Download
information systems security n.
Skip this Video
Loading SlideShow in 5 Seconds..
Information Systems Security PowerPoint Presentation
Download Presentation
Information Systems Security

Information Systems Security

112 Views Download Presentation
Download Presentation

Information Systems Security

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

  1. Information Systems Security Telecommunications Domain #7

  2. OSI Reference Model • Physical • Datalink • Network • Transport • Session • Presentation • Application

  3. Routing • Dynamic • RIP I • RIP II • OSPF • BGP

  4. Cabling Types - Coaxial • Copper wire insulated by braided metallic ground shield • Less vulnerable to EMI • Two main types • 10BASE2 (Thinnet) (185 meters) • 10BASE5 (Thicknet) (500 meters) • Mainly used in one-way networks (TV) • Two-way networks required special equipment • Larger minimum arc radius than TP

  5. Cabling Type - TP • Copper-based • Two major types • UTP • Least secure • Susceptible to EMI, cross-talk, and eavesdropping • Less security than fiber or coaxial • Most commonly used today • STP • Extra outer foil shielding

  6. Cabling Type - Fiber • Data travels as photons • Higher speed, less attenuation, more secure • Expensive and harder to work with • Two major types • Multimode • Less expensive with slower speed • Single mode • Faster speeds available but more $ and delicate

  7. Signal Issues • Attenuation • Interference from environment • Cable runs are too long • Poor quality cable • Cross Talk • Signals radiate from a wire and interfere with other wires • Data corruption • More of a problem with UTP

  8. Transmission Types • Analog • Carrier signal used to move data • Signal works at different frequencies • Used in broadband networks • Digital • Discrete units of voltage • Moves data in binary representation • Cleaner signal compared to analog

  9. Encoding Techniques

  10. Synchronous or Asynchronous • Sync • Prior agreement of data TX rules • Sending system sends a clocking pulse • Stop and start bits are not required • T-lines & optical lines use synchronous • Asynchronous • Must use start/stop bits • Dial-up connections use asynchronous

  11. Broadband or Baseband • Baseband • TX media only uses one channel • Digital signaling • Used over TP or Coax • Broadband • Multiple channels • TXs more data at one time • Can use analog signaling • Used over coax or fiber (at 100Mbps or more) • Can carry video, audio, data, and images

  12. Plenum Cable • Polyvinyl chloride can give off dangerous chemicals if burned • Plenum rated cable is made of safe fluoropolymers • Should be used in dropped ceilings and raised floorings and other ventilation areas

  13. Number of Receivers • Unicast • One system communicates to one system • Multicast • One system communicates to many systems • Class D addresses dedicated to this • “Opt-in” method (webcasts, streaming video) • Broadcast • One system communicates to all systems • Destination address contains specific values

  14. Types of Networks • Local Area Network (LAN) • Limited geographical area • Ethernet and Token Ring • Metropolitan Area Network (MAN) • Covers a city or town • SONET, FDDI • Wide Area Network (WAN) • ATM, Frame Relay, X.25

  15. Network Terms • Internet • Network of networks providing a communication infrastructure • The web runs on top of this Internet infrastructure • Intranet • Employs Internet technology for internal use • HTTP, web browsers, TCP/IP

  16. Network Terms • Extranet • Intranet type of network that allows specific entities to communicate • Usually business partners and suppliers • B2B networks • Shared DMZ area or VPN over the Internet

  17. Network Configuration • DMZ • Network segment that is between the protected internal network and the external (non-trusted) network • Creates a buffer zone • Systems in DMZ will be the 1st to come under attack and must be properly fortified

  18. Physical Layer • Network Topologies • Physical connection of system and devices • Architectural layout of network • Choice determined by higher level technologies that will run on it • Types (Bus, Ring, Star, Mesh)

  19. BUS • Nodes are connected to a backbone through drops • Linear bus – one cable with no branches • Tree – network with branches • Easy to extend • Single node failure affects ALL participants • Cable is the single point of failure

  20. Ring • Interconnection of nodes in circle • Each node is dependent upon the physical connection of the upstream node • Data travels unidirectionally • One node failure CAN affect surrounding nodes • Used more in smaller networks

  21. Star • All computers are connected to central device • Central device is single point of failure • No node-to-node dependencies

  22. Mesh • Network using many paths between points • Provides transparent rerouting when links are down • High degree of fault tolerance • Partial Mesh – Not every link is redundant • Internet is an example • Full Mesh – All nodes have redundancy

  23. Media Access • Dictates how system will access the media • Frames packets with specific headers • Different media access technologies • CSMA • Token Ring • Polling • Protocols within the data link • SLIP, PPP, L2F, L2TP, FDDI, ISDN

  24. Carrier Sense Multiple Access • CSMA/CD (Collision Detection) • Monitors line to know when it is free • When cable not busy, data is sent • Used in Ethernet • CSMA/CA (Collision Avoidance) • Listens to determine is line is busy • Sends out a warning that message is coming • All other nodes go into waiting mode • Used in 802.11 WLANs

