+ All Categories
Home > Documents > CISSP – Chapter 7

CISSP – Chapter 7

Date post: 13-Jan-2016
Category:
Upload: bryony
View: 52 times
Download: 5 times
Share this document with a friend
Description:
CISSP – Chapter 7. Telecommunications and Network Security. Chapter 7. - PowerPoint PPT Presentation
Popular Tags:
21
Loi de Boyle Mariotte Loi de Boyle Mariotte Application à l’appareil Application à l’appareil respiratoire respiratoire 1 1 . . Poumon Poumon organe clos organe clos 2 2 . . Homme Homme = = Homéotherme ( Homéotherme ( constante) constante) 3. 3. Toute Toute Volume du poumon entraîne une Volume du poumon entraîne une de la de la Pression dans les Voies Pression dans les Voies Aériennes Aériennes 4. 4. Toute Toute Volume du poumon entraîne une Volume du poumon entraîne une de la de la Pression dans les Voies Pression dans les Voies Aériennes Aériennes
Transcript

CISSP – Chapter 7

Telecommunications and Network Security

Chapter 7

• This chapter is HUGE and honestly you are not going to understand all of it unless you’ve done a lot of network or network security in your life. Don’t get too stressed, try to follow along I will try to point out the most important things to understand. If you have questions ASK ME, luckily this is my area of expertise so I should be able to help you out. Some questions may have to be directed to after class or in between breaks if they go to in depth.

Chapter 7 – OSI/Internet Model 483

• There is something called the “OSI” model that lays out functional levels/different distinct services that a network should provide. It’s not actually used in real life but serves as a reference. The “Internet (TCP/IP)” model is used and maps directly to the OSI model, but is simpler.

• The layered model defines that functionality a certain layer should provide and provides “Services” to the layer directly above it that that layer can use. Each layer generally uses the resources and functionality of the layer below it.

OSI model 484

• 7 layers• A P S T N D P… “All People Seem to Need Data

Processing”… say that 10 times– Application– Presentation– Session– Transport– Network– Data link– Physical

OSI model – layer 1 physical 494

• Layer 1 Physical – simply put is concerned with physically sending electric signals over a medium. Is concerned with – specific cabling, – voltages and – Timings

• This level actually sends data as electrical signals that other equipment using the same “physical” medium understand – ex. Ethernet

OSI model – layer 2 data link 492

• Layer 2 Data Link – data link goes hand in hand with physical layer. The data link level actually defines the format of how data “Frames”* will be sent over the physical medium, so that two network cards of the same network type will actually be able to communicate. These frames are sent to the “physical” level to actually be turned into the electronic signals that are sent over a specific network. (layer 2 uses the services of layer 1)

• Two network cards on the same LAN communicate at the data link layer.

• Data Link and Physical layers really go together to define how a specific network type operates, in fact Layer 1 & 2 of the OSI model = layer 1 of the “TCP/IP model” (Network Access)

(more)

OSI model – layer 2 - 492

• Protocols that use the data link layer– ARP– RARP– PPP– SLIP– Any LAN format (Ethernet)

OSI model – layer 3 network - 491

• Layer 3 Network – For the Internet this is “IP” which defines how “packets” are sent across different physical networks/LANs. Layer 2 is concerned with defining unique hosts on a network, and routing packets between distinct networks.– Layer 3 protocols

• IP• IPX/SPX• Apple Talk

(more)

OSI model layer 3 network - 491

• For IP other protocols that “work” on this layer are– ICMP – IP “helpers” (like ping)– IGMP – Internet Group Message Protocol

– RIP – routing protocol– OSPF – routing protocol– BGP – routing protocol

(more)

OSI Model Layer 3 - 491

• OSI layer 3 Network = Internet model layer 2 (Network)

• Layer 3 actually uses to services of the data link layer to move data between two computers on the same LAN.

OSI model Layer 4 Transport - 490

• OSI Layer 4 Transport – Provides “end-to-end” data transport services and establishes a logical connection between 2 computers systems”

• Virtual connection between “COMPUTERS”• Protocols used at layer 4

– TCP– UDP

• In the Internet Model this is layer 3 (transport/host to host)

• Layer 4 user the services of layer 3 to move data between 2 different networks/hosts

OSI Model Layer 5 Session - 489

• OSI Layer 5 Session – responsible for establishing a connection between two APPLICATIONS! (either on the same computer or two different computers)

• Create connection• Transfer data• Release connection• Protocols that work at this layer

– NFS– SQL– RPC

• Remember Session is setting up a conversation between two applications rather than comptuers, however the session layer uses the services of the layer beneth it (transport) to move data between 2 computers

• OSI lay 5 = Internet model layer 3 (transport/host to host)

OSI model Layer 6 – Presentation - 487

• OSI Layer 6 – present the data in a format that all computers can understand– Concerned with encryption, compression and

formatting

• Maps to layer 4 of the Internet Model

OSI model Layer 7 – Application - 487

• This defines a protocol (way of sending data) that two different programs or protocols understand. – HTTP– SMTP– DNS

• This is the layer that most software uses to talk with other software.

