My Blog

Cisco team up with VMWare

2013-12-19T10:30:00.000-05:00

http://www.networkworld.com/news/2013/121813-cisco-amazon-cloud-277061.html?source=NWWNLE_nlt_network_architecture_2013-12-19

Cisco MPLS Concepts - The Cisco Learning Network

2012-01-07T17:37:00.000-05:00

Cisco MPLS Concepts - The Cisco Learning Network

IP network design, part 1: Fundamental principles

2011-12-27T12:10:00.000-05:00

IP network design, part 1: Fundamental principles

Network Infrastructure Security Overview

2011-09-22T16:19:00.002-04:00

Network infrastructure refers to the grouping of physical hardware and logical components which are needed to provide a number of features for the network, such as connectivity, routing and switching capabilities, network security, and access control. The physical infrastructure of the network refers to the physical design of the network together with the hardware components. The logical infrastructure of the network consists of all the software components required to enable connectivity between devices, and to provide network security. The network's logical infrastructure consists of software products and networking protocols and services.

While Windows Server 2003 provides a number of features and tools when you install it on a computer, you have to implement additional features and functionality on a server to provide the services and capabilities required by the organization and its users.

There are a number of different risks that have an impact on an organization. Some of the primary threats which you should address are listed here:

Environmental threats pertain to both environmental disasters and disasters due to human intervention. Examples of environmental threats are fires, earthquakes, storms, faulty wiring, and so forth.
Accidental threats relate to threats which are caused without malicious intent. Accidental risks occur when an employee accidentally deletes important files, or modifies data that should not have been changed.
Deliberate threats relate to threats which are caused with malicious intent as the primary objective. Examples of deliberate threats are viruses, Trojan horses, and all other network attacks caused by hackers and intruders.

A typical security life cycle is consists of the following processes:

Determining and designing the security infrastructure: The design phase of the security life cycle includes elements such as identifying the resources of the organization that needs to be secured, and then designing the security infrastructure to protect these resources. The security design team should be accountable for creating and designing security policies for the organization.
Deploying and implementing security features and security policies: The security design team should also be responsible for implementing security features and security policies.
Continually managing the security solution: All security software should be upgraded as necessary, and audit logs should be regularly examined.

A number of common steps or processes have to be completed to design network infrastructure security:

Determine the security requirements of the organization.
Plan network security which should be implemented.
Establish and create secure boundaries.
Implement security technologies for the network.
Implement server security technologies.
Implement application security technologies.
Implement user security technologies.
Implement an auditing strategy.
Implement a network monitoring strategy.

A few methods of securing your network infrastructure are listed here:

Physically secure all mission-critical network servers: A few guidelines and recommendations for implementing physical security are detailed below:
- All servers should be secured in a locked server room.
- Only those individuals that need access should be permitted to access the server room using a key or security code. You can also implement a mechanism that monitors who enters and leaves the server room.
- All hubs, routers and switches should be placed in a wiring closet, or in a locked cable room.
- You should use case locks on your servers. You can also install case locks on other systems that can be physically accessed.
- You should restrict access to the floppy drive as well.
  Set a BIOS password on all systems. This would prevent an unauthorized person from accessing the BIOS.
- You should change the operating system selection timeout interval to 0 in order for Windows to boot automatically.
- When you are setting up Windows, disconnect the server from the Internet.
- Install Windows operating systems to a NTFS partition.
- Ensure that you use a strong local administrator password during setup.
Using the NTFS file system and its security features.
Using the Encrypting File System (EFS).
Securing network access points.
Enforcing user authentication.
Securing network access.
Enforcing the use of strong passwords.
Securing confidential network service data as it moves over the network.
Securing confidential application data as it moves over the network.
Securing confidential user data as it moves over the network.

Each Windows server operating system provides different features, and different security configurations which can be enabled to enhance network security and server security. Before deciding on the operating system to utilize, you have to know which security features are required for your network design, as determined by the organization's requirements.

Most organizations use a security design committee or team to determine the security needs of the organization and to deploy security policies which can meet these requirements.

The members of the network security design committee should be knowledgeable on a number of factors, including the following:

The mission critical resources of the organization.
The security weaknesses or vulnerabilities of the organization.
The threats to which the mission critical resources of the organization is exposed.
The resources which are mainly at risk.
The loss to the organization should particular resources of the organization be compromised.
The level of security needed to secure the organization's resources.
The security features and security policies which can be used to secure the resources of the organization.
The security features and security policies which are ideal to secure particular resources.
The impact of implementing security features and security policies on employees, users and administrators.
The requirements for deploying identified security solutions.

Finding the Balance between Security and Usability

One of the trickiest challenges of designing network infrastructure security is to establish a balance between security and usability. The network has to be secure so that valuable network resources can be protected, but it also has to allow the sufficient extent of usability. Networks that are too secure, or that have an exceptional high level of security can end up having low levels of usability. This typically leads to users not being able to access network resources and services. On the other hand, a network that has an exceptionally low level of network security has a somewhat higher level of vulnerability to network attacks and data corruption.

To find a balance between security and usability, the following approach is recommended:

Determine the risk to which the network and its data is exposed to, and then establish the level of security needed to alleviate and protect against these risk: This would typically involve an assessment of the physical security of your network infrastructure:
- Assessing whether the physical building is secured.
- Assessing whether the network location is secured.
- Determining whether access to the physical building is access controlled.
- Determine the impact of data being compromised.
Determine which data is valuable and mission critical data: Valuable and mission critical data would typically include usernames and passwords, confidential customer information, company financial and legal information, and so forth. As mentioned previously, one of the challenges you face when designing network infrastructure security is to find a balance between security and usability. You also need to find a balance between securing valuable or mission critical data and performance of the network. For each traffic class that should be secured, an additional layer of processing is added to the actual processing of IP packets. This makes the process of identifying valuable and mission critical data a bit more complicated. You need to find an acceptable balance between applying too much security and applying too little security.
Determine which security policies need to be implemented. You should only attempt to determine the security policies that need to be implemented after you have determined the risk that the network and its data is exposed to, and the data that is considered valuable and mission critical data. The security policies that you identify should be based on all of this previously collected information. Windows Server 2003 and the IPSec framework specify three levels of security. IPSec is a framework of open standards which can be used to encrypt TCP/IP traffic. IPSec works by encrypting the information contained in IP datagrams through encapsulation. This in turn provides network level data integrity, data confidentiality, data origin authentication, and replay protection. To secure data moving over the intranet, extranet, and Internet, IPSec can be used. The three levels of security specified by Windows Server 2003 and the IPSec framework are listed here:
- Minimum security level: This is the default level of security. The minimum security level has the following characteristics:
  - The system and its data is exposed to low risk, and not to substantial risk
  - IPSec is not implemented.
  - No confidential or valuable data is exchanged.
- Standard security level: The standard security level has the following characteristics:
  - There are a number of computers and servers that store mission critical, sensitive data. These servers need to be secured.
  - Windows Server 2003 utilizes security policies to secure valuable data. The Client (Respond Only) and Server (Request Security) policies can be utilized to secure data.
- High security level: The high security level has the following characteristics:
  - There a number of computers and servers that store highly sensitive data. These servers need to be highly secured.
  - All communication has to be secured.
  - The Windows Server 2003 Secure Server (Require Security) policy can be used to provide the highest level of security to secure data.
Identify how the optimal method of implementing security policies: There are a number of methods which can be used to implement security policies. The recommended method is through IPSec policies that comprise of a number of IPSec rules. An IPSec rule contains the following components:
- A filter list.
- A filter action.
- An authentication method.
- A connection type.
- A tunnel configuration
When you configure and manage IPSec policies, you would basically be configuring a number of aspects of IPSec policies:
- Assign the predefined default IPSec policies OR
- Create customized IPSec policies that include customized IPSec rules and filters.
- Control how IPSec policies are applied.
- Apply IPSec policies at different levels on the network. IPSec policies can be applied at the following levels within a network:
  - Active Directory domain
  - Active Directory site
  - Active Directory organizational unit
  - Computers
  - Applications
Implement security technologies and management requirements. You have to ensure that these technologies are both implemented and available. ActiveDirectory was the important feature introduced in Windows 2000 because it brought about a few important domain structural changes. Domains in Active Directory use the DNS domain naming structure, and not the NetBIOS naming structure used in Windows NT domains. Because of DNS, Active Directory domains are structured in a hierarchical model. Domain trees is the concept used to describe hierarchically structured groups of domains with a contiguous namespace, while the grouping of trees with a noncontiguous namespaces are called forests. Active Directory should be deployed to ensure that the network infrastructure is as secured as can be. Active Directory enables you to perform policy based administration through Group Policy. Through group policies, you can deploy applications and configure scripts to execute at startup, shutdown, logon, or logoff. You can also implement password security, control certain desktop settings, and redirect folders. With Active Directory, permissions control access to resources, while user rights define what actions users can perform. Security groups are considered security principal accounts because they can contain user accounts. It is the security principal accounts that are used in authentication and access control. The security settings of a security principal account controls whether the user, group, or computers are authorized to access the following:
- Active Directory
- Domain controllers
- Member servers
- Client computers
- Applications
- Printer and file system objects
- Other network components
You can apply standard permissions or special permissions to Active Directory objects. Access control and authentication are extremely important components in Active Directory security. Domain and forest functional levels provides the means by which you can enable additional domain-wide and forest-wide Active Directory features, remove outdated backward compatibility within your environment, and improve Active Directory security.
An organizational unit (OU) is a container that is used to organize Active Directory objects into logical administrative groups. An OU enables you to apply security policies, deploy applications, delegate administrative control for Active Directory objects, and to run scripts. A good security management strategy would be to group computers that have similar roles into Active Directory OUs. You can then apply IPSec policies and security templates to all the computers located within the OU.
Implement a secure, yet simple method for users to access the necessary resources: As mentioned previously, you have to determine the balance between securing valuable data and allowing authorized users to access the necessary resources. The higher the level of security, the slower the response times users experience. Using group policies to control security policies, and using IPSec and smart cards are options that should be explored.

