PROTECTING INFORMATION ASSETS NETWORK SECURITY

Transcription

1 PROTECTING INFORMATION ASSETS NETWORK SECURITY

2 PAUL SMITH 20 years of IT experience (desktop, servers, networks, firewalls.) 17 years of engineering in enterprise scaled networks 10+ years in Network Security 10+ years as a CISSP Graduate of Fox School of Business, MBA Assistant Director of Network Security for Temple University Adjunct Professor for ITACS: Network Security IT Governance

3 SIMPLE DEFINITIONS OF NETWORK SECURITY The purpose of network security is to protect the network and its component parts from unauthorized access and misuse The policies, practices and technology employed to prevent unauthorized access, misuse, modification, or denial of a computer network and network resources.

4 What is Security Posture? It is your overall security plan the approach your business takes to security, from planning to implementation. It is comprised of technical and non-technical policies, procedures and controls, that protect you from both internal and external threats

5 How Networks Work Network Security Security Posture Governance (Placing Limits) Compliance and Alignment with Laws Management Frameworks Risks Created by Paul M. Smith, MBA, CISSP

6 How Networks Work Network Security Security Posture Governance (Placing Limits) Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws Management Frameworks Risks Created by Paul M. Smith, MBA, CISSP

7 How Networks Work Network Security Security Posture Governance (Placing Limits) Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Management Frameworks Risks Created by Paul M. Smith, MBA, CISSP

8 How Networks Work Network Security Security Posture Governance (Placing Limits) Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Created by Paul M. Smith, MBA, CISSP

9 How Networks Work Network Security Security Posture Governance (Placing Limits) Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Created by Paul M. Smith, MBA, CISSP Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

10 How Networks Work Network Security Security Posture Governance (Placing Limits) Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Created by Paul M. Smith, MBA, CISSP Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

11 How Networks Work Network Security Security Posture Governance (Placing Limits) OSI Model Well-known ports Encapsulation Connection vs connectionless Three-way handshake Packet Analysis What is an anomaly Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Created by Paul M. Smith, MBA, CISSP Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

12 How Networks Work Network Security Security Posture Governance (Placing Limits) OSI Model Internet Protocols Well-known ports Encapsulation Connection vs connectionless Three-way handshake Packet Analysis What is an anomaly DHCP SSH ARP DNS MAC TLS/SSL FTP TCP SNMP HTTP UDP IPSec NTP ICMP IPv4 v6 Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Created by Paul M. Smith, MBA, CISSP Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

13 How Networks Work Network Security Security Posture Governance (Placing Limits) OSI Model Internet Protocols Well-known ports Encapsulation Connection vs connectionless Three-way handshake Packet Analysis What is an anomaly DHCP SSH ARP DNS MAC TLS/SSL FTP TCP SNMP HTTP UDP IPSec NTP ICMP IPv4 v6 Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Network Types Public IP Addressing Private IP Addressing Network Address Translation Cloud Computing Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Created by Paul M. Smith, MBA, CISSP Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

14 How Networks Work Network Security Security Posture Governance (Placing Limits) OSI Model Internet Protocols Well-known ports Encapsulation Connection vs connectionless Three-way handshake Packet Analysis What is an anomaly DHCP SSH ARP DNS MAC TLS/SSL FTP TCP SNMP HTTP UDP IPSec NTP ICMP IPv4 v6 Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Network Types Components Public IP Addressing Private IP Addressing Network Address Translation Cloud Computing Hubs vs Switches Routers Wireless Intrusion Prevention and Detection Virtual Local-Area-Networks (VLANs) Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Created by Paul M. Smith, MBA, CISSP Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

