Network Technologies and Tools

Install and configure network components, both hardware and software-based, to support organizational security.

Firewalls

Isolate one network from another
A network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules (Cisco)
Hardware (appliances), software or both
Network or host-based

Packet filter
- Passes or blocks traffic to specific ports or IP addresses based on rules
- Access Control List (ACL) filter
- Little intelligence / stateless
- Faster than stateful inspection
Proxy firewall
- Acts as an intermediary
- Application Proxy
- Web Proxy
Stateful packet inspection
- Intelligent
- Analyzes data flows and traffic patterns
- Dynamic access control decisions
- Records are kept using a state table that tracks every communications channel;
- Remembers where the packet came from and where the next one should come from.

Configured to specify computers, programs, services, or ports or protocols
Order of firewall rules matters
Implicit deny
- Access or resource availability is restricted to only those that are explicitly granted access; all others are denied
- Deny any any <- last firewall or ACL rule

Controls input, output, and/or access from, to, or by an application or service based on categories, rules, or heuristics.
Deep packet inspection
Function at Layer 7 of the OSI model
Web Application Firewall (WAF)
- Protects web applications from known attacks (Injection, Buffer Overflows, etc-)
Often included in other firewall types (Proxy, IDS/IPS)

Intrusion — any activity or action that attempts to undermine or compromise the confidentiality, integrity, or availability of resources
Intrusion Detection / Protection Systems
Like a burglar alarm — Identify unauthorized activity, access or anomalies
Sensor— the IDS component that collects data from the data source and passes it to the analyzer
Host-based — On individual systems
Network-based — On the network borders

Passive response
- Logging
- Notification
- Shunning/Quarantine
Active response
- Terminating process or sessions
- Configuration changes
- Deception active response – Attacker believes the attack is succeeding while the system monitors the activity and potentially redirects the attacker to a honeypot or logging system

Signature based (aka knowledge-based)
- Detects known vulnerabilities
- Rules/updates provided by vendor
- Reactive
Behavior-based
- Outside of normal bounds / establish profile
- Anomaly-based
- Potential for false positives
Heuristic-based
- Uses algorithms to analyze the activity / network traffic
- High initial overhead

False Positive — Occurs when a typical or expected behavior is identified as irregular or malicious

False Negative — Occurs when an alert that should have been generated did not happened

A virtual private network (VPN) allows remote access into a network
- Site-to-Site
- User (host-to-site)
VPN concentrator
- Single device to funnel all VPN access / Connects VPN nodes
- Encrypted tunnels
- Centralized authentication (RADIUS, Kerberos, Federated ID)
Always-on VPN
Network security through encryption
- Internet Protocol Security (IPsec)
- Secure Sockets Layer (SSL)

Provides authentication services and encapsulation of data through support of the Internet Key Exchange (IKE) protocol
Functions within the IP / Network layer (layer 3)
Three Services:
- Data verification
- Data tampering protection
- Private transactions
Two separate (mutually exclusive) protocols
- Authentication Header (AH) – authentication and integrity checking for data packets
- Encapsulating Security Payload (ESP) — encryption services

Full tunnel — all requests are routed and encrypted through the VPN. More secure

Split tunnel — only some (usually all incoming requests) are routed and encrypted over the VPN