Defence Against Threats - Management, Firewall, Encryption

In defending against network attack, there are four sets of tools that will help you to keep your network secure against unauthorized access, monitoring, and network attacks:-

• Management


• Firewall


• Encryptions


• End Point Security

Management

The management is the main set of defense against network attacks. The following actions should be implemented as part of configuration management against network attacks.

Backup, Upgrade, Update, and Patch

The machines in the network should be running up-to-date because the latest update can provide more effective defense against network attacks. Whenever new malware is released, the operating systems need the current update with the latest versions of antivirus software. The best way to keep up-to-date against network attacks is to download security updates and patch from the operating system vendor.

The management needs to create central patch server for critical security patches. All other systems must have access from time to time. Any required security patches that are not installed to a host are automatically downloaded from the server and installed automatically user intrusion.

Backup is very important when defending against network attacks. Each computer should have the latest copy of the backup.  All your configuration files in your Operating Systems or Applications should have enough security.

Authentication, Authorization, and Accounting

Authentication, authorization, and accounting (AAA) network security services provide primary access control on a network device. AAA authenticate and control access to a network, its control the users what they can do while they are login.

Passwords

The password is very important to protect network devices against attacks, it is important to use strong passwords rather than using default password or to easy password. For password, implementation follows the below steps.

• Use complex password Including uppercase letters, lowercase letters, numbers, symbols, and spaces, if allowed.


• Use minimum 8 characters password, preferably 10 or more characters.


• Do not use common dictionary words for the password.


• Avoid passwords based on repetition, number sequences, letter sequences, usernames, relative or pet names, misspell words.


• Do not use biographical information, such as birthdates, ID numbers, ancestor names, or other easily identifiable pieces of information.


• Change passwords frequently.


• Do not write passwords down and leave them in clear places.


• Following are the examples of passwords

Weak Password

• Pakistan


• Yasir


• Nokia


• Khan1975


• 1234567

Strong Password

• P@12>fo<ur^1978


• No ^^&34@fsc^hub

On Cisco routers and switches, leading spaces are ignored for passwords, but spaces after the first character are the part of the passwords. The password which uses the space bar and creates a phrase made of many words which are called a passphrase.

Firewalls

A firewall is the most efficient security tools for protecting users from network attacks. The firewalls exist in between two or more networks controlling traffic and prevent unauthorized access between them. Personal firewalls are also installed on end systems. Following are different techniques which use a firewall for filtering:

• URL filtering - Prevents or allows access to websites using Keywords or URLs. Packet filtering – Uses MAC address or IP address to prevent or allows access.


• Application filtering - Prevents or allows access by specific application types.


• State full packet inspection (SPI) - Incoming packets must be valid responses from internal hosts. Voluntary packets are blocked unless permitted particularly. SPI also recognize and filter specific types of attacks.

Encryption

Encryption is used in defense against network attacks. It can give protection against eavesdropping and sniffer attacks. Internet Protocol Security (IPSec), Private Key Infrastructure (PKI),  and Virtual Private Networks (VPN) can secure a network against attacks.

Endpoint Security

Individual computer (host) system or device that acts as a network client. Common endpoints are laptops, desktops, servers, smartphones, and tablets. Securing and preventing these devices from network attack is the most challenging task for a network administrator. For securing endpoint must have well-documented policies, and the employees must be aware of these rules. The employees must be trained for proper using the network. The policies must include the use of antivirus software and host intrusion prevention.

Network Attacks

There are different types of network attacks that can harm computer network. The network attacks are classified into three main categories which are following:

• Reconnaissance attacks 


• Access attacks 


• Denial of service 

Reconnaissance Attacks

The attackers use internet tool for the reconnaissance attack, such as the whois and nslookup, to resolve the IP address of the host or the organization. Once the attacker resolves the IP address, then he can ping the public addresses to identify the address that is active. The attacker also can use ping sweep tool such as fping and gping that automatically pings addresses in the given range. The attacker can also use port scan and packet sniffing.