• This maps to the Internet model Layer 4 (application)

Quick OSI review

• What layer is creates a connection between 2 applications?

• What layer turns the frames sent to it into the proper voltages and timings to send across a wire?

• What layer is concerned with finding paths between different networks?

• What layer is concerned with the formatting of the data?• What layer is concerned with communicating between

two of the? same interface types on computers on the same LAN?

• What layer creates a connection between two computers?

• What layer is concerned with the data/protocol that the application you are using uses?

Some network equipment and what layers they generally work on

We will talk about these later on.

• Hub/repeater – physical

• Switch – data link

• Router – network

• firewall – can be one of many levels above network

• Application proxy firewall – application

TCP/IP model

• Network Access = OSI layers 1 & 2, defines LAN communication, what do I mean by that?

• Network = OSI layer 3 – defines addressing and routing

• Transport/Host to Host = OSI layer 4, 5 – defines a communication session between two applications on one or two hosts

• Application = OSI layers 6,7 the application data that is being sent across a network

OSI vs. TCP/IP model

TCP/IP (497)• TCP/IP is a suite of protocols that define IP

communications.• IP is a network layer protocol, and handles

addressing and routing• We use IP version 4• The main components of an IP address

– IP address– Netmask– What is the netmask used for?

– Host part, network part, like street address and zip code.

(more)

TCP/IP class networks - 504

• Class A – IP ranges 0.0.0.0 – 127.255.255.255– Implied Netmask 255.255.255.0– Lots of hosts (about 16 million)

• Class B– IP ranges 128.0.0.0 to 192.255.255.255– Implied netmask 255.255.0.0– About 65,000 hosts

(more)

TCP/IP class networks - 504

• Class C– IP ranges 192.0.0.0 to 223.255.255.255– Implied netmask 255.255.255.0– 254 hosts

• Class D– IP ranges 224.0.0.0 to 239.255.255.255– Reserved for multicast, not normal IP addresses

• Class E– IP ranges 240.0.0.0 to 255.255.255.255– Reserved for research

TCP/IP Classless networks

• Classes are not really used anymore, we now use CIDR, which is just an IP address and a netmask or /– Ex. 172.16.1.0/24 = 172.16.1.0 with a

netmask of 255.255.255.0

TCP/IP - 504

• We currently use IPv4 with has 2^32 addresses (about 4 billion IP addresses) however we are running out. IPv6 has 2^128 addresses (4 billion x 4 billion… (NOT 16 billion))

• IPv6 also has a simplified format and additional features such as IPSEC. (talk about IP SEC later)

TCP/UDP - 498

• TCP/UDP handle the transport and session layers. They setup a communications channel between two programs talking over the network

• Programs talk via “ports” which are numbers that generally define what program/services you want to talk to (talk about this in a couple slides)

More on TCP/UDP in the next slides

TCP - 502

• Reliable connection-oriented protocol– Has a true connection– Starts with a 3-way handshake, (SYN, SYN-

ACK, ACK) talk about this

TCP - 499

– Keeps state, and will guarantee delivery of data to other side (or inform the application of the inability to send) does this with sequence and acknowledgement numbers, these numbers also provide ordering to packets

– Has some security due to the state of the connection

– Nice to program with, but slower/more overhead because of the work done to guarantee delivery.

UDP - 499

• Like a postcard, each packet is separate• No guarantee on delivery• Best effort• Fast, little overhead• No sequence numbers (ordering)• No acknowledgements• No connection• Security issues due to lack of a connection

Ports - 501

• Both TCP and UDP use “ports” as the end points of conversations. Ports for services that are defined and static are called “well known ports” some well know ports are– telnet TCP/23– Email (SMTP) TCP/25– Email (POP) TCP/110– Email (IMAP) TCP/143– Web (HTTP) TCP/80– Web (HTTPS) TCP/443– DNS TCP & UDP 53– FTP TCP/21 & 20

Random Networking Terms - 507

• Latency• Bandwidth• Synchronous – synchronized via a time source• Asynchronous – not timed• Baseband – use the entire medium for

communication• Broadband – slide the medium into multiple

channels for multiple simultaneous communications

Random Networking Terms

• Unicast (524)

• Multicast (524)

• Broadcast (524)

Network Topologies (509)

• Ring

• Bus

• Star

• Mesh

• Talk about each of these

• Perhaps memorize chart at bottom of 511

Ethernet - 513

• Most common form of LAN networking, has the following characteristics– Shares media (only one person talks at a time

