SSID (service set identifier) and potentially other identical settings, the exploit is known as the evil twin. This exploit takes advantage of a vulnerability inherent in wireless communications in which SSIDs are openly broadcast and Wi-Fi clients scan for connections. A zero-day exploit is one that takes advantage of a software vulnerability that hasn’t yet become public, and is known only to the hacker who discovered it. Zero-day exploits are particularly dangerous because the vulnerability is exploited before the software developer has the opportunity to provide a solution for it. Most vulnerabilities, however, are well known. Throughout this chapter, you will learn about several kinds of exploits and how to prevent or counteract security threats. As you read about each vulnerability, think about how it could be prevented, whether it applies to your network (and if so, how damaging it might be), and how it relates to other security threats. Keep in mind that malicious and determined intruders may use one technique, which then allows them to use a second technique, which then allows them to use a third technique, and so on. For example, a hacker might discover someone’s username by watching her log on to the network; the hacker might then use a password cracking program to access the network, where he might plant a program that generates an extraordinary volume of traffic that essentially disables the network’s connectivity devices.

  

Risks Associated with People

By some estimates, human errors, ignorance, and omissions cause more than half of all security breaches sustained by networks. One of the most common methods by which an intruder gains access to a network is to simply ask users for their passwords. For example, the intruder might pose as a technical support analyst who needs to know the password to troubleshoot a problem. This strategy is commonly called social engineering because it involves manipulating social relationships to gain access. A related practice is phishing, in which a person attempts to glean access or authentication information by posing as someone who needs that information. For example, a hacker might send an e-mail asking you to submit your user ID and password to a Website, whose link is provided in the message, claiming that it’s necessary to verify your account with a particular online retailer. Following are some additional risks associated with people:

·         Intruders or attackers using social engineering or snooping to obtain user passwords.

·         An administrator incorrectly creating or configuring user IDs, groups, and their associated rights on a file server, resulting in file and logon access vulnerabilities.

·         Network administrators overlooking security flaws in topology or hardware configuration.

·         Network administrators overlooking security flaws in the operating system or application configuration.

·         Lack of proper documentation and communication of security policies, leading to deliberate or inadvertent misuse of files or network access.

·         Dishonest or disgruntled employees abusing their file and access rights.

·         An unused computer or terminal being left logged on to the network, thereby providing an entry point for an intruder.

·         Users or administrators choosing easy-to-guess passwords.

·         Authorized staff leaving computer room doors open or unlocked, allowing unauthorized individuals to enter.

·         Staff discarding disks or backup tapes in public waste containers.

·         Administrators neglecting to remove access and file rights for employees who have left the organization.

·         Vendors or business partners who are granted temporary access to private networks.

·         Users writing their passwords on paper, then placing the paper in an easily accessible place (for example, taping it to a monitor or keyboard)

Human errors account for so many security breaches because taking advantage of them is often an easy way to circumvent network security.

Risks Associated with Transmission and Hardware

This section describes security risks inherent in the Physical, Data Link, and Network layers of the OSI model. Recall that the transmission media, NICs, network access methods (for example, Ethernet), switches, routers, access points, and gateways reside at these layers. At these levels, security breaches require more technical sophistication than those that take advantage of human errors. For instance, to eavesdrop on transmissions passing through a switch, an intruder must use a device such as a protocol analyzer, connected to one of the switch’s ports. In the middle layers of the OSI model, it is somewhat difficult to distinguish between hardware and software techniques. For example, because a router acts to connect one type of network to another, an intruder might take advantage of the router’s security flaws by sending a flood of TCP/IP transmissions to the router, thereby disabling it from carrying legitimate traffic. The following risks are inherent in network hardware and design:

·         Transmissions can be intercepted. One type of attack that relies on intercepted transmissions is known as a man-in-the-middle attack. It can take one of several forms, but in all cases a person redirects or captures secure transmissions as they occur. For example, in the case of an evil twin attack, a hacker could intercept transmissions between clients and the rogue access point, and, for instance, learn users’ passwords or even supply users with a phony Web site that looks valid but presents clickable options capable of harming their systems.

·         Networks that use leased public lines, such as T1 or DSL connections to the Internet, are vulnerable to eavesdropping at a building’s demarc (demarcation point), at a remote switching facility, or in a central office.

·         Repeating devices broadcast traffic over the entire segment, thus making transmissions more widely vulnerable to sniffing. By contrast, switches provide logical point-to-point communications, which limit the availability of data transmissions to the sending and receiving nodes. Still, intruders could physically connect to a switch or router and intercept the traffic it receives and forwards.

·         Unused switch, router, or server ports can be exploited and accessed by hackers if they are not disabled. A router’s configuration port, accessible by Telnet, might not be adequately secured. Network administrators can test how vulnerable their servers, routers, switches, and other devices are by using a port scanner, or software that searches the node for open ports. The network administrator can then secure those ports revealed by the scan to be vulnerable. Later in this chapter, you’ll learn about port scanning tools.

·         If routers are not properly configured to mask internal subnets, users on outside networks (such as the Internet) can read the private addresses.

·         If routers aren’t configured to drop packets that match certain, suspicious characteristics, they are more vulnerable to attack.

·         Access servers used by remote users might not be carefully secured and monitored.

·         Computers hosting very sensitive data might coexist on the same subnet with computers open to the general public.

·         Passwords for switches, routers, and other devices might not be sufficiently difficult to guess, changed frequently, or worse, might be left at their default value.

Imagine that a hacker wants to bring a library’s database and mail servers to a halt. Suppose also that the library’s database is public and can be searched by anyone on the Web. The hacker might begin by scanning ports on the database server to determine which ones have no protection. If she found an open port on the database server, the hacker might connect to the system and deposit a program that would, a few days later, damage operating system files. Or, she could launch a heavy stream of traffic that overwhelms the database server and prevents it from functioning. She might also use her newly discovered access to determine the root password on the system, gain access to other systems, and launch a similar attack on the library’s mail server, which is attached to the database server. In this way, even a single mistake on one server (not protecting an open port) can open vulnerabilities on multiple systems.

Risks Associated with Protocols and Software

Like hardware, networked software is only as secure as you configure it to be. This section describes risks inherent in the higher layers of the OSI model, such as the Transport, Session, Presentation, and Application layers. As noted earlier, the distinctions between hardware and software risks are somewhat blurry because protocols and hardware operate in tandem. For example, if a router is improperly configured, a hacker could exploit the openness of TCP/IP to gain access to a network. NOSs (network operating systems) and application software present different risks.

In many cases, their security is compromised by a poor understanding of file access rights or simple negligence in configuring the software. Remember— even the best encryption, computer room door locks, security policies, and password rules make no difference if you grant the wrong users access to critical data and programs. The following are some risks pertaining to networking protocols and software:

·         Certain TCP/IP protocols are inherently insecure. For example, IP addresses can be falsified, checksums can be thwarted, UDP requires no authentication, and TCP requires only weak authentication. FTP is notorious for its vulnerabilities. In a famous exploit, FTP bounce, hackers take advantage of this insecure protocol. When a client running an FTP utility requests data from an FTP server, it specifies an IP address and port number for the data’s destination. Normally, the client specifies its own IP address. However, it is possible for the client to specify any port on any host’s IP address. By commanding the FTP server to connect to a different computer, a hacker can scan the ports on other hosts and transmit malicious code. To thwart FTP bounce attacks, most modern FTP servers will not issue data to hosts other than the client that originated the request.

·         Trust relationships between one server and another might allow a hacker to access the entire network because of a single flaw.

·         NOSs might contain “back doors” or security flaws that allow unauthorized users to gain access to the system. Unless the network administrator performs regular updates, a hacker may exploit these flaws.

·         Buffer overflow is a vulnerability in all operating systems. Buffers, which temporarily store information in memory, are not strictly limited to the areas allocated to them on the hard disk. Someone who wants to harm a system can write a program that forces the buffer’s size beyond its allotted space and saves data into adjacent memory areas. In this way, the malicious program can change the way the computer operates.

·         If the NOS allow server operators to exit to a command prompt, intruders could run destructive command-line programs.

·         Administrators might accept the default security options after installing an operating system or application. Often, defaults are not optimal. For example, the default username that enables someone to modify anything in Windows Server 2008 R2 is called Administrator. This default is well known, so if you leave the default username as Administrator, you have given a hacker half the information he needs to access and obtain full rights to your system.

·         Transactions that take place between applications, such as databases and Web-based forms, might allow interception.

To understand the risks that arise when an administrator accepts the default settings associated with a software program, consider the following scenario. Imagine that you have invited a large group of computer science students to tour your IT Department. While you’re in the computer room talking about subnetting, a bored student standing next to a Windows 7 workstation that is logged on to the network decides to find out which programs are installed on the workstation. He discovers that this workstation has the SQL Server administrator software installed. Your organization uses a SQL Server database to hold all of your employees’ salaries, addresses, and other confidential information. The student knows a little about SQL Server, including the facts that the default administrator user ID is called sa, and that, by default, no password is created for this ID when someone installs SQL Server. He tries connecting to your SQL Server database with the sa user ID and no password.

Because you accepted the defaults for the program during its installation, within seconds the student is able to gain access to your employees’ information. He could then change, delete, or steal any of the data.

Risks Associated with Internet Access

Although the Internet has brought computer crime, such as hacking, to the public’s attention, network security is more often compromised “from the inside” than from external sources. Nevertheless, the threat of outside intruders is very real. Users need to be careful when they connect to the Internet. Even the most popular Web browsers sometimes contain bugs that permit scripts to access their systems while they’re connected to the Internet, potentially for the purpose of causing damage. Users must also be careful about providing information while browsing the Web. Some sites will capture that information to use when attempting to break into systems. Bear in mind that hackers are creative and typically revel in devising new ways of breaking into systems. As a result, new Internet-related security threats arise frequently. By keeping software current, staying abreast of emerging security threats, and designing your Internet access wisely, users can prevent most of these threats. Common Internet-related security issues include the following:

·         A firewall may not provide adequate protection if it is configured improperly. For example, it may allow outsiders to obtain internal IP addresses, and then use those addresses to pretend that they have authority to access your internal network from the Internet—a process called IP spoofing. Alternately, a firewall may not be configured correctly to perform even its simplest function, which is preventing unauthorized packets from entering the LAN from outside. (You will learn more about firewalls later in this chapter.) Correctly configuring a firewall is one of the best means to protect your internal LAN from Internet-based attacks.

·         When a user Telnets or FTPs to your site over the Internet, her user ID and password are transmitted in plain text—that is, unencrypted. Anyone monitoring the network (that is, running a network monitor program or a hacking program specially designed to capture logon data) can pick up the user ID and password and use it to gain access to the system.

·         Hackers may obtain information about your user ID from newsgroups, mailing lists, or forms you have filled out on the Web.

·         While users remain logged on to Internet chat sessions, they may be vulnerable to other Internet users who might send commands to their machines that cause the screen to fill with garbage characters and require them to terminate their chat sessions. This type of attack is called flashing. 

·         After gaining access to your system through the Internet, a hacker may launch denial-of-service attacks. A denial-of-service attack occurs when a system becomes unable to function because it has been inundated with requests for services and can’t respond to any of them. As a result, all data transmissions are disrupted. This incursion is a relatively simple attack to launch (for example, a hacker could create a looping program that sends thousands of e-mail messages to your system per minute). One specific type of denial-of-service attack, known as a smurf attack, occurs when a hacker issues a flood of broadcast ping messages. In this case, the originating source address of the attack is spoofed to appear as a known host on the network. Because it’s a broadcast transmission, all hosts on the subnet receive the ping messages and then generate more ICMP traffic by responding to it. Denial-of-service attacks can also result from malfunctioning software. Regularly upgrading software is essential to maintaining network security.

Now that you understand the variety of risks facing networks, you are ready to learn about policies that help mitigate these risks.

An Effective Security Policy

Network security breaches can be initiated from within an organization, and many depend on human errors. This section describes how to minimize the risk of break-ins by communicating with and managing the users in your organization via a thoroughly planned security policy. A security policy identifies your security goals, risks, levels of authority, designated security coordinator and team members, responsibilities for each team member, and responsibilities for each employee. In addition, it specifies how to address security breaches. It should not state exactly which hardware, software, architecture, or protocols will be used to ensure security, nor how hardware or software will be installed and configured. These details change from time to time and should be shared only with authorized network administrators or managers.

Security Policy Goals

Before drafting a security policy, you should understand why the security policy is necessary and how it will serve your organization. Typical goals for security policies are as follows:

·         Ensure that authorized users have appropriate access to the resources they need.

·         Prevent unauthorized users from gaining access to the network, systems, programs, or data.

·         Protect sensitive data from unauthorized access, both from within and from outside the organization.

·         Prevent accidental damage to hardware or software.

·         Prevent intentional damage to hardware or software.

·         Create an environment in which the network and systems can withstand and, if necessary, quickly respond to and recover from any type of threat.

·         Communicate each employee’s responsibilities with respect to maintaining data integrity and system security.

A company’s security policy need not pertain exclusively to computers or networks. For example, it might state that each employee must shred paper files that contain sensitive data or that each employee is responsible for signing in his or her visitors at the front desk and obtaining a temporary badge for them. Noncomputer related aspects of security policies are beyond the scope of this chapter, however. After defining the goals of your security policy, you can devise a strategy to attain them. First, you might form a committee composed of managers and interested parties from a variety of departments, in addition to your network administrators. The more decision-making people you can involve, the more supported and effective your policy will be. This committee can assign a security coordinator, who will then drive the creation of a security policy. To increase the acceptance of your security policy in your organization, tie security measures to business needs and clearly communicate the potential effects of security breaches. For example, if your company sells clothes over the Internet and a two-hour outage (as could be caused by a hacker who uses IP spoofing to gain control of your systems) could cost the company $1 million in lost sales, make certain that users and managers understand this fact. If they do, they are more likely to embrace the security policy. A security policy must address an organization’s specific risks.

To understand your risks, you should conduct a posture assessment that identifies vulnerabilities and rates both the severity of each threat and its likelihood of occurring, as described earlier in this chapter. After risks are identified, the security coordinator should assign one person the responsibility for addressing that threat.

Security Policy Content

After you have identified risks and assigned responsibilities for managing them, you are ready to outline the policy’s content. Subheadings for the policy outline might include the following: Password policy, Software installation policy, Confidential and sensitive data policy, Network access policy, E-mail use policy, Internet use policy, Remote access policy, Policies for connecting to customers’ and vendors’ networks, Policies for use of personal smartphones and laptops, and Computer room access policy. Although compiling all of this information might seem daunting, the process ensures that everyone understands the organization’s stance on security and the reasons it is so important. The security policy should explain to users what they can and cannot do and how these measures protect the network’s security. A section aimed at users might organize security rules according to the particular function or part of the network to which they apply. This approach makes the policy easier for users to read and understand; it also prevents them from having to read through the entire document. For example, in the “Passwords” section, guidelines might include “Users may not share passwords with friends or relatives, “users must choose passwords that exceed ten characters and are composed of both letters and numbers,” and “users should choose passwords that bear no resemblance to a spouse’s name, pet’s name, birth date, anniversary, or other widely available information.” A security policy should also define what confidential means to the organization. In general, information is confidential if it could be used by other parties to impair an organization’s functioning, decrease customers’ confidence, cause a financial loss, damage an organization’s status, or give a significant advantage to a competitor. However, if you work in an environment such as a hospital, where most data is sensitive or confidential, your security policy should classify information in degrees of sensitivity that correspond to how strictly its access is regulated. For example, top-secret data may be accessible only by the organization’s CEO and vice presidents, whereas confidential data may be accessible only to those who must modify or create it (for example, doctors or hospital accountants).

