Security Topologies

1
Security Topologies

• Widyawan

2
Security Topologies

• Defines the network design and implementation
  from a security perspective
• Unlike network topology, we are more concerned
  with access method, security and technology used
• Cover four main area
• Design Goals
• Security Zone
• Technologies
• Business Requirement

3
Design goal

• Confidentiality prevent unauthorised disclosure
  of information
• Integrity prevent unauthorised modification of
  information
• Availability prevent unauthorised with-holding
  of information or resources
• Accountability make system accountable for
  change and detect and investigate intrusions

4
Security Zones

• Describe design method that isolate systems from
  other systems or network
• Key aspect of creating and designing security
  zones
• Internet
• Intranet
• Extranet
• Private Connection
• VPN
• DMZ

5
Technologies

• VLAN
• Networks are grouped logically instead of
  physically
• NAT
• Allow presenting a single address for all
  computer connection
• Can be achieved by router or NAT server
• Tunneling
• Ability to create a virtual dedicated connection
  between two systems or network

6
Business Requirements

• Business requirements of security environments
• Asset Identification
• Risk assessment/ analysis
• Threat Identification
• Vulnerabilities

7
Asset Identification

• The process in which a company attempts to place
  a value on the information and systems in place
• In some cases, it may be as simple as counting
  systems and software license
• The more difficult is to assign value on
  information
• You would not assign the same value for the
  recipe of coca cola with your mothers recipe

8
Risk Assessment

• From highly scientific formula-based methods to
  conversation wit the owner
• An attempt to identify the costs of replacing
  stolen data or systems, cost of downtime and
  virtually any other factor
• Then evaluate the like hood that certain types
  and outcome will occur
• Have any single person is planned for September
  11 attack

9
Threat Identification

• Implementing a security policy requires that we
  evaluate the risk of both internal and external
  threats
• Internal threats
• Theft
• Financial abuse and embezzlements
• Sabotage
• Espionage
• External threats
• Natural disaster
• Burglar
• Attacker

10
Vulnerabilities

• Operating System Vulnerabilities
• TCP/IP vulnerabilities
• Primarily experimental and used by schools and
  governmental agencies for research
• Very robust in error handling
• It is by its nature unsecured
• Many modern attack occur through TCP/IP