Hands-On Ethical Hacking and Network Defense

1. Hands-On Ethical Hacking and Network Defense Chapter 13 Protecting Networks with Security Devices

2. Objectives • Describe network security devices • Describe firewall technology • Describe intrusion detection systems • Describe honeypots Hands-On Ethical Hacking and Network Defense

3. Understanding Network Security Devices • Network security devices • Routers • Firewalls • Intrusion detection systems • Honeypots Hands-On Ethical Hacking and Network Defense

4. Understanding Routers • Routers are hardware devices used on a network to send packets to different network segments • Operate at the network layer of the OSI model • Routing protocols used by routers • Link-state routing protocol • Router advertises link-state to identify network topology and any changes on paths • Distance-vector routing protocol • Router passes its routing table to all routers participating on the network Hands-On Ethical Hacking and Network Defense

5. Understanding Basic Hardware Routers • Cisco routers are widely used in the networking community • More than one million Cisco 2500 series routers are currently being used by companies around the world • Vulnerabilities exist in Cisco as they do in any operating system • Security professionals must consider these vulnerabilities when conducting a security test Hands-On Ethical Hacking and Network Defense

6. Cisco Router Components • A Cisco router uses the Cisco Internetwork Operating System (IOS) to function • Components • Random access memory (RAM) • Holds the router’s running configuration, routing tables, and buffers • If you turn off the router, the contents stored in RAM are wiped out • Nonvolatile RAM (NVRAM) • Holds the router’s configuration file, but the information is not lost if the router is turned off Hands-On Ethical Hacking and Network Defense

7. Cisco Router Components (continued) • Components (continued) • Flash memory • Holds the IOS the router is using • Is rewritable memory, so you can upgrade the IOS • Read-only memory (ROM) • Contains a minimal version of the IOS used to boot the router if flash memory gets corrupted • Interfaces • Hardware connectivity points • Example: an Ethernet port is an interface that connects to a LAN Hands-On Ethical Hacking and Network Defense

8. Hands-On Ethical Hacking and Network Defense

9. Cisco Router Configuration • Configuration modes: • User mode • Administrator can perform basic troubleshooting tests and list information stored on the router • Router-name>, indicates that you are in user mode • Privileged mode • Administrator can perform full router configuration tasks • Router-name#, indicates that you are in privileged mode • By default, you are in user mode • Type “enable” or “en” to change to privileged mode Hands-On Ethical Hacking and Network Defense

10. Cisco Router Configuration (continued) • Once in privileged mode, you can change to two more configuration modes • Global configuration mode • Administrator can configure router settings that affect overall router operation • To use this mode, you enter the command config t at the Router-name# prompt • Router-name (config)# tells the user she is in global configuration mode Hands-On Ethical Hacking and Network Defense

11. Cisco Router Configuration (continued) • Once in privileged mode, you can change to two more configuration modes (continued) • Interface configuration mode • Administrator can configure an interface on the router • To use this mode, you enter global configuration mode first • Next, you enter the command for interface configuration mode and the interface name you want to configure • Router-name(config-if)# indicates you are in interface configuration mode Hands-On Ethical Hacking and Network Defense

12. Hands-On Ethical Hacking and Network Defense

13. Understanding Access Control Lists • There are several types of access control lists • We will focus on IP access lists • IP access lists • Lists of IP addresses, subnets, or networks that are allowed or denied access through a router’s interface • Two different types of access lists on Cisco router • Standard IP access lists • Extended IP access lists Hands-On Ethical Hacking and Network Defense

14. Standard IP Access Lists • Can restrict IP traffic entering or leaving a router’s interface based on source IP address • The syntax of a standard access list is as follows: access-list [list #] [permit|deny] [source address] [source wildcard mask] • [list #] is a number in the range of 1 to 99 • permit | deny] are keywords to permit or deny traffic • [source address] specifies the IP address of the source host • [source wildcard mask] signifies which bits of the source address are significant Hands-On Ethical Hacking and Network Defense