(at least without a switch)– Broadcast and collision domains– CSMA/CD– Supports full duplex with a switch– Defined by IEEE 802.3

Ethernet media types - 514

• 10Base2 – Thin net, coaxial cable (like TV cable, but

different electrically)– Max length about 200 meters– 10 Mbs second– Requires a BNC connector– BUS/Shared medium (security problems?)– obsolete

(more)

Ethernet Media Types - 514

• 10base5– Thick net, thicker coax– Max length about 500 meters– 10Mbs– Uses vampire taps– More resistant to electrical interference– BUS/shared medium– Used to be used as backbone– Obsolete

(more)

Ethernet Media Types - 514

• 10BaseT– Length about 100 Meters– 10Mbs second– Twisted pair (like phone wire) (CAT 3)– Use RJ-45 connector– Use in star topology– Susceptible to interference– Mostly obsolete

(more)

Ethernet Media Types - 514

• 100BaseTX – Length about 100 Meters– 100Mbs– Twisted pair (like phone wire) (CAT 5, 6)– Use RJ-45 connector– Use in star topology– Susceptible to interference

(more)

Ethernet Media Types - 514

• 1000BaseT – Length about 100 Meters– 1000+Mbs– Twisted pair (like phone wire) (CAT 5e,6)– Use RJ-45 connector– Use in star topology– Susceptible to interference

Token Ring (516)

• Briefly describe token ring– Ring topology, though using a HUB– HUB = Multistation access Unit (MUA)– Token passing for control of network– Beaconing for failure detection

• Pretty much not used except legacy networks

FDDI - 517

• Similar to token ring but uses fiber.

• High Speed

• Used to be used as backbone networks

• 2 rings to create a “wrap” if one goes down

Cabling - 519

• Coaxial – copper core surrounded by a shielding layer and a grounding wire.– More resistant to EMI than UTP– Note used much anymore– Can be baseband (one channel Ethernet) or

broadband (multiple channels, cable TV)

Twisted Pair - 520

• Like phone wire, but more wires.• RJ-45 connector• Two main “types” UTP, and STP• STP is shielded and better if you have EMI

issues• UTP is unshielded and susceptible to EMI and

crosstalk• UTP also gives off signals which could be picked

up if you have sufficient technology. (tempest stuff)

• “least secure vs. coax and fiber”• Chart on 521 (for your own study)

Fiber - 522

• Glass tubes• High speed, long haul• NOT effected by EMI, doesn’t “lose” signal

either (attenuation)• Does NOT radiate energy, better security• Expensive • Difficult to work with• Used in backbones

Media Access Technologies (526)

• Token Passing• CSMA/CD – waits for clear, then starts talking,

detect collisions• CSMA/CA – signals intent to talk

Collision Domain – where collisions can occur. (i.e. two people try to talk at the same time) (how do we make the collision domain smaller?)

What is a security impact of collision domains? sniffing, DoS

LAN Protocols - 529

• ARP – Network Adapters have 2 addresses, and IP address, and a MAC address. (what is each used for? How do they relate? which “layer” does each exist on?)– ARP is the glue for relating the IP and the

MAC addresses

• Attacks– ARP table poisoning – what is this how does it

happen, what would it do?

DHCP - 530

• DHCP – what is it what is it used for?– Precursors

• RARP – what did it do?• BOOTP – what did it do?

ICMP - 531

• ICMP – “IP helper”– Echo request/reply– Destination unreachable– Source quench– Redirect– Trace route

• Security problems? Anyone?• LOKI – sending data in ICMP messages.

(stealthy!)

Basic Networking Devices (536)

• There are different types of networking devices that exist we will look at

• Repeaters

• Hubs

• Bridges

• Switches

• Routers

Repeaters - 536

• Layer 1 device

• No intelligence

• Simply repeats and electrical signal from an input to an output.

• Used to increase range (ex. Put a repeater 200 meters down a 10Base2 run to double the length)

Hub

• Multiport repeater

• The initial way to connect computer together in a STAR configuration, using twisted pair wiring

• Layer 1 device

• No intelligence

• Just repeats a signal down ALL the wires

Bridge (537)

• Layer 2 device, splits a LAN into 2 segments.• A bridge builds a table of the layer 2 (MAC) addresses

on each side of the bridge and only forwards communication if communication is between MAC addresses on each side of the bridge

• Reduces collision domain by ½• Does not affect broadcast domain (doesn’t affect

broadcast storms)• Recreates the signal• Can combine two network types into one LAN (i.e.

translate between LAN types)• Uses “Spanning Tree algorithm” to detect loops.

Switch - 541

• Multi-port bridge (all the bridge attributes hold true)

• Modern form of connecting computer together on a LAN

• Allows full duplex communication (what do I mean by this?)

