© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Evaluating Security Solutions for the Network Defining Network Security

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Reasons for Network Security Defend against attacks Prevent unauthorized access Prevent data misuse and theft Comply with security legislation Comply with industry standards Comply with company policy

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Example: Legislation and Directives Legislation and industry directives that may affect organizational security include: GLBAThe Gramm-Leach-Bliley Act HIPAAHealth Insurance Portability and Accountability Act EU data protection Directive 95/46/EC SOXSarbanes–Oxley Act PCI DSSPayment Card Industry Data Security Standard

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Threats and Risks

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Reconnaissance and Vulnerability Scanning Determine active targets Determine running network services Determine operating system platform Find trust relationships Check for proper file permissions Identify user account information Port-scanning tools include: –Nmap– SuperScan –NetStumbler– Kismet

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Example: NMAP Screen

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Vulnerability Assessment Active (sending packets) or passive (sniffer) Published vulnerability information –CERT/CC –MITRE –Microsoft –Cisco security notices Reconnaissance tools –Nessus –MBSA –SAINT

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Gaining System Access Using knowledge of usernames and passwords –Improper escalation of privilege –Default administrative and service accounts –Gaining access to other systems via trust relationships Using social engineering –Physical access to information –Psychological approach Cracking captured passwords

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Integrity and Confidentiality Threats

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Availability Threats (Denial of Service)

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Everything Is a Potential Target Hosts are the preferred target for worms and viruses. –In the past year, large number of attacks targeted hosts. –Compromised hosts are often used as attack launch points (botnets). But there are other high-value alternative targets: –Infrastructure devices: routers, switches –Support services: DHCP servers, DNS servers –Endpoints: management stations, IP phones –Infrastructure: network capacity –Security devices: IDS and IPS

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Network Security in the System Lifecycle Business needs: What does your organization want to do with the network? Risk analysis: What is the risk and cost balance? Security policy: What are the policies, standards, and guidelines to address business needs and risk? Industry recommended practices: What are the reliable, well-understood, and recommended security recommended practices? Security operations: What is the process for incident response, monitoring, maintenance, and compliance auditing of the system?

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v What Is a Security Policy? A security policy is a formal statement of the rules by which people who are given access to an organizations technology and information assets must abide. RFC 2196, Site Security Handbook

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Why Is a Security Policy Needed? Sets the framework for the security implementation –Defines organizational assets and the way to use them –Defines and communicates roles –Helps determine necessary tools and procedures –Defines how to identify and handle security incidents Creates a baseline of the current security posture –Defines allowed and not-allowed system behaviors –Informs users of their responsibilities and ramifications of asset misuse –Provides risk assessment and cost-benefit analysis

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Network Security and Risks Network security can reduce risks to acceptable levels: –Risk assessment defines threats and their probability and severity. –A network security policy enumerates risks relevant to the network and describes how risks will be controlled or managed. –A network security design implements the security policy. Justify security costs by the potential cost and inconvenience of incidents.

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Risk Index Calculation RiskProbability (P) (1–3) Severity (S) (1–3) Control (C) (1–3) Risk Index (P * S) / C (–9)

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Example: Risk Index Calculation RiskProbability (P) (1–3) Severity (S) (1–3) Control (C) (1–3) Risk Index (P * S) / C (–9) 1. Breach of confidentiality of customer database DDoS attack sustained for more than 1 hour against e-commerce server 2214

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Components of a Security Policy

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Network Security Is a Continuous Process Secure –Identity and authentication –Filtering and stateful inspection –Encryption and VPNs Monitor –Intrusion detection and response –Content-based detection and response Test –Security posture assessment –Vulnerability scanning –Patch verification and application auditing Improve –Event and data analysis and reporting –Network security intelligence

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Integrate Security Design and Network Design Security services can reside inside network infrastructure. Security design coupled with network design is far more manageable. Recommended practice: Integrate security and network design. Integrated security and network design requires coordination.

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v Summary Security services must provide adequate protection to conduct business in a relatively open environment. –There are many types security threats and associated risks. –Each device on the network, such as a host, router, or switch, is a potential security target. Network security is part of the system life cycle. –Network security is a continuous process built around a security policy. –Security design and network design should be integrated.

© 2007 Cisco Systems, Inc. All rights reserved.DESGN v