A network designer’s main responsibility includes defining the network and security architecture; the designer should not be concerned with the actual implementation of security mechanisms and deployment of security solutions. From a design standpoint, the network designer should focus on security management concepts, and the CCDA candidate must understand the reasons for network security, including the systematic approaches to manage security.
Cisco invented the concept of the Self-Defending Network, which describes the network infrastructure and the services used in order for the network to respond to attacks while maintaining availability and reliability. Networks should be able to absorb attacks and remain operational without affecting organizational productivity.
Security Threats and Risks
Efficient security mechanisms must address organizational threats and mitigate risks successfully. One characteristic of successful security is being transparent to the end-user. The security manager should maintain a balance between strict security policies and productivity and collaboration. If the security rules are too tight, the users’ experience may be affected and the employees might not be able to fulfill their tasks easily. On the other hand, if the security rules are too permissive, the users’ experience may be improved but the network is more vulnerable.
The network designer should create a secure environment for the organization by preventing attacks, while ensuring that the security features have as little effect on end-user productivity as possible.
A network security implementation must mitigate multiple factors and accomplish the following:
- Block outside malicious users from getting access to the network
- Allow only system, hardware, and application access to authorized users
- Prevent attacks from being sourced internally
- Support different levels of user access using an access control policy
- Safeguard the data from being changed, modified, or stolen
As detailed previously, network threats can be categorized into the following types:
- Reconnaissance
- Unauthorized access
- Denial of Service (DoS)
Reconnaissance is the precursor to a more structured and advanced threat. Many worms, viruses, and Trojan horse attacks usually follow some type of reconnaissance attack. Reconnaissance can also be accomplished through social engineering techniques, for example, gathering information using the human factor. There are several tools that can be used for reconnaissance, including port scanning tools and packet sniffers. The goal is to gather as much information as possible about the target host and network. The information gathered in the reconnaissance phase is used to plan and select the most appropriate attack technique before initiating the attack.
Unauthorized access might relate to operating systems, physical access, or any service that allows for privilege escalation in a system. The final goal is reading or modifying confidential data. DoS attacks overwhelm the resources of different servers or systems in order to prevent them from answering legitimate users’ requests. The affected resources can include memory, CPU, bandwidth, or any other resource that can bring down (i.e., crash) the server or the service. A DoS attack denies service using well-known protocols, such as ICMP, ARP, or TCP, but attackers can also perform a more structured and distributed DoS attack by using several systems to overwhelm an entire network (i.e., sending a very large number of invalid flows).
Vulnerabilities are measurements of the probability of being negatively influenced by a threat (e.g., reconnaissance attack, unauthorized access, or DoS attack). Vulnerabilities are often measured as a function of risk that might include the following:
- Risk to the confidentiality of data
- Risk to the integrity of data
- Risk to the authenticity of systems and users
- Risk to the availability of networking devices
The level of security risks (i.e., vulnerability to threats) must be assessed in order to protect network resources, procedures, and policies. System availability involves uninterrupted access to network-enabled devices and computing resources in order to minimize business disruptions and productivity loss. Data integrity involves making sure data not only is seen by authorized users but also is not modified in transit (i.e., data that leaves the sender node must be identical to the data that enters the receiver node). Data confidentiality should ensure that only legitimate users see sensitive information. Confidentiality is used to prevent data theft and damage to the organization.
The risk assessment process involves identifying all possible targets within the organization and placing a quantitative value on them based on their importance in the business process. Targets include the following:
- Any kind of network infrastructure device (switches, routers, security appliances, wireless access points, and wireless controllers )
- Network services (DNS, ICMP, and DHCP)
- Endpoint devices, especially management stations that perform in-band or out-of-band management
- Network bandwidth, which can be overwhelmed by DoS attacks
Network Security System Lifecycle
Security is one of the main responsibilities of a network design professional, and this includes a solid knowledge of organizational security policies and procedures.
The security policy is a key element in securing network services, offering the necessary level of security, and enhancing network availability, confidentiality, integrity, and authenticity.
Figure 8.12 – Network Security System Lifecycle
The security policy is a small part of a larger network security system lifecycle, as illustrated in Figure 8.12 above, that is driven by an assessment of the business’s needs and comprehensive risk analysis. Risk assessment may also need to be performed, using penetration testing and vulnerability scanning tools.
The security policy contains written documents that include the following:
- Guidelines
- Processes
- Standards
- Acceptable use policies
- Architectures and infrastructure elements used (e.g., IPSec or 802.1x)
- Granular areas of security policy, such as Internet use policy or access control policy
The written security policy leads to a security system that can include the following elements:
- Cisco ASA devices
- IDSs and IPSs
- 802.1x port-based authentication
- Device hardening
- Virtual private networking
These system elements are chosen based on a set of guidelines and best practices. The entire process leads to defining the organizational security operations, which involves the actual integration and deployment of the incident response procedures, the monitoring process, compliance with different standards, and implementation of security services (e.g., IPS, proxy authentication, and zone-based firewalls). The diagram presented above is an iterative process, and once the security operations are put into place, the process can step back and the business’s needs can be reassessed, leading to changes being made to the security policy. The network security system lifecycle is an ongoing framework that requires all of its components to be revised and updated periodically.