15. Hands-On Ethical Hacking and Network Defense

16. Standard IP Access Lists (continued) • Example: access-list 1 deny 173.110.0.0 0.0.255.255 access-list permit any • A wildcard mask is similar to a subnet mask • Example: access-list 1 deny 10.10.1.112 0.0.0.0 • The 0s used after the IP address signify that every octet in the IP address must match the IP address being filtered • Another example: access-list 1 deny 192.168.10.0 0.0.0.255 access-list 1 permit any Hands-On Ethical Hacking and Network Defense

17. Standard IP Access Lists (continued) • Cisco allows a shortcut for the mask 0.0.0.0 access-list 1 deny host 192.168.10.112 • Access lists always end with an implicit deny rule • To avoid this, you must add the “permit any” statement access-list 1 deny host 192.168.10.112 access-list 1 permit any • Steps for applying the access list to an interface • Enter global configuration mode • Create the access list • Enter interface configuration mode • Use the ip access-group command Hands-On Ethical Hacking and Network Defense

18. Standard IP Access Lists (continued) • Example Router> en Password ****** Router# config t Router(config)# access-list 1 deny 172.16.5.0 0.0.0.255 Router(config)# access-list 1 permit any Router(config)# int e0 Router(config-if)# ip access-group 1 out Router(config-if) Ctrl+z [to save and exit global configuration mode] Router# Hands-On Ethical Hacking and Network Defense

19. Extended IP Access Lists • Allow packet filtering based on • Source IP address • Destination IP address • Protocol type • Application port number • Syntax for extended IP access lists access-list [list #] [permit|deny] [protocol] [source IP address] [source wildcard mask] [destination IP address] [destination wildcard mask] [operator] [port] [log] • [list #] is a number in the range of 100 to 199 • [permit | deny] are keywords to permit or deny traffic Hands-On Ethical Hacking and Network Defense

20. Extended IP Access Lists (continued) • Syntax for extended IP access lists (continued) • [protocol] can be IP, TCP, UDP, ICMP, and so on • [source IP address] is the IP address of the source • [source wildcard mask] determines significant bits of source IP address • [destination IP address] is the IP address of the destination • [destination wildcard mask] determines significant bits of destination IP address • [operator] can be lt, gt, eq, or neq Hands-On Ethical Hacking and Network Defense

21. Extended IP Access Lists (continued) • Syntax for extended IP access lists (continued) • [port] port number of the protocol to be filtered • [log] logs all activity of the access list for the administrator • Example: access-list 100 deny tcp host 172.16.1.112 host 172.30.1.100 eq www Hands-On Ethical Hacking and Network Defense

22. Extended IP Access Lists (continued) • Applying an access list to an interface Router> en Password ****** Router# config t Router(config)# access-list 100 deny tcp host 172.16.1.112 host 172.30.1.100 Router(config)# access-list 100 permit any Router(config)# int e0 Router(config-if)# ip access-group 100 in Router(config-if) Ctrl+z Router# Hands-On Ethical Hacking and Network Defense

23. Understanding Firewalls • Firewalls are hardware devices or software installed on a system and have two purposes • Controlling access to all traffic that enters an internal network • Controlling all traffic that leaves an internal network • Advantages of hardware firewalls • They are usually faster than software firewalls • They can handle a larger throughput than software firewalls Hands-On Ethical Hacking and Network Defense

24. Understanding Firewalls (continued) • Disadvantage of hardware firewalls • You are locked into the firewall’s hardware • Advantage of software firewalls • You can easily add NICs to the server running the firewall software • Disadvantage of software firewalls • You might have to worry about configuration problems • They rely on the OS on which they are running Hands-On Ethical Hacking and Network Defense

25. Understanding Firewall Technology • Firewall technologies • Network address translation (NAT) • Access control lists • Packet filtering • Stateful packet inspection (SPI) Hands-On Ethical Hacking and Network Defense

26. Network Address Translation (NAT) • The most basic security feature of a firewall • With NAT, internal private IP addresses are mapped to public external IP addresses • Hiding the internal infrastructure • Port Address Translation (PAT) • Technology derived from NAT • This allows thousands of internal IP addresses to be mapped to one external IP address Hands-On Ethical Hacking and Network Defense

27. Access Control Lists • Access lists are used to filter traffic based on source IP address, destination IP address, and ports or services • Firewalls also use this technology • Creating access control lists in a firewall is a similar process to creating them in a router Hands-On Ethical Hacking and Network Defense