Determining Security Requirements of the Organization

To determine the security requirements of the organization, you have to include a number of business factors:

The business model that the organization uses greatly influences the type of security an organization implements. An organization that has world-wide branches would have different security requirements to a business that has a single office.
To successfully implement security, you have to know how business processes within the organization work. You have to ensure that security does not prevent business processes from being carried out.
As the business grows so too must the security policies and processes be able to cater for this growth.
Determine the risk tolerance of the organization. The level of risk tolerance would differ between organizations.
Determine whether there are any laws and regulations that the organization has to adhere to. This is especially important when you draw up the security design.
The management strategy being used should be included as well. Organizations can use either a centralized management strategy or a decentralized management strategy.
The existing security policies and procedures should be included when you define the security requirements of the organization
The financial stance of the organization would also influence which security design is implemented.

Assessing the existing security processes and security policies would typically involve determining what the current security processes and security policies are, and whether these can be improved to meet the security requirements of the organization.

There are a number of recommendations which you can use to match the business requirements to the security plan:

The organization uses business processes,
- You should determine how these business processes flow and how the data associated with these processes flow.
- You should determine the users that need to access services used in the business processes.
The organization uses a centralized management strategy,
- You should minimize the number of domains
- Include the management of administrative group membership.
The organization uses a decentralized management strategy,
- You should determine the rights that users require.
- You should determine whether users need administrative abilities on the network, and if yes, determine who those users are.
The risk tolerance level of the organization indicates an aversion to risks,
- You should determine the risks that the organization is not prepared to tolerate.
- Identify the actions which are necessary should the risk become a reality, and then include this in the security plan.
The organization expects business growth in the next number of years,
- You should try to estimate how many users and computers will be needed to provide for future business expansion.
- Try to determine how the business will be geographically dispersed.

Designing Security based on Technical Requirements

There are also a number of technical requirements which could have an impact on your security plan, that have to be met: The common technical requirements are listed here:

How users and computers are distributed has a direct impact on how security is implemented for an organization. The distribution and size of these resources would impact:
- How Active Directory sites are defined.
- How Active Directory domains and organizational units are defined.
Before network infrastructure security can be implemented, the organization has to determine what the desired levels of performance which have to be maintained are. For instance, deploying additional authentication methods, and implementing encryption technologies affect performance levels.
The methods in which data is accessed would affect the security plan. You should include all the components used to access data:
- Users
- Computers
- Protocols
- Services
- Applications
How remote branches access the corporate network also has an impact on the security plan. Dedicated network links or virtual networking can be used to enable connectivity to the corporate network. Included in your security plan, should be the level of encryption that is required for WAN links.

IPSec Fundamentals Summary

IPSec is a framework of open standards for encrypting TCP/IP traffic within networking environments. IPSec works by encrypting the information contained in IP datagrams through encapsulation to provide data integrity, data confidentiality, data origin authentication, and replay protection. IPSec uses cryptography to provide authentication, data integrity, and data confidentiality services.

IPSec uses he Authentication Header (AH) protocol and Encapsulating Security Payload (ESP) protocol to provide data security on client computers, domain servers, corporate workgroups, LANs, WANs and remote offices. The Authentication Header (AH) protocol provides data authentication and integrity, and can be used on its own when data integrity and authentication are important to the organization but confidentiality is not. The AH protocol does not provide for encryption, and therefore cannot provide data confidentiality. The Encapsulating Security Payload (ESP) protocol ensures data confidentiality through encryption, data integrity, data authentication, and other features that support optional anti-replay services. To ensure data confidentiality, a number of encryption algorithms are used. The main difference between the AH protocol and the ESP protocol is that the ESP protocol provides all the security services provided by the AH protocol, together with data confidentiality through encryption.

When you install IPSec, the two main IPSec components which are installed are the IPSec Policy Agent and the IPSec driver. The IPSec Policy Agent is a service running on a Windows Server 2003 computer that accesses IPSec policy information. The IPSec Policy Agent accesses the IPSec policy information in the local Windows registry or in Active Directory, and then passes the information to the IPSec driver. The IPSec driver performs a number of operations to enable secure network communications such as initiating IKE communication, creating IPSec packets, encrypting data, and calculating hashes.

IPSec can operate in either Tunnel mode or in Transport mode. IPSec Tunnel mode should be used to provide security for WAN and VPN connections that use the Internet. In tunnel mode, IPSec encrypts the IP header and the IP payload. With tunneling, the data contained in a packet is encapsulated inside an additional packet. The new packet is then sent over the network. In Transport Mode, the default mode of operation used by IPSec, only the IP payload is encrypted. Transport mode is used for end-to-end communication security between two computers on the network.

The security features provided by IPSec are summarized here:

Authentication; a digital signature is used to verify the identity of the sender of the information. IPSec can use Kerberos, a preshared key, or digital certificates for authentication.
Data integrity; a hash algorithm is used to ensure that data is not tampered with. A checksum called a hash message authentication code (HMAC) is calculated for the data of the packet. When a packet is modified while in transit, the calculated HMAC changes. This change will be detected by the receiving computer.
Data privacy; encryption algorithms are utilized to ensure that data being transmitted is undecipherable.
Anti-replay; prevents an attacker from resending packets in an attempt to gain access to the private network.
Nonrepudiation; public key digital signatures are used to prove message origin.
Dynamic rekeying; keys can be created during data sending to protect segments of the communication with different keys.
Key generation; the Diffie-Hellman key agreement algorithm is used to enable two computers to exchange a shared encryption key.
IP Packet filtering; the packet filtering capability of IPSec can be used to filter and block specific types of traffic, based on either of the following elements or on a combination of them:
- IP addresses
- Protocols
- Ports

To secure and protect data, IPSec uses cryptography to provide the following capabilities:

Authentication: Authentication deals with verifying the identity of the computer sending the data, or the identity of the computer receiving the data. The methods which IPSec can use to authenticate the sender or receiver of data are:
- Digital certificates: Provides the most secure means of authenticating identities. Certificate authorities (CAs) such as Netscape, Entrust, VeriSign, and Microsoft provide certificates which can be used for authentication purposes.
- Kerberos authentication: A downside of using the Kerberos v5 authentication protocol is that the identity of the computer remains unencrypted up to the point that the whole payload is encrypted.
- Pre-shared keys; should be used when none of the former authentication methods can be used.
Anti-replay ensures that the authentication data cannot be interpreted as it is sent over the network. In addition to authentication, IPSec can provide nonrepudiation. With nonrepudiation, the sender of the data cannot at a later stage deny actually sending the data.
Data integrity: Data integrity deals with ensuring that the data received at the recipient has not been tampered with. A hashing algorithm is used to ensure that the data is not modified as it is passed over the network. The hashing algorithms which can be used by IPSec are:
- Message Digest (MD5); a one-way hash that results in a 128-bit hash which is used for integrity checking.
- Secure Hash Algorithm 1 (SHA1); a 160-bit secret key to generate a 160-bit message digest which provides more security than MD5.
Data confidentiality: IPSec ensures data confidentiality by applying encryption algorithms to data before it is sent over the network. If the data is intercepted, encryption ensures that the intruder cannot interpret the data. To ensure data confidentiality, IPSec can use either of the following encryption algorithms:
- Data Encryption Standard (DES); the default encryption algorithm used in Windows Server 2003 which uses 56-bit encryption.
- Triple DEC (3DES); data is encrypted with one key, decrypted with another key, and encrypted again with a different key.
- 40-bit DES; the least secure encryption algorithm.

IPSec Policies Summary

IPSec policies are used to apply security in your network. The IPSec policies define when and how data should be secured. The IPSec policies also determine which security methods to use when securing data at the different levels in your network. You can configure IPSec policies so that different types of traffic are affected by each individual policy.

The IPSec policy components are:

IP filter; informs the IPSec driver on the type of inbound traffic and outbound traffic which should be secured.
IP filter list; used to group multiple IP filters into a single list in order to isolate a specific set of network traffic.
Filter action; used to define how the IPSec driver should secure traffic.
Security method; refers to security types and algorithms used for the key exchange process and for authentication.
Connection type: identifies the type of connection which the IPSec policy impacts.
Tunnel setting; the tunnel endpoint's IP address/DNS name.
Rule; a grouping of components such as filters and filter actions to secure a specific subset of traffic in a particular manner:

IPSec policies can be applied at the following levels within a network:

Active Directory domain; Active Directory site; Active Directory organizational unit; Computers; Applications.

Windows Server 2003 IPSec deployments include predefined IPSec rules, filter lists, filter actions, and three default IPSec policies. Each default IPSec policy contains a set of predefined rules, filter lists and filter actions.

The three predefined IPSec policies are:

Client (Respond Only): The Client (Respond Only) default IPSec policy is the least secure predefined policy. Here, the computer assigned the policy never initiates secure data communication. Th computer only responds to IPSec requests from those computers who request it. The Client (Respond Only) predefined IPSec policy contains the default response rule that creates dynamic IPSec filters for inbound and outbound traffic based on the protocol and port which was requested.
Secure Server (Request Security): With the Secure Server (Request Security) default IPSec policy, the computer prefers and initiates secure data communication. If the other computer supports IPSec, secure data communication will take place. If the other computer does not support IPSec, the computer will allow unsecured communication with that computer.
Secure Server (Require Security): With the Secure Server (Require Security) default IPSec policy only secure data communication is allowed. If the other computer does not support IPSec, the connection is not established.

You can create customized IPSec policies that include customized rules and filters that suit specific security requirements of the organization. You can also create your own IPSec policy by using the IP Security Wizard which you can initiate from within the IP Security Policy Management MMC.