Response Policy

Finally, a security policy should provide for a planned response in the event of a security breach. The response policy should identify the members of a response team, all of who should clearly understand the security policy, risks, and measures in place. Each team member should accept a role with certain responsibilities. The security response team should regularly rehearse their defense by participating in a security threat drill. Suggested team roles include the following:

Dispatcher—The person on call who first notices or is alerted to the problem. The dispatcher notifies the lead technical support specialist and then the manager. He also creates a record for the incident, detailing the time it began, its symptoms, and any other pertinent information about the situation. The dispatcher remains available to answer calls from clients or employees or to assist the manager.

Manager—This team member coordinates the resources necessary to solve the problem. If in-house technicians cannot handle the break-in, the manager finds outside assistance. The manager also ensures that the security policy is followed and that everyone within the organization is aware of the situation. As the response ensues, the manager continues to monitor events and communicate with the public relations specialist.

Technical support specialist—This team member focuses on only one thing: solving the problem as quickly as possible. After the situation has been resolved, the technical support specialist describes in detail what happened and helps the manager find ways to avert such an incident in the future. Depending on the size of the organization and the severity of the incident, this role may be filled by more than one person.

Public relations specialist—If necessary, this team member learns about the situation and the response and then acts as official spokesperson for the organization to the public.

After resolving a problem, the team reviews what happened, determines how it might have been prevented, and then implements those measures to prevent future problems. A security policy alone can’t guard against intruders. Network administrators must also attend to physical, network design, and NOS vulnerabilities, as described in the following sections.

Physical Security

An important element in network security is restricting physical access to its components. Only trusted networking staff should have access to secure computer rooms, telco rooms, wiring closets, storage rooms, entrance facilities, and locked equipment cabinets. Furthermore, only authorized staff should have access to the premises, such as offices and data centers, where these rooms are located. If computer rooms are not locked, intruders may steal equipment or sabotage software or hardware. For example, a malicious visitor could slip into an unsecured computer room and take control of a server where an administrator is logged on, then steal data or reformat the server’s hard disk. Although a security policy defines who has access to the computer room, locking the locations that house networking equipment is necessary to keep unauthorized individuals out. Locks may be either physical or electronic. Many large organizations require authorized employees to wear electronic access badges. These badges can be programmed to allow their owner access to some, but not all, rooms in a building. Figure 11-1 on page 504, depicts a typical badge access security system. A less-expensive alternative to the electronic badge access system consists of locks that require entrants to punch a numeric code to gain access. For added security, these electronic locks can be combined with key locks. A more-expensive solution involves biorecognition access in which a device scans an individual’s unique physical characteristics, such as the color patterns in her iris or the geometry of her hand, to verify her identity. On a larger scale, organizations may regulate entrance through physical barriers to their campuses, such as gates, fences, walls, or landscaping. Many IT departments also use closed-circuit TV systems to monitor activity in secured rooms. Surveillance cameras can be placed in data centers, computer rooms, telco rooms, and data storage areas, as well as facility entrances. A central security office might display several camera views at once, or it might switch from camera to camera. The video footage generated from these cameras is usually saved for a time in case it’s needed in a security breach investigation or prosecution. As with other security measures, the most important way to ensure physical security is to plan for it. You can begin your planning by asking s related to physical security checks in your security audit. Relevant s include the following:

·         Which rooms contain critical systems or data and must be secured?

·         Through what means might intruders gain access to the facility, computer room, telecommunications room, wiring closet, or data storage areas (including doors, windows, adjacent rooms, ceilings, temporary walls, hallways, and so on)?

·         How and to what extent are authorized personnel granted entry? (Do they undergo background or reference checks? Is their need for access clearly justified? Are their hours of access restricted? Who ensures that lost keys or ID badges are reported?)

·         Are employees instructed to ensure security after entering or leaving secured areas (for example, by not propping open doors)?

·         Are authentication methods (such as ID badges) difficult to forge or circumvent?

·         Do supervisors or security personnel make periodic physical security checks?

·         Are all combinations, codes, or other access means to computer facilities protected at all times, and are these combinations changed frequently?

·         Do you have a plan for documenting and responding to physical security breaches?

Also consider what you might stand to lose if someone salvaged computers you discarded. To guard against the threat of information being stolen from a decommissioned hard disk, you can run a specialized disk sanitizer program to not only delete the hard drive’s contents but also make file recovery impossible. Alternatively, you can remove the disk from the computer and erase its contents using a magnetic hard disk eraser. Some security professionals even advise physically destroying a disk by pulverizing or melting it to be certain data is unreadable.

Security in Network Design

Addressing physical access to hardware and connections is just one part of a comprehensive security approach. Even if you restrict access to computer rooms, teach employees how to select secure passwords, and enforce a security policy, breaches may still occur due to poor LAN or WAN design. In this section, you will learn how to address some security risks via intelligent network design. Preventing external security breaches from affecting your network is a matter of restricting access at every point where your LAN connects to the rest of the world. This principle forms the basis of hardware- and design-based security.

Router Access Lists

Before a hacker on another network can gain access to files on your network’s server, he must traverse a switch or router. Although devices such as firewalls, described later in this chapter, provide more tailored security, manipulating switch and router configurations affords a small degree of security. This section describes a fundamental way to control traffic through routers. A router’s main function is to examine packets and determine where to direct them based on their Network layer addressing information. Thanks to a router’s ACL (access control list, also known as an access list), routers can also decline to forward certain packets. An ACL instructs the router to permit or deny traffic according to one or more of the following variables:

·         Network layer protocol (for example, IP or ICMP)

·         Transport layer protocol (for example, TCP or UDP)

·         Source IP address

·         Source netmask

·         Destination IP address

·         Destination netmask

·         TCP or UDP port number

Each time a router receives a packet, it examines the packet and refers to its ACL to determine whether the packet meets criteria for permitting or denying travel on the network. If a packet’s characteristics match a variable that’s flagged as “deny” in the ACL, the router drops the packet. If the packet’s characteristics match a variable that’s flagged as “permit,” it forwards the packet.

An access list may contain many different statements. For example, it might include a statement to deny all traffic from source addresses whose netmask is 255.255.255.255 and another statement to deny all traffic destined for TCP port 23. Or it might include a statement to permit access to a console port from a certain subnet that is reserved for use by network administrators. On most routers, each interface must be assigned a separate ACL. In addition, different ACLs may be associated with inbound and outbound traffic. Naturally, the more statements a router must scan (in other words, the longer the ACL), the more time it takes a router to act, and, therefore, the slower the router’s overall performance. An access list is not included on a router by default. If you install a router and do not create an ACL, you are allowing any kind of traffic to go in or out of that router. Once you create an ACL and assign it to an interface, you have explicitly permitted or denied certain types of traffic. Furthermore, any traffic that you do not explicitly permit in the ACL is implicitly denied. An example of an access list configuration command that will allow traffic from users outside the LAN to pass through a Cisco router and access a Web server whose IP address is 10.250.1.10 is: permit tcp any host 10.250.1.10 any eq www. The command’s syntax begins with a permit or deny statement (permit), followed by the Transport layer protocol (TCP), the source IP address (any), the destination’s IP address (10.250.1.10), the source port number ( any), and the destination’s port number (eq www, which means the Web port 80).

Intrusion Detection and Prevention

Although a router’s access list can block certain types of traffic, a more proactive security measure involves detecting suspicious network activity. In the world outside of computer networks, a business owner might install closed-circuit TV cameras above her business’s entrance and electrical sensors on its doors to monitor attempts to enter the building. Similarly, a network administrator might use techniques to monitor and flag any unauthorized attempt to access an organization’s secured network resources using an IDS (intrusion-detection system). An IDS exists as software running on a single computer, such as a server, or on a connectivity device, such as a switch. IDS that runs on a single computer, such as a client or server, and that has access to and allows access from the Internet, is known as HIDS (host-based intrusion detection). Intrusion detection that occurs on devices that are situated at the edge of the network or that handle aggregated traffic is known as NIDS (network-based intrusion detection). The most thorough security combines HIDS and NIDS to detect a wider scope of threats and provide multiple levels of defense. For example, an HIDS might detect an attempt to exploit an insecure application that an NIDS missed. Major vendors of networking hardware, such as Cisco, HP, Juniper Networks, and Lucent sell IDS devices. Examples of popular open source IDS software, which can run on virtually any network-connected machine, include Tripwire and Snort. One technique that an IDS may use to monitor traffic traveling carried by a switch is port mirroring. In port mirroring, one port is configured to send a copy of all its traffic to a second port on the switch. The second port issues the copied traffic to a monitoring program. IDS software can be configured to detect many types of suspicious traffic patterns, including those typical of denial-of-service or smurf attacks, for example. For detecting unauthorized attempts to access a network, its sensors are installed at the edges of the network, the places where a protected, internal network intersects with a public network. A network’s protective perimeter is known as the DMZ, or demilitarized zone. Alternately, an IDS can operate on a host to monitor suspicious attempts to log on or access the host’s resources. One drawback to using an IDS at a network’s DMZ is the number of false positives it can log. For instance, it might interpret multiple logon attempts of a legitimate user who’s forgotten his password as a security threat. If the IDS is configured to alert the network manager each time such an event occurs, the network manager might be overwhelmed with such warnings and eventually ignore all the IDS’s messages.

Therefore, to be useful, IDS software must be thoughtfully customized. In addition, to continue to guard against new threats, IDS software must be updated and rules of detection reevaluated regularly. Although an IDS can only detect and log suspicious activity, an IPS (intrusion-prevention system) can react when alerted to such activity. For example, if a hacker’s attempt to flood the network with traffic is detected, the IPS can detect the threat and prevent that traffic, based on its originating IP address, from flowing to the network. Thereafter the IPS will quarantine that malicious user. At the same time, the IPS continues to allow valid traffic to pass. As with IDS, an IPS can protect entire networks through NIPS (network-based intrusion prevention) or only certain hosts, through HIPS (host-based intrusion prevention). Using NIPS and HIPS together increases the network’s security. For example, an HIDS running on a file server might accept a hacker’s attempt to log on if the hacker is posing as a legitimate client. With the proper NIDS, however, such a hacker would likely never get to the server. Many vendors sell devices that integrate both IDS and IPS functions. As with an IDS, an IPS must be carefully configured to avoid an abundance of false alarms. Figure 11-2 on page 508, illustrates the placement of an IDS/IPS device on a private network that’s connected to the Internet. Note that such a device may be positioned between the firewall and the external network, as shown in Figure 11-2, or behind the firewall. This is an example of NIDS/NIPS. An IDS/IPS software running on the server or one of the clients within the internal LAN would be an example of HIDS/HIPS. Intrusion-prevention systems were originally designed as a more comprehensive traffic analysis and protection tool than firewalls, which are discussed next. However, firewalls have evolved, and as a result, the differences between a firewall and an IPS have diminished.

Firewalls

A firewall is a specialized device, or a computer installed with specialized software, that selectively filters or blocks traffic between networks. A firewall typically involves a combination of hardware and software. The computer acting as a firewall may reside between two interconnected private networks or, more typically, between a private network and a public network (such as the Internet), as shown in Figure 11-3 on page 508. This is an example of a network-based firewall, so named because it protects an entire network.

Figure 11-4 on page 509 shows a firewall designed for use in a business with many users. Other types of firewalls, known as host-based firewalls, only protect the computer on which they are installed. Many types of firewalls exist, and they can be implemented in many different ways. To understand secure network design and to qualify for Network+ certification, you should recognize which functions firewalls can provide, where they can appear on a network, and how to determine what features you need in a firewall. The simplest form of a firewall is a packet-filtering firewall, which is a router (or a computer installed with software that enables it to act as a router) that examines the header of every packet of data it receives to determine whether that type of packet is authorized to continue to its destination. If a packet does not meet the filtering criteria, the firewall prevents the packet from continuing. However, if a packet does meet filtering criteria, the firewall allows that packet to pass through to the network connected to the firewall. In fact, nearly all routers can be configured to act as packet-filtering firewalls. In addition to blocking traffic on its way into a LAN, packet-filtering firewalls can block traffic attempting to exit a LAN. One reason for blocking outgoing traffic is to stop worms from spreading. For example, if you are running a Web server, which in most cases only needs to respond to incoming requests and does not need to initiate outgoing requests, you could  configure a packet-filtering firewall to block certain types of outgoing transmissions initiated by the Web server. In this way, you help prevent spreading worms that are designed to attach themselves to Web servers and propagate themselves to other computers on the Internet.

Often, firewalls ship with a default configuration designed to block the most common types of security threats. In other words, the firewall may be preconfigured to accept or deny certain types of traffic. However, many network administrators choose to customize the firewall settings, for example, blocking additional ports or adding criteria for the type of traffic that may travel in or out of ports. Some common criteria a packet-filtering firewall might use to accept or deny traffic include the following:

·         Source and destination IP addresses

·         Source and destination ports (for example, ports that supply TCP/UDP connections,

·         FTP, Telnet, ARP, ICMP, and so on)

·         Flags set in the IP header (for example, SYN or ACK)

·         Transmissions that use the UDP or ICMP protocols

·         A packet’s status as the first packet in a new data stream or a subsequent packet

·         A packet’s status as inbound to or outbound from your private network

Based on these options, a network administrator could configure his firewall, for example, to prevent any IP address that does not begin with “196.57,” the network ID of the addresses on his network, from accessing the network’s router and servers. Furthermore, he could disable—or block—certain well-known ports, such as the FTP ports (20 and 21), through the router’s configuration. Blocking ports prevents any user from connecting to and completing a transmission through those ports. This technique is useful to further guard against unauthorized access to the network. In other words, even if a hacker could spoof an IP address that began with 196.57, he could not access the FTP ports (which are notoriously insecure) on the firewall. Ports can be blocked not only on firewalls, but also on routers, servers, or any device that uses ports. For example, if you established a Web server for testing but did not want anyone in your organization to connect to your Web pages through his or her browsers, you could block port 80 on that server. For greater security, you can choose a firewall that performs more complex functions than simply filtering packets. Among the factors to consider when making your decision are the following:

·         Does the firewall support encryption? (You will learn more about encryption later in this chapter.)

·         Does the firewall support user authentication?

·         Does the firewall allow you to manage it centrally and through a standard interface?

·         How easily can you establish rules for access to and from the firewall?

·         Does the firewall support filtering at the highest layers of the OSI model, not just at the Data Link and Transport layers? For example, content-filtering firewalls can block designated types of traffic based on application data contained within packets. A school might configure its firewall to prevent responses from a Web site with able content from reaching the client that requested the site.

·         Does the firewall provide logging and auditing capabilities, such as IDS or IPS?

