It is absolutely critical to ensure all your network devices are in place. Next, you must ensure those devices are configured according to set corporate policies. Here is where we study the application of network administration principles. This section will cover the following topics:
- Rule-based management
- Firewall rules
- VLAN management
- Secure router configuration
- Access control lists
- Port security
- 802.1X
- Flood guards
- Loop protection
- Implicit Deny
- Prevent network bridging by network separation
- Log analysis
Rule-based Management
One of the main challenges facing IT management today is the sheer amount of computers and their geographic dispersion, as well as the challenge of managing differing types of network traffic. In order to ensure business continuity when attacks happen and maintain standardization across systems, administrators will most likely implement some form of rule-based management.
Rule-based management is simple: it states that network traffic will be subject to rules and will be allowed or denied based on those rules. Rules are either explicit Allow or explicit Deny, and rule-based appliances (such as proxy servers, firewalls, NIDS, and NIPS) should be configured to deny traffic that does not match any Allow rules by default.
Rule-based management therefore creates a whitelisted environment where, if the traffic does not match anything on the list, it is blocked. This is very effective and has much less overhead and management requirements than blacklisting. In addition, rule-based management expresses security policies in a technical manner and embeds management policies into technical infrastructure.
Firewall Rules
As described previously in the Firewalls section, firewalls are one example of a rule-based management device. Therefore, firewall rules are an implementation of rule-based management. Firewall rules act as “traffic cops” for network traffic, stating whether certain types of traffic can traverse the firewall, and which directions are allowed. Firewall rules are Allow or Block only. Firewall rules can be defined by the port, the protocol, or the program used in the network communication. For example, firewalls can be configured with rules that block FTP traffic.
The default rule on a firewall should be to “Deny All” traffic (unless explicitly allowed within an Allow rule). Implicit Deny is the last rule most likely included in any firewall configuration. As with all rule-based management implementations, firewall rules are also an expression of management and security policies within the IT infrastructure.
VLAN Management
First, we must discuss the concept of a VLAN. A VLAN is a virtual local area network, or a network of computers that communicates as if they were all in the same location, regardless of the computers’ physical or geographical placement. VLAN membership is managed through software.
Secure Router Configuration
In any enterprise, network and security hardware must be configured properly to ensure that network communications are secure. One of the most important components in the network is the router configuration. Many routers can be configured using the router’s administration page, which is usually accessed by a private IP address, such as 192.168.1.1. Most routers have a default administration password that must be changed for security purposes; default router usernames and passwords are available freely on the Internet, and all a person must know to find this information is the brand and model of the router.
Routers can also be configured using scripts. It is usually recommended to configure routers offline, where active changes will not affect the network configuration (and possibly the security configuration). However, configuring a router while it is on the network and is active can provide the benefit of watching changes happen immediately. In order to ensure the router is hardened, or open and vulnerable to the minimum degree necessary, ensure all unnecessary services are turned off (disabled).
Access Control Lists
Sometimes it is necessary to provide an additional mechanism by which administrators can control traffic on a network. Utilizing access control lists (ACLs) on routers can provide administrators with this functionality. ACLs can control which MAC addresses (the physical/hardware address of the network card) are able to transmit or receive network traffic through a particular network segment by filtering the MAC address at the router.
An example of a MAC address for a network card is 02-50-F3-CE-83-01.
Port Security
Port security references two different types of security: logical ports, or network ports, and the physical security of ports on network devices, such as routers. This can refer to ensuring firewalls are sufficiently locked down and physical ports on devices are secured.
802.1X
Access points and wireless access points can be vulnerable if undesirable individuals or attackers wish to connect to the network. 802.1X is a security and authentication mechanism that ensures only authorized individuals connect to access points and other network devices. It is Extensible Authentication Protocol (EAP)-based, which is an authentication protocol used mainly in wireless networks. EAP extends five different authentication types, but 802.1X specifically defines the encapsulation of EAP (authentication) traffic over LANs (EAPOL) or over wireless networks.
Flood Guards
A certain type of attack called a SYN flood takes advantage of the connection process between a client computer and a server (called a 3-way handshake) to deny connections to legitimate users. Flood guards help assist in preventing this type of attack.
