SAFE AND SOUND

SAFE AND SOUND

INTRODUCTION Elements of Security Auditing Applications to Customers Network

Modular Approach User layer…….Server layer……..Network layer …………..interconnects (cabling)……………

User Layer Thin-clients, or physically-secure workstations Login + passworded access Access only to relevant services, applications Run background malware prevention software

Server Layer Remove unnecessary services User groups to match physical topology Don’t run services as root / admin Run OS as read-only

Network Layer Backup IOS, OS, data Distribute & centralise topology (failover, and ordered & documented design & layout) Use firewalls & logging Use IDS, IPS, traffic monitoring

Cabling Use more secure cable types Use patch-panels and colour-coding Layouts that make testing, fault-finding easy

Security Considerations

Network Threats Viruses Tend to be inadvertently activated ….or may be installed deliberately

Network Threats Worms Travel the internet, scanning for vulnerabilities Often disrupt networks by flooding, forking

Network Threats Spiders and webbots Can be used maliciously – Automated signups, website duplication, spam

Network Threats • Trojans • Masquerade as regular software • Tend to allow attacker to control infected machine

Network Threats Spyware and Phishing Information stealing, user profiling Used in advert targeting, spam, ID theft

Network Threats Spam Can contain other malware Congests networks

Network Threats Delete traces of intrusions Alter logs Forensics get-around Bombs

Solutions for Customer Separate physical network for WAN access Honeypot to track & ID intrusions Monitoring station for internal LANs

Solutions for Customer Honeypot Mimics internal network or DMZ Allows profiling of network threats

Solutions for Customer SAN - storage area network RAID 40 : RAID level 4 & RAID level 0 4 – block striping with parity: failure tolerant & faster rebuilds 0 – striping: faster writes

Solutions for Customer RAID 40

Tenable’s Security Center Each node is a router, hosts behind router

Advisor Parallel co-ordinate plot of firewall logs

Flamingo Port scan 1 source many targets

Rumint Visualisation Jamming Attack

Psad Nachi worm network behaviour Red nodes are ICMP packets

Web server log, Raju Varghese Spider attack on web server from single IP Red colouration indicates 5xx status codes

f i n Network monitoring visualisations from: http://www.secviz.org/category/image-galleries/graph-exchange

SAFE AND SOUND

Télécharger la présentation

Plus de contenu associé