• Each link is a separate collision domain• Does not alter broadcast domains• Can be used to create VLANS (talk about in a

few slides)

VLANs - 544

• Virtual Lan • What is it• Why would it be used?• Do you still have to route between VLANS?*• Two different VLAN protocols• 802.1Q*, or Cisco ISL* for trunking between

switches• see picture on next slide

VLAN - 544

Routers - 539• Work on layer 3 – Network layer• Uses IP addresses to best route between

networks, is NOT used to create a LAN. You must use hubs or switches to create a LAN, routers go between LANS/networks to allows communications between different LANS/networks.

• Routers do NOT care about layer 2 (MAC addresses)

• When would you use a router, when would you use a switch?

• Routers can perform firewall functionality.• Does not forward on broadcasts!*

Routers vs. Switches - 540

• You should understand the different between a router and a switch. Also memorize the table at the bottom of 540.

Now we need to talk about some routing protocols

Routing Protocols (532)

• Routing is the dynamic updating and sharing of routes to networks with other routers in your company and thought the internet. You can setup routes either– Statically– Dynamically

(discuss pros/cons of each, not too in-depth)

Routing Protocols (532)

• Some Dynamic routing protocols use the concept of an “AS” Autonomous System, which groups a bunch of networks together for an organization, and only advertise the networks that can be reached in the AS, not the details of the individual networks inside. These are generally called “Exterior Routing Protocols” and are used to connect different organizations together

• Other routing protocols try to advertise and track each individual network separately. These are generally called “Interior Routing Protocols” and are for use within an organization

• A company can run IGP and EGPs at the same time, how?

Dynamic Routing Protocols (533)

• Distance vector– Builds a TABLE of all routes and a “distance”

to get to them along with the next hop router– Susceptible to route-flapping– Long “convergence” times– Examples

• RIP• IGRP

Dynamic routing protocols (533)

• Link State– Actually builds a graph/map of all networks and the

ways to reach them. So the router can “see the entire topography”

– Has quick convergence times– Can take link speeds and other factors into

consideration– Slow to build initially– Requires a lot of resources– Examples

• OSPF

Specific Routing Protocols (534+)

RIP • DV algorithm used only in small networks, sends

entire route table every 30 seconds*.• Max number of hops to a networks = 16*• Slow convergence• Only cares about hops, not network speed or

reliability etc.• Original RIP could only use “Classful routing”, v2

allows classless (CIDR) routing*

Specific Routing Protocols (534)

• IGRP – DV protocol designed to solve problems with RIP.

• Examines bandwidth and delay

• Converges faster than RIP

• No max hop limit

• New version is EIGRP (enhanced IGRP)

OSPF (534)

• Open Shortest Path First – Link State protocol developed as a replacement for RIP.

• Supports Autonomous systems• Builds a graph rather than a table• Fast convergence• Slow to start• Requires high resources to build and maintain

map. • Only sends link changes to other routers.

BGP (535)

• BGP is an exterior routing protocol

• Uses AS

• Used by ISPs and large companies as their Internet Routing protocol. (to connect to the internet)

Advanced Networking Devices

• These are devices that are beyond the “basic” fundamental networking devices, they generally provide some specific advanced functionality.

• Let the slides begin!

Gateway - 545

• Generic Term for something that connects two separate things together (can be any level).

• Default gateway = router to get you off your network

• Application gateways – work at the application level and help translate between two different applications. (Ex. Windows and Unix file sharing)

• Email Gateway – translate between different email types. (Exchange and SMTP)

PBX 547

• Private Branch Exchange – phone system– Old systems “analog”– New systems digital and VoIP

• Crackers that hack phone systems used to be call “phreakers”– Free calls (long distance)– Masquerade as other people/hide calls– Often this goes un-noticed as companies

often do not audit their phone bills closely

Firewalls - 548• Enforce network policy.• Generally firewalls are put on the perimeter of a network

and allow or deny traffic based on company or network policy.

• MUST have IP forwarding turned off*• Firewalls are often used to create a DMZ. • Generally are dual/multi homed* (What do I mean by

this?)• 5 types of firewalls (more in depth about each next

slides)– Packet filtering– Statefull– Proxy– Dynamic packet filtering– Kernel Proxy

Packet filter

• Uses Access control lists (ACLs), which are rules that a firewall applies to each packet it receives.

• Not statefull, just looks at the network and transport layer packets (IP addresses, ports, and “flags”)– Do not look into the application, cannot block

viri etc.– Generally do not support anything advanced

or custom

Statefull firewall• Like packet filtering, however the router keeps

track of a connection. It knows which “conversations” are active, who is involved etc.

• It allows return traffic to come back where a packet filter would have to have a specific rule to define returned traffic

• Keeps a state table which lists the state of the conversations.