·         Does the firewall protect the identity of your internal LAN’s addresses from the outside world?

·         Can the firewall monitor a data stream from end to end, rather than simply examine each packet individually? If it can view a data stream, it’s known as a stateful firewall. If not, it’s known as a stateless firewall. Stateless firewalls perform more quickly than stateful firewalls, but are not as sophisticated.

You will recognize examples of firewall placement in most VPN architectures. For example, you might design a VPN that uses the Internet to connect your Houston and Denver offices.

To ensure that only traffic from Houston can access your Denver LAN through an external connection, you could install a packet-filtering firewall between the Denver LAN and the Internet. Further, you could configure the firewall to accept incoming traffic only from IP addresses that match the IP addresses on your Houston LAN. In a way, the firewall acts like a bouncer at a private club who checks everyone’s ID and ensures that only club members enter through the door. In the case of the Houston-Denver VPN, the firewall discards any data packets that arrive at the Denver firewall and do not contain source IP addresses that match those of Houston’s LAN. Some devices that provide firewall services are not called firewalls. For example, a small office or home office wireless router typically includes packet-filtering options. At the other end of the spectrum, devices made by Cisco for enterprise-wide security are known as security appliances and can perform several functions, such as encryption, load balancing, and IPS, in addition to packet filtering. Examples of software that enables a computer to act as a packet-filtering firewall include iptables (for Linux systems), ZoneAlarm, and Comodo Firewall. Some operating systems, including Windows 7, include firewall software. Because you must tailor a firewall to your network’s needs, you cannot simply purchase one, install it between your private LAN and the Internet, and expect it to offer much security. Instead, you must first consider what type of traffic you want to filter, and then configure the firewall accordingly. It may take weeks to achieve the best configuration—not so strict that it prevents authorized users from transmitting and receiving necessary data, yet not so lenient that you risk security breaches. Further complicating the matter is that you might need to create exceptions to the rules. For example, suppose that your human resources manager is working from a conference center in Salt Lake City while recruiting new employees and needs to access the Denver server that stores payroll information. In this instance, the Denver network administrator might create an exception to allow transmissions from the human resources manager’s workstation’s IP address to reach that server. In the networking profession, creating an exception to the filtering rules is called “punching a hole” in the firewall. Because simple packet-filtering firewalls operate at the Network layer of the OSI model and examine only network addresses, they cannot distinguish between a user who is trying to breach the firewall and a user who is authorized to do so. For example, your organization might host a Web server, which necessitates accepting requests for port 80 on that server. In this case, a packet-filtering firewall, because it only examines the packet header, could not distinguish between a harmless Web browser and a hacker attempting to manipulate his way through the Web site to gain access to the network. For higher-layer security, a firewall that can analyze data at higher layers is required. The next section describes this kind of device.

Proxy Servers

One approach to enhancing the security of the Network and Transport layers provided by firewalls is to combine a packet-filtering firewall with a proxy service. A proxy service is a software application on a network host that acts as an intermediary between the external and internal networks, screening all incoming and outgoing traffic. The network host that runs the proxy service is known as a proxy server. (A proxy server may also be called an Application layer gateway, an application gateway, or simply, a proxy.) Proxy servers manage security at the Application layer of the OSI model. To understand how they work, think of the secure data on a server as the president of a country and the proxy server as the secretary of state. Rather than have the president risk her safety by leaving the country, the secretary of state travels abroad, speaks for the president, and gathers information on the president’s behalf. In fact, foreign leaders may never actually meet the president. Instead, the secretary of state acts as her proxy. In a similar way, a proxy server represents a private network to another network (usually the Internet). Although a proxy server appears to the outside world as an internal network server, in reality it is merely another filtering device for the internal LAN.

One of its most important functions is preventing the outside world from discovering the addresses of the internal network. For example, suppose your LAN uses a proxy server, and you want to send an e-mail message from your workstation to your mother via the Internet. Your message would first go to the proxy server (depending on the configuration of your network, you might or might not have to log on separately to the proxy server first). The proxy server would repackage the data frames that make up the message so that, rather than your workstation’s IP address being the source, the proxy server inserts its own IP address as the source. Next, the proxy server passes your repackaged data to the packet-filtering firewall. The firewall verifies that the source IP address in your packets is valid (that it came from the proxy server) and then sends your message to the Internet. Examples of proxy server software include Squid (for use on UNIX or Linux systems) and Microsoft’s Forefront Threat Management Gateway, which includes firewall features as well. Figure 11-5 on page 512 depicts how a proxy server might fit into a WAN design. Proxy servers can also improve performance for users accessing resources external to their network by caching files. For example, a proxy server situated between a LAN and an external Web server can be configured to save recently viewed Web pages. The next time a user on the LAN wants to view one of the saved Web pages, content is provided by the proxy server. This eliminates the time required to travel over a WAN and retrieve the content from the external Web server.

Scanning Tools

Often, firewall and proxy server features are combined in one device. In other words, you might purchase a firewall and be able to configure it not only to block certain types of traffic from entering your network, but also to modify the addresses in the packets leaving your network. Despite your best efforts to secure a network with router access lists, IDS/IPS, firewalls, and proxy servers, you might overlook a critical vulnerability. To ensure that your security efforts are thorough, it helps to think like a hacker. During a posture assessment, for example, you might use some of the same methods a hacker uses to identify cracks in your security architecture. Scanning tools provide hackers—and you—a simple and reliable way to discover crucial information about your network, including, but not limited to, the following:

·         Every available host

·         Services, including applications and versions, running on every host

·         Operating systems running on every host

·         Open, closed, and filtered ports on every host

·         Existence and type of firewalls

·         Software configurations

·         Unencrypted, sensitive data

For example, a popular scanning tool called NMAP (Network Mapper) is designed to scan large networks quickly and provide information about a network and its hosts. NMAP, which runs on virtually any modern operating system, is available for download at no cost at www.nmap.org. NMAP began as a simple port scanning tool, but developers expanded its capabilities to include gathering information about hosts and their software. When running NMAP, you can choose what type of information to discover, thereby customizing your scan results. Another tool, Nessus, from Tenable Security, performs even more sophisticated scans than NMAP. For example, among other things, Nessus can identify unencrypted, sensitive data, such as credit card numbers, saved on your network’s hosts. The program can be purchased to run on your network or to run on off-site servers continuously maintained and updated by the developer. Because of its comprehensive nature and its use for revealing security flaws that must be addressed, Nessus and utilities like it are known as penetration-testing tools.

Another penetration-testing tool, metasploit, combines known scanning techniques and exploits to result in potentially new hybrids of exploits. Used intentionally on your own network, scanning tools improve security by pointing out insecure ports, software that must be patched, permissions that should be restricted, and so on. They can also contribute valuable data to asset management and audit reports. Used by hackers—or, more likely, bots—these tools can lead to compromised security. In other words, each of these tools has legitimate uses as well as illegal uses. However, even if the scanning tools are used against you, you can learn from them. For example, a properly configured firewall will collect information about scanning attempts in its log. By reviewing the log, you will discover what kinds of exploits might be—or have been—attempted against your network. Another way to learn about hackers is to lure them to your network on purpose, as described next.

Lures

Staying a step ahead of hackers and constantly evolving exploits requires vigilance. Those who want to learn more about hacking techniques or nab a hacker in the act might create a honeypot, or a decoy system that is purposely vulnerable. To make it attractive to hackers, the system might be given an enticing name, such as one that indicates its role as a name server or a storage location for confidential data. Once hackers access the honeypot, a network administrator can use monitoring software and logs to track the intruder’s moves. In this way, the network administrator might learn about new vulnerabilities that must be addressed on his real networked hosts. To fool hackers and gain useful information, honeypots cannot appear too blatantly insecure, and tracking mechanisms must be hidden. In addition, a honeypot must be isolated from secure systems to prevent a savvy hacker from using it as an intermediate host for other attacks. In more elaborate setups, several honeypots might be connected to form a honeynet. Decoy systems can provide unique information about hacking behavior. But in practice, security researchers or those merely curious about hacking trends are more likely than overworked network administrators to establish and monitor honeypots and honeynets.

NOS (Network Operating System) Security

Regardless of whether you run your network on a Microsoft, Macintosh, Linux, or UNIX

NOS, you can implement basic security by restricting what users are authorized to do on a network. Every network administrator should understand which resources on the server all users need to access. The rights conferred to all users are called public rights because anyone can have them and exercising them presents no security threat to the network. In most cases, public rights are very limited. They may include privileges to view and execute programs from the server and to read, create, modify, delete, and execute files in a shared data directory. In addition, network administrators need to group users according to their security levels and assign additional rights that meet the needs of those groups. Creating groups simplifies the process of granting rights to users. For example, if you work in the IT Department at a large college, you will most likely need more than one person to create new user IDs and passwords for students and faculty. Naturally, the staff in charge of creating new user IDs and passwords need the rights to perform this task. You could assign the appropriate rights to each staff member individually, but a more efficient approach is to put all of the personnel in a group, and then assign the appropriate rights to the group as a whole.

Logon Restrictions

In addition to restricting users’ access to files and directories on the server, a network administrator can constrain the ways in which users can access the server and its resources. The following is a list of additional restrictions that network administrators can use to strengthen the security of their networks:

Time of day—Some user accounts may be valid only during specific hours—for example, between 8:00 a.m. and 5:00 p.m. Specifying valid hours for an account can increase security by preventing any account from being used by unauthorized personnel after hours.

Total time logged on—Some user accounts may be restricted to a specific number of hours per day of logged-on time. Restricting total hours in this way can increase security in the case of temporary user accounts. For example, suppose that your organization offers an Adobe Photoshop training class to a group of high school students one afternoon, and the Photoshop program and training files reside on your staff server. You might create accounts that could log on for only four hours on that day.

Source address—You can specify that user accounts may log on only from certain workstations or certain areas of the network (that is, domains or segments). This restriction can prevent unauthorized use of usernames from workstations outside the network.

Unsuccessful logon attempts—Hackers might repeatedly attempt to log on under a valid username for which they do not know the password. As the network administrator, you can set a limit on how many consecutive unsuccessful logon attempts from a single user ID the server will accept before blocking that ID from even attempting to log on. Another security technique that can be enforced by a network administrator through the NOS is the selection of secure passwords. The following section discusses the importance and characteristics of choosing a secure password.

Passwords

Choosing a secure password is one of the easiest and least expensive ways to guard against unauthorized access. Unfortunately, too many people prefer to use an easy-to-remember password. If your password is obvious to you, however, it may also be easy for a hacker to figure out. The following guidelines for selecting passwords should be part of your organization’s security policy. It is especially important for network administrators to choose difficult passwords, and also to keep passwords confidential and to change them frequently. Tips for making and keeping passwords secure include the following:

·         Always change system default passwords after installing new programs or equipment. For example, after installing a router, the default administrator’s password on the router might be set by the manufacturer to be “password”.

·         Do not use familiar information, such as your name, nickname, birth date, anniversary, pet’s name, child’s name, spouse’s name, user ID, phone number, address, or any other words or numbers that others might associate with you.

·         Do not use any word that might appear in a dictionary. Hackers can use programs that try a combination of your user ID and every word in a dictionary to gain access to the network. This is known as a dictionary attack, and it is typically the first technique a hacker uses when trying to guess a password (besides asking the user for her password).

·         Make the password longer than eight characters—the longer, the better. Choose a combination of letters and numbers; add special characters, such as exclamation marks or hyphens, if allowed. Use a combination of uppercase and lowercase letters.

·         Do not write down your password or share it with others.

·         Change your password at least every 60 days, or more frequently. If you are a network administrator, establish controls through the NOS to force users to change their passwords at least every 60 days.

·         Do not reuse passwords after they have expired.

·         Use different passwords for different applications. For example, choose separate passwords for your e-mail program, online banking, VPN connection, and so on. That way, if someone learns one of your passwords, he won’t necessarily be able to access all of your secured accounts.

Password guidelines should be clearly communicated to everyone in your organization through your security policy. Although users might grumble about choosing a combination of letters and numbers and changing their passwords frequently, you can assure them that the company’s financial and personnel data is safer as a result.

Encryption

Encryption is the use of an algorithm to scramble data into a format that can be read only by reversing the algorithm—that is, by decrypting the data. The purpose of encryption is to keep information private. Many forms of encryption exist, with some being more secure than others. Even as new forms of encryption are developed, new ways of cracking their codes emerge, too. Encryption is the last means of defense against data theft. In other words, if an intruder has bypassed all other methods of access, including physical security (for instance, he has broken into the data center) and network design security (for instance, he has defied a firewall’s packet-filtering techniques), data may still be safe if it is encrypted. Encryption can protect data stored on a medium, such as a hard disk, or in transit over a communications channel. To protect data, encryption provides the following assurances:

·         Data was not modified after the sender transmitted it and before the receiver picked it up.

·         Data can only be viewed by its intended recipient or at its intended destination.

·         All of the data received at the intended destination was truly issued by the stated sender and not forged by an intruder.

The following sections describe data encryption techniques used to protect data stored on or traveling across networks.

Key Encryption

The most popular kind of encryption algorithm weaves a key, or a random string of characters, into the original data’s bits—sometimes several times in different sequences—to generate a unique data block. The scrambled data block is known as ciphertext. The longer the key, the less easily the ciphertext can be decrypted by an unauthorized system. For example, a 128-bit key allows for 2 possible character combinations, whereas a 16-bit key allows for 2 possible character combinations. Hackers may attempt to crack, or discover, a key by using a brute force attack, which means simply trying numerous possible character combinations to find the key that will decrypt encrypted data. Typically, a hacker runs a program to carry out the attack. Through a brute force attack, a hacker could discover a 16-bit key quickly and without using sophisticated computers, but would have difficulty discovering a 128-bit key.

Adding 1 bit to an encryption key makes it twice (2¹ times) as hard to crack. For example, a 129-bit key would be twice as hard to crack as a 128-bit key. Similarly, a 130-bit key would be four (2²) times harder to crack as a 128-bit key.

The process of key encryption is similar to what happens when you finish a card game, place your five-card hand into the deck, and then shuffle the deck numerous times. After shuffling, it might take you a while to retrieve your hand. If you shuffled your five cards into four decks of cards at once, it would be even more difficult to find your original hand. In encryption, theoretically only the user or program authorized to retrieve the data knows how to unshuffle the ciphertext and compile the data in its original sequence. Figure 11-6 on page 517 provides a simplified view of key encryption and decryption. Note that actual key encryption does not simply weave a key into the data once, but rather inserts the key, shuffles the data, shuffles the key, inserts another copy of the shuffled key into the shuffled data, shuffles the data again, and so on for several iterations. Keys are randomly generated, as needed, by the software that manages the encryption. For example, an e-mail program or a Web browser program may be capable of generating its own keys to encrypt data. In other cases, special encryption software is used to generate keys. This encryption software works with other types of software, such as word-processing or spreadsheet programs, to encrypt data files before they are saved or transmitted. Key encryption can be separated into two categories: private key and public key encryption.

