Ensuring Network Security

1
Ensuring Network Security

• Physical Security
• Ciphering
• Authentication
• Integrity
• Firewalls
• Data Security
• Passwords
• Auditing
• Sniffing
• Viruses

2
Physical Security

• Access to hardware
• Locked Doors
• Locked Cabinets
• Access to the system console
• Screen Passwords
• Locked keyboards (removing keyboard)
• Access to network wiring/switches/routers

3
Physical Environment

• Power source
• Noise sources
• Air conditioning (temperature control)
• Dust and smoke
• Water problems (flood possible?)

4
Network Security

• Confidentiality
• Authentication
• Message integrity and nonrepudiation
  (modification, deletion, or insertion)
• Availability and access control

5
Cryptography/Ciphers

• Simple cipher
• ABCDEFGHIJKLMNOPQRSTUVWXYZ
• MNOPQRSTUVWXYZABCDEFGHIJKL
• Secret Message crypted EQODQF YQEEMSQ
• Better cipher
• ABCDEFGHIJKLMNOPQRSTUVWXYZ
• FGHIJKLMNOPQRSTUVWXYZABCDE C1(k5)
• TUVWXYZABCDEFGHIJKLMNOPQRS C2(K19)
• Crypt Codes C1,C2,C1,C2,etc.
• Secret Message XXHKJM RXXLFZJ

6
Decrypting

• Simplest
• Use the frequency of characters
• E 12.88 N 6.94 R 5.97 C 2.75 G 1.87
• V 0.99 Q 0.11 T 9.31 I 6.92 D 4.07
• M 2.56 P 1.85 K 0.61 Z 0.06 A 8.03
• S 6.36 L 4.00 F 2.53 Y 1.73 X 0.22 
• O 7.62 H 6.00U 2.83 W 2.06 B 1.60
• J 0.13 
• Find the most commonly used character and insert
  it into the sentence.

7
Downsides

• The encryption systems are too simple (easy to
  crack)
• The keys must be distributed to the users
• Ciphers dont change with time (same each day
  until news keys are distributed)
• Faster computing provides faster cracking
  algorithms.

8
Encryption

• DES (Digital Encryption Standard)
• AES (Advanced Encryption Standard)
• Secure Shells
• Secure Web Pages
• Pretty Good Privacy
• Private Keys
• Publics
• Signatures

9
DES/AES

• Data Encryption Standard
• Advanced Encryption Standard

10
How safe is encryption?

• 4 character password (alphabetic characters only)
  cracking time (maybe a minute on a 450mhz
  computer)
• 40 bit key (can be cracked in 24hours on a
  parallel computing system)
• 128 bit key (probably not able to be cracked in a
  millennium)

11
Pretty Good Privacy

• Encryption of keys
• 40 bit
• 128 bit
• Creating your authenticated signature
• Your key ring
• Submitting your public key to a database
• Email and PGP

12
PGP System
International Database
PGP Encryption
Public keys
Private key
Data
User 1
PGP Decryption
Key Ring
Key Ring
Message can be entirely encrypted or Just the
signature can be encrypted.
User 2
13
Authentication

• Simple I am Alice, Bob believes the message
• It is very easy to lie!
• Next Alice is on a known IP address, Bob
  believes Alice because the message header
  contains the address.
• Address SPOOFING
• Better Alice gives Bob her password
• Hacker records the conversation and plays it back
  (playback attack)
• Best Public Key/Private Key
• Man in the middle attack

14
Man in the middle Attack
15
Integrity

• Digital Signatures

16
Key Distribution and Certification

• Trusted intermediary
• Key Distribution Center (KDC)
• Repository of public keys
• Certification Authority (CA)
• Certificate creation and authentication

17
Firewalls

• Purpose
• Disadvantages
• Slowdown of packets
• Inconvenient for users
• Advantages
• Slows down hacking attempts
• Limits incoming traffic
• Overcomes IP number limitations (NAT)

18
Firewalls (cont.)

• Setup
• IPTABLES
• ZoneAlarm
• Addressing
• Name Service
• Proxies
• E-mail
• Web
• FTP

19
Types of attacks

• Packet Sniffing
• Spoofing
• Stealing and copying IP addresses
• Denial of Service (DOS)
• Syn flooding
• Distributed Denial of Services (DDOS)
• Numerous hosts operating concurrently
• Hijacking

20
Sniffers

• Sniffer, Snoop, Tcpdump, Ethereal
• Promiscuous mode
• Many protocols
• Interpretation

21
Data Security

• Share Level Security vs. User Level Security
• Proper passwords
• Length
• Uncommon names
• Use of non alphanumeric characters
• Controlled access (Screen/Keyboard Locks)
• Use of a Routed vs. Flat network architecture
• Audit use of the system

22
Security Planning

• Unauthorized access
• Electronic Tampering
• Theft
• Intentional damage
• Unintentional damage

23
Auditing

• Check for System Logs for
• Logon attempts
• Connection to resources
• Connection termination
• Directory creation, modification, or deletion
• Server events and modifications
• Password changes

24
Microsoft Gotchas

• Microsoft operating systems have a tendency to
  store passwords on the local hard disk in the
  Windows registry to save time when logging in to
  remote services. This can be quite dangerous!