Security Policy and Procedures
The security policy is the main component of the network security system lifecycle, defined by RFC 2196 as a formal statement of the rules and guidelines that must be followed by the organization’s users, contractors, and temporary employees, and anybody who has access to the company’s data and informational assets. This general framework for organizational security implementation contains the different areas of the organization documented in a modular approach.
One way of approaching security policing is by examining the modular network design of the organization and developing a separate policy for each different module or a single policy that includes all the modules. The modular approach is also recommended when performing risk and threat assessments.
The security policy also creates a security baseline that allows future gap analysis to be performed in order to detect new vulnerabilities and countermeasures. The most important aspects covered by the written security policy and procedures are as follows:
- Identifying the company’s assets
- Determining how the organization’s assets are used
- Defining communication roles and responsibilities
- Describing existing tools and processes
- Defining the security incident handling process
A steering committee will review and eventually publish the security policy after all the component documents are finalized.
Cisco presents a four-step process that defines the security policy methodology that is part of the network security system lifecycle, as illustrated in Figure 8.13 below:
Figure 8.13 – Security Policy Methodology
The first step is to identify and classify the organization’s assets and assign them a quantitative value based on the impact of their loss. The next step is determining the threats to those assets, because threats only matter if they can affect specific assets within the company. One company may assign a higher priority to physical security than to other security aspects, such as protecting against reconnaissance attacks.
Next, a risk and vulnerability assessment is performed to determine the probability of the occurrence of threats. The next step is performed after the security policy is published, and it involves implementing cost-effective mitigation in order to protect the organization. This defines the actual tools, techniques, and applications used to mitigate the threats to which the company is vulnerable. The last step, which is often skipped by many organizations, involves periodically reviewing and documenting the developed security policy.
Many organizations have templates for developing the security policy and some of the common components are as follows:
- The acceptable use policy: This general end-user document defines the roles, responsibilities, and allowed processes, software, and hardware equipment. For example, certain file sharing applications or instant messaging programs can be forbidden.
- Network access control policy: This policy contains general access control principles and can relate to things such as password requirements, password storage, or data classification.
- Security management policy: This policy summarizes the organizational security mechanisms and defines ways to manage the security infrastructure with necessary tools (e.g., CiscoWorks or Cisco NAC).
- Incident handling policy: This document should describe the policies and procedures by which security incidents are handled. It can even include emergency-type scenarios such as Disaster Recovery plans or Business Continuity procedures.
- VPN policy: This dedicated policy covers the virtual private networking technologies used and the various security aspects that concern them. Different policies may be applied for teleworkers, remote access users, or site-to-site VPN users.
- Physical security policy: This involves physical security aspects such as access control (badges, biometrics, and facility security).
- Training and awareness: Ongoing training and awareness campaigns must sustain the organizational security policy, and this is especially applicable to new employees.
The following are the two driving factors behind the security policy:
- The business’s needs and goals
- Risk assessment
Network security requires a comprehensive risk management and risk assessment approach that will help lower the risks to acceptable levels for the organization. These acceptability levels will vary from organization to organization. The risk assessment process leads to the implementation of components included in the security policy. Risk assessment will also be accompanied by the cost-benefit analysis, which will analyze the financial implications of the mitigation (i.e., control) that will be put into place to protect specific assets. For example, money should not be spent protecting certain assets against threats that are not likely to occur.
The risk assessment process involves the following components:
- Severity
- Control
- Probability
These three components should explain what assets should be secured, their monetary value, and the actual loss that would result if one of those resources were to be affected. The severity and the probability aspects refer to the probability and impact of a certain attack on the organization. The control aspect defines how the policy will be used to control and minimize the risks.
The three components form a risk index (RI), which uses the following formula:
RI = (severity factor * probability factor) / control factor
where:
- The severity factor represents the quantitative loss of a compromised asset.
- The probability factor is a mathematical value of the risk actually occurring.
- The control factor is the ability to control and manage that risk.
For example, the severity factor may have a range of 1 to 5, the probability factor may have a range of 1 to 3, and the control factor may have the same range. Looking at a particular example, if the severity factor for a DoS attack on an e-mail server lasting two hours has a value of 3, the probability factor has a value of 2, and the control factor has a value of 1, then the calculated RI has a value of 6. This calculation should be applied to different areas of the network and should take into account different types of threats.