Private Key Encryption

In private key encryption, data is encrypted using a single key that only the sender and the receiver know. Private key encryption is also known as symmetric encryption because the same key is used during both the encryption and decryption of the data. Suppose Leon wants to send a secret message to Mia via private encryption. Assume he has chosen a private key. Next, he must share his private key with Mia, as shown in Step 1 of Figure 11-7 on page 518. Then, Leon runs a program that encrypts his message by combining it with his private key, as shown in Step 2. Next, Leon sends Mia the encrypted message, as shown in Step 3. After Mia receives Leon’s encrypted message, she runs a program that uses Leon’s private key to decrypt the message, as shown in Step 4. The result is that Mia can read the original message Leon wrote. The most popular private, or symmetric, key encryption is based on DES (pronounced dez), which stands for Data Encryption Standard. DES, which uses a 56-bit key, was developed by IBM in the 1970s. When DES was released, a 56-bit key was secure; however, now such a key could be cracked within days, given sufficient computer power. For greater security, the modern implementation of DES weaves a 56-bit key through data three times, using two or three different keys. This implementation is known as Triple DES (3DES). A more recent private key encryption standard is the AES (Advanced Encryption Standard), which weaves keys of 128, 160, 192, or 256 bits through data multiple times. The algorithm used in the most popular form of AES is known as Rijndael, after its two Belgian inventors, Dr. Vincent Rijmen and Dr. Joan Daemen. AES is considered more secure than DES and much faster than Triple DES. AES has replaced DES in situations such as military communications, which must have the highest level of security. A potential problem with private key encryption is that the sender must somehow share his key with the recipient. For example, Leon could call Mia and tell her his key, or he could send it to her in an e-mail message. But neither of these methods is very secure. To overcome this vulnerability, a method of associating publicly available keys with private keys was developed. This method is called public key encryption.

Public Key Encryption

In public key encryption, data is encrypted using two keys: One is a key known only to a user (that is, a private key), and the other is a public key associated with the user. A user’s public key can be obtained the old-fashioned way—by asking that user—or it can be obtained from a third-party source, such as a public key server. A public key server is a publicly accessible host (such as a server on the Internet) that freely provides a list of users’ public keys, much as a telephone book provides a list of peoples’ phone numbers. Figure 11-8 on page 519, illustrates the process of public key encryption.

For example, suppose that Mia wants to use public key encryption to send Leon a message via the Internet. Assume Leon already established a private and a public key, as shown in Step 1 of Figure 11-8. He stores his public key on a key server on the Internet, as shown in Step 2, and keeps his private key to himself. Before Mia can send Leon a message, she must know his public key. Leon tells Mia where she can find his public key, as shown in Step 3. Next, Mia writes Leon a message, retrieves his public key from the public key server, and then uses her encryption software to scramble her message with Leon’s public key, as shown in Step 4. Mia sends her encrypted message to Leon over the Internet, as shown in Step 5. When Leon receives the message, his software recognizes that the message has been encrypted with his public key. In other words, the public key has an association with the private key. A message that has been encrypted with Leon’s public key can only be decrypted with his private key. The program then prompts Leon for his private key to decrypt the message, as shown in Step 6. To respond to Mia in a publicly encrypted message, Leon must obtain Mia’s public key. Then, the steps illustrated in Figure 11-8 are repeated, with Leon and Mia’s roles reversed. The combination of a public key and a private key is known as a key pair. In the private key encryption example discussed previously, Leon has a key pair, but only he knows his private key, whereas the public key is available to people, like Mia, who want to send him encrypted messages. Because public key encryption requires the use of two different keys, it is also known as asymmetric encryption. Due to their semipublic nature, public keys are more vulnerable than private keys, and, therefore, public key algorithms generally use longer keys. The first public, or asymmetric, key algorithm, called Diffie-Hellman, was released in 1975 by its creators, Whitfield Diffie and Martin Hellman. However, the most popular public key algorithm in use today is RSA (named after its creators, Ronald Rivest, Adi Shamir, and Leonard Adleman), which was made public in 1977. In RSA, a key is created by first choosing two large prime numbers (numbers that cannot be divided evenly by anything but 1 or themselves) and multiplying them together. RSA is routinely used to secure e-commerce transactions. RSA may be used in conjunction with RC4, a key encryption technique that weaves a key with data multiple times, as a computer issues the stream of data. RC4 keys can be as long as 2048 bits. In addition to being highly secure, RC4 is fast. With the abundance of private and public keys, not to mention the number of places where each may be kept, users need easier key management. One answer to this problem is using digital certificates. A digital certificate is a password-protected and encrypted file that holds an individual’s identification information, including a public key. In the context of digital certificates, the individual’s public key verifies the sender’s digital signature. An organization that issues and maintains digital certificates is known as a CA (certificate authority). For example, on the Internet, certificate authorities such as VeriSign will, for a fee, keep your digital certificate on their server and ensure to all who want to send encrypted messages to you (for example, an order via your e-commerce site) that the certificate is indeed yours. The use of certificate authorities to associate public keys with certain users is known as PKI (Public-key Infrastructure). The following sections detail specific methods of encrypting data as it is transmitted over a network. These methods use one or more of the encryption algorithms discussed in this section.

PGP (Pretty Good Privacy)

You have probably exchanged e-mail messages over the Internet without much concern for what happens with your message between the time you send it and when your intended recipient picks it up. In addition, you have probably read e-mails from friends without thinking that they might not be from your friends, but rather from other users who are impersonating your friends over the Internet. In fact, some e-mail communication is highly insecure.

Depending on the mail server and client, messages may be sent in clear (that is, unencrypted) text, which makes it readable by anyone who can capture the message on its way from you to your recipient. In addition, a person with malicious intentions can easily pretend he is someone else. For example, if your e-mail address is joe@example.com, someone else could assume your address and send messages that appear to be sent by joe@example.com. To secure e-mail transmissions, a computer scientist named Phil Zimmerman developed PGP in the early 1990s. PGP (Pretty Good Privacy) is a public key encryption system that can verify the authenticity of an e-mail sender and encrypt e-mail data in transmission. PGP, which is now administered at MIT, is freely available as both an open source and a proprietary software package. Since its release, it has become the most popular tool for encrypting e-mail. However, PGP can also be used to encrypt data on storage devices (for example, a hard disk) or with applications other than e-mail (for example, IP telephony).

SSL (Secure Sockets Layer)

SSL (Secure Sockets Layer) is a method of encrypting TCP/IP transmissions—including Web pages and data entered into Web forms—en route between the client and server using public key encryption technology. If you trade stocks or purchase goods on the Web, for example, you are most likely using SSL to transmit your order information. SSL is popular and used widely. The most recent versions of Web browsers, such as Google Chrome and Firefox, include SSL client support in their software. You have probably noticed that URLs for most Web pages begin with the HTTP prefix, which indicates that the request is handled by TCP/IP port 80 using the HTTP protocol. When Web page URLs begin with the prefix HTTPS (which stands for HTTP over Secure Sockets Layer or HTTP Secure), they require that their data be transferred from server to client and vice versa using SSL encryption. HTTPS uses the TCP port number 443, rather than port 80. Each time a client and server establish an SSL connection, they also establish a unique SSL session, or an association between the client and server that is defined by an agreement on a specific set of encryption techniques. An SSL session allows the client and server to continue to exchange data securely as long as the client is still connected to the server. An SSL session is created by the SSL handshake protocol, one of several protocols within SSL, and perhaps the most significant. As its name implies, the handshake protocol allows the client and server to introduce each other and establishes terms for how they will securely exchange data. For example, when you are connected to the Web and you decide to open your bank’s account access URL, your browser initiates an SSL connection with the handshake protocol. The handshake protocol sends a special message to the server, called a client_hello message, which contains information about what level of security your browser is capable of accepting and what type of encryption your browser can decipher (for example, RSA or Diffie-Hellman). The client_hello message also establishes a randomly generated number that uniquely identifies your client and another number that identifies your SSL session. The server responds with a server_hello message that confirms the information it received from your client and agrees to certain terms of encryption based on the options your client supplied. Depending on the Web server’s preferred encryption method, the server may choose to issue your browser a public key or a digital certificate at this time. After the client and server have agreed on the terms of encryption, they begin exchanging data. SSL was originally developed by Netscape. Since that time, the IETF has attempted to standardize SSL in a protocol called TLS (Transport Layer Security). TLS, which is supported by modern Web browsers, uses slightly different encryption algorithms than SSL, but otherwise is very similar to the most recent version of SSL.

SSH (Secure Shell)

Earlier in this book, you learned about Telnet, the TCP/IP utility that provides remote connections to hosts. For example, if you were a network administrator working at one of your company’s satellite offices and had to modify the configuration on a router at the home office, you could telnet to the router and run commands to modify its configuration. However, Telnet provides little security for establishing a connection (authenticating) and no security for transmitting data (encryption). SSH (Secure Shell) is a collection of protocols that does both. With SSH, you can securely log on to a host, execute commands on that host, and copy files to or from that host. SSH encrypts data exchanged throughout the session. It guards against a number of security threats, including unauthorized access to a host, IP spoofing, interception of data in transit (even if it must be transferred via intermediate hosts), and DNS spoofing, in which a hacker forges name server records to falsify his host’s identity. Depending on the version, SSH may use DES, Triple DES, RSA, Kerberos, or another, less-common encryption algorithm or method. SSH was developed by SSH Communications Security, and use of their SSH implementation requires paying for a license. However, open source versions of the protocol suite, such as OpenSSH, are available for most computer platforms. To form a secure connection, SSH must be running on both the client and server. Like Telnet, the SSH client is a utility that can be run at the shell prompt on a UNIX or Linux system or at the command prompt on a Windows-based system. Other versions of the program come with a graphical interface. The SSH suite of protocols is included with all modern UNIX and Linux distributions and with Mac OS X Server and Mac OS X client operating systems. For Windows-based computers, you need to download a freeware SSH client, such as PuTTY. Before you can establish a secure SSH connection, you must first generate a public key and a private key on your client workstation by running the ssh keygen command (or by choosing the correct menu options in a graphical SSH program). The keys are saved in two different, encrypted files on your hard disk. Next, you must transfer the public key to an authorization file on the host to which you want to connect. Finally, you are ready to connect to the host via SSH. On a computer running UNIX or Linux, this is accomplished by running the slogin -1 username hostname command, where username is your client username and hostname is the name of the host to which you are trying to connect. The client and host then exchange public keys, and if both can be authenticated, the connection is completed. On a Windows-based computer, follow the menu options in the SSH client application. SSH is highly configurable. For example, it can be configured to use one of several types of encryption for data en route between the client and host. It can be configured to require that the client enter a password in addition to a key. It can also be configured to perform port forwarding, which means it can redirect traffic that would normally use an insecure port (such as FTP) to an SSH-secured port. This allows you to use SSH for more than simply logging on to a host and manipulating files. With port forwarding, you could, for example, exchange HTTP traffic with a Web server via a secured SSH connection.

SCP (Secure CoPy) and SFTP (Secure File Transfer Protocol)

An extension to OpenSSH is the SCP (Secure CoPy) utility, which allows you to copy files from one host to another securely. SCP replaces insecure file copy protocols such as FTP, which do not encrypt usernames, passwords, or data while transferring them. Most modern OpenSSH packages, such as those supplied with the UNIX, Linux, and Macintosh OS X (client and server version) operating systems, include the SCP utility. Not all freeware SSH programs available for Windows include SCP, but separate, freeware SCP applications, such as WinSCP, exist. SCP is simple to use. At the shell prompt of a UNIX or Linux system, type scp filenamel filename2, where filename1 is the name of the file on the source host and filename2 is the name of the file on the target host.

Suppose you are copying a file from a server to your client workstation. In that case, you also need to include your username on the server and the server’s host name in the command, as follows: scp userid@hostname: filename1 filename2. In this command, userid is your username on the server; hostname is the server’s fully qualified host name, filename1 is the name of the file on the server, and filename2 is what you want to call the file on your client workstation. On a Windows-based system, follow the menu options in your SSH or SCP client for copying files with SCP. If your system uses the proprietary version of SSH, available from SSH Communications Security, you need to use SFTP (Secure File Transfer Protocol) to copy files rather than SCP. SFTP is slightly different from SCP, in that it does more than copy files. Like FTP, SFTP first establishes a connection with a host and then allows a remote user to browse directories, list files, and copy files. To open an SFTP connection from a UNIX or Linux system, type sftp hostname at a shell prompt, where hostname is the fully qualified host name of the computer to which you want to connect. To copy a file, type get filename1 filename2 , where filename1 is the name of the file on the source computer and filename2 is what you want to call the file on the target computer. To close the SFTP connection, type quit and then press Enter. On a Windows-based system, follow the menu options in the SSH or SFTP client for copying files with SFTP. The following section describes another technique for encrypting data in transit on a network.

IPSec (Internet Protocol Security)

IPSec (Internet Protocol Security) protocol defines encryption, authentication, and key management for TCP/IP transmissions. It is an enhancement to IPv4 and is native to IPv6. IPSec is somewhat different from other methods of securing data in transit. Rather than apply encryption to a stream of data, IPSec actually encrypts data by adding security information to the header of all IP packets. In effect, IPSec transforms the data packets. To do so, IPSec operates at the Network layer of the OSI model. IPSec accomplishes authentication in two phases. The first phase is key management, and the second phase is encryption. Key management refers to the way in which two nodes agree on common parameters for the keys they will use. IPSec relies on IKE (Internet Key Exchange) to negotiate and authenticate keys. A separate service, ISAKMP (Internet Security Association and Key Management Protocol), establishes policies for verifying the identity and the encryption methods that nodes will use for data transmission. After IKE has managed the shared keys and ISAKMP policies have ensured that both parties agree on the methods of secure transmission, IPSec invokes its second phase, encryption. In this phase, two types of encryption may be used: AH (authentication header) or ESP (Encapsulating Security Payload). Both types of encryption provide authentication of the IP packet’s data payload through public key techniques. In addition, ESP encrypts the entire IP packet for added security. IPSec can be used with any type of TCP/IP transmission. However, it most commonly runs on routers or other connectivity devices in the context of VPNs. As you learned in Chapter 10, VPNs are used to transmit private data over public networks. Therefore, they require strict encryption and authentication to ensure that data is not compromised. On networks where more than a few simultaneous VPN connections must be maintained, a specialized device known as a VPN concentrator can be positioned at the edge of the private network to establish VPN connections, as shown in Figure 11-9. VPN concentrators authenticate VPN clients and establish tunnels for VPN connections. Their support of specific tunneling protocols, authentication mechanisms, and encryption algorithms vary from one manufacturer and model to another. Some support only IPSec or SSL, while others support both, for example. Some also provide enhanced features such as packet filtering. VPN concentrators are one type of encryption device.

Encryption devices are computers, or, more often, specialized adapters within other devices, such as routers and servers, that perform encryption. Encryption devices encrypt and decrypt data faster than software running on other machines. As a result, they accelerate secure data transmission.

Authentication Protocols

You have learned that authentication is the process of verifying a user’s credentials (typically a username and password) to grant the user access to secured resources on a system or network. Authentication protocols are the rules that computers follow to accomplish authentication. Several types of authentication protocols exist. They vary according to which encryption schemes they rely on and the steps they take to verify credentials. The following sections describe some common authentication protocols in more detail.