Access Attacks

the unauthorized manipulation of data, system access, or user privileges

This type of attack use vulnerabilities in the operating system authentication service; web and FTP services to get access to different types of account such as web account; databases and information services. This attack allows attackers unauthorized access to information that the attacker have no rights. The access attacks are classified into four types:

• Password attacks - The attackers use a different technique to get a password of the users, such as packet sniffers, Brute-force-attack and Trojan horse.


• Trust Exploitation – For this type of access attacks, the attacker can use active directory services and network files systems.

• Port Redirection – In this type of attack the attackers used compromised computer ports to get access on another computer on the network.

• Man-in-the-Middle – in this type of attack the attacker inter between the server and client.

Denial of Service Attacks

Denial of Service (DoS) attacks is the most difficult attack to avoid and eliminate. DoS attacks are required so little effort to execute but it is too damaging than other types of attacks. So DoS attacks need special attention from network security administrators. The DoS attack has many forms, to help prevent DoS attacks it is important to systems with the latest security update for operating system and application.

The Dos attacks prevent authorized peoples from using a service by using up system resources. following are some types of DoS attacks

• Disk space, bandwidth, buffers overloading


• Ping floods such as smurf


• Packet storms like UDP bombs and Fraggle


• Oversized packets such as ping of death


• Overlapping packet like winuke


• Unhandled data such as teardrop.

Types of Malware

Malware or malicious software is a program or code file that is dangerous and unsafe for a user computer. This code is specially designed to harm, interrupt, steal, delete, monitor or other illegal action on user computer or networks without any permission. The malware includes viruses, Trojan horse, worms, and spyware. 

Viruses

The virus is a kind of malware that spread out inserting a copy of itself into the user computer and fitting itself as a part of another program. It spreads from computer to computer. It reproduces and spread itself using programming files or document. A virus inserting or attaching itself to a valid program or document that supports macros to execute its code.

 A virus has the power to cause harmful or destructive effects, for example, harming the system software by corrupting or destroying data which causing denial-of-service (DoS) conditions. All types of viruses are attached to an executable file, that will not be active until a user runs this affected file. When a user opens the affected file, a viral code is executed also. Usually, the affected program work but; viruses overwrite other programs with copies of themselves, which destroys the computer programs completely. Viruses also spread when the software or document are copied or transferred from one computer to another.

Worms

Computer worms are a type of malicious software just like viruses. It is a self-replicating program that duplicates functional copies of themselves and can cause the same type of damage like a virus.  In comparing to viruses, which require infected host file to spread; worms are individual software and it does not require a host file, program or human help to spread.

The computer worms are not requiring attachment to a program to infect a host and enter a computer through vulnerability. The computer worms often use parts of a computer operating system that are automatic and invisible to the user.  It is usually, noticed when it consumes maximum system resources, slowing and halting the computer tasks.

Trojan Horses

Trojan horse is another harmful program for computers. The cyber-thieves used Trojan to gain access to the user's system. Users are usually tricked into loading and executing it on their systems by using some social engineering. Once it is executed on the user's computer; it can steal users important data, it can also get backdoor access to the user's system. Trojan horse can delete user data from the system. It is also used to activate and spread another malware program on the user’s computer.

Like viruses and worms, Trojan horses do not use the self-replicate method to infect other files.  It should spread through user interaction such download files from the internet; accepting files while chatting to unknown persons and opening an e-mail attachment from an untrusted source.

Types of Vulnerabilities

Weaknesses of the network which is intrinsic in every network and its device which included routers, switches, servers, desktops and even security devices e.g. firewall etc. Usually, the endpoints are under attacks, such as servers and desktop computers. Defending the privacy of information, securing from unauthorized access and shielding the network against attacks are the primary issue of network security professionals today. There are three primary vulnerabilities of the network. Which lead to various attacks on the network, including malicious code attacks and network attacks.

