2.6 Given a scenario, implement secure protocols

Question 1

Protocols

Answer 1

Common types of traffic that you may look at encrypting are web, e-mail, Telnet, and FTP traffic. When designing or assessing security, you want to ensure that you are using the most secure communication protocols possible.

Question 2

Protocols - DNSSEC

Answer 2

DNSSEC is an important security protocol to DNS. DNSSEC does not encrypt communication to the DNS server, but adds integrity to the DNS records so that clients know if the DNS data was modified by an unauthorized person. DNSSEC does this by adding to each record a digital signature that contains a hash value of the data that can be verified.

Question 3

Protocols - SSH

Answer 3

SSH is designed to be a secure replacement to Telnet, and provides authentication and encryption services. SSH can be used to create an encrypted channel so that communication through the channel is encrypted. A common scenario where SSH is used is for remote access to switches and routers.

Question 4

Protocols - S/MIME

Answer 4

S/MIME is the protocol used to encrypt email messages on the network. For example, S/MIME could be used to encrypt e-mail messages from the client.

Question 5

Protocols - SRTP

Answer 5

For voice and video conferencing applications that use RTP, if you are concerned that someone can capture your voice and video traffic and then play it back, you can implement SRTP as a replacement protocol. It provides encryption and authentication services to voice and video communication.

Question 6

Protocols - LDAPS

Answer 6

LDAPS is a secure directory service access protocol that should be used instead of LDAP when security is a concern, as it encrypts all communication to the directory server.

Question 7

Protocols - FTPS

Answer 7

FTP Secure, also known as FTP-SSL, should be used as a secure replacement to FTP because it encrypts FTP communication using either the SSL or TLS security protocol.

Question 8

Protocols - SFTP

Answer 8

SFTP is an extension on SSH that allows secure transfer and management of files through an SSH channel. Note that this is not the same as FTPS, which uses SSL or TLS to secure FTP traffic.

Question 9

Protocols - SNMPv3

Answer 9

This version should be used over earlier versions of SNMP because it provides authentication and communication encryption features. SNMP is used for monitoring and managing devices on the network, such as routers and switches. You should review those devices and verify they are using SNMPv3 instead of version 1 or version 2.

Question 10

Protocols - SSL/TLS

Answer 10

SSL has been the popular protocol for encrypting traffic, such as web and email traffic, for several years. TLS is a more secure protocol that is designed to replace SSL. SSL or the newer TLS protocol could be used to encrypt communication between servers within your organization. You could also use this to secure communication between two e-mail servers, either within your organization or with a partner company.

Question 11

Protocols - HTTPS

Answer 11

Instead of using HTTP, which is the protocol for unsecured web traffic, you should be using HTTPS, also known as Secure HTTP (SHTTP). HTTPS uses SSL (discussed next) to encrypt the communication between the client and the web server. A scenario, or use case, where HTTPS could be used is if you have a web site that allows customers to update their profile information and you want to ensure their information is encrypted as it travels across the Internet.

Question 12

Protocols - Secure POP/IMAP

Answer 12

When you have an e-mail client on the Internet that will connect to your company e mail server using POP or IMAP, which send data in an unencrypted format (including username and password), you should look to using Secure POP or Secure IMAP to encrypt the communication. Both Secure POP and Secure IMAP use TLS or SSL to secure e-mail communication.

Question 13

Use Cases (for Secure Protocols)

Answer 13

There are a number of common scenarios where you should be using the secure protocol over the insecure version of the protocol.

Question 14

Use Cases - Voice and Video

Answer 14

If your organization is using VoIP solutions, be sure to use SRTP to encrypt your voice traffic on the network.

Question 15

Use Cases - Time Synchronization

Answer 15

Many network devices, such as routers and

firewalls have the capability to connect to a time synchronization server to maintain time on the device.

Question 16

Use Cases - Email and Web

Answer 16

If collecting sensitive information online, be sure to use HTTPS instead of HTTP. For organizations that need to encrypt their e mail encryption, they can use S/MIME to do e-mail encryption.

Question 17

Use Cases - File Transfer

Answer 17

When downloading files across the Internet, you want to encrypt the communication to maintain confidentiality—be sure to use SFTP or SCP to secure your file transfer communication.

Question 18

Use Cases - Directory Services

Answer 18

When accessing a directory service, such as Active Directory, use LDAPS to encrypt communication between the client and server.

Question 19

Use Cases - Remote Access

Answer 19

When you need to give users remote access to the network, look to VPN solutions for remote access and use protocols such as Secure Socket Tunneling Protocol (SSTP) or Layer Two Tunneling Protocol (L2TP) to encrypt VPN traffic.

Question 20

Use Cases - Domain Name Resolution

Answer 20

When it comes to securing your DNS environment, look to using DNSSEC to add integrity to your DNS. It is common today for hackers to compromise your DNS environment and then change your DNS records to point to the hacker’s system. DNSSEC can add integrity to your DNS records.

Question 21

Use Cases - Routing and Switching

Answer 21

With your routers and switches, use SSH instead of Telnet for remote access to the router and use SNMPv3 if you are going to run SNMP on the device because it is the most secure SNMP version.

Question 22

Use Cases - Network Address Allocation

Answer 22

You can configure your devices to allocate IP addresses on the network. Be sure to only allocate the number of addresses that are needed.