RADIUS and TACACS+

In environments that support many simultaneous connections and several user IDs and passwords, it makes sense to use a centralized service to manage access to resources. This section describes a category of protocols known as AAA (authentication, authorization, and accounting) that provides that service. AAA protocols first establish a client’s identity by prompting a user for a username and password. Next, the protocols examine those credentials and based on their validity, allow or deny access to a system or network. Finally, AAA protocols track the client’s system or network usage. By far, the most popular AAA service is RADIUS (Remote Authentication Dial-In User Service). RADIUS is a service defined by the IETF that runs over UDP and provides centralized network authentication, authorization, and accounting for multiple users. RADIUS can operate as a software application on a remote access server or on a computer dedicated to this type of authentication, called a RADIUS server. Because RADIUS servers are highly scalable, many Internet service providers use a RADIUS server as a central authentication point for mobile or remote users. RADIUS may also be used to authenticate connections between wireless clients and access points or on cellular networks. Finally, they may operate in conjunction with other network servers. For example, an organization might combine a DHCP server with a RADIUS server to manage allocation of addresses and privileges assigned to each address on the network. Figure 11-10 illustrates a RADIUS server used for remote access. RADIUS can run on UNIX, Linux, Windows, or Macintosh networks. Another AAA protocol, TACACS+ (Terminal Access Controller Access Control System Plus) offers network administrators the option of separating the access, authentication, and auditing capabilities. For instance, TACACS+ might provide access and accounting functions, but use another technique, such as Kerberos (discussed later in this chapter), to authenticate users. TACACS+ also differs from RADIUS in that it relies on TCP, not UDP, at the Network layer. TACACS+ is a proprietary protocol developed by Cisco Systems, Inc., and is typically installed on a router, rather than on a separate server. Each of the protocols described in the following sections may play a role in the authentication step of AAA.

PAP (Password Authentication Protocol)

In Chapter 10’s discussion of remote access protocols, you were introduced to PPP (Point-to-Point Protocol), which belongs to the Data Link layer of the OSI model and provides the foundation for connections between remote clients and hosts. PPP alone, however, does not secure connections. For this, it requires an authentication protocol. In fact, several types of authentication protocols can work over PPP. One is PAP (Password Authentication Protocol).

After establishing a link with a server through PPP, a client uses PAP to send an authentication request that includes its credentials—usually a username and password. The server compares the credentials to those in its user database. If the credentials match, the server responds to the client with an acknowledgment of authentication and grants the client access to secured resources. If the credentials do not match, the server denies the request to authenticate. Figure 11-11 illustrates PAP’s two- step authentication process. Thus, PAP is a simple authentication protocol, but it is not very secure. It sends the client’s credentials in clear text, without encryption, and this opens the way for eavesdroppers to capture a username and password. In addition, PAP does not protect against the possibility of a malicious intruder attempting to guess a user’s password through a brute force attack. For these reasons, PAP is rarely used on modern networks. Instead, more sophisticated protocols, such as those described in the following sections, are preferred.

CHAP and MS-CHAP

CHAP (Challenge Handshake Authentication Protocol) is another authentication protocol that operates over PPP. Unlike PAP, CHAP encrypts usernames and passwords for transmission. It also differs from PAP in that it requires three steps to complete the authentication process. Together, these steps are known as a three-way handshake. In CHAP, the authenticating device (for example, a remote access server) takes the first step in authentication after PPP establishes a connection between it and the computer requesting authentication (for example, a remote client). The server sends the client a randomly generated string of characters called the challenge. In the second step, the client adds its password to the challenge and encrypts the new string of characters. It sends this new string of characters in a response to the server. Meanwhile, the server also concatenates the user’s password with the challenge and encrypts the new character string, using the same encryption scheme the client used. In the third step of the three-way handshake, the server compares the encrypted string of characters it received from the client with the encrypted string of characters it has generated. If the two match, it authenticates the client. But if the two differ, it rejects the client’s request for authentication. Figure 11-12 illustrates the three-way handshake used in CHAP. The benefit of CHAP over PAP is that in CHAP, a password is never transmitted alone, and never as clear text. This same type of security is offered in MS-CHAP (Microsoft Challenge Handshake Authentication Protocol), a similar authentication protocol from Microsoft used with Windows-based computers. One potential flaw in CHAP and MSCHAP authentication is that someone eavesdropping on the network could capture the string of characters that is encrypted with the password, decrypt that string, and obtain the client’s password. To address this, Microsoft released MS-CHAPv2 (Microsoft Challenge Handshake Authentication Protocol, version 2), which uses stronger encryption, does not use the same encryption strings for transmission and reception, and requires mutual authentication.  In mutual authentication, both computers verify the credentials of the other—for example, the client authenticates the server just as the server authenticates the client. This is more secure than requiring only one of the communicating computers to authenticate the other. MS-CHAPv2 is available for use with VPN and dial-up connections in the Windows client and network operating systems. Windows XP, Vista, and 7 clients support the use of PAP, CHAP, or MS-CHAPv2 when making dial-up connections. An authentication protocol that is more secure than CHAP or MS-CHAP and is supported by multiple operating systems is EAP, discussed next.

EAP (Extensible Authentication Protocol)

EAP (Extensible Authentication Protocol) is another extension to the PPP protocol suite. It differs from the authentication protocols discussed previously in that it is only a mechanism for authenticating clients and servers; it does not perform encryption or authentication on its own.

Instead, it works with other encryption and authentication schemes to verify the credentials of clients and servers. Like CHAP, EAP requires the authenticator (for example, the server) to initiate the authentication process by asking the connected computer (for example, the client) to verify itself. In EAP, the server usually sends more than one request. In its first request, it asks the client’s identity and indicates what type of authentication to use. In subsequent requests, it asks the client for authentication information to prove the client’s identity. The client responds to each of the servers’ requests in the required format. If the responses match what the server expects, the server authenticates the client. One of EAP’s advantages is its flexibility. It is supported by nearly all modern operating systems and can be used with any authentication method. For example, although the typical network authentication involves a user ID and password, EAP also works with biorecognition methods, such as retina or hand scanning. EAP is also adaptable to new technology. Therefore, no matter what future wireless encryption schemes are developed, EAP will support them. In the case of wireless LANs, EAP is used with older encryption and authentication protocols to form a new, more secure method of connecting to networks from wireless stations. A distinct implementation of EAP, described next, forms the basis of one of the most secure wireless authentication techniques.

802.1x (EAPoL)

The 802.1x standard, codified by IEEE, specifies the use of one of many authentication methods, plus EAP, to grant access to and dynamically generate and update authentication keys for transmissions to a particular port. Although it’s primarily used with wireless networks now, it was originally designed for wired LANs; thus, it’s also known as EAPoL (EAP over LAN). 802.1x only defines a process for authentication. It does not specify the type of authentication or encryption protocols clients and servers must use. However, 802.1x is commonly used with RADIUS authentication. As you might expect, for nodes to communicate using 802.1x, they must agree on the same authentication method. What distinguishes 802.1x from other authentication standards is the fact that it applies to communication with a particular port—for example, a physical switch port or a logically defined port on an access point. When a client wants to access the network, a port on the authenticator (such as a switch or access point) challenges the client to prove its identity.

If the client is running the proper 802.1x software, the client will supply the authenticator with its credentials. The authenticator next passes on the client’s credentials to an authentication server—for example, a RADIUS server. Only after the authentication server has verified a client’s legitimacy will the switch or access point port be opened to the client’s Layer 3 traffic. For this reason, 802.1x is sometimes also called port authentication, or port-based authentication. After the port is opened, the client and network communicate using EAP and an agreed upon encryption scheme. Figure 11-13 illustrates the process followed by 802.1x when used with a WLAN (wireless LAN). You’ll learn more about wireless network security techniques later in this chapter.

Kerberos

Kerberos is a cross-platform authentication protocol that uses key encryption to verify the identity of clients and to securely exchange information after a client logs on to a system. It is an example of a private key encryption service. Kerberos provides significant security advantages over simple NOS authentication. Whereas an NOS client/server logon process assumes that clients are who they say they are and only verifies a user’s name against the password in the NOS database, Kerberos does not automatically trust clients. Instead, it requires clients to prove their identities through a third party. This is similar to what happens when you apply for a passport. The government does not simply believe that you are “Leah Torres,” but instead requires you to present proof, such as your birth certificate. In addition to checking the validity of a client,

Kerberos communications are encrypted and unlikely to be deciphered by any device on the network other than the client. Contrast this type of transmission to the normally unencrypted and vulnerable communication between an NOS and a client. To understand specifically how a client uses Kerberos, you need to understand some of the terms used when discussing this protocol. In Kerberos terminology, the server that issues keys to clients during initial client authentication is known as the KDC (Key Distribution Center). To authenticate a client, the KDC runs an AS (authentication service). An AS issues a ticket, which is a temporary set of credentials that a client uses to prove that its identity has been validated (note that a ticket is not the same as a key, which is used to initially validate its identity). A Kerberos client, or user, is known as a principal. Now that you have learned the terms used by Kerberos, you can follow the process it requires for client/server communication. Bear in mind that the purpose of Kerberos is to connect a valid user with the service that user wants to access. To accomplish this, both the user and the service must register their keys with the authentication service. Suppose the principal is Jamal Sayad and the service is called “inventory.” Jamal first logs on to his network as usual. Next, he attempts to log on to the “inventory” service with his Kerberos principal name and password. The KDC confirms that Jamal Sayad is in its database and that he has provided the correct password. Then the AS running on the KDC randomly generates two copies of a new key, called the session key. The AS issues one copy to Jamal’s computer and the other copy to the inventory service. Further, it creates a ticket that allows Jamal to use the inventory service. This ticket contains the inventory service key and can only be decrypted using Jamal Sayad’s key. The AS sends the ticket to Jamal Sayad. Jamal’s computer decrypts the session key with Jamal’s personal key. It then creates a time stamp associated with his request, and encrypts this time stamp with the session key. The encrypted time stamp is known as the authenticator. This time stamp helps the service verify that the ticket is indeed associated with Jamal Sayad’s request to use the inventory service. Next, Jamal’s computer sends his ticket and authenticator to the service. The service decrypts the ticket using its own key and decrypts the authenticator using its session key. Finally, the service verifies that the principal requesting its use is truly Jamal Sayad as the KDC indicated. The preceding events illustrate the original version of the Kerberos authentication process. The problem with the original version was that a user had to request a separate ticket each time he wanted to use a different service. To alleviate this inconvenience, Kerberos developers created the TGS (Ticket-Granting Service), an application separate from the AS that also runs on the KDC. So that the client does not need to request a new ticket from the TGS each time it wants to use a different service on the network, the TGS issues the client a TGT (Ticket-Granting Ticket). After receiving the TGT, anytime the user wants to contact a service, he requests a ticket not from the AS, but from the TGS. Furthermore, the reply is encrypted not with the user’s personal key, but with the session key that the AS provided for use with the TGS. Inside that reply is the new session key for use with the regular service. The rest of the exchange continues as described previously. Kerberos, which is named after the three-headed dog in Greek mythology who guarded the gates of Hades, was designed at MIT (Massachusetts Institute of Technology). MIT still provides free copies of the Kerberos code. In addition, many software vendors have developed their own versions of Kerberos. Kerberos is an example of single sign-on, a form of authentication in which a client signs on one time to access multiple systems or resources. The primary advantage of single sign-on is convenience. Users don’t have to remember several passwords, and network administrators limit the time they devote to password management. The biggest disadvantage to single sign-on is that once the obstacle of authentication is cleared, the user has access to numerous resources. A hacker needs fewer credentials to gain access to potentially many files or connections. For greater security, some systems require clients to supply two or more pieces of information to verify their identity. For example, in a two-factor authentication scenario, a user might have to pass a fingerprint scan as well as provide his password.

In general, an authentication process that requires two or more pieces of information is known as multifactor authentication. For example, multifactor authentication might require a password, fingerprint scan, plus a piece of information generated from a security token. A security token is a device or piece of software that stores or generates information, such as a series of numbers or letters, known only to its authorized user. One example of a hardware-based token is the popular SecurID key chain fob from RSA Security, as shown in Figure 11-14. The SecurID device generates a password that changes every 60 seconds. When logging in, a user provides the number that currently appears on the SecurID fob. Before he is allowed access to secured resources, his network checks with RSA Security’s service to verify that the number is correct. Google Authenticator, Google’s number generator service, provides free, software-based security tokens.

Wireless Network Security

Wireless transmissions are particularly susceptible to eavesdropping. For example, a hacker could search for unprotected wireless networks by driving around with a laptop configured to receive and capture wireless data transmissions—a practice known as war driving. (The term is derived from the term war dialing, which is a similar tactic involving modems.) War driving is surprisingly effective for obtaining private information. Years ago, the hacker community publicized the vulnerabilities of a well-known store chain, which were discovered while war driving. The retailer used wireless cash registers to help customers make purchases when the regular, wired cash registers were busy. However, the wireless cash registers transmitted purchase information, including credit card numbers and customer names, to network access points in clear text. By chance, a person in the parking lot who was running a protocol analyzer program on his laptop obtained several credit card numbers in a very short time. The person alerted the retailer to the security risk (rather than exploiting the information he gathered). Needless to say, after the retailer discovered its error, it abandoned the use of wireless cash registers until after a thorough evaluation of its data security. Once hackers discover vulnerable access points, they might make this information public through war chalking, or using chalk to draw symbols on the sidewalk or wall within range of an access point. The symbols, patterned after marks that hobos devised to indicate hospitable places for food or rest, indicate the access point’s SSID and whether it’s secured. Most access points are not left unsecured. The following sections describe techniques for encrypting data between Wi-Fi clients and access points. WEP (Wired Equivalent Privacy) As you have learned, most organizations use one of the 802.11 protocol standards on their WLANs. By default, the 802.11 standard does not offer any security. In addition, most access points do not require a client to authenticate before it can communicate with the AP. The client only needs to know the access point’s SSID, which many access points broadcast. Network administrators may prevent their access points from broadcasting the SSIDs, making them harder to detect. However, this does not provide true security. For some measure of security, 802.11 allows for optional encryption using the WEP (Wired Equivalent Privacy) standard. WEP uses keys both to authenticate network clients and to encrypt data in transit. When configuring WEP, you establish a character string required to associate with the access point, also known as the network key. When the client detects the presence of the access point, the user is prompted to provide a network key before the client can gain access to a network via the access point. The network key can be saved as part of the client’s wireless connection’s properties. The first implementation of WEP allowed for 64-bit network keys, and current versions of WEP allow for more secure, 128-bit or even 256-bit network keys. Still, WEP’s use of the shared key for authenticating all users and for exchanging data makes it more susceptible to discovery than a dynamically generated, random, or single-use key. An exploit in which a hacker uses a program to determine a WEP key is known as WEP cracking.

Even 128-bit network keys can be cracked in a matter of minutes. Moreover, because WEP operates in the Physical and Data Link layers of the OSI model, it does not offer end-to-end data transmission security. A better wireless security technique is 802.11i, which is discussed next.