28. Packet Filtering • Packet filters screen packets based on information contained in the packet header • Protocol type • IP address • TCP/UDP port Hands-On Ethical Hacking and Network Defense

29. Stateful Packet Inspection (SPI) • Stateful packet filters record session-specific information about a network connection • Create a state table • Can help reduce port scans that rely on spoofing or sending packets after a three-way handshake • Stateful packet filters recognize types of anomalies that most routers ignore • Stateless packet filters handle each packet on an individual basis • Spoofing or DoS attacks are more prevalent Hands-On Ethical Hacking and Network Defense

30. Hands-On Ethical Hacking and Network Defense

31. Implementing a Firewall • Placing a firewall between a company’s internal network and the Internet is dangerous • It leaves the company open to attack if a hacker compromises the firewall • Use a demilitarized zone instead Hands-On Ethical Hacking and Network Defense

32. Demilitarized Zone (DMZ) • DMZ is a small network containing resources available to Internet users • Helps maintain security on the company’s internal network • Sits between the Internet and the internal network • It is sometimes referred to as a “perimeter network” Hands-On Ethical Hacking and Network Defense

33. Hands-On Ethical Hacking and Network Defense

34. Hands-On Ethical Hacking and Network Defense

35. Understanding the Private Internet Exchange (PIX) Firewall • Cisco PIX firewall • One of the most popular firewalls on the market Hands-On Ethical Hacking and Network Defense

36. Configuration of the PIX Firewall • Working with a PIX firewall is similar to working with any other Cisco router • Login prompt If you are not authorized to be in this XYZ Hawaii network device, log out immediately! User Access Verification Password: • This banner serves a legal purpose • General prompt example: Type help or '?' for a list of available commands. xyz> Hands-On Ethical Hacking and Network Defense

37. Configuration of the PIX Firewall (continued) • You should enter privileged mode to configure the PIX firewall • To enter configuration mode in PIX, you use the same command as on a Cisco router xyz# configure terminal xyz(config)# ? • Nameif is a PIX command to name an interface • PIX allows the administrator to assign values to an interface that designate its security level • Values can be from 0 to 100 Hands-On Ethical Hacking and Network Defense

38. Configuration of the PIX Firewall (continued) • Access lists • PIX enables an administrator to use descriptive names for the access list instead of numbers • PIX also uses the implicit deny rule Hands-On Ethical Hacking and Network Defense

39. Understanding Microsoft ISA • Microsoft’s software approach to firewalls • Microsoft Internet Security and Acceleration (ISA) Server • Functions as a software router, firewall, and IDS • ISA has the same functionality as any hardware router • Packet filtering to control incoming traffic • Application filtering through the examination of protocols • Intrusion detection filters • Access policies to control outgoing traffic Hands-On Ethical Hacking and Network Defense

40. IP Packet Filters • ISA enables administrators to filter IP traffic based on the following: • Source and destination IP address • Network protocol, such as HTTP • Source port or destination port • ISA provides a GUI for these configurations • A network segment can be denied or allowed HTTP access in the Remote Computer tab Hands-On Ethical Hacking and Network Defense

41. Hands-On Ethical Hacking and Network Defense

42. Hands-On Ethical Hacking and Network Defense

43. Application Filters • Can accept or deny data from specific applications or data containing specific content • SMTP filter can restrict • E-mail with specific attachments • E-mail from a specific user or domain • E-mail containing specific keywords • SMTP commands • SMTP Filter Properties dialog box • Administrator can filter a specific e-mail attachment based on a rule he or she configures Hands-On Ethical Hacking and Network Defense

44. Hands-On Ethical Hacking and Network Defense

45. Hands-On Ethical Hacking and Network Defense

46. Hands-On Ethical Hacking and Network Defense

47. Application Filters (continued) • Users/Domains tab in the SMTP Filter Properties dialog box • Administrator can filter e-mail messages sent from a user or from specific domains • As a security professional, you might be asked to restrict e-mails containing certain keywords • SMTP Commands tab • Administrator can prevent a user from running SMTP commands Hands-On Ethical Hacking and Network Defense

48. Hands-On Ethical Hacking and Network Defense

49. Hands-On Ethical Hacking and Network Defense

50. Hands-On Ethical Hacking and Network Defense