15 How Networks Work Network Security Security Posture Governance (Placing Limits) OSI Model Internet Protocols Well-known ports Encapsulation Connection vs connectionless Three-way handshake Packet Analysis What is an anomaly DHCP SSH ARP DNS MAC TLS/SSL FTP TCP SNMP HTTP UDP IPSec NTP ICMP IPv4 v6 Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Network Types Components Security Technology Created by Paul M. Smith, MBA, CISSP Public IP Addressing Private IP Addressing Network Address Translation Cloud Computing Hubs vs Switches Routers Wireless Intrusion Prevention and Detection Virtual Local-Area-Networks (VLANs) Firewalls Types, placement, rulesets, NAT Cryptography Algorithms, secret/public keys, CA Intrusion Prevention and Detection Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

16 How Networks Work Network Security Security Posture Governance (Placing Limits) OSI Model Internet Protocols Well-known ports Encapsulation Connection vs connectionless Three-way handshake Packet Analysis What is an anomaly DHCP SSH ARP DNS MAC TLS/SSL FTP TCP SNMP HTTP UDP IPSec NTP ICMP IPv4 v6 Concepts CIA Triad Security Architecture Segmentation/Zones Perimeter Defense Defense-in-Depth Least Privilege Threat Landscape Due Care Due Diligence Redundancy / HA Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Network Types Components Public IP Addressing Private IP Addressing Network Address Translation Cloud Computing Hubs vs Switches Routers Wireless Intrusion Prevention and Detection Virtual Local-Area-Networks (VLANs) Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Security Technology Created by Paul M. Smith, MBA, CISSP Firewalls Types, placement, rulesets, NAT Cryptography Algorithms, secret/public keys, CA Intrusion Prevention and Detection Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

17 How Networks Work Network Security Security Posture Governance (Placing Limits) OSI Model Internet Protocols Well-known ports Encapsulation Connection vs connectionless Three-way handshake Packet Analysis What is an anomaly DHCP SSH ARP DNS MAC TLS/SSL FTP TCP SNMP HTTP UDP IPSec NTP ICMP IPv4 v6 Concepts CIA Triad Security Architecture Segmentation/Zones Perimeter Defense Defense-in-Depth Least Privilege Threat Landscape Due Care Due Diligence Redundancy / HA Threats and Attacks Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Network Types Components Public IP Addressing Private IP Addressing Network Address Translation Cloud Computing Hubs vs Switches Routers Wireless Intrusion Prevention and Detection Virtual Local-Area-Networks (VLANs) Threat Landscape Reconnaissance Vulnerabilities (CVEs) DDoS / DOS Sniffers Social Engineering Data Harvesting Cyber Kill Chain Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Security Technology Created by Paul M. Smith, MBA, CISSP Firewalls Types, placement, rulesets, NAT Cryptography Algorithms, secret/public keys, CA Intrusion Prevention and Detection Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

18 How Networks Work Network Security Security Posture Governance (Placing Limits) OSI Model Internet Protocols Well-known ports Encapsulation Connection vs connectionless Three-way handshake Packet Analysis What is an anomaly DHCP SSH ARP DNS MAC TLS/SSL FTP TCP SNMP HTTP UDP IPSec NTP ICMP IPv4 v6 Concepts CIA Triad Security Architecture Segmentation/Zones Perimeter Defense Defense-in-Depth Least Privilege Threat Landscape Due Care Due Diligence Redundancy / HA Threats and Attacks Organizational Culture Policy and Strategy Ethical Issues Balance = Trade-offs What are you governing? Asset Classification (FIPS 199) Compliance and Alignment with Laws HIPAA (Healthcare) PCI-DSS (Retail) GLBA (Financial Sector) FISMA (Government) SOX (Corporate) Network Types Components Public IP Addressing Private IP Addressing Network Address Translation Cloud Computing Threat Landscape Reconnaissance Vulnerabilities (CVEs) DDoS / DOS Sniffers Social Engineering Data Harvesting Cyber Kill Chain Hubs vs Switches Routers Wireless Intrusion Prevention and Detection Virtual Local-Area-Networks (VLANs) Security Operations Management Frameworks Best Practices Guidelines Gap Analysis NIST FIPS 199 ISO / COBIT/DSS05.x/APO13 CSET Assessment Risks Security Technology Created by Paul M. Smith, MBA, CISSP Firewalls Types, placement, rulesets, NAT Cryptography Algorithms, secret/public keys, CA Intrusion Prevention and Detection Security Operations Centers (SOC) Continuous Monitoring Security Incident Event Mgmt (SIEM) Subject Matter Experts (SMEs) Process / Operational controls Logical Controls Technical Controls Risk acceptance Risk avoidance Risk transfer Risk mitigation Risk assessments Likelihood Impact SP ISO 27005