IEEE 802.11i and WPA (Wi-Fi Protected Access)

A significant disadvantage to WEP is that it uses the same key for all clients and the key may never change. Due to this inherent insecurity, IEEE devised a new wireless security protocol, called 802.11i, that uses 802.1x (EAPoL) to authenticate devices and dynamically assign every transmission its own key. 802.11i often relies on an encryption key generation and management scheme known as TKIP (Temporal Key Integrity Protocol), pronounced tee-kip. As you can imagine, EAPoL makes logging on to a wireless network more complex than it is with WEP. In 802.11i, a wireless station first issues a request to the access point. The access point functions as a proxy between the remote access server and station until the station has successfully authenticated with a remote access server. Meanwhile, the access point prevents any direct exchange of data between the two. After obtaining data from an unknown station, the access point repackages the data and then transmits it to the remote access server. It also repackages data from the remote access server before issuing it to the station. Thus, 802.11i requires mutual authentication—the station authenticates with the remote access server, and also, the remote access server authenticates with the station. After mutual authentication, the remote access server instructs the access point to allow traffic from the client into the network without first having to be repackaged. Next, the client and server agree on the encryption key they will use with the encryption scheme. Finally, they exchange data that has been encrypted through the mutually agreed-upon method. 802.11i specifies the AES encryption method and mixes each packet in a data stream with a different key. Because of its impressive security, 802.11i has replaced the less-secure WEP as the preferred means for protecting wireless transmissions from intruders. WPA (Wi-Fi Protected Access) is a subset of the 802.11i standard endorsed by the Wi-Fi Alliance, an international, nonprofit organization dedicated to ensuring the interoperability of 802.11-capable devices. In fact, the Wi-Fi Alliance released WPA before 802.11i was ratified to quickly provide a more secure alternative to WEP. In WPA, authentication follows the same mechanism specified in 802.11i. The main difference is that WPA specifies RC4 encryption rather than AES. Since the 802.11i standard was approved, the Wi-Fi Alliance has released an updated version called WPA2. WPA2 includes support for the previously released WPA protocol. In all other ways, it is identical to 802.11i. The most secure Wi-Fi communication is made possible by combining a RADIUS server with WPA or WPA2, known as WPA-Enterprise or WPA2-Enterprise, respectively.  Although they are significantly more secure than WEP, WPA and WPA2 keys can be discovered through WPA cracking programs. Table 11-1 summarizes the most important encryption and authentication methods discussed in this chapter.

Table 11-1 Notable encryption and authentication methods

Security method	Type	Primary use(s)	Notes
PGP	Encryption	E-mail, but also other applications and stored data	Uses public key encryption
SSL	Encryption	TCP/IP (Web) transmissions	Can use one of many encryption algorithms
SSH	Encryption	VPN	Can use public or private key exchange and one of many encryption algorithms
IPSec	Authentication	VPN	Uses IKE for key management, ISAKMP for secure associations, and AH or ESP for encryption; native to IPv6
RADIUS	Authentication, Authorization, and Accounting (AAA)	Remote access	Can use PPP, CHAP, and other protocols for authentication; relies on UDP at the Transport layer; supported by multiple platforms
TACACS+	Authentication, Authorization, and Accounting (AAA)	Remote access	Allows for separation of authentication, authorization, and accounting services; can use PPP, CHAP, and other protocols for authentication; relies on TCP at the Transport layer; Cisco proprietary
CHAP	Authentication	Remote access	Operates over PPP and requires a three-way handshake
MS-CHAP	Authentication	Remote access	Microsoft’s version of CHAP
MS-CHAPv2	Authentication	Remote access	A revised version of MS-CHAP; requires mutual authentication between client and server
EAP	Authentication	Remote access	Operates over PPP; does not perform authentication or encryption, but provides framework for these
EAPoL (802.1x)	Authentication	Wi-Fi	Not a protocol, but a process for port-based authentication; EAPoL combines EAP plus one of many encryption algorithms
Kerberos	Authentication	Client logon to services	Uses private key encryption to allow single sign-on to multiple resources
WEP	Authentication	Wi-Fi	Uses symmetric, private key encryption; keys are statically assigned; easily thwarted
WPA	Authentication	Wi-Fi	Uses public key encryption (RC4) and EAPoL to authenticate devices and dynamically assign every transmission its own public key
WPA2	Authentication	Wi-Fi	Uses public key encryption (AES) and EAPoL to authenticate devices and dynamically assign every transmission its own key
WPA/WPA2-Enterprise	Authentication	Wi-Fi	Adds RADIUS to WPA or WPA2 authentication

Chapter Summary

·         Every organization should assess its security risks by conducting a posture assessment that identifies vulnerabilities and rates the severity of threats and their potential consequences. Network administrators use the results of posture assessments to close gaps in security. If the assessment is conducted by a consulting company that has been accredited by an agency that sets network security standards, the assessment qualifies as a security audit.

·         One of the most common methods by which an intruder gains access to a network is to simply ask users for their passwords. This strategy is commonly called social engineering because it involves manipulating social relationships to gain access. Phishing, a related tactic, involves luring users into revealing information that would allow intruders to gain access to secured network resources.

·         Security risks that a network administrator must guard against include incorrectly configuring user accounts or groups and their privileges; overlooking security flaws in topology or hardware configuration; overlooking security flaws in operating system or application configuration; improperly documenting or communicating security policies; and leaving system settings at their default values.

■ Some risks inherent in network transmission and design include leased lines that may

allow for eavesdropping; unused router or server ports that can be exploited and

accessed by hackers if not disabled; a router’s configuration port, accessible by Telnet,

that might not be adequately secured; routers that may not be properly configured to

mask internal subnets or to deny access to certain hosts; and remote access servers

used by telecommuting or remote staff that might not be carefully secured and

monitored.

■ Some risks pertaining to networking protocols and software include the following:

inherent TCP/IP security flaws; trust relationships between one server and another;

NOS “back doors” or security flaws; an NOS that allows server operators to exit

to a command prompt; administrators who accept default operating system

security; and transactions that take place between applications left open to

interception.

■ A security policy identifies an organization’s security goals, risks, levels of authority,

designated security coordinator and team members, responsibilities for each team

member, responsibilities for each employee, and strategies for addressing security

breaches.

■ Only authorized personnel should be allowed into data centers, computer rooms,

entrance facilities, and wiring closets. If these areas remain unsecured, intruders may

easily enter and steal equipment or sabotage software and hardware.

■ A router’s ACL (access control list, also known as an access list) instructs it to decline

to forward certain packets according to source IP address, source netmask, destination

IP address, destination netmask, or TCP or UDP port, among other things.

■ An IDS (intrusion-detection system) monitors traffic on a network or host for

unauthorized attempts to access a network’s resources. An IPS (intrusion-prevention

system) can detect such attempts and automatically react to them—for example, by

denying access to a host whose traffic triggers an alert.

■ A firewall is a specialized device (typically a router, but possibly only a desktop

computer running special software) that selectively filters or blocks traffic between

networks.

It can be placed between two interconnected private networks or, more

typically, between a private network and a public network.

■ The most common form of firewall is a packet-filtering firewall, which examines the

header of every packet of data that it receives to determine whether that type of

packet is authorized to continue to its destination.

■ A proxy service is a software application on a network host that acts as an

intermediary between the external and internal networks, screening all incoming and

outgoing traffic. The host that runs the proxy service is known as a proxy server.

A proxy server appears to external machines as a network server, but it is actually

another filtering device for the internal LAN.

■ Scanning tools such as NMAP (Network Mapper) and Nessus can quickly reveal

comprehensive information about a network. Open ports, services, hosts, and even

software configurations may be discovered. Used legitimately, scanning tools provide

network administrators with valuable information that can help improve network

security.

■ To learn more about hackers’ techniques or to catch a hacker in the act, some

networking professionals use intentionally unsecured and isolated systems known

as honeypots. Once a hacker has compromised the honeypot, his movements can

be logged and his tactics examined. A network of honeypots is known as a

honeynet.

■ Every NOS provides at least some security by allowing you to limit users’ access to

files and directories on the network. In addition, network administrators can

constrain how those with different types of user IDs can use the network by setting

restrictions on, for example, time of day, total time logged on, source address, and

number of unsuccessful logon attempts.

■ Choosing secure passwords is one of the easiest and least expensive ways to guard

against unauthorized access.

■ Encryption is the use of an algorithm to scramble data into a format that can be read

only by reversing the algorithm—or decrypting the data—to keep the information

private. Many forms of encryption exist, with some being more secure than others.

■ The most popular kind of encryption algorithm weaves a key, or a random string of

characters, into the original data’s bits, sometimes several times in different sequences,

to generate a unique data block. The longer the key, the less easily the encrypted data

can be decrypted by an unauthorized program.

■ Key encryption comes in two forms: public and private key encryption. Popular

private (symmetric) key encryption algorithms include DES (Data Encryption

Standard), Triple DES (3DES), and AES (Advanced Encryption Standard). Popular

public (asymmetric) key encryption algorithms include Diffie-Hellman, RSA, and

RC4.

■ Popular methods of encryption include PGP (Pretty Good Privacy), SSL (Secure

Sockets Layer), SSH (Secure Shell) and OpenSSH, and IPSec (Internet Protocol

Security). IPSec, which is native to IPv6, is a protocol used on many modern VPNs.

■ SCP (Secure CoPy) and SFTP (Secure File Transfer Protocol) are ways of copying files

securely via SSH or OpenSSH.

■ Authentication protocols used with PPP connections include RADIUS (Remote

Authentication Dial-In User Service), TACACS+ (Terminal Access Controller

Access Control System Plus), PAP (Password Authentication Protocol), CHAP

(Challenge Handshake Authentication Protocol), MS-CHAP (Microsoft Challenge

Handshake Authentication Protocol), and MS-CHAPv2 (Microsoft Challenge

Handshake Authentication Protocol, version 2). Other authentication protocols

include EAP (Extensible Authentication Protocol), 802.1x (or EAPoL), and

Kerberos.

■ Wireless networks can use the WEP (Wired Equivalent Privacy) method of

encrypting data in transit between stations and access points. WEP allows for keys

as long as 256 bits. However, because WEP uses the same key for all stations

attaching to an access point and for all transmissions, it is not very secure.

■ A better wireless security solution than WEP is provided by IEEE’s 802.11i standard,

also known as TKIP (Temporal Key Integrity Protocol). In 802.11i, the 802.1x

authentication method is combined with AES encryption. Each 802.11i transmission

is dynamically assigned its own key for encryption.

■ The Wi-Fi Alliance has released two wireless security standards: WPA and WPA2.

WPA follows the same authentication and encryption processes as 802.11i, but uses

RC4 encryption. WPA2 is identical to 802.11i, but provides backward compatibility

for clients running WPA. The most secure Wi-Fi communication is made possible by

combining a RADIUS server with WPA or WPA2, known as WPA-Enterprise or

WPA2-Enterprise, respectively.

Key Terms

Ø 3DES See Triple DES.

Ø 802.11i The IEEE standard for wireless network encryption and authentication that uses

the EAP authentication method, strong encryption, and dynamically assigned keys,

which are different for every transmission. 802.11i specifies AES encryption and

weaves a key into each packet.

Ø 802.1x A vendor-independent IEEE standard for securing transmission between nodes

according to the transmission’s port, whether physical or logical. 802.1x, also known as

EAPoL, is the authentication standard followed by wireless networks using 802.11i.

Ø AAA (authentication, authorization, and accounting) The name of a category of

protocols that establish a client’s identity; check the client’s credentials and, based on

those, allow or deny access to a system or network; and, finally, track the client’s

system or network usage.

Ø access control list See ACL.

Ø access list See ACL.

Ø ACL (access control list) A list of statements used by a router to permit or deny the

forwarding of traffic on a network based on one or more criteria.

Ø Advanced Encryption Standard See AES.

Ø AES (Advanced Encryption Standard) A private key encryption algorithm that

weaves keys of 128, 160, 192, or 256 bits through data multiple times. The algorithm

used in the most popular form of AES is known as Rijndael. AES has replaced DES in

situations such as military communications, which require the highest level of security.

Ø AH (authentication header) In the context of IPSec, a type of encryption that provides

authentication of the IP packet’s data payload through public key techniques.

Ø application gateway See proxy server.

Ø Application layer gateway See proxy server.

Ø AS (authentication service) In Kerberos terminology, the process that runs on a KDC

(Key Distribution Center) to initially validate a client who’s logging on. The

authentication service issues a session key to the client and to the service the client

wants to access.

Ø asymmetric encryption A type of encryption (such as public key encryption) that uses

a different key for encoding data than is used for decoding the ciphertext.

Ø authentication, authorization, and accounting See AAA.

Ø authentication header See AH.

Ø authentication protocol A set of rules that governs how servers authenticate clients.

Several types of authentication protocols exist.

Ø authentication service See AS.

Ø authenticator In Kerberos authentication, the user’s time stamp encrypted with the

session key. The authenticator is used to help the service verify that a user’s ticket is

valid.

Ø biorecognition access A method of authentication in which a device scans an

individual’s unique physical characteristics (such as the color patterns in her iris or the

geometry of her hand) to verify the user’s identity.

Ø brute force attack An attempt to discover an encryption key or password by trying

numerous possible character combinations. Usually, a brute force attack is performed

rapidly by a program designed for that purpose.

Ø CA (certificate authority) An organization that issues and maintains digital certificates

as part of the Public-key Infrastructure.

Ø certificate authority See CA.

Ø challenge A random string of text issued from one computer to another in some forms

of authentication. It is used, along with the password (or other credential), in a response

to verify the computer’s credentials.

Ø Challenge Handshake Authentication Protocol See CHAP.

Ø CHAP (Challenge Handshake Authentication Protocol) An authentication protocol

that operates over PPP and that requires the authenticator to take the first step by

offering the other computer a challenge. The requestor responds by combining the

challenge with its password, encrypting the new string of characters and sending it to

the authenticator. The authenticator matches to see if the requestor’s encrypted string of

text matches its own encrypted string of characters. If so, the requester is authenticated

and granted access to secured resources.

Ø ciphertext The unique data block that results when an original piece of data (such as

text) is encrypted (for example, by using a key).

Ø client_hello In the context of SSL encryption, a message issued from the client to the

server that contains information about what level of security the client’s browser is

capable of accepting and what type of encryption the client’s browser can decipher (for

example, RSA or Diffie-Hellman). The client_hello message also establishes a

randomly generated number that uniquely identifies the client, plus another number that

identifies the SSL session.

Ø content-filtering firewall A firewall that can block designated types of traffic from

entering a protected network.

Ø Data Encryption Standard See DES.

Ø demilitarized zone See DMZ.

Ø denial-of-service attack A security attack in which a system becomes unable to

function because it has been inundated with requests for services and can’t respond to

any of them. As a result, all data transmissions are disrupted.

Ø DES (Data Encryption Standard) A popular private key encryption technique that

was developed by IBM in the 1970s.

Ø dictionary attack A technique in which attackers run a program that tries a

combination of a known user ID and, for a password, every word in a dictionary to

attempt to gain access to a network.

Ø Diffie-Hellman The first commonly used public, or asymmetric, key algorithm. Diffie Hellman was released in 1975 by its creators, Whitfield Diffie and Martin Hellman.