In discussing this topic, we must first discuss the TCP 3-way handshake. When a client computer wants to connect to a server, it first attempts to send a special packet called a SYN (“synchronize”) packet to create the connection. This is the first step of the three steps in a 3-way handshake. The second step requires the server to send a SYN-ACK packet, which “acknowledges” (ACK) the connection request and reciprocates the connection initiation (SYN). The last step of the 3-way handshake is the client computer’s response after receipt of the SYN-ACK from the server, where the client sends a final ACK packet to acknowledge the connection request. The client and the server are then connected at that point.
SYN floods occur when the first and third steps of the process (the client computer’s responsibility) are compromised. The first step of a 3-way handshake in a SYN flood attack is a flood of SYN requests to the server; the server then attempts to answer each request with a SYN-ACK packet, which opens multiple pending connections on the server. Normally, the client computer would send the final ACK packet to cement the connection between client and server, but in a SYN flood, the attacker does not send any ACK packets to the server, forcing the server to keep all the fraudulent connections open, and thus denying any new connections to legitimate users. A SYN flood is a type of Denial of Service (DoS) attack.
To protect against SYN floods, administrators can implement flood guards, one of which is SYN cookies. SYN cookies behave like Internet cookies, preserving a small amount of information about a connection request for later use. When a client, legitimate or malicious, sends a SYN request to a server, the server sends the SYN-ACK to the client, as in the normal connection process. The server then drops the SYN portion, which is the open connection request, until it receives an ACK from the client computer, indicating a legitimate request. (Remember, SYN floods occur when malicious attackers refuse to send the final ACKs to the server, creating a flood of open connections that deny service to legitimate users). When the server receives an ACK from the client, the server can rebuild the original connection request (SYN) from the SYN cookie and create the connection. If the ACKs are never received, there is no real damage and no SYN flood, because the SYN request was dropped, effectively freeing up server resources for legitimate users.
Loop Protection
When configuring networks, it is important to consider possible network disruption due to end-user behavior: if a user (or a malicious person) plugs a network cable into two different ports on a switch, it can lead to network problems. Therefore, it is important to implement loop protection. Loop protection implies that SLPP (Simple Loop Protection Protocol) is in place and is preventing network traffic that originates from the same source from looping back on itself. This type of network traffic (Layer 2 of the OSI model) does not have a TTL (Time-to-Live) value, so it will loop forever, and it is thus necessary to prevent this from occurring.
Implicit Deny
Specific to Cisco routers, ACLs are lists of commands that control how packets are filtered based on the originating IP address of the packet. After all the rules have been processed, a command called an implicit Deny is last on the list, indicating that any traffic that was not specified in the aforementioned rules is to be implicitly denied on the network. Thus, implicit Deny ensures security by specifying only a whitelist of firewall rules that allow traffic on the network.
Another permutation of the implicit Deny rule is the Deny any any rule. It, too, is the last command on an ACL, following all explicitly mentioned rules. The Deny any any rule is applied to Extended ACLs, which filter traffic by not only the sender’s IP but also the destination IP address. Therefore, the rule must have the double “ any any” in the command.
Prevent Network Bridging by Network Separation
It is very common for users to connect to their workplace intranet and have their network and Internet traffic filtered. However, sometimes users want to get around filtering restrictions and access sites that are blocked by corporate policies by attaching a wireless broadband card or dongle to their computer to enable a second network connection and access blocked sites. When users employ this method of subverting security controls, they may inadvertently compromise their intranet by bridging two networks (their intranet and the Internet). This may allow attacks to enter from the Internet through the unsecured, unmanaged connection between the two networks formed at the user’s computer.
Log Analysis
An administrator’s main duty is to ensure all systems are up and running and are in compliance with policies. One valuable way to help with this daunting task is to perform log analysis. Log analysis, when performed on firewall logs, simply refers to checking the logs for suspicious activity, such as port scanning (looking for open, and thus vulnerable, ports) and packet flooding, which can cause a DoS attack. There are many types of attacks performed on computers to attempt to compromise them, and firewall logs are a good first place to look for evidence of these attacks.