Lecture CCNA Exploration 4.0 (Kỳ 4) - Chapter 4: Network security

Chia sẻ: You Can | Ngày: | Loại File: PDF | Số trang:157

Thêm vào BST

Báo xấu

46
lượt xem 5
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

In this chapter, you will learn to: Identify security threats to enterprise networks. Describe methods to mitigate security threats to enterprise networks. Configure basic router security. Disable unused router services and interfaces. Use the Cisco SDM one-step lockdown feature. Manage files and software images with the Cisco IOS Integrated File System (IFS).

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Lecture CCNA Exploration 4.0 (Kỳ 4) - Chapter 4: Network security

Chapter 4 – Network Security CCNA Exploration 4.0 1
Introduction Học viện mạng Bach Khoa - Website: www.bkacad.com
Why is Network Security Important?
Why is Network Security Important? • Computer networks have grown in both size and importance in a very short time. • If the security of the network is compromised, there could be serious consequences, such as loss of privacy, theft of information, and even legal liability. Học viện mạng Bach Khoa - Website: www.bkacad.com
The Increasing Threat to Security Animation 4.1.1.2 • As shown in the figure, in 1985 an attacker had to have sophisticated computer, programming, and networking knowledge to make use of rudimentary tools and basic attacks. • As time went on, and attackers' methods and tools improved, attackers no longer required the same level of sophisticated knowledge. This has effectively lowered the entry-level requirements for attackers. • People who previously would not have participated in computer crime are now able to do so. Học viện mạng Bach Khoa - Website: www.bkacad.com
Some of the Security Terms • White hat -An individual who looks for vulnerabilities in systems or networks and then reports these vulnerabilities to the owners of the system so that they can be fixed. • Hacker -A general term that has historically been used to describe a computer programming expert. More recently, this term is often used in a negative way to describe an individual that attempts to gain unauthorized access to network resources with malicious intent. • Black hat -Another term for individuals who use their knowledge of computer systems to break into systems or networks that they are not authorized to use, usually for personal or financial gain. A cracker is an example of a black hat. • Cracker -A more accurate term to describe someone who tries to gain unauthorized access to network resources with malicious intent. • Phreaker -An individual who manipulates the phone network to cause it to perform a function that is not allowed. A common goal of phreaking is breaking into the phone network, usually through a payphone, to make free long distance calls. • Spammer -An individual who sends large quantities of unsolicited e-mail messages. Spammers often use viruses to take control of home computers and use them to send out their bulk messages. • Phisher -Uses e-mail or other means to trick others into providing sensitive information, such as credit card numbers or passwords. A phisher masquerades as a trusted party that would have a legitimate need for the sensitive information. Học viện mạng Bach Khoa - Website: www.bkacad.com
Think Like a Attacker • Step 1 – Perform footprint analysis (reconnaissance). Scan information and build a picture of the security profile or "footprint" of the company. • Step 2 – Enumerate information. – An attacker can expand on the footprint by monitoring network traffic with a packet sniffer such as Wireshark, finding information such as version numbers of FTP servers and mail servers. • Step 3 – Manipulate users to gain access. • Step 4 – Escalate privileges. After attackers gain basic access, they use their skills to increase their network privileges. • Step 5 – Gather additional passwords and secrets. With improved access privileges, attackers use their talents to gain access to well-guarded, sensitive information. • Step 6 – Install backdoors. Backdoors provide the attacker with a way to enter the system without being detected. The most common backdoor is an open listening TCP or UDP port. • Step 7 – Leverage the compromised system. After a system is compromised, an attacker uses it to stage attacks on other hosts in the network.
Types of Computer Crime • Insider abuse of network access • Virus • Mobile device theft • Phishing where an organization is fraudulently represented as the sender • Instant messaging misuse • Denial of service • Unauthorized access to information • Bots within the organization • Theft of customer or employee data • Abuse of wireless network • System penetration • Financial fraud • Password sniffing • Key logging • Website defacement • Misuse of a public web application • Theft of proprietary information • Exploiting the DNS server of an organization • Telecom fraud • Sabotage Học viện mạng Bach Khoa - Website: www.bkacad.com
Open versus Closed Networks • The overall security challenge facing network administrators is balancing two important needs: – keeping networks open to support evolving business requirements – and protecting private, personal, and strategic business information. Học viện mạng Bach Khoa - Website: www.bkacad.com
Open versus Closed Networks • Open Access : – An open security model is the easiest to implement . – Simple passwords and server security become the foundation of this model. – If encryption is used, it is implemented by individual users or on servers. – LANs, which are not connected to the Internet or public WANs, are more likely to implement this type of model. Học viện mạng Bach Khoa - Website: www.bkacad.com
Open versus Closed Networks • Restrictive Access: – A restrictive security model is more difficult to implement . – Firewalls and identity servers become the foundation of this model. – LANs, which are connected to the Internet or public WANs, are more likely to implement this type of model. Học viện mạng Bach Khoa - Website: www.bkacad.com
Open versus Closed Networks • Closed Access: – A closed security model is most difficult to implement. All available security measures are implemented in this design. – This model assumes that the protected assets are premium, all users are not trustworthy, and that threats are frequent. – Network security departments must clarify that they only implement the policy, which is designed, written, and approved by the corporation. Học viện mạng Bach Khoa - Website: www.bkacad.com
Developing a Security Policy • A security policy meets these goals: 1. Informs users, staff, and managers of their obligatory requirements for protecting technology and information assets 2. Specifies the mechanisms through which these requirements can be met 3. Provides a baseline from which to acquire, configure, and audit computer systems and networks for compliance with the policy Học viện mạng Bach Khoa - Website: www.bkacad.com
Developing a Security Policy • ISO/IEC 27002 is intended to be a common basis and practical guideline for developing organizational security standards and effective security management practices. The document consists of 12 sections: 1. Risk assessment 2. Security policy 3. Organization of information security 4. Asset management 5. Human resources security 6. Physical and environmental security 7. Communications and operations management 8. Access control 9. Information systems acquisition, development, and maintenance 10. Information security incident management 11. Business continuity management 12. Compliance Học viện mạng Bach Khoa - Website: www.bkacad.com
Common Security Threats
Vulnerabilities • Vulnerability is the degree of weakness which is inherent in every network and device. This includes routers, switches, desktops, servers, and even security devices. • There are three primary vulnerabilities or weaknesses: 1. Technological weaknesses 2. Configuration weaknesses 3. Security policy weaknesses Học viện mạng Bach Khoa - Website: www.bkacad.com
Vulnerabilities Học viện mạng Bach Khoa - Website: www.bkacad.com
Threats to Physical Infrastructure • The four classes of physical threats are: 1. Hardware threats -Physical damage to servers, routers, switches, cabling plant, and workstations 2. Environmental threats -Temperature extremes (too hot or too cold) or humidity extremes (too wet or too dry) 3. Electrical threats -Voltage spikes, insufficient supply voltage (brownouts), unconditioned power (noise), and total power loss 4. Maintenance threats -Poor handling of key electrical components (electrostatic discharge), lack of critical spare parts, poor cabling, and poor labeling • Here are some ways to mitigate physical threats: 1. Hardware threat mitigation 2. Environmental threat mitigation 3. Electrical threat mitigation Học viện mạng Bach Khoa - Website: www.bkacad.com
Physical Threat Mitigation • Hardware • Environmental Học viện mạng Bach Khoa - Website: www.bkacad.com
Physical Threat Mitigation • Electrical • Maintenance Học viện mạng Bach Khoa - Website: www.bkacad.com