Ø digital certificate A password-protected and encrypted file that holds an individual’s

identification information, including a public key and a private key. The individual’s

public key is used to verify the sender’s digital signature, and the private key allows the

individual to log on to a third-party authority who administers digital certificates.

Ø DMZ (demilitarized zone) The perimeter of a protected, internal network where users,

both authorized and unauthorized, from external networks can attempt to access it.

Firewalls and IDS/IPS systems are typically placed in the DMZ.

Ø DNS spoofing A security attack in which an outsider forges name server records to

falsify his host’s identity.

Ø EAP (Extensible Authentication Protocol) A Data Link layer protocol defined by the

IETF that specifies the dynamic distribution of encryption keys and a preauthentication

process in which a client and server exchange data via an intermediate node (for example, an access point on a wireless LAN). Only after they have mutually

authenticated can the client and server exchange encrypted data. EAP can be used with

multiple authentication and encryption schemes.

Ø EAP over LAN See EAPoL.

Ø EAPoL (EAP over LAN) See 802.1x.

Ø Encapsulating Security Payload See ESP.

Ø encryption The use of an algorithm to scramble data into a format that can be read only

by reversing the algorithm—decrypting the data—to keep the information private. The

most popular kind of encryption algorithm weaves a key into the original data’s bits,

sometimes several times in different sequences, to generate a unique data block.

Ø encryption devices Computers or specialized adapters inserted into other devices, such

as routers or servers, that perform encryption.

Ø ESP (Encapsulation Security Payload) In the context of IPSec, a type of encryption

that provides authentication of the IP packet’s data payload through public key

techniques. In addition, ESP also encrypts the entire IP packet for added security.

Ø evil twin An exploit in which a rogue access point masquerades as a legitimate access

point, using the same SSID and potentially other identical settings.

Ø exploit In the context of network security, the means by which a hacker takes advantage

of a vulnerability.

Ø Extensible Authentication Protocol See EAP.

Ø flashing A security attack in which an Internet user sends commands to another Internet

user’s machine that cause the screen to fill with garbage characters. A flashing attack

causes the user to terminate her session.

Ø FTP bounce A security exploit in which an FTP client specifies a different host’s IP

address and port number for the requested data’s destination. By commanding the FTP

server to connect to a different computer, a hacker can scan the ports on other hosts and

transmit malicious code. To thwart FTP bounce attacks, most modern FTP servers will

not issue data to hosts other than the client that originated the request.

Ø hacker Traditionally, a person who masters the inner workings of operating systems

and utilities in an effort to better understand them. More generally, an individual who

gains unauthorized access to systems or networks with or without malicious intent.

Ø handshake protocol One of several protocols within SSL, and perhaps the most

significant. As its name implies, the handshake protocol allows the client and server to

authenticate (or introduce) each other and establishes terms for how they securely

exchange data during an SSL session.

Ø HIDS (host-based intrusion detection) A type of intrusion detection that runs on a

single computer, such as a client or server, that has access to and allows access from the

Internet.

Ø HIPS (host-based intrusion prevention) A type of intrusion prevention that runs on a

single computer, such as a client or server, that has access to and allows access from the

Internet.

Ø honeynet A network of honeypots.

Ø honeypot A decoy system isolated from legitimate systems and designed to be

vulnerable to security exploits for the purposes of learning more about hacking

techniques or nabbing a hacker in the act. Ø host-based firewall A firewall that only protects the computer on which it’s installed.

Ø host-based intrusion detection See HIDS.

Ø host-based intrusion prevention See HIPS.

Ø HTTP over Secure Sockets Layer See HTTPS.

Ø HTTP Secure See HTTPS.

Ø HTTPS (HTTP over Secure Sockets Layer) The URL prefix that indicates that a Web

page requires its data to be exchanged between client and server using SSL encryption.

HTTPS uses the TCP port number 443.

Ø IDS (intrusion-detection system) A dedicated device or software running on a host

that monitors, flags, and logs any unauthorized attempt to access an organization’s

secured resources on a network or host.

Ø IKE (Internet Key Exchange) The first phase of IPSec authentication, which

accomplishes key management. IKE is a service that runs on UDP port 500. After IKE

has established the rules for the type of keys two nodes use, IPSec invokes its second

phase, encryption.

Ø Internet Key Exchange See IKE.

Ø Internet Protocol Security See IPSec.

Ø Internet Security Association and Key Management Protocol See ISAKMP.

Ø intrusion-detection system See IDS.

Ø intrusion-prevention system See IPS.

Ø IPS (intrusion-prevention system) A dedicated device or software running on a host

that automatically reacts to any unauthorized attempt to access an organization’s

secured resources on a network or host. IPS is often combined with IDS.

Ø IPSec (Internet Protocol Security) A Layer 3 protocol that defines encryption,

authentication, and key management for TCP/IP transmissions. IPSec is an

enhancement to IPv4 and is native to IPv6. IPSec is unique among authentication

methods in that it adds security information to the header of all IP packets.

Ø IP spoofing A security attack in which an outsider obtains internal IP addresses and

then uses those addresses to pretend that he has authority to access a private network

from the Internet.

Ø ISAKMP (Internet Security Association and Key Management Protocol) A service

for setting policies to verify the identity and the encryption methods nodes will use in

IPSec transmission.

Ø KDC (Key Distribution Center) In Kerberos terminology, the server that runs the

authentication service and the Ticket-Granting Service to issue keys and tickets to

clients.

Ø Kerberos A cross-platform authentication protocol that uses key encryption to verify

the identity of clients and to securely exchange information after a client logs on to a

system. It is an example of a private key encryption service.

Ø key A series of characters that is combined with a block of data during that data’s

encryption. To decrypt the resulting data, the recipient must also possess the key.

Ø Key Distribution Center See KDC.

Ø key management The method whereby two nodes using key encryption agree on

common parameters for the keys they will use to encrypt data.

Ø key pair The combination of a public and private key used to decipher data that was

encrypted using public key encryption.

Ø man-in-the-middle attack A security threat that relies on intercepted transmissions. It

can take one of several forms, but in all cases a person redirects or captures secure data

traffic while in transit.

Ø metasploit A penetration-testing tool that combines known scanning techniques and

exploits to result in potentially new types of exploits.

Ø Microsoft Challenge Handshake Authentication Protocol See MS-CHAP.

Ø Microsoft Challenge Handshake Authentication Protocol, version 2 See MS-

CHAPv2.

Ø MS-CHAP (Microsoft Challenge Handshake Authentication Protocol) An

authentication protocol provided with Windows operating systems that uses a three-way

handshake to verify a client’s credentials and encrypts passwords with a challenge text.

Ø MS-CHAPv2 (Microsoft Challenge Handshake Authentication Protocol, version 2)

An authentication protocol provided with Windows operating systems that follows the

CHAP model, but uses stronger encryption, uses different encryption keys for

transmission and reception, and requires mutual authentication between two computers.

Ø multifactor authentication An authentication process that requires the client to provide

two or more pieces of information, such as a password, fingerprint scan, and security

token.

Ø mutual authentication An authentication scheme in which both computers verify the

credentials of each other.

Ø Nessus A penetration-testing tool from Tenable Security that performs sophisticated

scans to discover information about hosts, ports, services, and software.

Ø network-based firewall A firewall configured and positioned to protect an entire

network.

Ø network-based intrusion detection See NIDS.

Ø network-based intrusion prevention See NIPS.

Ø network key A key (or character string) required for a wireless station to associate with

an access point using WEP.

Ø Network Mapper See NMAP.

Ø NIDS (network-based intrusion detection) A type of intrusion detection that occurs

on devices that are situated at the edge of the network or that handle aggregated traffic.

Ø NIPS (network-based intrusion prevention) A type of intrusion prevention that

occurs on devices that are situated at the edge of the network or that handle aggregated

traffic.

Ø NMAP (Network Mapper) A scanning tool designed to assess large networks quickly

and provide comprehensive, customized information about a network and its hosts.

NMAP, which runs on virtually any modern operating system, is available for download

at no cost at www.nmap.org.

Ø OpenSSH An open source version of the SSH suite of protocols.

Ø packet-filtering firewall A router that examines the header of every packet of data that

it receives to determine whether that type of packet is authorized to continue to its

destination. Packet-filtering firewalls are also called screening firewalls.

Ø PAP (Password Authentication Protocol) A simple authentication protocol that

operates over PPP. Using PAP, a client issues its credentials in a request to authenticate,

and the server responds with a confirmation or denial of authentication after comparing

the credentials with those in its database. PAP is not very secure and is, therefore, rarely

used on modern networks.

Ø Password Authentication Protocol See PAP.

Ø PGP (Pretty Good Privacy) A key-based encryption system for e-mail that uses a two-

step verification process.

Ø phishing A practice in which a person attempts to glean access or authentication

information by posing as someone who needs that information.

Ø PKI (Public-key Infrastructure) The use of certificate authorities to associate public

keys with certain users.

Ø port authentication A technique in which a client’s identity is verified by an

authentication server before a port, whether physical or logical, is opened for the

client’s Layer 3 traffic. See also 802.1x.

Ø port-based authentication See port authentication.

Ø port forwarding The process of redirecting traffic from its normally assigned port to a

different port, either on the client or server. In the case of using SSH, port forwarding

can send data exchanges that are normally insecure through encrypted tunnels.

Ø port mirroring A monitoring technique in which one port on a switch is configured to

send a copy of all its traffic to a second port.

Ø port scanner Software that searches a server, switch, router, or other device for open

ports, which can be vulnerable to attack.

Ø posture assessment An assessment of an organization’s security vulnerabilities.

Posture assessments should be performed at least annually and preferably quarterly—or

sooner if the network has undergone significant changes. For each risk found, it should

rate the severity of a potential breach, as well as its likelihood.

Ø Pretty Good Privacy See PGP.

Ø principal In Kerberos terminology, a user or client.

Ø private key encryption A type of key encryption in which the sender and receiver use

a key to which only they have access. DES (Data Encryption Standard), which was

developed by IBM in the 1970s, is a popular example of a private key encryption

technique. Private key encryption is also known as symmetric encryption.

Ø proxy See proxy server.

Ø proxy server A network host that runs a proxy service. Proxy servers may also be

called gateways.

Ø proxy service A software application on a network host that acts as an intermediary

between the external and internal networks, screening all incoming and outgoing traffic

and providing one address to the outside world, instead of revealing the addresses of

internal LAN devices.

Ø public key encryption A form of key encryption in which data is encrypted using two

keys: One is a key known only to a user, and the other is a key associated with the user

and that can be obtained from a public source, such as a public key server. Some

examples of public key algorithms include RSA and Diffie-Hellman. Public key

encryption is also known as asymmetric encryption.

Ø public-key infrastructure See PKI.

Ø public key server A publicly available host (such as an Internet host) that provides free

access to a list of users’ public keys (for use in public key encryption).

Ø RADIUS (Remote Authentication Dial-In User Service) A popular protocol for

providing centralized AAA (authentication, authorization, and accounting) for multiple

users. RADIUS runs over UDP and can use one of several authentication protocols.

Ø RADIUS server A server that offers centralized authentication services to a network’s

access server, VPN server, or wireless access point via the RADIUS protocol.

Ø RC4 An asymmetric key encryption technique that weaves a key with data multiple

times as a computer issues the stream of data. RC4 keys can be as long as 2048 bits. In

addition to being highly secure, RC4 is fast.

Ø Remote Authentication Dial-In User Service See RADIUS.

Ø RSA An encryption algorithm that creates a key by randomly choosing two large prime

numbers and multiplying them together. RSA is named after its creators, Ronald Rivest,

Adi Shamir, and Leonard Adleman. RSA was released in 1977, but remains popular

today for e-commerce transactions.

Ø SCP (Secure CoPy) A method for copying files securely between hosts. SCP is part of

the OpenSSH package, which comes with modern UNIX and Linux operating systems.

Third-party SCP applications are available for Windows-based computers.

Ø Secure CoPy See SCP.

Ø Secure File Transfer Protocol See SFTP.

Ø Secure Shell See SSH.

Ø Secure Sockets Layer See SSL.

Ø security audit An assessment of an organization’s security vulnerabilities performed by

an accredited network security firm.

Ø security policy A document or plan that identifies an organization’s security goals,

risks, levels of authority, designated security coordinator and team members,

responsibilities for each team member, and responsibilities for each employee. In

addition, it specifies how to address security breaches.

Ø security token A device or piece of software used for authentication that stores or

generates information, such as a series of numbers or letters, known only to its

authorized user.

Ø server_hello In the context of SSL encryption, a message issued from the server to the

client that confirms the information the server received in the client_hello message. It

also agrees to certain terms of encryption based on the options the client supplied.

Depending on the Web server’s preferred encryption method, the server may choose to

issue your browser a public key or a digital certificate at this time.

Ø session key In the context of Kerberos authentication, a key issued to both the client

and the server by the authentication service that uniquely identifies their session.

Ø SFTP (Secure File Transfer Protocol) A protocol available with the proprietary

version of SSH that copies files between hosts securely. Like FTP, SFTP first

establishes a connection with a host and then allows a remote user to browse directories,

list files, and copy files. Unlike FTP, SFTP encrypts data before transmitting it.

Ø single sign-on A form of authentication in which a client signs on once to access

multiple systems or resources.

Ø smurf attack A threat to networked hosts in which the host is flooded with broadcast

ping messages. A smurf attack is a type of denial-of-service attack.

Ø social engineering The act of manipulating personal relationships to circumvent

network security measures and gain access to a system.

Ø SSH (Secure Shell) A connection utility that provides authentication and encryption.

With SSH, you can securely log on to a host, execute commands on that host, and copy

files to or from that host. SSH encrypts data exchanged throughout the session.

Ø SSL (Secure Sockets Layer) A method of encrypting TCP/IP transmissions—

including Web pages and data entered into Web forms—en route between the client and

server using public key encryption technology.

Ø SSL session In the context of SSL encryption, an association between the client and

server that is defined by an agreement on a specific set of encryption techniques. An

SSL session allows the client and server to continue to exchange data securely as long

as the client is still connected to the server. SSL sessions are established by the SSL

handshake protocol.

Ø stateful firewall A firewall capable of monitoring a data stream from end to end.

Ø stateless firewall A firewall capable only of examining packets individually. Stateless

firewalls perform more quickly than stateful firewalls, but are not as sophisticated.

Ø symmetric encryption A method of encryption that requires the same key to encode

the data as is used to decode the ciphertext.

Ø TACACS+ (Terminal Access Controller Access Control System Plus) A Cisco

proprietary protocol for AAA (authentication, authorization, and accounting). Like

RADIUS, TACACS+ may use one of many authentication protocols. Unlike RADIUS,

TACACS+ relies on TCP at the Network layer and allows for separation of the AAA

services.

Ø Temporal Key Integrity Protocol See TKIP.

Ø Terminal Access Controller Access Control System Plus See TACACS+.

Ø TGS (Ticket-Granting Service) In Kerberos terminology, an application that runs on

the KDC that issues Ticket-Granting Tickets to clients so that they need not request a

new ticket for each new service they want to access.