19

20 MOVING DATA Addressing Data Packets Delivery Method

21 BASIC NETWORKING - MAC ADDRESSES b b A Media Access Control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. The Address Resolution Protocol (ARP) is a telecommunication protocol used for discovering the MAC Addresses of known Internet Protocol (IP) addresses LAN a2-b a ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network.

22 BASIC NETWORKING PORTS MACHINES LISTEN TO FOR DATA TRAFFIC b b Port 80: Web Port 443: Secure web Port 1433: SQL Database Port 1521: Oracle Database Scan networks for these ports to identify which servers are offering which services LAN a2-b a

23 A data packet is typically forwarded from one router to another through the networks that constitute the internetwork until it reaches its destination node. BASIC NETWORKING ROUTERS b b SQL Server Listening: LAN c2-a LAN Router a2-b a A router is a networking device that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet.

24 MODELS AND PROTOCOLS

25 OSI MODEL Developed by ISO International Organization of Standardization Layered, each level sends to the layer above or below.

26 BENEFITS OF OSI MODEL Common Language Acceptable Behavior Protocols: set of rules that dictates how computers communicate over networks TCP/IP is a suite of protocols - de facto standard of the internet

27 DATA FLOW OSI MODEL Data encapsulation occurs as data travels down the stack. Data DE-capsulation = stripping off layers as the data travels up the stack.

28 PACKETS

29 TWO MODELS

30 SWITCHED ENVIRONMENTS

31 NONE-SWITCH ENVIRONMENTS Broadcast Domain All packets received by the hub are transmitted out all ports b b b b a2-b b a2-b b a a

32 SWITCH ENVIRONMENTS Packets received by the switch are transmitted out ports based on destination mac addresses Broadcast Domain b b b b a2-b b a2-b b a a

33 Router A broadcast domain is a logical division of a computer network, in which all nodes can reach each other by broadcast at the data link layer. - Wikipedia Broadcast Mac: FF:FF:FF:FF:FF:FF Broadcast Mac: FF:FF:FF:FF:FF:FF Broadcast Domain 1 Broadcast Domain 2 Switch Switch b b b b a2-b b a2-b b a a

34 IP ADDRESSING IP ADDRESSING IS THE LAYER ABOVE MAC ADDRESSING

35 IP ADDRESSING What is it? Postal System for packets Street, City and ZIP code Network ID vs. Host ID

36 IP ADDRESSING Private vs public addressing Internet Engineering Task Force s RFC 1918 architecture sets three blocks of IP addresses for private/internal (local area network) use Address ranges are not routed on the Internet Addresses require Network Address Translation or NAT to access the Internet

37 BROADCAST DOMAIN

38 Router Packet DST = Packet SRC= (Spoofed) Broadcast IP: Broadcast IP: Broadcast Domain 1 Broadcast Domain 2 Switch Switch b b b b a2-b b a2-b b a a

39 Router The router will change the DST mac address to FF:FF:FF:FF:FF:FF Packet DST = Broadcast IP: Broadcast Domain 1 Broadcast Domain 2 Switch Switch b b b b a2-b b a2-b b a a

40 Router Each receiving machine will send a reply to Packet DST= Broadcast IP: Broadcast IP: Broadcast Domain 1 Broadcast Domain 2 Switch Switch b b b b a2-b b a2-b b a a