Microsoft Best Practices for Implementing IPSec

The Microsoft best practices for implementing IPSec are summarized here:

You need to plan your IPSec implementation and configuration.
You should develop a test tab and use the test lab to test the implementation of your IPSec policies. There are a few features of IPSec that are not supported in all versions of the Windows operating systems. Windows Server 2003 does though support all the features of IPSec and it also includes IPSec-specific enhancements.
Because preshared keys is considered the least secure supported authentication method, you should only use preshared keys when you cannot use digital certificates or the Kerberos v5 authentication protocol.
You should not use the Kerberos v5 authentication protocol for computers that are connected to the Internet. This is primarily because the identity of the computer remains unencrypted up to the point that the whole payload is encrypted.
You should use digital certificates as the authentication method for computers that are connected to the Internet. When sending the certificate request, do not however transmit the name of the Certification Authority (CA) together with the request.
For computers that are connected to the Internet, only allow secured connections and communication to occur. Ensure that the Allow Unsecured Communication With Non-IPSec Aware Computers option and Accept Unsecured Communication, But Always Respond Using IPSec option is disabled.
Diffie-Hellman key agreement enables two computers to create a shared private key that authenticates data and encrypts an IP datagram. IPSec in Windows Server 2003 includes support for the Group 3 2048-bit Diffie-Hellman key exchange which is much stronger and more complex than the previous Group 2 1024-bit Diffie-Hellman key exchange. If you need backward compatibility with Windows 2000 and Windows XP, then you have to use the Group 2 1024-bit Diffie-Hellman key exchange. You should though never use Group 1 768-bit Diffie-Hellman key exchange because it offers the lowest keying strength.
If you are running Windows XP and Windows Server 2003 computers, use the Triple Data Encryption Standard (3DES) encryption algorithm which provides the strongest encryption algorithm. When you use 3DES, data is encrypted with one key, decrypted with another key, and encrypted again with a different key. If you running Windows 2000 computers, install the High Encryption Pack or Service Pack 2 so that 3DES can be used.

Securing DNS Infrastructure

The common threats to a DNS infrastructure are:

Denial-of-service (DoS) attacks occur when DNS servers are flooded with recursive queries in an attempt to prevent the DNS server fro servicing legitimate client requests for name resolution. A successful DoS attack can result in the unavailability of DNS services, and in the eventual shut down of the network.
Footprinting occurs when an intruder intercepts DNS zone information. When the intruder has this information, the intruder is able to discover the DNS domain names, computer names, and IP addresses that are being used on the network. The intruder can then utilize this information to decide on which computers he/she wants to attacks.
IP Spoofing: After an intruder has obtained a valid IP address from a footprinting attack, the intruder can use that IP address to send malicious packets to the network, or access network services. The intruder can also use the valid IP address to modify data.
A redirection attack occurs when an intruder is able to make the DNS server forward or redirect name resolution requests to the incorrect servers. In this case, the incorrect servers are under the control of the intruder. A redirection attack is achieved by an intruder corrupting the DNS cache in a DNS server that accepts unsecured dynamic updates.

There are a number of by which you can secure DNS servers:

If you are using DNS zone files to store zone data, change the zone file permissions or the folder's permissions that stores the zone files to only allow Full Control to the System group.
The DNS registry keys stored in HKEY_LOCAL_MACHINESystemCurrentControlSetServicesDNS should be secured as well.
If you have a DNS server that is not configured to resolve Internet names, you should configure the root hints to point to those DNS servers hosting the root domain.
If you have a DNS server that is not configured with forwarders, and the DNS server does not respond to any DNS clients directly, then it is recommended that your disable recursion for the DNS server.
Configure the Secure cache against pollution option to protect the DNS server from an intruder that might be attempting to pollute the DNS cache with the incorrect information.
Limit the number of IP addresses that the DNS server listens to for DNS queries

The DNS security recommendations for an external DNS implementation are summarized below:

You should harden your DNS servers, and place your DNS servers in a DMZ or in a perimeter network.
Ensure that access rules and packet filtering is defined on your firewalls to control source and destination addresses and ports.
Install the latest service packs on your DNS servers, and remove all unnecessary services from these servers.
Eliminate all single points of failure.
Host your DNS servers on different subnets and ensure that your DNS servers have different configured routers.
Ensure that zone transfer is only allowed to specific IP addresses.
Secure zone transfer data by using VPN tunnels or IPSec.
You can use a stealth primary server to update secondary DNS servers which are registered with ICANN.
For Internet facing DNS servers, disable recursion, disable dynamic updates, and enable protection against cache pollution
Monitor your DNS logs. DNS logging is enabled by default. The DNS service generates DNS logging information that you can use to monitor for attacks on your DNS servers.

Designing Security for Data being Transmitted

Other than IPSec, there are a number of methods which you can use to secure data transmission for a number of different circumstances:

Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocol
S/MIME
Server Message Block (SMB) signing
Port Authentication for switches
Through segmented networks

Secure Sockets Layer/Transport Layer Security (SSL/TLS) Protocol Overview

The Secure Sockets Layer (SSL) protocol was developed by Netscape Communications to secure communication over the Internet. SSL works at the transport layer of Transmission Control Protocol/Internet Protocol (TCP/IP), which makes the protocol independent of the application layer protocol functioning on top of it. SSL is an open standard protocol and is supported by a range of servers and clients.

SSL can be utilized for the following:

To encrypt Web traffic using Hypertext Transfer Protocol (HTTP). When HTTP is utilized together with SSL, it is known as HTTPS.
To authenticate Web servers, and to encrypt communications between Web browsers and Web servers.
To encrypt mail and newsgroup traffic.

SSL works by combining public key cryptography and secret key encryption to ensure data confidentiality. The Rivest-Shamir-Adleman (RSA) public key algorithm is used to generate the certificates, and the public and private key pairs utilized in SSL. When a client Web browser connects to a Web server that is configured for SSL, a SSL handshake process is initiated with the Web server. The SSL handshake process occurs to negotiate the secret key encryption algorithm which the client and Web server will utilize to encrypt the data which is transmitted in the SSL session.

Transport Layer Security (TLS) is a internet standard version of Secure Sockets Layer (SSL), and is very similar to Secure Sockets Layer version 3 (SSLv3). The key differences between SSLv3 and TLS are:

You can extend TLS by adding new authentication methods.
TLS utilizes session caching, thereby improving on SSL performance.
TLS also distinctly separates the handshake process from the record layer. The record layer holds the data.

The different situations where an SSL/TLS implementation normally occurs:

SSL/TLS can be utilized to authenticate client access to a secure site. You can require client and server certificates, and only allow access to the site to those clients that are authenticated.
Applications which support SSL can require authentication for remote users logging on to the system.
Exchange servers can use SSL/TLS to provide data confidentiality when data is transmitted between servers on the intranet or Internet.

The benefits of implementing SSL/TLS are:

SSL/TLS is easy to deploy.
Server authentication, and client authentication (optional) occurs.
Message confidentiality and integrity are ensured.
The parties partaking in the secure session can choose the authentication methods, and encryption and hash algorithms.

The shortcomings associated with deploying SSL/TLS are:

SSL/TLS needs additional CPU resources to establish the secure session between the server and client.
Because SSL/TLS utilizes certificates, you would need administrators to manage these certificates, and the certificate systems.

S/MIME Overview

Secure /Multipurpose Internet Mail Extensions (S/MIME) can be used to provide end-to-end security for e-mail traffic. You can implement S/MIME to digitally sign e-mail messages being transmitted, thereby protecting the information from being modified.

Digitally signing e-mail messages provides the following key security features:

Origin integrity
Message integrity
E-mail messages can be encrypted as well.

Microsoft Exchange Server 2000 and Exchange Server 2003 support S/MIME. To implement S/MIME, S/MIME requires e-mail application support only. The e-mail servers do not need to support S/MIME.

Server Message Block (SMB) Protocol Signing Overview

Server Message Block (SMB) signing can be implemented to ensure the validity and integrity of data in transit between a client and a server. Server Message Block (SMB) signing can therefore be used to prevent man-in-the-middle attacks. SMB signing ensures the authenticity of a user and the server on which the data resides. To prevent the modification of SMB packets while in transit, SMB supports the digital signing of SMB packets. The signature is then verified at the recipient computer. To sign SMB packets, a mathematical algorithm is run over specific fields within the packet, to calculate a mathematical result. The recipient runs the same mathematical algorithm and then compares the mathematical result. When the two mathematical results match, it means that the data was not modified while in transit. A failure on either the server end or client end results in data not being transmitted.

To protect against the impersonation of clients and servers in high security networking environments that include Windows 2000 based clients and down-level Windows clients, consider implementing SMB signing.

SMB signing is negotiated between the client and the server at the time when the SMB session is established:

A client wants to establish a connection with a server that is defined to require SMB signing.
The server responds by sending a challenge to the server. The challenge takes the form of the data that the client will encrypt to the server.
The client responds by encrypting the challenge with a 168-bit session key. The session key is calculated from the password of the user. Both the response and the actual algorithm which was utilized to encrypt the challenge are sent to the server.
The server utilizes its stored value for the user password to carry out the same algorithm on the challenge, and then compares its results to the results received from the client. Authentication of the user occurs when there is a match between the mathematical results.
The server and client then negotiate the SMBs version which will be used. The version selected is the highest SMBs version supported by both the server and the client.
All messages sent between the client and server is protected through the calculation of a digest. The digest is then included with each message.

When you configure a security template to utilize SMB signing, you can select between the following options:

Microsoft network client Digitally sign communications (always)
Microsoft network client Digitally sign communications (if server agrees)
Microsoft network server Digitally sign communications (always)
Microsoft network server Digitally sign communications (if client agrees)

When designing SMB signing security, consider the following factors:

By default, server end SMB signing is only enabled on domain controllers. It is not enabled for member servers.
By default, client end SMB signing is enabled on domain controllers, servers, and workstations.
If you want all communication with a server to require SMB signing;
- The server must be configured to enable and require the utilization of SMB signing.
- The client computers have to be configured to enable or require SMB signing.
If you want communication with a server to allow SMB signing and unsigned communications;
- The server must be configured to only enable SMB signing.

