Chapter 11: Network Security

Computer security has become increasingly important because of which acts?

1) Sarbanes-Oxley Act (SOX)
2) Health Insurance Portability and Accountability Act (HIPAA)

A company of any size can be the target of a cyberattack

True

What are the 3 main reasons for an increase in computer security?

1) being a cybercriminal is a profession
2) Hacktivism
3) Increase in mobile devices makes a fertile environment for exploitation

Why do networks need more security?

1) Organizations have become dependent on data communication networks
2) huge losses with security failures (~3.5 million per breach)
3) Protecting customer privacy and preventing identity theft

What are the three primary goals in providing security?

1) Confidentiality: refers to the protection of organizational data from unauthorized discloser of customer and proprietary data
2) Integrity: the assurance that data have not been altered or destroyed
3) Availability: providing continuous operation of the organization’s hardware and software.

Threats can be classified into what two categories?

1) Ensuring business continuity (IA)
- disruptions, destruction, disasters
2) Preventing unauthorized access (CI)

Developing a secure network means…

developing controls for it

What are network controls?

software, hardware, rules, or procedures that reduce or eliminate the threats to network security. They are reviewed periodically.

What the 3 types of network controls?

1) Preventive controls
2) Detective controls
3) Corrective controls

Preventive controls

mitigate or stop a person from acting or an even from occuring

Detective controls

reveal or discover unwanted events

Corrective controls

remedy an unwanted event or an intrusion

The first step in developing a secure network is to conduct…

a risk assessment

What are the most common risk assessment frameworks?

1) OCTAVE
2) COBIT
3) NIST guide

What are the 5 common steps to risk assessment?

1) Develop risk measurement criteria
2) Inventory IT assets
3) Identify threats
4) Document existing controls
5) Identify improvements

Risk measurement criteria are the ____ used to evaluate the way a security threat could affect the organization. Each organization needs to develop its own _____.

measures; set

What are five most common risk measurement criteria?

1) Financial
2) Productivity
3) Reputation
4) safety
5) Legal

The next step of developing risk measurement criteria is to…

develop specific measures of what could happen in each impact area (high, medium, low impact)

Asset

something of value (hardware, software, data, application)

An important type of asset is the ______ and the next is the organizations ____

mission-critical application; data

After all assets are identified, they need to be rated for ___

importance

Threat

potential occurrence that can do harm, interrupt the systems using the network, or cause a monetary loss to the organization (after we identify the threat scenarios)

A threat scenario begins with the ___ of the asset and the threat being ____.

name; considered

In a threat scenario, the consequences of the threat are assessed and we calculate the relative risk score by…

multiplying the impact score by the likelihood

Risk control strategy

the way an organization intends to address a risk

What are the four ways an organization can address risk?

1) Accept risk: no action to address it, accept consequences
2) Mitigate risk: implementation of some control to counter threat or minimize its impact
3) Share risk: buying insurance
4) Defer risk: collect information about the risk and threat.

Most organizations face so many threats that they can’t afford to mitigate them all so they focus on what first and second?

1) highest risks
2) threat scenarios whose mitigation controls have low adequacy

_____ means that the organization’s data and applications will continue to operate even in the face of disruption, destruction, or disaster

Business continuity

A business continuity plan what 2 major parts?

1) Development of controls that will prevent these events from having a major impact on the organization
2) disaster recovery plan

What are 5 major threats to business continuity?

1) Viruses
2) Theft
3) Denial of service attacks
4) Device failure
5) Disaster

Special attention must be paid to preventing malware such as computer ____ and _____

viruses; ransonware

Most _____ attaches itself to other programs or USB drives and is often spread by downloading files from the Internet

malware

Macros viruses

can spread when an infected file is simply opened

Worm

special type of virus that spreads itself without human invention

What is the best way to prevent the spread of viruses?

install antivirus software

With a _____ attack, an attacker attempts to disrupt the target by flooding it with messages (1 billion packets/sec_

denial of service (DoS)

DDoS agent, zombie, bot

The attacker breaks into and takes control of thousands of computers or smart device and plants software on them

The attacker can use a_____ to control DDoS agents

DDoS handler (botnet)

Traffic-filtering (to prevent DoS)

Configure the main router for your Internet to verify that the source address of all incoming messages is in a valid address range for that connection

Traffic-limiting (to prevent DoS)

Configure the main router (firewall) to limit the number of incoming packets that could be DoS/DDoS attack packets that it allows to enter the network

Traffic anomaly detector (to prevent DoS)

Installed in front of a main router that monitors normal traffic patterns and learns what normal traffic looks like. When it recognizes a DoS attack it quarantines those incoming packets but allows normal traffic.

One often overlooked security risk is theft

True

______ is a key component of theft protection. One of the most common targets for these thefts is ______

physical security; laptop computers

Not every computerized device will fail

False

The best way to prevent a failure from impacting business continuity is to build what into the network?

redundancy

Redundancy is ____ and also applies to ____-

expensive; servers

uninterruptible power supply (UPS)

a device that detects power failures and permits the devices attached to it to continue to operate

Redundant array of independent disks (RAID)

storage technology that is made of many separate disk drives

A ____ is an event that destroys a large part of the network and computing infrastructure in one part of the organization

disaster

The most important elements of the disaster recovery plan are ___ and ___ controls that enable the organization to recover its data and restart its application software

backup; recovery

Continuous data protection (CDP)

another option that firms are using in addition to or instead of regular backups (copies of all data and transactions on certain servers are written to CDP servers as the transaction occurs)

Disaster recovery drill

tests the disaster recovery plan and provides staff the opportunity to practice their skills

Most large organizations have what two level disaster recovery plan?