Technological

• HTTP, ICMP, and FTP are basically insecure. SMTP and NSMP are related to the insecure structure upon which TCP was designed.


• The operating system UNIX, Linux Mac OS, Mac OSX, Window has the security problem that must be considered by network administrators.


• There is various type of network equipment, such as switches, routers, and firewalls. These all have a security weakness including password protection, lack of authentication, protocols and firewall weakness that must be acknowledged and protected.

 Configuration

The vulnerabilities of configuration are following:-

• User Account Information may be transmitted over the network insecurely, which exposing username and passwords.


• Another common vulnerability is easily guessed password and username. The system account password must contain uppercase latter, lower case latter, figures, and signs.


• Javascript in the web browser, enabling attacks by way of hostile javascript when accessing untrusted sites.IIS, FTP, and terminal services also pose problems


• The difficult setting of devices enables security holes.


• Misconfiguration of the equipment is also a big security problem.

Security policy

The vulnerabilities of security policy are following:-

• An un-written security policy cannot be consistently applied.


• Default password and poorly chosen password like dictionary word can easily allow hackers unauthorized access to the network.


• Unauthorized changes to the hardware and software which not meet the policy can create security risks

Types of Threats

Threats to the network security are an emergent problem for the individual as well as organizations in the whole world, and the threats become worse and multiply day by day. Computer networks are necessary for everyday activities and both the Individuals and organizations depend on their computers and networks.

Intrusion to these computers by an illegal person can result in network breakdown and loss of data and works. Attacks on a network can be disturbing, which result in a loss of time and money due to damage or theft of significant information.

The Intruders can enter into the network through software vulnerabilities, through guess someone's username and password and hardware attacks. An intruder is an individual commonly called hacker or software that enters a computer without authorization. When intruder (hacker) successfully gains access to the network, four types of threats may happen:-

Loss of Data and manipulation

When hacker successfully enters to someone computer, he destroys or alters data records. Examples sending a virus that reformats a computer's hard drive and breaking into a records system to change information.

Information Theft

In this case when intruder gain access to the computer which obtains confidential information. The intruder used this Information for different purposes and he also sold this information.

Identity Theft

The individual usually obtains the personal document on their personal computer.  The intruder stole this personal information. Using this information, an intruder can get legal documents, make an unauthorized purchase and apply for credit.

Disruption of service

If the intruder can't get in, then he tries to ensure that no one else can, either. This is the Dos (denial-of-service attack). This kind of threat does not try to get information directly, depending on which service crashes under the load, their effect can expose other resources that were previously protected.

Physical Security Threats

The physical security is another important aspect of network security. The aspects of physical security must be dealt with in an organizational policy. The physical security has four classes of physical threats are:

• Hardware threats– hardware threat is physical damage network devices, servers, and workstations.


• Electrical threats– This threat is about the input voltage, the voltage may be insufficient, voltage spikes, unconditioned power, and complete power loss


• Maintenance threats– This threat is about poor handling of electrical components, poor cabling and labeling and lack of spare parts.


• Environmental threats– Environment threat also important, the temperature too hot or too cold and humidity too wet or too dry are the environmental threats.

To Limit the physical damage to equipment, make a security plan is as follow:-

• Lockup equipment


• Prevent unauthorized access


• Maintain electronic logs of entry and exits


• Use security cameras

The figure below illustrates a general floor plan for a secure computer room for a network. 

Small Network Growth

Growth is a natural process for many small businesses, it must grow up with the passage of time. Many of larger companies start as small companies. The world-leading Microsoft company start with two persons.  A strategic plan will help you to grow your company. Ideally, the network administrator has much time to make smart decisions about increasing the network in sequence with the growth of the company. To balance a network and take a decision the below elements are used to scale a small network into a large network.

Network documentation – diagram of the physical and logical topology

Device inventory – The list of devices included in the network

Budget - itemized IT budget, including fiscal year equipment purchasing budget

Traffic analysis - protocols, applications, services and their respective traffic requirements e.g. bandwidth and disk/storage capacity should be documented a planned.