41 Router Each receiving machine will send a reply to Packet SRC= Broadcast IP: Broadcast IP: Broadcast Domain 1 Broadcast Domain 2 Switch Switch b b b b a2-b b a2-b b a a

42 NETWORK ARCHITECTURES Access costs, speed, flexibility and reliability Critical infrastructure Risk of downtime (loss of availability)? Impact of downtime? Business Continuality Planning Role of Highly Available and Redundant networks

43 b b a a Switch b b b b b b a2-b a2-b b b b b a2-b a2-b Switch a a Router 1 Router 2 Router Cluster Dual Connected switches

44 DOMAIN NAME SYSTEM (DNS) Hostname-to-IP addressing translation: to

45 DOMAIN NAME SERVER (DNS) Hierarchical structure Root Servers Top-level domains Split-DNS Internal vs External facing Vulnerability to attack

46 FIREWALLS

47 FIREWALL ROLES AND PLACEMENT Placed at network borders Network Address Translation (NAT) Packet filtering IP-Address Port Application based Stateful inspection Reassembling packets first IPS Inspections All equal overhead processing

48 ENCRYPTION

49 ENCRYPTION Protecting data in-transit Becoming the standard for data transmission and storage in large companies Encryption IPSEC and TLS

50 ENCRYPTION BASICS

51 AVOID USING CLEAR TEXT SERVICES

52 ATTACKS

53 ATTACK METHODOLOGY Reconnaissance Scanning Gaining Access (Exploit) Elevating Access Exfiltration/ Modify Clearing Tracks

54 ATTACK METHODOLOGY/COUNTER MEASURES Port / Network Level Filter Firewall or ACL Reconnaissance Scanning Vulnerability Patching System Patching Password Policy Least-privilege Gaining Access (Exploit) Elevating Access System Patching Password Policy Least-privilege Monitor IPFlows Encryption File Logging Exfiltration/ Modify Clearing Tracks Move logs off to SIEMS

55 DENIAL OF SERVICE ATTACKS (DOS) Rather than gaining access, deny access to others! Two Types DoS or Distributed DoS By preventing networks and servers from handling legitimate traffic, attackers deny service. Overwhelm firewalls or servers with invalid traffic patterns that consume bandwidth, memory or CPU resources. Distributed means leveraging others in the attack.

56 HOW DOS WORKS SYN attack: attacker ignored syn/ack return, each SYN takes up a TCP connection on the server. Goal is to exhaust TCP connection table. Reflective DoS: spoof the sending IP address so return syn/ack traffic attacks another IP. Distributed DoS: Have multiple Zombie machines in a BOT Net attack a single IP. UDP attacks: flooding the pipes or links with traffic Which does not need Three-Way Handshake. Forces routers and firewalls to process useless traffic.

57 HOW TO COUNTER DOS Anomaly detection Usual traffic patterns Network traffic which breaks rules Install an Anomaly detection appliance Turn on features on firewalls Not the same a signature based Intrusion Detection (IPS)

58 INTRUSION DETECTION VS PREVENTION Monitor Mode Signature Based

59 SIGNATURE VS BEHAVIOR Signature-based Knowledge based Database of signatures Needs constant updates Zero-day attacks missed Behavior-based Statistical or anomaly based Many false positives Compares activity to normal (Baselines)

60 SUMMARY OF BEST PRACTICE STEPS Segment Hosts and Broadcast Domains (vlans, switches, routers) Know where your data is and classify it (Data classification standards, policy) Control which hosts can talk. (Router Access Control Lists or Firewall rules) Reduce exposure to untrusted networks (Firewalls) Good host hygiene. (Patch Management, vulnerability management) Know your own network (Discover scans to look for new hosts usually not patched!) Protecting Data (Encryption at rest and Encryption in-transit)

61