Presentation is loading. Please wait.

Presentation is loading. Please wait.

1 Copyright © 2005, Cisco Systems, Inc. All rights reserved. Applying Security Principles to Networking Applications Mark Enright Dec.

Similar presentations


Presentation on theme: "1 Copyright © 2005, Cisco Systems, Inc. All rights reserved. Applying Security Principles to Networking Applications Mark Enright Dec."— Presentation transcript:

1 1 Copyright © 2005, Cisco Systems, Inc. All rights reserved. Applying Security Principles to Networking Applications Mark Enright Dec 08, 2005

2 222 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS What is Security in Computer Development Projects What are you protecting Why are you protecting it From whom are you protecting it How are you going to protect it What is the cost of protecting it

3 333 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Wired Access Topology V V Internet Access Device Local Area Network (LAN) Wide Area Network (WAN)

4 444 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Wireless Access Topology Internet Access Device Local Area Network (LAN) Wide Area Network (WAN)

5 555 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Wireless Access Topology Internet Access Device Local Area Network (LAN) Wide Area Network (WAN)

6 666 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Wireless Access Security Complication Physical Access to Local Area Network no longer exists – Anyone can intercept your conversations – Anyone can utilize your network resources

7 777 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Security Solution For Wireless Access Authentication Encryption

8 888 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Typical Solution for Wireless Access Internet 1) Where is Access Point “MyAP” 2) I am here. Prove you know my secret

9 999 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Typical Solution for Wireless Access Internet 3) Here is my proof 4) OK. Here are session keys

10 10 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS So Whats The Problem? Wireless Access is a huge Consumer Market People are beoming concerned with Wireless Security My GrandMother cant use it

11 11 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS What Can We Do To Help Make it easy for Grandma to set up Wireless Security

12 12 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 1. Configure Security Parameters Automatically Internet When Access Point is booted 1 st time: Configures Random Secure SSID Configures Random WPA Shared Secret Waits for Wireless Association on Secure SSID SSID: 55ID WPA-PSK:

13 13 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. How Can We Transfer Security Parameters Securely?

14 14 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One SSID: Well Known SSID Open Authentication 1) Where is my Access Point “Well Known SSID” 2) Here I am. Come on in

15 15 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One SSID: Well Known SSID Open Authentication 3) Give me Security Parameters 4) Here They Are

16 16 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One 1) Where is my Access Point 55ID” 2) I am here. Prove you know my secret SSID: 55ID WPA-PSK:

17 17 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One 3) Here is my proof 4) OK. Here are session keys SSID: 55ID WPA-PSK:

18 18 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One Attack SSID: Well Known SSID Open Authentication 1) Where is my Access Point “Well Known SSID” 2) Here I am. Come on in

19 19 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial One Attack SSID: Well Known SSID Open Authentication 3) Give me Security Parameters 4) Here they are

20 20 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial Two What Authentication is possible given constraints – something we know – something we have – something we are – something we do If we can’t be sure, at least be safe

21 21 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial Two SSID: Well Known SSID Open Authentication Where is my Access Point “Well Known SSID” Here I am. Come on in Where is my Access Point “Well Known SSID” Here I am. Come on in

22 22 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial Two SSID: Well Known SSID Open Authentication 1) Give Me Security Parameters Hang on a sec Give Me Security Parameters Unable to guarantee unique access Access to all denied

23 23 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Step 2. Trial 2 Attack Attacker just Associates and Listens

24 24 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Trial 3. Use Trial 2 Method for Authentication Use SSL for Encryption

25 25 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS So Whats The Problem with IPSec? Network Protection is a huge Consumer Market People are beoming concerned with Security and look to IPSec for help My GrandMother cant use it

26 26 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS Network Address Translation Internet Local Area Network (LAN) Wide Area Network (WAN)

27 27 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS The RoadWarrior IPSec Problem With common implementations the IP Address need to be known a priori or else a global shared secret is used for Authentication Mobility and NAT make it hard to predict the IP Address

28 28 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS RoadWarrior Solution 2. Client configured Web Install client software Configure address of Home Gateway 3. Client software connects Logs on to HTTPS Initiates the IPSec VPN 1. Gateway configured SSL Username, password 4. Gateway accepts Authenticates Client by password Figures out current Client IP Address Provisions IPSec for Client IP Address Joins Client to Protected Network using IPSec VPN Home Gateway Internet Protected Network IPSec VPN Tunnel HTTPS Road Warrior Client

29 29 Copyright © 2003, Cisco Systems, Inc. All rights reserved. EDCS


Download ppt "1 Copyright © 2005, Cisco Systems, Inc. All rights reserved. Applying Security Principles to Networking Applications Mark Enright Dec."

Similar presentations


Ads by Google