• More complex, and can launch DoS against by trying to fill up all the entries in the state tables/use up memory.

• If rebooted can disrupt conversation that had been occurring.

Dynamic packet filtering

• Like a statefull firewall but more advanced. Can actually rewrite rules dynamically.

• Some protocols such as FTP have complex communications that require multiple ports and protocols for a specific application, packet and statefull filter cannot handle these easily, however dynamic packet filter can as they can create rules on the fly as needed.

Proxy firewall – 552

• Works as a middleman• Works only with the applications it understands. • Inspects the data that is being past to look for

dangerous data (like viri) or incorrect usage of a protocol.

• Also rewrites the address so the external hosts only see the proxy. (stops direct access between two computers, hides the internal network structure) why is this good?

(more)

Proxy firewall - 552

+ looks at data at all levels, (though usually concentrates on applications layer)

+ can provide very specific security tailored to specific protocols and vulnerabilities

+ hides internal network- Slow- Can be a bottleneck- Breaks the traditional client/server application

model which can cause issues on some applications. Can make troubleshooting harder

(more)

Proxy firewalls - 552

• Two types of proxies– Circuit level– Application

• Talk about each of these on next slides

Application level proxies - 552

• Proxies only specific applications (ex. HTTP, SMTP)

+ these can strongly protect and be aware of specific vulnerabilities and protocol violations, or dangerous data

+ can have logging or authentication features

- Only work with the protocols that they specifically understand

Circuit Level proxies - 554

• Works at a lower level (transport/session level) to generically be a middle man between two computer.

+ generally works with all network protocols, as it doesn’t understand the actual applications involved

- Cannot protect against, violations in the protocol or bad data being passed around, main purpose is to hide internal network and stop direct communications between external machines and internal machines.- Example SOCKS, NAT, PNAT

NAT (577)

• Network address translation – a type of generic network proxy– Hides internal networks by rewriting internal

addresses– Allows you to use “private” network addresses and

still have internet connectivity– Protects internal machines from being accessed.– Requires a pool of IP addresses to use. (mapping is

1-to-1)

(example next page)

NAT (577)

NAT (577)Example: 10.0.0.1 want to talk to 175.56.28.03

– SRC = 10.0.0.1– Dest = 175.56.28.03

Router at 215.37.32.203 intercepts request and changes SRC to be 175.56.28.03– SRC = 215.37.32.203– DEST= 175.56.28.03

Destination send response– SRC=175.56.28.03– DEST = 215.37.32.203

Router accepts packet rewrites– SRC = 175.56.28.03– DEST = 10.0.0.1

Send packet to original requestor (10.0.0.1)

NAT (577)

• See handout for normal IP traffic and NAT traffic

PNAT (577)

• Similar to NAT but only requires a single IP address, rather than map IPs one to one, we actually remap port numbers.

• Much more commonly used that NAT, a bit more secure, as only established connections can respond back to the sender, whereas in normal NAT once a machine is using a temporary IP, the outside world can establish connections back to the originating computer.

Example next 2 slides

PNAT (577)

PNAT (577)1. Client computer creates packet

SRC: 10.0.0.1:TCP:10000 DEST: 130.85.1.3:TCP:80

2. Router rewrites the SRC portion to be SRC: 208.254.31.1:1026 Makes an entry in the PNAT table

3. End server accepts packet4. End server creates return packet

SRC: 130.85.1.3:TCP:80 DEST: 208.254.31.1:1026

5. Router receives packet, rewrites destination to be– DEST: 10.0.0.1:TCP:10000

6. Client receives the return packet

Basic Firewall best practices (563)

• Block ICMP redirects• Keep ACLS simple• Implicit deny * what is this?• Disallow source routed packets* explain• Only keep open necessary ports/services• Block directed IP broadcasts• Block packets where the addresses seem

spoofed (how can you tell?)• Enable logging• Drop fragments, or re-assemble fragments…

Anyone know why?

Firewall issues

• Potential bottleneck

• Can restrict valid access

• Often mis-configured (not the firewalls fault)

• Except for certain types (application proxies) generally don’t filter out malevolent data (viri etc)

• Don’t protect against inside attacks!*

Firewall architecture - 560

• Now that we understand firewalls, how do we lay them out

DMZ

DMZ - 560

• A zone between the Internet and your companies internal network where you put your Internet accessible servers. A DMZ usually has – A of firewall between it and the Internet that

blocks access except to “Internet accessible services”.

– A firewall between it and the internal company network, usually a much more “locked down” firewall that doesn’t allow any access into the company

Bastion Host (560)

• Bastion Host – a server that is highly locked down (hardened). Usually put in a DMZ. These machines can be directly accessed by the internet (though usually though one layer of firewall) so they are “hardened” (what do I mean by that?)