Network segmentation requirements. Based on performance, Security, Management, and availability requirement.

Protocol Analysis

When a network is growing, it is important to understand the type of traffic that will be crossing the network including current traffic flow. If the types of traffic are not known; a protocol analyzer can help recognize the traffic and its source. During peak hours try to capture the network traffic to find out the traffic types. Also, perform capture on different network segments for better understand. The figure below illustrates the network analyzer for different segments.

The protocol analyzer is analyzing the bases of its source and destination as well as the type of traffic being sent. The analysis can be used to make decisions on how to manage the traffic efficiently when relocating a server. 

Employee Network Utilization

When the network is growing, it is very necessary for a network administrator to understand; how network usage is going to change.

In addition to understanding changing traffic trends, a network administrator must also be aware of how network use is changing. The small network administrator has the capability to get  “snapshots” of employee application utilization for an important portion of the employee workforce time to time. These snapshots may contain information about:

• Operating system and its Version


• Both Network and Non-Network work application


• CPU, Drive and RAM Utilization

Common Applications

Without applications, the network is not too useful. The applications are software programs that used to communicate over the network or process that giving access to the network. The application has two types, network application and application layer services.

Network Applications

The network applications are used to communicate over the network. Some end-user applications apply application layer protocols and are able to communicate straight with the lower layers of the protocol stack. Email clients are the example of this type of application.

Application Layer Services

Network print spooling and file transfer over the network is required application layer services to use network resources. These services are the software programs that interface with the network and organize the data for transfer. Several types of data e.g. text, graphics audio, and video are required different network services to make sure that the data is perfectly ready for processing.

Each application or network service uses protocols, which describe the standards and formats to be used for data. There is no way to format data without common network protocols. Before understanding the role of network services, the understanding of protocols is very important. In the Windows operating system, we can view the current application, services, and running process as shown in the above figure. Following are the common protocols uses in networking:-

DNS

DNS was created to change the numeric address into a simple, recognizable name. The DNS is short for Domain Name System (or Service or Server). 

Telnet

Telnet is a service that allows network administrators to log in to a host remotely and control the host just like they are working locally.

Email Server

SMTP, POP3, or IMAP are used to send email messages from clients to servers over the Internet.

DHCP Server

DHCP is the service that assigns the IP address, subnet mask, default gateway, and other information to clients automatically.

Web Server

Web server is used to transfer information and data between web clients and web servers

the majority of websites are accessed using HTTP (Hypertext Transfer Protocol)

FTP Server

The FTP service allows download and uploads files between a client and server

Voice and Video Applications

Streaming media is too much important for businesses to communicate with customers as well as their business partners. The network administrators must care that the equipment is properly configured, installed and it’s meet the requirements of real-time applications. The administrator must determine whether the present switches and cabling can support the traffic that will be added in near future.  

VoIP

VOIP stands for Voice Over Internet Protocol. In common terms, VOIP is call service over the Internet.
VOIP is required quality Internet connection for getting a phone service through Internet connection instead of the local phone company. VoIP can also be used with traditional phone service because VOIP service providers typically give low call rates than traditional phone services.

We can use a traditional phone set using ATA (analog telephone adopter). The ATA adopter converts the analog signal into digital IP packets and vice versa. The device is attached between a traditional analog phone and the Ethernet switch. VoIP is too much less expensive than an integrated IP telephony solution, but the quality does not meet the same standards

IP Telephony

In IP telephony the ATA adopter is no more required because the IP phone itself performs the voice-to-IP conversion. The IP phones use a separate server for call control and signaling.

Real-time Applications

A real-time application is a software program that works within a time frame that the user senses as current. This kind of software uses Real-Time Transport Protocol (RTP) and Real-Time Transport Control Protocol (RTCP). The QoS mechanism controls the latency of less than a defined value, which usually measured in seconds. Video conferencing application, online gaming video chatting are the examples of Real-time applications