Securing the Network Flashcards
DMZ
• Demilitarized zone —An additional layer of security between the Internet and you —Public access to public resources
Extranet
•A private network for partners —Vendors, suppliers • Usually requires additional authentication —Only allow access to authorized users
Intranet
• Private network —Only available internally • Company announcements, important documents, other company business —Employees only • No external access —Internal or VPN access only
Wireless networking
•The convenience of wireless
—The security concerns of wireless
• Internal use
—Perhaps configure a separate
wireless network for guests
• Users authenticate to the wireless network
—Use their normal network login credentials
—802. IX standard
—Integrates into the existing name services
—No shared wireless passphrase
Guest network
•An optional network —But convenient to provide —Meetings, demonstrations, etc • No access to the internal network —Internet access only • Integrate with a captive portal —Avoid unauthorized use of the network —Useful in congested areas —Keeps employees off the guest network
Ad hoc
•Wireless without an access point
—Point to point communication
• Common on mobile devices
—AirDrop, contact sharing apps
• Difficult to control on unmanaged devices
—Configure ad hoc settings through the MDM
• Implement network access control
—Use ad hoc, but only with the right credentials
—Limit application use for ad hoc
Honeypots and honeynets
•Attract the bad guys —And trap them there •The bad guys are probably a machine —Makes for interesting recon • Honeypots —Single-use/single-system traps • Honeynets —More than one honeypot on a network —More than one source of information
NAT - Network Address Translation
• It is estimated that there are over
20 billion devices connected
to the Internet (and growing)
—IPv4 supports around 4.29 billion addresses
•The address space for IPv4 is exhausted
—There are no available addresses to assign
• How does it all work?
— Network Address Translation
•This isn’t the only use of NAT
—NAT is handy in many situations
NAT and security
• NAT is not a security mechanism!
—There’s no protection there
• Security through obscurity
—The premise: If you can’t see it, you can’t attack it
—This isn’t security at all
• Bad guys can circumvent an unprotected NAT
—Sophisticated attacks already assume NAT is in place
—They will gain access to your internal devices, even with NAT in place
•A stateful firewall is the security mechanism
—Used in conjunction with NAT to provide security
Segmenting the network
• Physical, logical, or virtual segmentation
—Devices, VLANs, virtual networks
• Performance
—High-bandwidth applications
• Security
— Users should not talk directly to database servers
—The only applications in the core are SQL and SSH
• Compliance
—Mandated segmentation (PCI compliance)
—Makes change control much easier
Physical segmentation
• Devices are physically separate
—Switch A and Switch B
• Must be connected to provide communication
—Direct connect, or another switch or router
• Web servers in one rack
—Database servers on another
• Customer A on one switch, customer B on another
—No opportunity for mixing data
Physical segmentation
• Separate devices
—Multiple units, separate infrastructure
Logical segmentation with VLANs
•Virtual Local Area Networks (VLANs)
—Separated logically instead of physically
—Cannot communicate between VLANs without a Layer 3 device / router
Virtualization
• Get rid of physical devices —All devices become virtualized • Servers, switches, routers, firewalls, load balancers —All virtual devices • Instant and complete control —Build a new network —Route between IP subnets —Drop a firewall between —Drag and drop devices between networks
Air gaps
• One step farther than physical segmentation
—Physical segmentation usually has some connectivity
• Remove any connectivity between components
—No possible way for one device to communicate to another
—No shared components
• Network separation
—Secure networks
—Industrial systems (SCADA, manufacturing)
• Some technologies can jump the gap
—Removable media