Dual Homed Firewall

• Pretty much any firewall, dual homed means there are two network interfaces, one on the “Internet” one on the “Internal network”

• Multi-homed just means 2 or more interfaces. Multi-homed firewalls may be used to setup a DMZ with a single firewall. (see next slide)

• On any dual/multi-homed machine, “IP forwarding” should be disabled.*

Multi-homed firewall

Screened Subnet - 561

• A type of DMZ, where there is a “middle” network where internet services reside before the “Internal” network (see next slide). In a screen subnet, there is usually a router performing packet filtering before the “first firewall”

Screen Subnet

Multiple interface firewalls - 560

• You may have a firewall that protects internal networks from each other!

End of firewalls

Other Technological security concepts (566)

• Honey pot – a machine left open for attackers to try to hack.. Why?

• Honey net – same concept, but an entire network, again why?

• What is the difference between entrapment and enticement?*

NOS (568)

• NOS is just a term you should understand, a Network Operating System. All modern OSes are NOS. This just means they manage more than just the local computer, they usually provide or use network services in a client server architecture. Some features a NOS provides are on the following slide

NOS (568)

• NOS features– Directory services– Remote access– Clustering (sometimes)– Authentication, authorization, Access Control,

Auditing– File and printer sharing– User management– “redirector services” *what is this?

DNS - 569

• Network software uses IP addresses, however these are difficult for users to remember (especially in IPv6). So DNS is used to help map “names” that we use such as www.paladingrp.com to addresses that computers use like 63.251.179.13

(more)

DNS - 569• DNS uses a hierarchical model. Starting with the “.” then

the top level domains “com, edu, org” etc. “Sub domains” are broken out into zones, and organizations can be assigned authority for their own zones and run their own DNS servers to provide DNS lookups for their own zone.

• A name server that is “authoritative for a zone” is called an “authoritative name server” for example. Paladingrp.com runs is authoritative for it’s own DNS and has it’s own group of name servers that provide DNS “resolution” to the rest of the Internet for names ending in paladingrp.com

• Name server can be “primary” or “secondary” and perform “Zone transfers” to each other

See next slide for example DNS hierarchy

DNS (also example on 571)

DNS

• Common top level domains are– .COM– .EDU– .MIL– .GOV– .ORG– .NET

• You should be aware of these above

DNS cache poisoning - 572

• Besides authoritative name servers organizations also have “Caching” name servers that simply do DNS resolution on behalf of clients.

• One common attack is DNS cache poisoning* – describe how that works and the purpose of it.

DNS SEC

• DNS sec tries to ensure integrity of DNS queries by signing them.* This will defeat cache poisoning.

• authoritative DNS servers should NOT also provide the “caching service”.

NIS - 573

• Network information System (NIS) – originally called “YP” Yellow Pages. Provides shared network information (ex user accounts, hosts entries) for many computers in a “domain” (NOT DNS domain or Windows domain) using “RPC”– ypserv– ypbind

• Files are sent clear text! Bad. Why?

NIS+ (574)

• Improved upon NIS performance (hierarchal rather than flat namespace)

• Incremental updates

• Improved upon NIS security concerns. (secure RPC), provides authentication, authorization and encryption)

Intranet, Extranet - 579

• Intranet – internal IP network, though often used to define a set of resources made available through a web interface for INTERNAL use

• Extranet – a set of network resources (usually web based) for two companies to collaborate or share resources, may or may not make use of VPNs

LAN, WAN, MAN - 581

• LAN – local area network– High speed– Small physical area

• WAN – wide area network– Used to connect LANS– Generally slow, using serial links

• MAN – metropolitan area network– Connect sites together within a medium range

area (like a city)

Types of links for WANs and MANS

• Dedicated/leased/point to point – a link that is pre-established and used ONLY for communications between 2 locations, it is DEDICATED (see next slide) to their use– Expensive, cost per distance– Types

• T1 - about 1.5Mbs• T3 - about 45 Mbs• Fractional T – some fraction of a T1/T3• T1s are time division multiplexed (what does this mean?)• T1s are annoying, because the “local loop portion” often fails • T1/T3 can also be used in shared/frame relay

Dedicated

Frame Relay - 592

• Data link protocol• Not a point to point connection, but a

connection into a “cloud” (see next slide)• CIR• Uses virtual circuits (PVC)• Uses DLCIs• Still uses T1/T3 but rather than going all

the way, they just go to the nearest “carriers” frame relay cloud POP.

Frame relay / cloud

WAN terms

Multiplexing

• Time Division

• Frequency Division

• Wavelength Division

• CDMA – speak multiple “languages”/mathematic multiplexing

CSU/DSU - 589

• Channel Service Unit / Data service Unit – effectively the “modem” for serial lines.