Risk assessment is an ongoing process that will experience continuous change due to new technologies emerging. The security policy must be updated in order to reflect these infrastructure changes. The following four steps to the risk assessment security lifecycle are illustrated in Figure 8.14 below:
- Secure
- Monitor
- Test
- Improve
Figure 8.14 – Risk Assessment Security Lifecycle
Securing implies using authentication and identification techniques, ACLs, packet inspection, firewall techniques, IDS and IPS technologies, VPNs, or encryption. The next step is monitoring the processes using Simple Network Management Protocol (SNMP) and Security Device Event Exchange (SDEE). Ongoing vulnerability testing should be provided, along with penetration testing and security auditing, in order to ensure the functionality of each process. The last step is an iterative process that helps improve different areas. Improving is based on data analysis, reports, summaries, and intelligent network design.
Trust and Identity Management
Trust and identity management is another key part of the Cisco Self-Defending Network initiative, and it is a critical aspect for developing secure network systems. Trust and identity management states who can access the network, what systems can access the network, when and where the network can be accessed, and how the access can occur. It also attempts to isolate infected machines and keep them off the network by enforcing access control, by which they are forced to update their signature databases and their applications.
Trust and identity management includes the following components:
- Trust
- Identity
- Access control
Trust is the relationship between two or more network entities, for example, a workstation and a firewall appliance. The trust concept will determine security policy decisions. If a trust relationship exists, communication is allowed between the entities. The trust relationship and the level of privilege can be affected by different postures (e.g., an outdated virus signature database or an unpatched system). Devices can be grouped into domains of trust that can have different levels of segmentation.
The identity aspect determines who accesses the network, including users, devices, or other organizations. The authentication of identity is based on the following attributes that make the connection to access control:
- Something that the subject knows (password or PIN)
- Something that the subject has (token or smartcard)
- Something that the subject is (biometrics, such as fingerprint, voice, or facial recognition)
The domains of trust can be implemented with Microsoft Active Directory implementation and they can be based on the Cisco design methodology. In large organizations and across the Internet, certificates play an important role in proving the user’s identity and the right to access information and services.
Access controls in enterprise organizations typically rely on AAA services. AAA solutions can use an intermediate authenticator device (e.g., a router, switch, or firewall) that can leverage some back-end services, such as Cisco Access Control Server (ACS) or various RADIUS or TACACS+ servers. Authentication establishes user or system identity and access to network resources, while authorization services define what users can access. The accounting part provides an audit trail that can be used for billing services (e.g., recording the duration of a user connection to a particular service). Most of the modern Cisco devices can act as authenticators and can pass user authentication requests to RADIUS/TACACS+ servers.
Secure Connectivity
Secure connectivity is another component of the Cisco Self-Defending Network that works closely with the trust and identity management concepts described above. This implies using secure technologies to connect endpoints. Examples include the following:
- Using IPSec inside the organization and over the insecure Internet
- Using SSH to replace insecure technologies, such as Telnet, for console access
- Using SSL/TLS (HTTPS) secure connectivity in web browsers
- Using solutions from service providers, such as Multi-Protocol Label Switching Virtual Private Networks (MPLS VPNs)
The primary goal of trust and identity services when combined with secure connectivity is infrastructure protection. This can be accomplished, from a Cisco standpoint, using a wide variety of integrated hardware security features, such as the following:
- Cisco ASA devices, including the 5500 family (ASA 5510, 5520, 5540, and so on)
- Routers using IOS security feature sets that include basic firewalls, zone-based firewalls, IPS functionality, IPSec VPNs, Dynamic Multipoint VPNs (DMVPNs), or SSL VPNs for web-based clients
- Cisco Catalyst switches with firewall, IDS, or VPN modules and other Layer 2 security features (e.g., 802.1x port-based authentication). The Cisco Catalyst 6500 series switch is a modular switch offering support for a wide variety of service modules that can help enhance network security. Examples of these modules include Cisco Firewall Services Module (FWSM), Cisco Intrusion Detection System Services Module (IDSM-2), and the Cisco SSL Services Module.
Threat Defense Best Practices
Some of the best practices for protecting the network infrastructure through trust and identity include the following:
- Using AAA services with the Cisco ACS server or other RADIUS/TACACS+ servers
- Using 802.1x
- Logging using Syslog and SDEE (the protocol used by Cisco IDS/IPS sensors to send information to the management stations) to create comprehensive reports
- Using SSH instead of Telnet to avoid any management traffic crossing the network in clear text
- Using secure versions of management protocols, such as SNMPv3 (it authenticates the client and the server), NTPv3, and SFTP
- Harden all network devices by making sure unnecessary services are disabled
- Using authentication between devices that are running dynamic routing protocols
- Using the Cisco one-step lockdown feature on network devices to harden them
- Using ACLs to restrict management access, allowing only certain hosts to access the network devices
- Using IPSec as an internal (encrypting management or other sensitive traffic) or external (VPN) solution
- Using Cisco Network Admission Control ( NAC ) solution, which ensures that network clients and servers are patched and updated in an automated and centralized fashion, with the newest anti-virus, anti-spam, and anti-spyware mitigation tools