25
Flat Network
Hub
User 1129.123.7.56
User 3129.123.6.123
Internet
Monitor sees some traffic from all 3 users
User 2129.123.3.88
26
Routed Network
User 2Subnet 3
User 1Subnet 7
User 3Subnet 6
Router
Internet
Monitor cant see traffic other than its own
subnet
Monitor on Subnet 1
27
Login Security

• Usernames/Passwords may be in plain text over the
  network
• Email security
• Netscape/Eudora leave configuration files on each
  PC.
• Webmail is an IMAP interface to a mail server
• can use SSL for security

28
Secure Shell (SSH)

• Use of encryption based on keys/certificates
• Block undesired hosts from accessing
• All data on the wire is encrypted
• Can be used for interactive communication and
  copying files

29
Secure Web Sites

• SSL/TLS
• Secure Sockets Layer, Transport Layer Security
• Keys/Cookies
• New key/encryption code for each access
• Encryption of data over the wire
• Keep track of trusted hosts that access the site.

30
SSL Handshake
31
IPsec

• This is Network Layer confidentiality
• Authentication Header (AH)
• Encapsulation Security Protocol (ESP)
• Security Parameter Index (SPI)
• Security association (SA)
• Internet Key Exchange (IKE)

32
IPsec Headers
ESP Headers
33
Viruses/Trojans/Macros

• Viruses spread by
• Removable media
• downloaded files
• Email
• Viruses are removed by
• Deleting the affected file
• Running a virus scanning/cleaning program

34
Companion Viruses

• Looks like a real program (WORD.EXE)
• Make replace a logon program and grab
  usernames/passwords
• Usually renames the actual executable and calls
  that executable from the bogus program.

35
Macro Viruses

• The virus infects the Macro definitions of a
  program (like Microsoft Word) and then infects
  every document created by the original program.
• These viruses are difficult to detect because
  they havent infected an executable program.

36
Polymorphic Viruses

• These change appearance every time they
  replicate. They may even change each time the
  computer is rebooted.
• Since they change frequently, virus checkers have
  a hard time determining a pattern or fingerprint
  of the virus.

37
Stealth Virus

• These hide from detection
• They may use hidden files or may modify the
  operating system so a standard directory scan
  doesnt show the virus file.
• They also return false information to virus
  checkers.

38
Trojans

• Trojan Horses
• Look like a benign game or program
• After a period of time they execute the virus
• Some may be cleaned with virus protection
  software.
• Some masquerade as Windows programs and removal
  will crash the system

39
Back Doors

• Provide access to system through published,
  unused, or unpublished ports.
• Sometimes are put there by programmers,
  engineers, or hackers
• They are hard to protect against unless you can
  find their access port and firewall protect
  against it.

40
Virus Consequences

• Cant boot
• Data is scrambled or unreadable
• Erratic or slow operation of the computer
• Computer is used as a distribution agent
• Excessive disk activity
• Disk drive is erased or data is lost.
• Disk is reformatted

41
Virus Protection

• Test each disk write for a particular pattern
  unique to the virus
• Test for writes to the disk boot block
• Test for code that might access PC hardware
• Scan files for virus patterns

42
D.O.S. Attacks

• Denial of Service
• Flood of useless packets/data
• Hard/Impossible? To track
• Can a firewall protect the network?

43
D.D.O.S. Attacks

• Distributed Denial of Service
• Many servers running in parallel
• Hard/Impossible? To track
• Good example of distributed computing
• How do we stop it?

44
Email Virus

• Use innocent email messages as the transport.
• Grab address book entries to spread
• Infect critical windows programs
• The user doesnt know he is infecting others
• Can be prevented by using email front end
  scanners and filtering outgoing mail.

45
Backups

• What kind of backup system should we use?
• Even a fault tolerant disk system can fail!
• Always back up
• Rotate several copies of backups in case one tape
  is unreadable
• Check the backups to see if they are readable
• Store the tapes or removable media in a safe
  place

46
Backup Strategy

• Full Backup
• Incremental Backup
• Copy
• Daily Copy
• Logging
• Date, tape-set number, type, which computer

47
Disaster Recovery

• Prevention
• What can I control?
• What is the best method?
• Keep updating your prevention methods
• Keep up on maintenance
• Training!

48
Disaster Preparation

• Plan ahead
• Use fault tolerance equipment
• Maintain backups
• Test your preparation plan!

49
Network Security
Remember Homework 4 on the Web page!