Ø TGT (Ticket-Granting Ticket) In Kerberos terminology, a ticket that enables a user to

be accepted as a validated principal by multiple services.

Ø three-way handshake An authentication process that involves three steps.

Ø ticket In Kerberos terminology, a temporary set of credentials that a client uses to prove

that its identity has been validated by the authentication service.

Ø Ticket-Granting Service See TGS.

Ø Ticket-Granting Ticket See TGT.

Ø TKIP (Temporal Key Integrity Protocol) An encryption key generation and

management scheme used by 802.11i.

Ø TLS (Transport Layer Security) A version of SSL being standardized by the IETF

(Internet Engineering Task Force). With TLS, the IETF aims to create a version of SSLthat encrypts UDP as well as TCP transmissions. TLS, which is supported by new Web

browsers, uses slightly different encryption algorithms than SSL, but otherwise is verysimilar to the most recent version of SSL.

Ø Transport Layer Security See TLS.

Ø Triple DES (3DES) The modern implementation of DES, which weaves a 56-bit key

through data three times, each time using a different key.

Ø two-factor authentication A process in which clients must supply two pieces of

information to verify their identity and gain access to a system.

Ø VPN concentrator A specialized device that authenticates VPN clients and establishes

tunnels for VPN connections.

Ø vulnerability A weakness of a system, process, or architecture that could lead to

compromised information or unauthorized access to a network.

Ø war chalking The use of chalk to draw symbols on a sidewalk or wall within range of

an access point. The symbols, patterned after marks that hobos devised to indicate

hospitable places for food or rest, indicate the access point’s SSID and whether it’s

secured.

Ø war driving The act of driving while running a laptop configured to detect and capture

wireless data transmissions.

Ø WEP (Wired Equivalent Privacy) A key encryption technique for wireless networks

that uses keys both to authenticate network clients and to encrypt data in transit.

Ø WEP cracking A security exploit in which a hacker uses a program to discover a WEP

key.

Ø Wi-Fi Alliance An international, nonprofit organization dedicated to ensuring the

interoperability of 802.11-capable devices.

Ø Wi-Fi Protected Access See WPA.

Ø Wired Equivalent Privacy See WEP.

Ø WPA (Wi-Fi Protected Access) A wireless security method endorsed by the Wi-Fi

Alliance that is considered a subset of the 802.11i standard. In WPA, authentication

follows the same mechanism specified in 802.11i. The main difference between WPA

and 802.11i is that WPA specifies RC4 encryption rather than AES.

Ø WPA2 The name given to the 802.11i security standard by the Wi-Fi Alliance. The

only difference between WPA2 and 802.11i is that WPA2 includes support for the older

WPA security method.

Ø WPA2-Enterprise An authentication scheme for Wi-Fi networks that combines WPA2

with RADIUS.

Ø WPA cracking A security exploit in which a hacker uses a program to discover a WPA

key.

Ø WPA-Enterprise An authentication scheme for Wi-Fi networks that combines WPA

with RADIUS.

Ø zero-day exploit An exploit that takes advantage of a software vulnerability that hasn’t

yet become public, and is known only to the hacker who discovered it. Zero-day

exploits are particularly dangerous, because the vulnerability is exploited before the

software developer has the opportunity to provide a solution for it.

Review s

1.   You work for a retailer that sells household goods online. The company has decided to redesign its network for better security. Included in this redesign is the addition of a new firewall. Assuming the firewall is placed between the Internet connection and the Web server, which of the following should be included in the firewall's configuration so that customers can still reach the Web site?

a.   Allow incoming UDP-based transmissions to port 23.

b.  Allow incoming TCP-based transmissions to port 80.

c.   Allow outgoing TCP-based transmissions to port 88.

d.   Allow outgoing UDP-based transmissions to port 1024.

2.   Which of the following is the most secure password?

a.   12345ABC

b.  dolphins

c.   !tlzOGS557x^^L

d.  A1B2C333

3.   You are alerted that suddenly 100% of the resources on your two core routers are being used and no legitimate traffic can travel into or out of your network. What kind of security attack are you most likely experiencing?

a.  IP spoofing

b.  Brute force attack

c.   Flashing

d.  Denial-of-service attack

4.   What type of device guards against an attack in which a hacker modifies the IP source address in the packets he's issuing so that the transmission appears to belong to your network?

a.  Packet-filtering firewall

b.  Proxy server

c.  NAT gateway

d.  Router

5.   Which of the following devices can improve performance for certain applications, in addition to enhancing network security?

a.                   Packet-filtering firewall

b.                  NAT gateway

c.                   Proxy server

d.                  Router

6.   If a firewall does nothing more than filter packets, at what layer of the OSI model does it operate?

a.       Transport

b.      Network

c.       Data Link

d.      Session

7.   Which of the following encryption methods provides the best security for data traveling over VPN connections?

a.       PPTP

b.      L2TP

c.       IPSec

d.      SLIP

8.   Which of the following criteria could a router's ACL use for denying packets access to a private network?

a.      Source IP address

b.      Authentication header

c.       RTT

d.      Source MAC address

9.   Which of the following NOS logon restrictions is most likely to stop a hacker who is attempting to discover someone's password through a brute force or dictionary attack?

a.       Total time logged on

b.      Time of day

c.        Period of time after which a password expires

d.      Number of unsuccessful logon attempts

10. Which of the following can automatically detect and deny network access to a host whose traffic patterns appear suspicious?

a.      IPS

b.      NAT gateway

c.       Proxy server

d.      Router

11. If you are entering your account number and password in a Web form to check your bank account balance online, which of the following encryption methods are you most likely using?

a.       PGP

b.      SSL

c.       SSH

d.      Kerberos

12. Which of the following encryption techniques is incorporated into IP version 6?

a.       SSH

b.      SSL

c.       Kerberos

d.      IPSec

13. Which of the following is one reason WEP is less secure than 802.11i?

a.       WEP is only capable of 16-bit keys, whereas 802.11i can use keys up to 128 bits long.

b.      WEP uses only one encryption method, whereas 802.11i combines two encryption methods for data in transit.

c.       WEP uses the same key for authentication and encryption every time a client connects, whereas 802.11i assigns keys dynamically to each transmission.

d.      WEP does not require clients to specify an SSID, whereas 802.11i requires clients to specify an SSID plus a user name and password for the network's access server.

14. Using a 20-bit key is how many times more secure than using an 18-bit key?

a.       Two times

b.      Three times

c.       Four times

d.      Eight times

15. How many keys are required for public key encryption?

a.       One

b.      Two

c.       Four

d.      None

16. You are designing an 802.11n wireless network for a local cafe. You want the wireless network to be available to the cafe's customers, but not to anyone with a wireless NIC who happens to be in the vicinity. Which of the following security measures require customers to enter a network key to gain access to your network via the access point?

a.       SSL

b.      IPSec

c.       TLS

d.      WPA2

17. Which of the following requires port-based authentication?

a.      Kerberos

b.      RADIUS

c.       WEP

d.      WPA

18. Which of the following plays a crucial role in the public key infrastructure?

a.       IDS

b.      Certificate authority

c.       VPN concentrator

d.      PGP

 

19. Which of the following techniques would prevent an FTP bounce attack?

a.      Configuring your firewall to deny requests to ports 20 and 21

b.      Performing a port scan of your network using NMAP

c.       Configuring the FTP service to require a password.

d.      Restricting the size of your FTP server’s memory allocation table

20. You have decided to add a honeypot to your network. Where on the network would you place it?

a.       On your company’s Web server

b.      In a decoy DMZ

c.       Between the access server and RADIUS server

d.      Attached to a workgroup switch

Practice Test

1. Packet-filtering firewalls cannot distinguish between a user who is trying to breach the firewall and a user who is authorized to do so.

a.       True

b.      False

2.   ____ is a public key encryption system that can verify the authenticity of an e-mail sender and encrypt e-mail data in transmission.

a.       SSL

b.      PGP

c.       IPSec

d.      SSH

 3. 802.11i is poised to replace the less-secure WEP as the preferred means for protecting wireless transmissions from intruders.

a.       True

b.      False

4. In ____, one port is configured to send a copy of all its traffic to a second port on the switch.

a.       IP spoofing

b.      port forwarding

c.       port mirroring

d.      phishing

5. Many large organizations require authorized employees to wear electronic ____, which can be programmed to allow their owner access to some, but not all, rooms in a building.

access badges

6. To guard against the threat of information being stolen from a decommissioned hard disk, you can run a specialized ____ program to not only delete the hard drive's contents but also make file recovery impossible.

a.       cracker

b.      disk sanitizer

c.       firewall

d.      key

7. Network security is more often compromised "from the inside" than from external sources.

a.       True

b.      False

8. HTTPS uses the TCP port number 80.

a.       True

b.      False

 9. A(n) ____ drives the creation of a security policy.

a.       security coordinator

b.      administrator

c.       IT specialist

d.      security manager

 10. The combination of a public key and a private key is known as a ____.

a.       key pair

b.      principal

c.       RADIUS server

d.      netstat

 11. When configuring WEP, you establish a character string required to associate with the access point, also known as the ____.

a.       proxy server

b.      principal

c.       network key

d.      public key server

 12. In key encryption, the scrambled data block is known as ____.

a.       cleartext

b.      fuzzytext

c.       a key pair

d.      ciphertext

13. A firewall may allow outsiders to obtain internal IP addresses, then use those addresses to pretend that they have authority to access your internal network from the Internet—a process called ____.

IP spoofing

14.  ____ is used with older encryption and authentication protocols to form a new, more secure method of connecting to networks from wireless stations.

a.       EAP

b.      RSA

c.       SCP

d.      RC4

15. More often than not, security is compromised from using the Internet.

a.       True

b.      False

16. In public key encryption, data is encrypted using a single key that only the sender and the receiver know.

a.       True

b.      False

17. Hackers can use programs that try a combination of your user ID and every word in a dictionary to gain access to the network. This is known as a(n) ____.

dictionary attack

 18. In CHAP, the authenticating device takes the first step in authentication after PPP establishes a connection between it and the computer requesting authentication.

a.       True

b.      False

19. A(n) ____ is a router (or a computer installed with software that enables it to act as a router) that examines the header of every packet of data it receives to determine whether that type of packet is authorized to continue to its destination.

packet-filtering firewall

20. Network administrators can test how vulnerable their servers, routers, switches, and other devices are by using a ____, or software that searches the node for open ports.

a.       network key

b.      proxy server

c.       port scanner

d.      principal

21. An IDS can react when alerted to suspicious activity.

a.       True

b.      False

22. WPA uses the AES encryption scheme.

a.       True

b.      False

23. Proxy servers manage security at the Network layer of the OSI model.

a.       True

b.      False

24. Although a security policy defines who has access to the computer room, locking the computer room is necessary to keep unauthorized individuals out.

a.       True

b.      False

25. Many companies mistakenly require employees only to use a password, and don't help them choose a good one. This oversight increases the risk of ____.

a.       war driving

b.      encryption

c.       port mirroring

d.      security breaches

26. A Kerberos client, or user, is known as a(n) ____.

principal

27. A(n) ____ is a password-protected and encrypted file that holds an individual's identification information, including a public key.

digital certificate

28. In ____, a wireless station first issues a request to the access point. The access point functions as a proxy between the remote access server and station until the station has successfully authenticated with a remote access server

802.11i

 29. Do not reuse passwords after they have expired.

    True

    False

Chapter Test

1. In general, information is ____________________ if it could be used by other parties to impair an organization’s functioning, decrease customers’ confidence, cause a financial loss, damage an organization’s status, or give a significant advantage to a competitor.

confidential

 2. A ____ firewall is a router (or a computer installed with software that enables it to act as a router) that examines the header of every packet of data it receives to determine whether that type of packet is authorized to continue to its destination.

a.       selective

b.      packet-filtering

c.       proxy

d.      gateway

3.   ____ is a method of encrypting TCP/IP transmissions above the network layer.

a.       SSL

b.      PAP

c.       PGP

d.      IPSec

4.   ____ is a social engineering practice in which a person attempts to glean access or authentication information by posing as someone who needs that information.

a.       Hacking

b.      Cracking

c.       War driving

d.      Phishing

5.  ____ protocols are the rules that computers follow to accomplish authentication.

a.       Authority

b.      Availability

c.       Access

d.      Authentication

6. RADIUS and TACACS belong to a category of protocols known as AAA (____).

a.       access, authorization, and accounting

b.      authentication, authorization, and authority

c.       authentication, authorization, and access

d.      authentication, authorization, and accounting

7. A(n) ____ is a password-protected and encrypted file that holds an individual’s identification information, including a public key.

a.       authentication file

b.      access control list

c.       digital certificate

d.      authentication certificate

8. The use of certificate authorities to associate public keys with certain users is known as ____.

a.       PGP

b.      PKI

c.       IPSec

d.      SSL

9. A ____ attack occurs when an Internet chat user sends commands to a victim’s machine that causes the screen to fill with garbage characters and requires the victim to terminate their chat sessions.

a.       phishing

b.      denial-of-service

c.       war driving

d.      flashing

10. A(n) ____________________ identifies an organization’s security risks, levels of authority, designated security coordinator and team members, responsibilities for each team member, and responsibilities for each employee.

security policy

11. The combination of a public key and a private key is known as a ____.

a.       key lock

b.      key frame

c.       key pair

d.      key set

12.  ____ software searches a node for open ports.

a.       Port scanner

b.      Authentication

c.       Phishing

d.      Sniffing

13. Encryption is the last means of defense against data theft.

a.       True

b.      False

14.  A ____ attack occurs when a hacker tries numerous possible character combinations to find the key that will decrypt encrypted data.

a.       flashing

b.      dictionary

c.       brute force

d.      denial-of-service

 15. In ____, both computers verify the credentials of the other.

a.       mutual access

b.      mutual verification

c.       mutual authentication

d.      mutual authorization

16. Human errors, ignorance, and omissions cause more than half of all security breaches sustained by networks.

a.       True

b.      False

17.  ____________________ is the use of an algorithm to scramble data into a format that can be read only by reversing the algorithm.

Encryption

18. A ____ main function is to examine packets and determine where to direct them based on their Network layer addressing information.

a.       router’s

b.      proxy server’s

c.       switch’s

d.      gateway’s

19. A(n) ____________________ is a thorough examination of each aspect of the network to determine how it might be compromised.

posture assessment

20. In a ____ attack, a person redirects or captures secure transmissions as they occur.

a.       war driving

b.      man-in-the-middle

c.       phishing

d.      denial-of service

21. A NOS that contains a “backdoor” is an example of a risk associated with ____.

a.       Internet access

b.      protocols and software

c.       people

d.      transmission and hardware

22. A ____ attack occurs when a hacker uses programs that try a combination of a user ID and every word in a dictionary to gain access to the network.

a.       brute force

b.      denial-of-service

c.       flashing

d.      dictionary

23. Network security is more often compromised “from the inside” than from external sources.

a.       True

b.      False

 

 24. A VPN ____ authenticates VPN clients and establishes tunnels for VPN connections.

a.       concentrator

b.      router

c.       service

d.      certificate authority

25. A security policy should state exactly which hardware, software, architecture, or protocols will be used to ensure security.

a.       True

b.      False