Designing Security for Wireless Networks

The different categories of wireless networks are:

Wireless local area networks (WLANs) make it possible for data to be shared within a local area. Wireless bridges connect devices to the wireless network, and can also connect two wireless networks.
Wireless metropolitan area networks (WMANs) make it possible to connect buildings in a city. WMANs use either infrared or radio frequency.
The second generation of Wireless wide area networks (WWANs) technology is used by cellular phones at the moment. Global System for Mobile Communications (GSM), Cellular Digital Packet Data (CDPD) and Code Division Multiple Access (CDMA) are enterprises that provide WWAN technologies.
Wireless personal ara networks (WPANs) connect personal devices so that data can be shared over an area. The personal devices that WPANs connect are devices such as personal digital assistants (PDAs), laptop computers and cellular phones. WPANs can operate using either infrared or radio frequency.

Wireless networks are exposed to the following types of threats are

Data modification; data is modified while being transmitted
Eavesdropping; data is captured while being transmitted.
Denial of service (DoS); the server is flooded with unauthorized requests, making it impossible for the server to service authorized user requests.
Spoofing; data is modified so that it looks as though it came from the sender/receiver.
Free-loading; network bandwidth is used by an unauthorized individual.
Accidental network access; a user with a wireless connection on a device accidentally accesses the network.
Rogue wireless networks; authorized users create an unauthorized wireless LAN, connected to the company network.

To secure wireless networks and wireless connections, administrators can require all wireless communications to be authenticated and encrypted. There are a number of wireless security technologies that can be used to protect wireless networks from the different types of attacks that these networks are vulnerable to.

The more common technologies used to protect wireless networks from security threats are:

Wired Equivalent Privacy (WEP) encryption
Wi-Fi Protected Access (WPA)
IEEE 802.1X authentication

To provide protection from casual eavesdropping, there are a number of options which WEP provides, including the following:

With 64-bit encryption the length of the encryption key defines the degree of encryption that is provided to secure transmissions.
128-bit encryption provides greater security than 64-bit encryption.
When WEP is configured with the No encryption option, all transmissions are sent in clear text.

A few advantages of using WEP to prevent intruders from examining traffic in transit are listed here:

WEP is easy to implement. You only have to configure the encryption key on the APs and your clients.
WEP can provide basic security for WLAN applications.
Transmission privacy is ensured through RC4 encryption. This means that the shared secret key has to be used for decryption.
Transmission integrity is ensured by the CRC-32 checksum.

802.1X authentication uses the Extensible Authentication Protocol (EAP) to provide authenticated communication between the client, the wireless access point (WAP), and a Remote Access Dial-In User Server (RADIUS) service. The Extensible Authentication Protocol (EAP) is a internet Engineering Task Force (IETF) standard protocol. To provide a secure authentication process, the EAP protocol regularly produces a new encryption key. This in turn reduces the vulnerabilities of the WEP protocol.

The authentication components used in the 802.1X authentication process are:

EAP-TLS authentication: With EAP-TLS authentication, public key certificates are used to authenticate the RADIUS service, and the client. EAP-TLS authentication is a stronger authentication method than PEAP authentication. To implement EAP-TLS authentication, you need to use a Public Key Infrastructure (PKI).
Protected EAP (PEAP) authentication: While EAP-TLS utilizes public key certificates to authenticate clients; PEAP authentication utilizes a user name and password to authenticate clients. EAP-TLS is therefore the stronger authentication method to authenticate wireless clients. One advantage of using PEAP authentication is that it is easy to implement. When PEAP authentication and the RADIUS service are use together, the encryption keys have to be changed on a regular basis. This in turn ensures that WEP encryption cannot be easily broken. The PEAP authentication process has the following two stages:
- The RADIUS server is authenticated through the examination of its public key certificate. A Transport Layer Security (TLS) session is established between the client and the RADIUS server.
- An additional EAP method within the PEAP session authenticates the client to the RADIUS service.
RADIUS service: The RADIUS service is used mainly to authenticate dial-up users, and can be used to authenticate wireless users when they attempt to connect to the network. One of the main benefits of using the RADIUS service is that user authentication for wireless networks are centralized. When a client transmits a request to establish a connection, the RADIUS service verifies the identity of the client by looking for a match in its authentication database. You can also configure a maximum session time limit which forces clients to regularly re-authenticate to the RADIUS service. During re-authentication, a new shared secret is generated, which makes it more difficult for attackers to decipher the shared secret keys.

When designing security for wireless networks, the factors listed below have to be determined or clarified:

Determine whether the Wi-Fi Protected Access (WPA) protocol or the Wired Equivalent Privacy (WEP) protocol will be used.
If you select to use the WAP protocol, determine whether your hardware needs to be upgraded to support WPA.
If you select to use the WEP protocol, determine whether 64-bit or 128-bit encryption will be used.
Determine whether 802.1X authentication will be used.
Determine whether wireless clients will use IPSec.
Determine whether MAC address filtering will be used to limit wireless access based on MAC addresses.
Determine whether Group Policy will be used to configure wireless client security settings; or whether it will be manually configured.
Determine whether your wireless network security strategy involves monitoring of wireless network activity, and if yes, how and when will you monitor wireless network traffic.

Maintaining a Security Plan

The typical circumstances under which a security plan should be updated are summarized here:

A change occurs to the existing organizational structure.
There is a change in the existing security policy or strategy of the organization.
Microsoft issued a new security update to deal with a security threat.
Mergers and takeovers usually mean an expansion or complete modification of existing security plans.

One of the challenges you face when designing network infrastructure security is to maintain an already implemented security plan. This is necessary to ensure that your existing security plan remains current, valuable and effective.

To keep updated on all new security threats;
- Regularly reference network security Web sites.
- Subscribe to security bulletins.
To keep up to date on all released security fixes;
- Apply all the latest hotfixes and service packs to computers.
- Reference the Microsoft Web site to check your system for missing security fixes.
To make certain that the security plan is based on the security policy;
- Regularly update the security plan when modifications are made to the security policy of the organization.
- Regularly examine the security plan to ensure that it is still based on the security policy.

Hackers Steal SSL Certificates for CIA, MI6, Mossad

2011-09-06T09:55:00.000-04:00

September 04, 2011 — Computerworld — The tally of digital certificates stolen from a Dutch company in July has exploded to more than 500, including ones for intelligence services like the CIA, the U.K.'s MI6 and Israel's Mossad, a Mozilla developer said Sunday.
The confirmed count of fraudulently-issued SSL (secure socket layer) certificates now stands at 531, said Gervase Markham, a Mozilla developer who is part of the team that has been working to modify Firefox to blocks all sites signed with the purloined certificates.
Among the affected domains, said Markham, are those for the CIA, MI6, Mossad, Microsoft, Yahoo, Skype, Facebook, Twitter and Microsoft's Windows Update service.
"Now that someone (presumably from Iran) has obtained a legit HTTPS cert for CIA.gov, I wonder if the US gov will pay attention to this mess," Christopher Soghoian, a Washington D.C.-based researcher noted for his work on online privacy, said in a tweet Saturday.
Soghoian was referring to assumptions by many experts that Iranian hackers, perhaps supported by that country's government, were behind the attack. Google has pointed fingers at Iran, saying that attacks using an ill-gotten certificate for google.com had targeted Iranian users .
All the certificates were issued by DigiNotar, a Dutch issuing firm that last week admitted its network had been hacked in July .
The company claimed that it had revoked all the fraudulent certificates, but then realized it had overlooked one that could be used to impersonate any Google service, including Gmail. DigiNotar went public only after users reported their findings to Google.
Criminals or governments could use the stolen certificates to conduct "man-in-the-middle" attacks, tricking users into thinking they were at a legitimate site when in fact their communications were being secretly intercepted.
Google and Mozilla said this weekend that they would permanently block all the digital certificates issued by DigiNotar, including those used by the Dutch government.
Their decisions come less than a week after Google, Mozilla and Microsoft all revoked more than 200 SSL (secure socket layer) certificates for use in their browsers, but left untouched hundreds more, many of which were used by the Dutch government to secure its websites.
"Based on the findings and decision of the Dutch government, as well as conversations with other browser makers, we have decided to reject all of the Certificate Authorities operated by DigiNotar," Heather Adkins, an information security manager for Google, said in a Saturday blog post .
Johnathan Nightingale, director of Firefox engineering, echoed that late on Friday .
"All DigiNotar certificates will be untrusted by Mozilla products," said Nightingale, who also said that the Dutch government had reversed its position of last week -- when it had asked browser makers to exempt its DigiNotar certificates.
"The Dutch government has since audited DigiNotar's performance and rescinded this assessment," Nightingale said. "This is not a temporary suspension, it is a complete removal from our trusted root program."
On Saturday, Piet Hein Donner, the Netherlands's Minister of the Interior, said the government could not guarantee the security of its websites because of the DigiNotar hack, and told citizens not to log into its sites until new certificates had been obtained from other sources.
The DigiNotar breach is being audited by Fox-IT, which told the Dutch government that it was likely certificates for its sites had been fraudulently acquired by hackers.
Several security researchers said the move by browser makers puts an end to DigiNotar's certificate business.
"Effectively a death sentence for DigiNotar," said Jeremiah Grossman, CTO of WhiteHat Security, in a Friday tweet .
Mozilla was scathing in its criticism of DigiNotar.
Nightingale ticked off the missteps that led Mozilla to permanently block all sites signed with the company's certificates, including DigiNotar's failure to notify browser vendors in July and its inability to tell how many certificates had been illegally obtained. "[And] the attack is not theoretical," Nightingale added. "We have received multiple reports of these certificates being used in the wild."
Markham went into greater detail on the hack and its ramifications. "It has now emerged that DigiNotar had not noticed the full extent of the compromise," said Markham in a Saturday post to his personal blog . "The attackers had managed to hide the traces of the misissuance -- perhaps by corrupting log files."
Because the Google certificate that prompted DigiNotar to acknowledge the intrusion was obtained before most of the others, Markham speculated that there had actually been two separate attacks, perhaps by different groups.
"It is at least possible (but entirely speculative) that an initial competent attacker has had access to [DigiNotar's] systems for an unknown amount of time, and a second attacker gained access more recently and their less-subtle, bull-in-a-china shop approach in issuing the [hundreds of] certificates triggered the alarms," he said.
Last week, Helsinki-based antivirus company F-Secure said it had found signs that DigiNotar's network had been compromised as early as May 2009 .
Mozilla will update Firefox 6 and Firefox 3.6 on Tuesday to permanently block all DigiNotar-issued certificates, including those used by the Dutch government.
On Saturday Google updated Chrome to do the same.