Circuit vs. Packet Switching - 590

• Packet-based networking vs. circuit based– Packets are small, quick to send– Routes vary– Route determined after computer begins to send the

packet– Can arrive from different routes in different order than

sent.– Can introduce delays as packets traverse network,

where as with circuit switching the delays is before data is sent (circuit/setup)

– Circuit switching – connection oriented/dedicated resources and circuit

– Circuit switching has fixed delays.

ATM - 594

• A type of packet based switching used to emulate circuit switching– Used by telcos– 53 byte packets– Sets up a virtual circuit– Guarantees resources once a circuit is setup– Guarantees QoS

QoS - 595

• What is Qos, why is it needed?

VoIP - 598

• What is VoIP• What are some concerns with VoIP

– Technical• Latency, Jitter, dropped packets QoS

– Security• Eavesdropping• Caller id Spoofing and vishing• Long Distance calls

• What is SIP?• What is a call processor?

– Sets up calls, terminates calls.(more)

VoIP

• What is a voicemail server?

• What is “convergence”

• VoIP and VLANS/Priority?

• What is an h.323 gateway?

Remote Access

Remote Access - 603

• Home users/remote users need a way to access work (though some high security places don’t allow offsite work)– Dial Up– ISDN– DSL– Cable Modems

Dial up - 603

• Advantages– Reduce networking costs (use internet) as

opposed to dedicated connections– Allows work from home– Streamlines access to information– Provides a competitive advantage

(more)

Dial Up - 603

• Disadvantages– Back door into networks (bypass firewall)– Often forgotten about– Slow

• Attacks– War dialing

• Defenses– Dial Back / – Caller ID restrictions– Use authentication– Answer after 4 or more rings (why/war dialing)

ISDN - 604

• Uses same lines as phone lines, directly dial into company– BRI

• 2 B Channels (64Kbits x 2)• 1 D Channel (control channel) Out of Band

– PRI• 23 B Channels• 1 D Channel• Not for personal use

DSL - 606

• MUCH faster than IDSN (6-30 times faster)

• Must live very close to the DSL equipment (a few miles)

• Symmetric and Asymmetric

• Always on (security concerns)

• Doesn’t connect directly to company / use VPN

Cable Modem - 606

• High speed access up to 50Mbps via cable TV lines.

• Shared bandwidth

• Always on (security concerns)

• Doesn’t connect directly to company, require VPN

VPNs - 608

• Securely connect to companies network/extend company network

• Private, usually encrypted connection• Usually use tunneling• Can be host to server or server to server• Can provide internal IP addresses• Can encrypt actual IP addresses• Protocols

– PPTP– L2TP– IP Sec

(more)

Tunnels - 609

• Tunnel – a virtual path across a network the encapsulates network packets within OTHER IP packets

• Can use to tunnel non-IP protocols (like IPX, NetBEUI)

• Can encrypt encapsulated packets for extra security.

PPTP - 612

• Microsoft• User gets connection to ISP• Setups PPTP connection to server at

company• Setup a tunnel• Generally encrypt traffic• Only works over IP networks*• Designed for use in software*

L2TP - 613

• Same general functionality of PPTP but works over other type of networks (non-IP) (ex. Frame relay, X.25, ATM)

• Does not provide encryption or authentication! Ouch, need to use IPSEC if wanting to do this

• Supports TACACS+, RADIUS, PPTP does not• Meant to be implemented in hardware• More of a carrier concept.

IPSEC (749 (chapter 8))

IPSEC a protocol providing a method for VPNs between to sites

• Designed for IPv6• Extended for use for IPv4• Not a strict protocol, allows for extensibility with

encryption and authentication algorithms• A “Framework”• 2 main protocols AH and ESP (next slide)• 2 modes “Tunnel and Transport” (2 slides away)

IPSEC

• AH - authentication header – Protocol number 51– Authentication only

• ESP – Encapsulating security payload– Protocol number 50– Encryption

Transport and Tunneling

• Transport does not actually tunnel IP within IP. It only encapsulates the transport layer and above

• Tunnel actually encapsulates IP within IP an entirely new IP packet is encapsulated within an external IP packet

See next slide

Transport vs. Tunnel

Example of transport

Example of Tunneling

IPSEC

• Each device in IPSec will have at least 1 security association for each VPN connection it uses. A SA is a set of parameters used for communication and includes– Authentication and encryiption keys– Algorithms choosen– IP ranges– SAs are unidirectional, so usually you have at least 2

for each tunnel that exists (one for sending, one for receiving)*

– An SPI (security parameter Index) is used to label which SA that any packet is associated with

– Use “IKE/ISAKMP” on port 500 UDP for key negotiations/SA setup*

Authentication Protocols - 614

• PAP

• CHAP

• EAP – framework not actual protocol

Remote Access Best Practices

• Always authenticate users

• Use multi-factor authentication

• Audit access

• Answer modems after 4 rings (modems)

• Use caller id (modems)

• Use callback (modems)

• use VPNs

Wireless

Wireless (619)

• Wireless, very common now.– No wires– Easy to use– Shared Medium (like Ethernet with Hubs…

what’s wrong with this? From security and performance?)