1) Purposely build networks to have enough capacity and spare equipment to recover from minor disaster
2) most large organizations rely on professional disaster recovery firms to provide second-level support for major disasters

Full service disaster recover firms include a _______ networked data center that clients can use when they experience a disaster

complete

What is the second main type of security problem, and the one that receives the most attention

Intrusion

Four types of intruders who may attempt to gain unauthorized access to computer networks

1) script kiddies
2) hackers and crackers
3) professional hackers
4) organization employees who gain access to information they are not allowed to use

A ____ is critical to controlling risk due to intrustion. Defines the important assets to be safeguarded and the important controls needed to do that. Has a section devoted to what employees should/shouldn’t do

security policy

What are the three basic access points into most networks?

1) Internet (most common for intrusion)
2) LANs
3) WLANs

A _____ is commonly used to secure an organization’s Internet connection

firewall

What is a firewall?

A router/special-purpose device that examines packets flowing in and out of the network and restricts access to the organizations network.

Where are firewalls placed?

Mostly placed between every network connection between the organization and Internet

What are the 3 types of firewalls?

1) Packet-level firewall
2) Application-level firewall
3) Network address translation firewall

Packet-level firewall

examines the source and dest. address of every packet that passes (only allows acceptable ones in/out)

The network manager writes what set of rules for the packet-level firewall?

access control list (ACL)

Application-level firewall

more expensive and complicated to install and manage than a packet-level firewall because they have rules for each application they process

Application level firewalls can use _____

stateful inspection

Stateful inspection

Application-level firewalls use this to monitor and record the status of each connection and can use this information in making decisions about what packets to discard as security threats

Many application-level firewalls prohibit external users from uploading executable files

True

Network address translation (NAT)

is the process of converting between one set of public IP addresses that are viewable from the Internet and a second set of private IP address that are hidden from people outside the organization (NAT is transparent)

If external intruders on the Internet can’t see your private ___ address inside your organization, they can’t ____ your computers

IP; attack

Most routers and firewalls today have what built into them?

NAT

The NAT firewall uses ____ to translate the private IP addresses (organization) → proxy IP addresses (Internet)

address table

security hole

a bug that permits unauthorized access (once one is discovered it is circulated through the Internet)

The minimum level of security for OSs is…

C2

Trojan horses

remote access management consoles that enable users to access a computer and manage it far away. (rootkits)

Trojans are usually concealed in other software that unsuspecting users might download over the Internet. What are three types of Trojans?

1) Spyware
2) Adware
3) DDoS agents

One of the best ways to prevent intrusion is …

encryption

Encryption

the process of disguising information

Decryption

the process of restoring encrypted material into its readable form

Symmetric encryption

The key used to encrypt a message is the same as the one used to decrypt it

Asymmetric encryption

the key used to decrypt a message is different from the key used to encrypt it

Symmetric encryption is comprised of these two parts…

1) The algorithm (doesn’t need to be secret)
2) The key (secret)

Two of the most popular encryption techniques are…

1) Data Encryption Standard (DES)
2) Advanced Encryption Standard (AES)

(U.S government sees encryption as a weapon and regulates its export)

Public key encryption

Based on one-way functions.
Asymmetric, so there are two keys:
1) public key: encrypts the message
2) private key: decrypts the message

Public key encryption also permits the use of _______ through a process of ____

digital signatures; authentication

Public key encryption algorithms are ____, meaning the text encrypted with either key can be decrypted by the other.

invertible

(normally we encrypt with public key and decrypt with private but you could do it in reverse)

Public Key Infrastructure (PKI)

a set of hardware, software, organizations, and policies designed to make public key encryption work on the Internet. Uses Certificate authority (CA)

Certificate authority (CA)

issues a digital certificate that is the requestors public key encrypted using the CA’s private key as proof of identity.

Pretty Good Privacy(PGP)

freeware public key encryption package that is often used to encrypt email

Secure Sockets Layer (SSL)

encryption protocol widely used on the Web (decrypts and encrypts between application layer and transport layer)

IP Security Protocol (IPSec)

Can operate in either transport or tunnel mode for VPNs

IPSec transport mode

IPSec encrypts just the IP payload, leaving the IP packet header unchanged so it can be easily routed through the Internet

IPSec tunnel mode

IPSec encrypts the entire IP packet and adds an entirely new IP packet that contains the encrypted packet as well as the IPSex AH or ESP packets

User authentication

only authorized users are permitted to enter the network which is absed on the user profile

What are ways of user authentication?

1) password
2) pass phrases
3) password managers
4) two-factor authentication
5) one-time passwords
6) biometric systems

Central authentication

Instead of logging into a file server the user logs into an authentication server which issues a certificate (Kerberos)

Social engineering

refers to breaking security simply by asking (phishing)

Intrustion prevention systems detect an intrustion and take action to stop it. What are the two general types?

1) Network-based IPS: an IPS sensor is placed on key network circuits
2) Host-based IPS: software package installed on a host or server

(both are usually installed)