Anonymous Claims Hack of Texas Police Website

2011-09-02T10:13:00.001-04:00

By John Ribeiro

September 02, 2011 — IDG News Service — Anonymous has attacked the website of the Texas Police Chiefs Association, in retaliation for the arrests of alleged members of the hacker group.
It said Thursday it had defaced the website, and leaked information that was classified as "law enforcement sensitive" and "for official use only". Among the leaked documents were also said to be some private e-mails from police officers, that had racist and sexist content.
Anonymous also claimed in a message on Twitter that it had brought down the police website for over three hours. The site which was subsequently restored, and the defacement removed, was however defaced again late Thursday. "It seems they restored the website somehow without removing the backdoors," Anonymous said in a Twitter message.
The Texas Police Chiefs Association did not respond to a request by e-mail for comment.
Separately, Anonymous claimed it had taken down the website of the United States Courts for the Ninth Circuit on Thursday, as justice argues that "civil disobedience is cyber-terrorism".
The Antisec operation by the hacker group and affiliates is protesting the arrest of people suspected to be its members, including Topiary, the person regarded as the spokesman of Anonymous and another group called LulzSec. Jake Davis, the person suspected to be Topiary, was arrested in July in the U.K. and charged with conspiring with others to conduct DDOS (distributed denial-of-service) attacks against the website of the Serious Organised Crime Agency (SOCA), a British law enforcement institution.
Police in the U.K. said Thursday they had charged two more persons in connection with investigations into online attacks, according to reports. Two others were also charged earlier this week, according to the Metropolitan Police.
Anonymous has been involved in a number of attacks on the websites of U.S. law enforcement agencies and defense contractors, and also government websites in Malaysia, Turkey, and Brazil. Its Antisec program targets governments, law enforcement, and corporations.

“Cyber Attacks, Real or Imagined, and Cyber War”

2011-07-28T10:38:00.000-04:00

Excerpt:
“Assorted “cyber attacks” have attracted much attention in the past few months. One headline in this genre recently proclaimed “Anonymous Declares War on Orlando.” This is wrong on so many levels that it almost defies analysis. A more precise accounting would show that there have been no cyber wars and perhaps two or three cyber attacks since the Internet first appeared.

The most ironic example of hyperbole catching itself involves the new Department of Defense Cyber Strategy, which says that the United States reserves the right to use military force in response to a cyber attack. Since many reports call everything—pranks, embarrassing leaks, fraud, bank robbery, and espionage—a cyber attack, the strategy led to expressions of concern that the United States would be shooting missiles at annoying teenage hackers or starting wars over Wikileaks. In fact, the strategy sets a very high threshold that is derived from the laws of armed conflict for defining a cyber attack. Nothing we have seen this year would qualify as an attack using this threshold.

Only by adopting an exceptionally elastic definition of cyber attack can we say they are frequent. There have been many annoyances, much crime, and rampant spying, but the only incidents that have caused physical damage or disruption to critical services are the alleged Israeli use of cyber attack to disrupt Syrian air defenses and the Stuxnet attacks against Iran’s nuclear facilities. An extortion attempt in Brazil against a public utility may have backfired and temporarily disrupted electrical service. A better way to identify an attack is to rely on “equivalence,” where we judge whether a cyber exploit is an attack by asking if it led to physical damage or casualties. No damage, no casualties, means no attack.

Many militaries are developing attack capabilities, but this is not some revolutionary and immensely destructive new form of warfare that any random citizen or hacker can engage in at will. Nations are afraid of cyber war and are careful to stay below the threshold of what could be considered under international law the use of force or an act of war. Crime, even if state sponsored, does not justify a military response. Countries do not go to war over espionage. There is intense hostile activity in cyberspace, but it stays below the threshold of attack.

The denial-of-service efforts against Estonian and Georgian websites in 2007 and 2008 were not attacks. The Estonian incident had a clear coercive purpose, and it is worth considering whether the denial-of-service exploit against Estonia could have become the equivalent of an attack if it had been extended in scope and duration. The exploits against Georgia, while undertaken with coercive intent and closely coordinated with Russian military activities (and a useful indicator of how Russia will use cyber warfare), did no damage other than to deface government websites…”

Anonymous, LulzSec Vow to Hack on

2011-07-22T10:30:00.000-04:00

By Jaikumar Vijayan
In a defiant statement addressed largely at FBI director Steve Chabinsky, members of the Anonymous and LulzSec hacktivist groups vowed to continue with their hacking campaigns and dared law enforcement to try and stop them.
The statement comes just two days after the FBI arrested 14 alleged members of Anonymous in connection with a series of distributed denial of service (DDoS) attacks against PayPal last year.
The immediate provocation appears to have been some comments made by Chabinsky in a NPR report following the recent arrests.
In it, Chabinsky is quoted as saying that chaos on the Internet is unacceptable. "[Even if] hackers can be believed to have social causes, it's entirely unacceptable to break into websites and commit unlawful acts."
In their response, posted on Pastebin.com , Anonymous and LulzSec members claimed their hactivist campaigns were motivated by a desire to expose what they described as lying governments, corrupt corporations and powerful lobbyists.
"We will continue to fight them, with all methods we have at our disposal, and that certainly includes breaking into their websites and exposing their lies," the letter said.
"We are not scared any more. Your threats to arrest us are meaningless to us as you cannot arrest an idea," the groups claimed. The two groups claimed they were acting like bandits only because they were forced to. "The Anonymous bitchslap rings through your ears like hacktivism movements of the 90s. We're back -- and we're not going anywhere."
Given the highly decentralized and loosely organized nature of the two groups it's hard to say how much of the content in the letter is bluster, how much is real or even how much it represents the true sentiment among members.
Certainly both Anonymous and LulzSec have demonstrated their ability to strike at what appears to be pretty much at will and pretty much against any target.
Just today for instance, Anonymous released a 36-page restricted document that is claimed to have obtained by breaking into a Web server at North Atlantic Treaty Organization (NATO) .
In a Twitter message, the group said that it has 1GB of material from NATO which it would not release because it would be irresponsible.
Over the last week, both groups have claimed credit for breaking into Rupert Murdoch's media sites. In one attack LulzSec compromised DNS servers at News International so that visitors to the group's Sun tabloid site were redirected to a fake story proclaiming Murdoch's death.
And in recent weeks and months both Anonymous and LulzSec have claimed responsibility for breaks-in at military contractor Booz Allen Hamilton, Sony and several other high-profile organizations.

The attacks have been mostly designed to embarrass and to provoke rather than to create any real damage. In most instances, the groups have cited some political or social cause for their attacks.
Recently for instance, when Anonymous attacked police union sites in Arizona , it claimed it was doing so because of the state's tough immigration laws.
However, law enforcement has made some important gains as well. Last weeks raids for instance, netted a total of 14 individuals who are allegedly members of Anonymous. Several arrests have been made overseas as well. Last month U.K police arrested Ryan Cleary, a 19-year old who is believed to be connected to both LulzSec and Anonymous.
Computers seized from last week's arrests and from Cleary's arrests are likely to lead authorities to more people connected with the two groups.
Whether such arrests will dampen their enthusiasm or only spur more attacks remains to be seen.

US federal government to close 800 data centers, walk into the cloud

2011-07-21T14:08:00.000-04:00

By Jesse Hicks

Sure, it's been just a few months since the National Security Agency asked for a $900 million supercomputing complex – you know, to help out with all that internet wiretapping. But concern about deficit spending will mean shuttering 800 other federal data centers in the US, or 40 percent of total government capacity. The closures are part of a larger push toward greater efficiency and consolidation, with an estimated savings of $3 billion a year; moving services to the cloud will mean more savings in licensing fees and infrastructure. Single-digit savings might sound like chump change when you realize the federal information technology budget runs around $80 billion a year, but hey, it's a start, right?

FBI Raids New York Homes in Hunt for Anonymous Hackers

2011-07-21T10:10:00.000-04:00

By John E Dunn

The FBI is reported to have raided homes in New York and California in connection with DDoS attacks carried out earlier this year by the hacktivist group, Anonymous.
Fox News has reported that the agency arrived to search two homes in Long Island and one in Brooklyn, removing papers and some computer equipment. The FBI is said to have followed up with search warrants at one or more addresses in California later in the day.
It is not yet clear whether anyone will be arrested as part of the investigation, but all the suspects were described by Fox News sources as being in their late teens or early twenties. Only one individual said to live at one of the addresses in New York has been named but his association has not been confirmed.
Getting on top of Anonymous has proved remarkably difficult for such a high-profile group, despite arrests by UK and US in January, further arrests in Spain, and an even larger raid in Turkey last month. It could be that Anonymous is simply too loose, dispersed and evolving to be stopped quickly by law enforcement.
Also in June, teen Ryan Cleary was arrested for being involved in DDoS attacks launched by LulzSec, a separate entity loosely associated with Anonymous.
Coincidentally, after a month out of the news, LulzSec yesterday launched a web redirection attack on websites run by British newspapers controlled by News International, owners of Fox News.
Not coincidentally, but perhaps ironically, thousands of miles away the head of News International, Rupert Murdoch, faced a committee of British parliamentarians to account for phone phreaking attacks allegedly carried out by journalists working for his company.

