Introduction
To Network Security
Common Security Measures
Firewalls:
By far the most common security measure these days is a firewall. A
lot of confusion surrounds the concept of a firewall, but it can basically
be defined as any perimiter device that permits or denies traffic based
on a set of rules configured by the administrator. Thus a firewall may
be as simple as a router with access-lists, or as complex as a set of
modules distributed through the network controlled from one central
location.
The firewall protects everything 'behind' it from everything in front
of it. Usually the 'front' of the firewall is its Internet facing side,
and the 'behind' is the internal network. The way firewalls are designed
to suit different types of networks is called the firewall topology.
Here is the link to a detailed explanation of different firewall topologies
:
http://www.firewall.cx/firewall_topologies.php
You also get what are known as 'personal firewalls' such as Zonealarm
(http://www.zonelabs.com),
Sygate Personal Firewall (http://www.sygate.com),
Tiny Personal Firewall (http://www.tinysoftware.com)
etc.
These are packages that are meant for individual desktops and are fairly
easy to use. The first thing they do is make the machine invisible to
pings and other network probes. Most of them also let you choose what
programs are allowed to access the Internet, therefore you can allow
your browser and mail client, but if you see some suspicious program
trying to access the network, you can disallow it. This is a form of
'egress filtering' or outbound traffic filtering and provides very good
protection against trojan horse programs and worms.
However firewalls are no cure all solution to network security woes.
A firewall is only as good as its rule set and there are many ways an
attacker can find common misconfigurations and errors in the rules.
For example, say the firewall blocks all traffic except traffic originating
from port 53 (DNS) so that everyone can resolve names, the attacker
could then use this rule to his advantage. By changing the source port
of his attack or scan to port 53, the firewall will allow all of his
traffic through because it assumes it is DNS traffic.
Bypassing firewalls is a whole study in itself and one which is very
interesting especially to those with a passion for networking as it
normally involves misusing the way TCP and IP are supposed to work.
That said, firewalls today are becoming very sophisticated and a well
installed firewall can severely thwart a would-be attackers plans.
It is important to remember the firewall does not look into the data
section of the packet, thus if you have a webserver that is vulnerable
to a CGI exploit and the firewall is set to allow traffic to it, there
is no way the firewall can stop an attacker from attacking the webserver
because it does not look at the data inside the packet. This would be
the job of an intrusion detection system (covered further on).
Anti-Virus systems:
Everyone is familiar with the desktop version of anti virus packages
like Norton Antivirus and Mcafee. The way these operate is fairly simple
-- when researchers find a new virus, they figure out some unique characteristic
it has (maybe a registry key it creates or a file it replaces) and out
of this they write the virus 'signature'.
The whole load of signatures that your antivirus scans for what is
known as the virus 'definitions'. This is the reason why keeping your
virus definitions up-to-date is very important. Many anti-virus packages
have an auto-update feature for you to download the latest definitions.
The scanning ability of your software is only as good as the date of
your definitions. In the enterprise, it is very common for admins to
install anti-virus software on all machines, but there is no policy
for regular update of the definitions. This is meaningless protection
and serves only to provide a false sense of security.
With the recent spread of email viruses, anti-virus software at the
MTA (Mail Transfer Agent , also known as the 'mail server') is becoming
increasingly popular. The mail server will automatically scan any email
it recieves for viruses and quarantine the infections. The idea is that
since all mail passes through the MTA, this is the logical point to
scan for viruses. Given that most mail servers have a permanent connection
to the Internet, they can regularly download the latest definitions.
On the downside, these can be evaded quite simply. If you zip up the
infected file or trojan, or encrypt it, the anti-virus system may not
be able to scan it.
End users must be taught how to respond to anti virus alerts. This
is especially true in the enterprise -- an attacker doesn't need to
try and bypass your fortress like firewall if all he has to do is email
trojans to a lot of people in the company. It just takes one uninformed
user to open the infected package and he will have a backdoor to the
internal network.
It is advisable that the IT department gives a brief seminar on how
to handle email from untrusted sources and how to deal with attachments.
These are very common attack vectors simply because you may harden a
computer system as much as you like, but the weak point still remains
the user who operates it. As crackers say 'The human is the path of
least resistance into the network'.
Next
- Intrusion Detection Systems
|