  25. Wireless Standards (802.x) • 802.11 – 2.4 GHz range at 1-2 Mbps • 802.11b – 2.4 GHz up to 11 Mbps • 802.11a – 5 GHz up to 54 Mbps • 802.11g – 2.4 GHz up to 54 Mbps • 802.11i – Security protocol (replace WEP) • 802.15 – Wireless PANs • 802.16 – Wireless MANs

  26. Access Points • Connects a wireless network to a wired network • Devices must authenticate to the AP before gaining access to the environment • AP works on a specific frequency that the wireless device must “tune itself” to

  27. Service Set ID (SSID) • WLANs can be logically separated by using subnet addresses • Wireless devices and APs use SSID when authenticating and associating • Should not be considered a security mechanism

  28. Authenticating to the AP • Station sends probe to all channels looking for the closest AP • AP will respond with the necessary information and a request for credentials • If WEP key is required, AP sends a challenge to the device and device encrypts with key and send it back • If no WEP key, could request SSID value and MAC value

  29. Wired Equivalent Protocol (WEP) • Protocol used to encrypt traffic for all IEEE wireless standards • Riddled with security flaws • Improper implementation of security mechanisms • No randomness (uses the same password) • No Automated Dynamic Key Refresh Method (DKRM), requires manual refresh

  30. More WEP Woes • Small initialization vector values • Uses a 24-bit value • Exhaust randomness is as little as 3 hours • Uses stream cipher (RC4) • No data integrity • Use XORs – flip a bit in ciphertext the corresponding bit in plaintext is flipped

  31. Wireless Application Protocol (WAP) • Requires a different protocol stack than TCP/IP • WAP allows wireless devices to access the Internet • Provides functions at each of the OSI layers similar to TCP/IP • Founded in 1997 by cell phone companies

  32. Wireless Transport Layer Security • Security layer of the WAP • Provides privacy, integrity, and authentication for WAP applications • Data encrypted with WTLS must be decrypted and reencrypted with SSL or TLS

  33. Common Attacks • Eavesdropping on traffic and spoofing • Erecting a rogue AP • Man-in-the-middle • Unauthorized modification of data • War driving • Cracking WEP • Birthday attacks • Weak key attacks (airsnort, WEPCrack)

  34. War Driving • Necessary Components • Antenna (omnidirectional is best) • Sniffers (TCPDump, Ethereal) • NetStumbler, AirSnort, or WEPCrack • NetStumbler finds APs and Logs • Network name • SSID • MAC • Channel ID • WEP (yes or no)

  35. Wireless Countermeasures • Enable WEP • Change default SSID and don’t broadcast • Implement additional authentication • Control the span of the radio waves • Place AP in DMZ • Implement VPN for wireless stations • Configure firewall for known MAC and IP

  36. TCP/IP Suite • TCP – connection oriented transport layer protocol that provides end-to-end reliability • IP – connectionless network layer protocol that provides the routing function • Includes other secondary protocols

  37. Port and Protocol Relations • Well known port numbers are 0-1023 • FTP is 20 and 21 • SMTP is 25 • SNMP is 161 • HTTP is 80 • Telnet is 23 • HTTPS is 443 • Source is usually a high dynamic number while destination is usually under 1024

  38. Address Resolution Protocol (ARP) • Maps the IP address to the MAC address • Data link understands MAC, not IP • Element in man-in-the middle attacks • Intruder spoofs its MAC address against the destination’s IP address into ARP cache • Countermeasures • Static ARP, active monitoring, and IDS to detect anomalies

  39. ARP Poisoning • Insert bogus IP to MAC addressing mapping in remote system • Misdirect traffic to attacker’s computer • Ideal scenario for man-in-the-middle attack

  40. Internet Control Message Protocol (ICMP) • Status and error messaging protocol • Ping is an example • Used by hackers for host enumeration • Redirects traffic by sending bogus ICMP messages to a router

  41. Simple Network Management Protocol (SNMP) • Master and agent model • Agents gather status information about network devices • Master polls agent and provides an overall view of network status • Runs on ports 161 and 162

  42. Simple Mail Transfer Protocol (SMTP) • Transmits mail between different mail servers • Security issue with mail servers • Improperly configured mail relay • Sendmail functions

  43. Other Protocols • FTP • TFTP • Telnet

  44. Repeater Device • Works at the physical layer • Extends a network • Helps with attenuation • No intelligence built in

  45. Hub Devices • Works at the physical layer • Connects several systems and devices • Also called multipoint repeater/concentrators • All data is broadcast • No intelligence

  46. Bridge Device • Functions at the data link layer • Extends a LAN by connecting similar or dissimilar LANs • Filtering capabilities • Uses the MAC address • Forwards broadcast data • Transparent – Ethernet • Source Routing – Token Ring

  47. Switch Device • Transfers connection from one circuit to another • Faster than bridges • Originally made decisions based on MAC • Major functionality takes place at Data Link Layer • Newer switches work at the Network layer and use IP addresses

  48. Virtual LAN (VLAN) • Logical containers used to group users, systems, and resources • Does not restrict administration based upon the physical location of device • Each VLAN has its own security policy • Used in switches • Can be static or dynamic

  49. Router Device • Works at the network layer • Can connect similar or dissimilar networks • Blocks broadcast • Uses routing tables • Bases decisions on IP addresses • Can work as a packet filtering firewall wit the use of Access Control Lists