The Sun Hacked: How it Happened

2011-07-21T10:08:00.000-04:00

By Leo King

A fake 'Murdoch dead' news report, placed on newspaper The Sun's website during a hacking attack last night by Lulz Security, has prompted a massive IT security crackdown at parent company News International. Computerworld UK.com has learned that the hackers injected a preformatted HTML file into an old internal server at News International, which is used to serve a text entry window on screen in the company's content management system. The window appears within pages hosted by the paper's main Amazon Cloud-delivered site, though sources close to News International said the Amazon Cloud data centre was not hacked.
Rupert Murdoch and his son James, as well as former editor Rebekah Brooks, are due to appear at 2.30pm today in front of the Commons Culture, Media and Sport Committee. They will be asked tough questions on allegations that journalists at the company hacked into the voicemail accounts of 9/11 victims, murdered teenager Milly Dowler, and a raft of celebrities, in a bid to find stories.
The spoof story placed last night on thesun.co.uk claimed that Rupert Murdoch had been found dead in his garden. Readers clicking on the hoax story were redirected to new-times.co.uk, where the story was placed, headlined 'Media mogul's body discovered'. The spoof story claimed Murdoch had taken palladium, a radioactive substance.
The news has prompted an aggressive IT security clampdown at News International this morning.
Sources told Computerworld UK.com that News International's staff have been issued with new login and password details, following the hacking attack, and that the company has also shut off remote access to its systems.
News International operates a Citrix virtual desktop system, which allows staff to 'hotdesk' and access their desktop on any PC in the firm's offices. Access codes for the virtual desktop, as well as News International's content management system, are said to have been changed.
The Sun and The Times websites are back online, but the News International website was offline at the time of writing. News International declined to comment on how it was hacked, what was happening with its corporate website, or how it is tackling IT security concerns. It gave confirmation only that its newspaper sites were back online.
The news comes as The Guardian newspaper reported that police are examining a laptop dumped near former News of the World and Sun editor Rebekah Brooks' flat in Chelsea. Brooks' husband, Charlie, has claimed it is his and that it was in a bag accidentally thrown out by a cleaner, but this remains unconfirmed. Rebekah Brooks was arrested on Sunday on suspicion of conspiring to intercept communications, and she was bailed the next day.
Rupert Murdoch, who is accustomed to his journalists writing stories on celebrities and other public figures, has in recent weeks found himself at the centre of the news as the hacking scandal grows.
Another of Scotland Yard's most senior police officers, John Yates, resigned yesterday. Yates decided in 2009 that there was no need to reopen investigations into alleged phone hacking by journalists on the now-shuttered News of the World newspaper. Yates was about to be suspended.
Sean Hoare, a former News of the World journalist and the first reporter to expose hacking at the paper, has been found dead.

Insider threats and critical infrastructure: Sometimes, the news is worth worrying about

2011-07-21T10:05:00.000-04:00

by CSO, Salted Hash – IT security news analysis, over easy!

My instinct is almost always to look at something scary and tell you why there's no real reason to be afraid. But when it comes to malicious insiders working in nuclear power plants, a little fear may be justified.
I bring this up after reading all the reports about how Osama Bin Laden was planning an attack for the 10th anniversary of 9-11. The Department of Homeland Security issued a report that malicious insiders sent by the terrorists may already be on the inside at nuclear and other facilities essential to maintaining our energy supply, in positions of deep responsibility.
And so here we are, on guard like we've been so many times before, with the TV news people telling us to be afraid -- very afraid.
Exhibit A: This ABC report featuring Brian Ross, who is, in my opinion, one of the biggest doom-and-gloom-we're-all-gonna-die reporters out there:
Sabotage by an insider at a major utility facility, including a chemical or oil refinery, could provide al Qaeda with its best opportunity for the kind of massive Sept. 11 anniversary attack Osama bin Laden was planning, according to U.S. officials.
A new intelligence report from the Department of Homeland Security issued Tuesday, titled Insider Threat to Utilities, warns "violent extremists have, in fact, obtained insider positions," and that "outsiders have attempted to solicit utility-sector employees" for damaging physical and cyber attacks.
"Based on the reliable reporting of previous incidents, we have high confidence in our judgment that insiders and their actions pose a significant threat to the infrastructure and information systems of U.S. facilities," the bulletin reads in part. "Past events and reporting also provide high confidence in our judgment that insider information on sites, infrastructure, networks, and personnel is valuable to our adversaries and may increase the impact of any attack on the utilities infrastructure."
By the way, purely by coincidence, I discovered that this report is all the more ominous when you play the song "Making the Bombs" by the Circle Jerks in the background.
I've learned to be skeptical of a lot of things mainstream media reports, because much of what was reported on years ago never came to pass. For example, in the days after Hurricane Katrina in 2005, as New Orleans' lower ninth ward continued to be submerged in putrid water and death, ABC decided it could get a lot of mileage from a series of reports on all the potentially catastrophic threats we face.
One show dealt with what would happen if a nuclear bomb were detonated in a major American city. Another segment focused on a strain of bird flu that was killing people in Cambodia, Vietnam and other nations in that part of the world.
If the virus were to mutate so it could easily pass from human to human, a huge percentage of the global population could be killed off, as happened with the 1918-19 Spanish Flu pandemic, Ross reported. After that report, the world spent the next year on edge as human cases were found elsewhere in the world. Doom was imminent. Modern medicine was ill-equipped to stop it. And then -- nothing.
We did have a flu pandemic in 2009, but it wasn't the bird flu we had been watching for. This was a much milder pandemic.
So here's Ross again, warning that we're in for some potentially nasty stuff. I want to shrug and change the channel as I've learned to do.
But this time, I stop and watch the whole report. And, I find myself taking it very seriously.
Why?
Because I've done a lot of writing about the insider threat in recent years. I've reported on malicious insiders stealing critical intellectual property and selling it to their employer's biggest competitors.
I've seen a lot of smaller cases where disgruntled insiders tampered with computer systems and damaged data.
The insider threat is real.
So when I see reports that potential terrorists may be working inside energy plants with evil intentions, I'm inclined to worry a little more than I normally would.
Not that I'm going to go hide under the living room couch. I wouldn't fit, anyway.
The good news is that the government is on to this potential plot, so a surprise attack is less likely. The bad news is that the government has demonstrated remarkable incompetence in the face of disaster before. I again refer you to Hurricane Katrina.
The greatest opportunity to avert disaster can be found where it usually is, in the private sector.
Now would be a good time for all our critical infrastructure suppliers to keep a sharp eye on the workforce, monitoring for any unusual behavior.
That may not be enough in the end. But we already know these companies have plenty of room for improvement.
This is an excellent opportunity to work on that.
--Bill Brenner

Cisco expands data center networking gear

2011-07-20T10:40:00.000-04:00

LAS VEGAS -- Cisco this week expanded its Unified Computing System networking portfolio in an effort to improve the scalability and performance of the data center consolidation system.

At its Cisco Live customer conference, Cisco added fabric interconnects, a virtual interface card, a chassis I/O module and an update of its UCS management software to the UCS portfolio. The extensions are intended to address challenges IT managers face in adopting virtualization, controlling costs, and scaling to meet growing business demands.
CISCO LIVE KEYNOTE: Chambers: Cisco will be leaner, faster, more attentive
Travelport, a service provider for the travel industry, is using UCS to make server provisioning faster and more agile as traffic growth strains the company's network and IT infrastructure.

"We were spending a lot of IT man-hours cabling individual servers to access switches," says Steven Senecal, manager of global server engineering for Travelport. "There was an increased risk of human errors through recabling, and our business growth was outpacing the scale of our infrastructure."
UCS and its associated products allowed Travelport to deploy 190 servers in six hours, with service profiles for applications assigned and provisioned, and turned over to other IT teams within three days. The firm turned up another 1,304 blades this week with several hundred more planned by October, just before a heavy travel season with the end-of-year holidays.
"Our problem now is that the product teams think we can turn over servers really fast now," Senecal said, adding that UCS is increasing server performance eightfold.
UCS' momentum recently allowed Cisco to become the third leading blade server vendor worldwide, and second in the U.S. in the first quarter. To keep that momentum going, Cisco this week rolled out the networking extensions for UCS.
First is the Fabric Interconnect 6248UP. This supports Cisco's Unified Port capability, which allows IT managers to designate any port to be Gigabit Ethernet, 10 Gigabit Ethernet, Fibre Channel (2/4/8 gigabits per second) or Fibre Channel over Ethernet. It doubles the UCS system switching capacity to 1Tbps and 48 Unified Ports, and results in a 40% reduction in end-to-end latency, Cisco says.
Next is the Fabric Extender 2208XP Chassis IO Module, which doubles bandwidth to the blade chassis to 160Gbps.
Third, Cisco unveiled a Virtual Interface Card -- the VIC 1280 -- that quadruples bandwidth to the server through dual 40G interfaces, up from dual 10G on previous VICs. VIC 1280 also supports 256 virtual interfaces, double the number of previous-generation VIC interfaces.
VIC 1280 is based on the IEEE's 802.1Qbh standard for Bridge Port Extension and also supports RedHat's KVM hypervisor.
Last, Cisco updated the UCS Manager with Release 2.0. The software, which manages all system configuration and operations for UCS, now supports VMware vCenter virtualization management to enable IT to organize, provision and configure the virtualized environment across branch offices and the data center.

UCS Manager 2.0 also now allows users to run the UCS Fabric in End Host Mode rather than switch mode, and can connect management, backup, production and test networks to the Fabric Interconnect in End Host Mode.
All UCS enhancements announced this week are interoperable with the existing UCS 5108 Blade Chassis for investment protection, Cisco says.
Cisco says it now has 5,400 UCS customers and is adding 1,000 every quarter. Sixty percent of these customers are in the U.S., with 55% to 60% of them in enterprises, 20% in service providers, and the remainder in the public sector.
Sixty percent to 70% of UCS customers used to be HP server customers, while others were IBM and Dell, said Soni Jiandani, vice president of Cisco's Server Access Virtualization Business Unit.

10 reasons to stay in IT

2011-07-04T08:32:00.000-04:00

By Alan Norton July 1, 2011, 1:27 PM PDT
Takeaway: Thinking about quitting IT? Alan Norton did — more than once. See why he says there are 10 good reasons to hang in there. In his article 10 reasons for quitting IT, Jack Wallen listed some rationales for leaving the IT profession. I would like to offer a different viewpoint, with a few thoughts of my own that may help elucidate why you should stay in IT.

