Network SecurityA Brief History of the WorldOverviewWhat is “Security”Slide 5Slide 6Slide 7Why do we need security?Who is vulnerable?Common security attacks and their countermeasuresFirewallsSlide 12Slide 13Slide 14Slide 15Slide 16Intrusion DetectionSlide 18Minor Detour…Dictionary AttackDenial of ServiceSlide 22Slide 23Slide 24Slide 25Slide 26Slide 27Slide 28Slide 29TCP AttacksSlide 31Slide 32Slide 33Slide 34Slide 35Slide 36Slide 37Slide 38Slide 39Slide 40Five Minute BreakPacket SniffingSlide 43Slide 44Slide 45Social ProblemsSlide 47Slide 48Slide 49Slide 50ConclusionsSecurity related URLs15-441 Networks Fall 2002 1Network SecurityJustin [email protected] Networks Fall 2002 2A Brief History of the World15-441 Networks Fall 2002 3OverviewWhat is security?Why do we need security?Who is vulnerable?Common security attacks and countermeasures–Firewalls & Intrusion Detection Systems–Denial of Service Attacks–TCP Attacks–Packet Sniffing–Social Problems15-441 Networks Fall 2002 4What is “Security”Dictionary.com says:–1. Freedom from risk or danger; safety.–2. Freedom from doubt, anxiety, or fear; confidence.–3. Something that gives or assures safety, as:•1. A group or department of private guards: Call building security if a visitor acts suspicious.•2. Measures adopted by a government to prevent espionage, sabotage, or attack.•3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant.…etc.15-441 Networks Fall 2002 5What is “Security”Dictionary.com says:–1. Freedom from risk or danger; safety.–2. Freedom from doubt, anxiety, or fear; confidence.–3. Something that gives or assures safety, as:•1. A group or department of private guards: Call building security if a visitor acts suspicious.•2. Measures adopted by a government to prevent espionage, sabotage, or attack.•3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant.…etc.15-441 Networks Fall 2002 6What is “Security”Dictionary.com says:–1. Freedom from risk or danger; safety.–2. Freedom from doubt, anxiety, or fear; confidence.–3. Something that gives or assures safety, as:•1. A group or department of private guards: Call building security if a visitor acts suspicious.•2. Measures adopted by a government to prevent espionage, sabotage, or attack.•3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant.…etc.15-441 Networks Fall 2002 7What is “Security”Dictionary.com says:–1. Freedom from risk or danger; safety.–2. Freedom from doubt, anxiety, or fear; confidence.–3. Something that gives or assures safety, as:•1. A group or department of private guards: Call building security if a visitor acts suspicious.•2. Measures adopted by a government to prevent espionage, sabotage, or attack.•3. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault: Security was lax at the firm's smaller plant.…etc.15-441 Networks Fall 2002 8Why do we need security?Protect vital information while still allowing access to those who need it–Trade secrets, medical records, etc.Provide authentication and access control for resources–Ex: AFSGuarantee availability of resources–Ex: 5 9’s (99.999% reliability)15-441 Networks Fall 2002 9Who is vulnerable?Financial institutions and banksInternet service providersPharmaceutical companiesGovernment and defense agenciesContractors to various government agenciesMultinational corporationsANYONE ON THE NETWORK15-441 Networks Fall 2002 10Common security attacks and their countermeasuresFinding a way into the network–FirewallsExploiting software bugs, buffer overflows–Intrusion Detection SystemsDenial of Service–Ingress filtering, IDSTCP hijacking–IPSecPacket sniffing–Encryption (SSH, SSL, HTTPS)Social problems–Education15-441 Networks Fall 2002 11FirewallsBasic problem – many network applications and protocols have security problems that are fixed over time–Difficult for users to keep up with changes and keep host secure–Solution•Administrators limit access to end hosts by using a firewall•Firewall is kept up-to-date by administrators15-441 Networks Fall 2002 12FirewallsA firewall is like a castle with a drawbridge–Only one point of access into the network–This can be good or badCan be hardware or software–Ex. Some routers come with firewall functionality–ipfw, ipchains, pf on Unix systems, Windows XP and Mac OS X have built in firewalls15-441 Networks Fall 2002 13FirewallsIntranetDMZInternetFirewallFirewallWeb server, email server, web proxy, etc15-441 Networks Fall 2002 14FirewallsUsed to filter packets based on a combination of features–These are called packet filtering firewalls•There are other types too, but they will not be discussed–Ex. Drop packets with destination port of 23 (Telnet)–Can use any combination of IP/UDP/TCP header information–man ipfw on unix47 for much more detailBut why don’t we just turn Telnet off?15-441 Networks Fall 2002 15FirewallsHere is what a computer with a default Windows XP install looks like:–135/tcp open loc-srv–139/tcp open netbios-ssn–445/tcp open microsoft-ds–1025/tcp open NFS-or-IIS–3389/tcp open ms-term-serv–5000/tcp open UPnPMight need some of these services, or might not be able to control all the machines on the network15-441 Networks Fall 2002 16FirewallsWhat does a firewall rule look like?–Depends on the firewall usedExample: ipfw–/sbin/ipfw add deny tcp from cracker.evil.org to wolf.tambov.su telnetOther examples: WinXP & Mac OS X have built in and third party firewalls–Different graphical user interfaces–Varying amounts of complexity and power15-441 Networks Fall 2002 17Intrusion DetectionUsed to monitor for “suspicious activity” on a network–Can protect against known software exploits, like buffer overflowsOpen Source IDS: Snort, www.snort.org15-441 Networks Fall 2002 18Intrusion DetectionUses “intrusion signatures”–Well known patterns of behavior•Ping sweeps, port scanning, web server indexing, OS fingerprinting, DoS attempts, etc.Example–IRIX
View Full Document
Unlocking...