– Uses CSMA/CA

Spread Spectrum - 619

• Spreads communication across different frequencies available for the wireless device.– Frequency Hopping Spread Spectrum

• Hop between frequencies (helps if other devices use same frequencies) (doesn’t use the entire “bandwidth of frequencies)

• Harder for eavesdroppers (if everybody didn't know the sequence.. Which they actually do)

– Direct Sequence Spread Spectrum• Sends data across entire bandwidth, using “chipping code”

along with data to appear as noise to other devices.

Wireless Components - 621

• Access points are like wireless “hubs”, they create a “infrastructure WLAN”

• If you use just wireless cards of computers to communicate together that is called an “Ad-Hoc” network.

• Wireless devices must use the same “channel”

• Devices are configured to use a specific SSID (often broadcasted)

802.11 standard

• Wireless networking

• 2.4, 3.6, 5 GHz

• Data Link layer specifications

• Access point (a type of bridge)

802.11 family

• 802.11a – 54Mbps– 5Ghz– 8 channels

• 802.11b– 11Mbs– 2.4Ghz (same as other home devices)

• 802.11g– 54Mbs– 2.4Ghz

• 802.11n– 100Mbs– 2.4G or 5Ghz

Wireless security problems

• Unauthorized access

• sniffing

• War driving

• Unauthorized access points (Man in the middle)

Wireless Authentication types - 623

• Open System Authentication– Doesn’t actually require authentication– can be sniffed

• Shared Key Authentication– Requires each device use the same key, and

before access is granted a “challenge” occurs

Transmission encryption - 626There are many different types of wireless encryption

protocols• WEP

– Shared passwords (why is this bad?)– 64 or 128 bit– Easily crack able– Only option for 802.11b

• WPA Personal– Shared password– 128 bit key– TKIP (what is TKIP?)– Implements a portion of 802.11i standard (later)

Transmission Encryption

• WPA2– more compliance with 802.11i standard

– AES based algorithm

– Also uses TKIP

– Should use WPA2 as WPA can be cracked like WEP

• WPA Enterprise– Uses 802.1X authentication to have individual passwords

for individual users

• RADIUS – what was radius again?• 802.11i – the official IEEE wireless security spec,

officially supports WPA2

802.1X - 627

• Authenticated port based access control.

• Provides distinct user authentication

• Has “supplicant” (client), Authenticator (AP) and Authentication Service (usually radius)

Bluetooth (634)

• What is Bluetooth, what is the purpose?– Blue jacking– Blue snarfing– Blue bugging

(next slides)

Mobile device security

• Blue jacking – Sending forged message to nearby Bluetooth devices– Need to be close– Victim phone must be in “discoverable” mode

• Blue snarfing– Copies information off of remote devices

• Blue bugging– More serious– Allows full use of phone– Allows one to make calls– Can eavesdrop on calls

WAP (636)• Wireless Application Protocol

– What is it– What is the purpose?– WML (wireless markup language)– WTLS ( wireless transport layer security)– Requires a “gateway”

• Between WTLS and HTTPS there is an encryption gap.

– Authentication• Class 1 – none• Class 2 – server authenticates to wireless• Class 3 – mutual authentication

Some attacks against software and systems

Root Kit

• What is a root kit?

MAC flooding

• What is it, what is the purpose?

Smurf

• Describe Smurf– Forge source address– Ping broadcast address

• Countermeasures– Disable directed broadcasts at perimeter

routers– Configure routers to drop forged packets– Employ and IDS

Fraggle (like Fraggle rock)

• Like Smurf, but uses UDP (echo and chargen)

• Countermeasures– Disable directed broadcasts on perimeter– Disable address forging– Disable echo and chargen services– Block echo and chargen ports on router– Use an IDS

SYN flood

• Describe 3 way handshake (not too in-depth)• Describe listen queue• Describe SYN flood• What does it accomplishCountermeasures• Decrease connection-establish timeout• Increase listen queue size• Patch• Use and IDS• Use a Firewall

Tear Drop

Overlapping fragments, cause OS to get confused and crash.

Countermeasures

• Patch the OS

• Drop fragments (problems?)

• Use a firewall that does fragment re-assembly.

DDoS

• What is it, why is it hard to defend against

• What previously discussed thing is used in DDoS attacks?

Countermeasures

• Good luck.

Buffer Overflows

• What are they? What are the attributes of a buffer overflow?

From Chapter 5

• Maintenance Hooks

• Time of Check/ Time of Use Attacks


Recommended