1: Money, money, money
While it is true that you work hard for your money, IT professionals are well compensated for that hard work. The pay isn’t just good, it’s great. According to the U.S. Bureau of Labor Statistics’ An Overview of U.S. Occupational Employment and Wages in 2010 (Chart 6, PDF), computer and mathematical sciences ranked third in 2010 of all major occupational groups with an annual mean salary of $77,230. Only the management and legal occupations had higher earnings.

2: The professionals
If you are like me, who you work with is extremely important. After all, more than one quarter of your working life will be spent with them. I have worked with professionals and those who weren’t so professional. I prefer the former and run from the latter. I have met professionals in other occupations, the defense industry to name one, but the professionalism of IT workers ranks right up there at the top.

3: Career continuity
The second time I left IT, I wanted to take time off and do nothing. I found out, too late, that being away from your career can make it harder to return. The biggest problem is how you are perceived by a potential employer. Employers don’t like gaps in your resume. You may have the unfortunate opportunity to discover the hard way that discrimination of the unemployed is real.

4: The challenges
One reason I chose to write computer programs was that I found it challenging. When coding, not a day that went by that I didn’t run into at least one obstacle in my path. IT professionals thrive on solving puzzles and problems. With the right mindset (which is necessary to be successful in IT), obstacles become challenges. Information technology is challenging, but you won’t find it boring. No matter what your role is in IT, the challenges you encounter tomorrow will likely be different from those you experience today.

5: The rewards
Challenges, when met, are rewarding — another reason to choose and stay in IT. I have never been more professionally satisfied than when a program I wrote actually worked as designed, without errors, or when a long-term systems project was successfully completed on time. Okay, so you’re probably not saving lives. But if you support the medical profession you are helping to save lives. And you’re saving blue- and white-collar workers the drudgery of tasks that can and should be done by a machine. Few people enjoy doing the grunt work. The systems I built during my career replaced numerous menial tasks. I can honestly say that except for a few rough patches, I left work at the end of the week satisfied, knowing that I was helping others do their jobs better. No matter what role you play in IT, helping people and a job well done create self-esteem and a sense of achievement that are highly rewarding. As TR member Chronological put it, “Most challenging jobs ever? Maybe. Most enriching jobs? — 100% sure.”

6: Marketability
IT professionals have a much better chance of finding and keeping a job. The future looks bright for IT pros — at least in the United States. Five of the top 20 and 14 of the top 50 highest paying jobs with the most growth potential are IT jobs, as ranked by CNN Money and Pay Scale.

7: The skills
Those who want to work in IT are typically quite intelligent with unique attributes and skills. IT attracts the analytical thinkers and technically inclined of the world. If you have these qualities and skills, you can find a home in IT. Another good reason to stay in IT is to keep your skills up to date. Leave IT for too long, and your skills will become rusty or even obsolete. Before you leave IT, consider that your employer is paying for you to learn new skills and keep your existing skills current. Those skills are an investment in your future.

8: The respect
Jack mentioned in his article that IT professionals get no respect from the general public. I know from your feedback in the forums that many of you agree and feel that you aren’t getting the prestige and respect that you deserve. If you are doing your job well, your perceived lack of respect may be due to the ignorance of the beholder and not through any fault of your own. The general public may well be a tough sell, but you can find respect from your peers. The knowledgeable and wise professional values the contributions of others and shows respect for his or her peers. IT is a great place to earn respect. If you can’t earn respect in IT, you probably won’t be able to earn it in any profession. Perhaps I have just been lucky or naïve, but I have always believed that I had the respect of my managers, associates, and clients. Perhaps most important, respect is a matter of attitude, your attitude, and your perception of how others see you.

9: The geek factor
IT is the perfect place to satisfy your craving for cutting-edge technology. Where else are you going to meet your geeky needs and get paid for it? If you enjoy thinking in bytes, gigahertz, flowcharts, milestones, and IF THEN ELSE statements, you will like working with others who share your interests and unique language.

10: The love of IT
Most people who choose to work in IT love what they do. Come on, admit it. Deep down you love your work. For those who don’t, it’s all relative. When you consider the other jobs available to the masses, and their pay, you just gotta love IT. If you can find nothing you like about you and your IT job, perhaps it is time you parted ways. In one discussion thread, IT_Goddess may have said it best: “How many peeps can say they really like/love their jobs? So many people I know, outside of IT, dread going into work. Most IT folk I know love their jobs, as long as they are getting fairly compensated for what they actually do.”

The bottom line
I have been away from “formal” IT for quite some time now. I have learned from the school of hard knocks the many reasons for staying. Truth be told, I miss each of the above items, more or less in the order listed. When you get right down to the basic reasons for working in IT, more needs of the technically minded are met by IT than by other professions. And the jobs are good jobs. According to the Wall Street Journal, Two of the top five jobs for 2011 were IT jobs: software engineer and systems analyst. I understand the grueling daily grind all too well, the stress of shouldering responsibilities day in and day out, the long, tiring hours, and the many never-ending frustrations. When your focus is on checking off one more to-do item and answering one more email, it’s not hard to understand why you can’t see the forest for the trees. I guess it is often human nature not to recognize the positive aspects of where you are in the here and now. As Joni Mitchell once sang, “Don’t it always seem to go that you don’t know what you’ve got ’til it’s gone.” It’s not really necessary to leave IT, like I had to, to appreciate its many benefits.

IP Spoofing: An Introduction

2011-06-30T01:49:00.000-04:00

Criminals have long employed the tactic of masking their true identity, from disguises to aliases to caller-id blocking. It should come as no surprise then, that criminals who conduct their nefarious activities on networks and computers should employ such techniques. IP spoofing is one of the most common forms of on-line camouflage. In IP spoofing, an attacker gains unauthorized access to a computer or a network by making it appear that a malicious message has come from a trusted machine by “spoofing” the IP address of that machine. In this article, we will examine the concepts of IP spoofing: why it is possible, how it works, what it is used for and how to defend against it. History The concept of IP spoofing, was initially discussed in academic circles in the 1980's. While known about for sometime, it was primarily theoretical until Robert Morris, whose son wrote the first Internet Worm, discovered a security weakness in the TCP protocol known as sequence prediction. Stephen Bellovin discussed the problem in-depth in Security Problems in the TCP/IP Protocol Suite, a paper that addressed design problems with the TCP/IP protocol suite. Another infamous attack, Kevin Mitnick's Christmas Day crack of Tsutomu Shimomura's machine, employed the IP spoofing and TCP sequence prediction techniques. While the popularity of such cracks has decreased due to the demise of the services they exploited, spoofing can still be used and needs to be addressed by all security administrators. Technical Discussion To completely understand how these attacks can take place, one must examine the structure of the TCP/IP protocol suite. A basic understanding of these headers and network exchanges is crucial to the process. Internet Protocol – IP Internet protocol (IP) is a network protocol operating at layer 3 (network) of the OSI model. It is a connectionless model, meaning there is no information regarding transaction state, which is used to route packets on a network. Additionally, there is no method in place to ensure that a packet is properly delivered to the destination. Examining the IP header, we can see that the first 12 bytes (or the top 3 rows of the header) contain various information about the packet. The next 8 bytes (the next 2 rows), however, contains the source and destination IP addresses. Using one of several tools, an attacker can easily modify these addresses – specifically the “source address” field. It's important to note that each datagram is sent independent of all others due to the stateless nature of IP. Keep this fact in mind as we examine TCP in the next section. Transmission Control Protocol – TCP IP can be thought of as a routing wrapper for layer 4 (transport), which contains the Transmission Control Protocol (TCP). Unlike IP, TCP uses a connection-oriented design. This means that the participants in a TCP session must first build a connection - via the 3-way handshake (SYN-SYN/ACK-ACK) - then update one another on progress - via sequences and acknowledgements. This “conversation”, ensures data reliability, since the sender receives an OK from the recipient after each packet exchange. As you can see above, a TCP header is very different from an IP header. We are concerned with the first 12 bytes of the TCP packet, which contain port and sequencing information. Much like an IP datagram, TCP packets can be manipulated using software. The source and destination ports normally depend on the network application in use (for example, HTTP via port 80). What's important for our understanding of spoofing are the sequence and acknowledgement numbers. The data contained in these fields ensures packet delivery by determining whether or not a packet needs to be resent. The sequence number is the number of the first byte in the current packet, which is relevant to the data stream. The acknowledgement number, in turn, contains the value of the next expected sequence number in the stream. This relationship confirms, on both ends, that the proper packets were received. It’s quite different than IP, since transaction state is closely monitored. Consequences of the TCP/IP Design Now that we have an overview of the TCP/IP formats, let's examine the consequences. Obviously, it's very easy to mask a source address by manipulating an IP header. This technique is used for obvious reasons and is employed in several of the attacks discussed below. Another consequence, specific to TCP, is sequence number prediction, which can lead to session hijacking or host impersonating. This method builds on IP spoofing, since a session, albeit a false one, is built. We will examine the ramifications of this in the attacks discussed below. Spoofing Attacks There are a few variations on the types of attacks that successfully employ IP spoofing. Although some are relatively dated, others are very pertinent to current security concerns. Non-Blind Spoofing This type of attack takes place when the attacker is on the same subnet as the victim. The sequence and acknowledgement numbers can be sniffed, eliminating the potential difficulty of calculating them accurately. The biggest threat of spoofing in this instance would be session hijacking. This is accomplished by corrupting the datastream of an established connection, then re-establishing it based on correct sequence and acknowledgement numbers with the attack machine. Using this technique, an attacker could effectively bypass any authentication measures taken place to build the connection. Blind Spoofing This is a more sophisticated attack, because the sequence and acknowledgement numbers are unreachable. In order to circumvent this, several packets are sent to the target machine in order to sample sequence numbers. While not the case today, machines in the past used basic techniques for generating sequence numbers. It was relatively easy to discover the exact formula by studying packets and TCP sessions. Today, most OSs implement random sequence number generation, making it difficult to predict them accurately. If, however, the sequence number was compromised, data could be sent to the target. Several years ago, many machines used host-based authentication services (i.e. Rlogin). A properly crafted attack could add the requisite data to a system (i.e. a new user account), blindly, enabling full access for the attacker who was impersonating a trusted host. Man In the Middle Attack Both types of spoofing are forms of a common security violation known as a man in the middle (MITM) attack. In these attacks, a malicious party intercepts a legitimate communication between two friendly parties. The malicious host then controls the flow of communication and can eliminate or alter the information sent by one of the original participants without the knowledge of either the original sender or the recipient. In this way, an attacker can fool a victim into disclosing confidential information by “spoofing” the identity of the original sender, who is presumably trusted by the recipient. Denial of Service Attack IP spoofing is almost always used in what is currently one of the most difficult attacks to defend against – denial of service attacks, or DoS. Since crackers are concerned only with consuming bandwidth and resources, they need not worry about properly completing handshakes and transactions. Rather, they wish to flood the victim with as many packets as possible in a short amount of time. In order to prolong the effectiveness of the attack, they spoof source IP addresses to make tracing and stopping the DoS as difficult as possible. When multiple compromised hosts are participating in the attack, all sending spoofed traffic, it is very challenging to quickly block traffic. Misconceptions of IP Spoofing While some of the attacks described above are a bit outdated, such as session hijacking for host-based authentication services, IP spoofing is still prevalent in network scanning and probes, as well as denial of service floods. However, the technique does not allow for anonymous Internet access, which is a common misconception for those unfamiliar with the practice. Any sort of spoofing beyond simple floods is relatively advanced and used in very specific instances such as evasion and connection hijacking. Defending Against Spoofing There are a few precautions that can be taken to limit IP spoofing risks on your network, such as: Filtering at the Router - Implementing ingress and egress filtering on your border routers is a great place to start your spoofing defense. You will need to implement an ACL (access control list) that blocks private IP addresses on your downstream interface. Additionally, this interface should not accept addresses with your internal range as the source, as this is a common spoofing technique used to circumvent firewalls. On the upstream interface, you should restrict source addresses outside of your valid range, which will prevent someone on your network from sending spoofed traffic to the Internet. Encryption and Authentication - Implementing encryption and authentication will also reduce spoofing threats. Both of these features are included in Ipv6, which will eliminate current spoofing threats. Additionally, you should eliminate all host-based authentication measures, which are sometimes common for machines on the same subnet. Ensure that the proper authentication measures are in place and carried out over a secure (encrypted) channel. Conclusion IP Spoofing is a problem without an easy solution, since it’s inherent to the design of the TCP/IP suite. Understanding how and why spoofing attacks are used, combined with a few simple prevention methods, can help protect your network from these malicious cloaking and cracking techniques.

Russian CEO Arrested for Alleged DDoS Attack on Rival .

2011-06-28T10:02:00.003-04:00

One of the most controversial figures in Russia’s online world, ChronoPay co-founder and CEO Pavel Vrublevsky, has been arrested on suspicion of ordering a DDoS attack against a rival firm.

By John E Dunn

June 27, 2011 — One of the most controversial figures in Russia's online world, ChronoPay co-founder and CEO Pavel Vrublevsky, has been arrested on suspicion of ordering a DDoS attack against a rival firm.

According to news sources, Vrublevsky was last week believed to have fled the country after a hacker associated told the country's FSB security services that he'd been hired by the head to attack Assist.ru, a rival in the lucrative digital payments processing sector.

On Friday, however, the fugitive CEO turned up in a Russian court where he was denied bail and a court appearance was scheduled for a month's time, according to The Financial Times.

The attack that has landed Vrublevsky in trouble took place last summer as his company company was bidding against rivals, including Assist.ru, for the contract to handle online payments for Russian national airline, Aeroflot.

The DDoS charges aside, Vrublevsky and his company ChronoPay have become one of the country's most notorious Internet companies, connected to a range of shady Internet businesses allegedly pushing and taking payments from scams including fake anti-virus software and pharmacy spam. ChronoPay has denied involvement in fake antivirus scams, including recent ones targeting Mac users.

Expert security journalist Brian Krebs has covered the firm's intricate web of operations in a long-running series of blog posts.

The arrest could be evidence Russia is at last making serious efforts to clean up its abysmal reputation as a breeding ground for Internet criminality.

Several weeks ago, Microsoft published a series of ads in Russian newspapers announcing its intention of pursuing those said to be involved with the notorious and now-defunct Rustock botnet, brought down in March. That previously unthinkable event - that Russians allegedly involved in online criminality might be pursued in their own country with the aid of the law - has hinted that the country's attitude to its poor image might be evolving.

Your Ad Here

Types of Firewalls

2011-06-22T10:51:00.002-04:00

Some of the most powerful firewall software on the market is designed to run on an ordinary computer — probably a dedicated server if you're securing a large network. Other firewall software is designed to run on proprietary hardware that you have to buy along with the software, turning the bundle into a "security appliance." As a general rule, appliances are faster, easier to install and operate — and also more expensive. But there's no guarantee that an appliance will do a better job than a software-only firewall. Software firewalls tend to be more flexible, and it's easier to upgrade the hardware it's running on.

Network-Level Firewalls

The first generation of firewalls (c. 1988) worked at the network level by inspecting packet headers and filtering traffic based on the IP address of the source and the destination, the port and the service. Some of these primeval security applications could also filter packets based on protocols, the domain name of the source and a few other attributes.

Network-level firewalls are fast, and today you'll find them built into most network appliances, particularly routers. These firewalls, however, don't support sophisticated rule-based models. They don’t understand languages like HTML and XML, and they are capable of decoding SSL-encrypted packets to examine their content. As a result, they can’t validate user inputs or detect maliciously modified parameters in an URL request. This leaves your network vulnerable to a number of serious threats.

Circuit-Level Firewalls

These applications, which represent the second-generation of firewall technology, monitor TCP handshaking between packets to make sure a session is legitimate. Traffic is filtered based on specified session rules and may be restricted to recognized computers only. Circuit-level firewalls hide the network itself from the outside, which is useful for denying access to intruders. But they don't filter individual packets.

Application-Level Firewalls

Recently, application-level firewalls (sometimes called proxies) have been looking more deeply into the application data going through their filters. By considering the context of client requests and application responses, these firewalls attempt to enforce correct application behavior, block malicious activity and help organizations ensure the safety of sensitive information and systems. They can log user activity too. Application-level filtering may include protection against spam and viruses as well, and be able to block undesirable Web sites based on content rather than just their IP address.

If that sounds too good to be true, it is. The downside to deep packet inspection is that the more closely a firewall examines network data flow, the longer it takes, and the heavier hit your network performance will sustain. This is why the highest-end security appliances include lots of RAM to speed packet processing. And of course you'll pay for the added chips.

Stateful Multi-level Firewalls

SML vendors claim that their products deploy the best features of the other three firewall types. They filter packets at the network level and they recognize and process application-level data, but since they don't employ proxies, they deliver reasonably good performance in spite of the deep packet analysis. On the downside, they are not cheap, and they can be difficult to configure and administer.

IDS vs. IPS Explained

2011-06-22T10:29:00.001-04:00

Layered security is the key to protecting any size network, and for most companies, that means deploying both intrusion detection systems (IDS) and intrusion prevention systems (IPS). When it comes to IPS and IDS, it’s not a question of which technology to add to your security infrastructure – both are required for maximum protection against malicious traffic. In fact, vendors are increasingly combining the two technologies into a single box.

At its most basic, an IDS device is passive, watching packets of data traverse the network from a monitoring port, comparing the traffic to configured rules, and setting off an alarm if it detects anything suspicious. An IDS can detect several types of malicious traffic that would slip by a typical firewall, including network attacks against services, data-driven attacks on applications, host-based attacks like unauthorized logins, and malware like viruses, Trojan horses, and worms. Most IDS products use several methods to detect threats, usually signature-based detection, anomaly-based detection, and stateful protocol analysis.

The IDS engine records the incidents that are logged by the IDS sensors in a database and generates the alerts it sends to the network administrator. Because IDS gives deep visibility into network activity, it can also be used to help pinpoint problems with an organization’s security policy, document existing threats, and discourage users from violating an organization’s security policy.

The primary complaint with IDS is the number of false positives the technology is prone to spitting out – some legitimate traffic is inevitable tagged as bad. The trick is tuning the device to maximize its accuracy in recognizing true threats while minimizing the number of false positives; these devices should be regularly tuned as new threats are discovered and the network structure is altered. As the technology has matured in the last several years, it has gotten better at weeding out false positives. However, completely eliminating them while still maintaining strict controls is next to impossible – even for IPS, which some consider the next step in the evolution of IDS.

The IPS Advantage
At its most basic, an IPS has all the features of a good IDS, but can also stop malicious traffic from invading the enterprise. Unlike an IDS, an IPS sits inline with traffic flows on a network, actively shutting down attempted attacks as they’re sent over the wire. It can stop the attack by terminating the network connection or user session originating the attack, by blocking access to the target from the user account, IP address, or other attribute associated with that attacker, or by blocking all access to the targeted host, service, or application.

In addition, an IPS can respond to a detected threat in two other ways. It can reconfigure other security controls, such as a firewall or router, to block an attack. Some IPS devices can even apply patches if the host has particular vulnerabilities. In addition, some IPS can remove the malicious contents of an attack to mitigate the packets, perhaps deleting an infected attachment from an email before forwarding the email to the user.

Twice the Protection
Because IDS and IPS devices sit in different spots on the network, they can – and should – be used concurrently. An IPS product installed at the perimeter of the network will help stop zero day attacks, such as worms and viruses, in their tracks – even the newest threats can be blocked with rigorous tuning. An IDS product installed inside the firewall will monitor internal activity, guarding against the ever-present insider threat, and lend greater visibility into security events, past and present.

Choosing a product that offers both technologies can be the most cost-effective and efficient approach. “With one device that does IDS and IPS, you can enable IDS on part of the network and enable IPS on a different part. It’s almost a virtual device,” says Sanjay Beri, senior director of product management at Juniper Networks, a network infrastructure vendor based in Sunnyvale, Calif.