Chapter 12 Communications Security & Countermeasures CISSP Study Guide BIS 4113/6113

Wireless (Wi-Fi) Network Types Standard Frequency Potential Speed Range Spectrum 802.11b 2.4 GHz 11 Mbps 50 m DSSS (Spread across range) 802.11a 5 GHz 54 Mbps 20 -25 m OFDM (Orthogonal Freq. MP) 802.11g 802.11n (2009) 2.4 and 5 GHz (MIMO) 600 Mbps 200 m 802.11ac (2013) 1.3 Gbps Wide channel

Types of WLAN Security Service Set Identifier (SSID) PAGES 458-459 Service Set Identifier (SSID) Transmitted by “beacon frame” Included as plain text Easy to break Wired Equivalent Privacy (WEP) Requires that user enter a key manually (to NIC and AP) Short key (40-128 bits)  Easy to break by “brute force” Extensible Authentication Protocol (EAP) WEP keys created dynamically after correct login Requires a login (with password) to a server Wi-Fi Protected Access (WPA) – new standard A longer key, changed for every packet Still requires a passphrase, could be guessed

Packet Sniffing / Eavesdropping

WiFi Security Procedure PAGE 462 1. Change admin default password 2. Disable SSID broadcast 3. Change default SSID 4. Enable MAC filtering (whitelist if less than 20 clients) 5. Enable highest form of authentication/encryption available 6. Monitor traffic using firewall and/or IDS 7. Require VPN connections

Physical Ethernet Media Types 1.        PAGES 474-475 Physical Ethernet Media Types Name Maximum Data Rate  Cables 10Base-5 10 Mbps Coaxial 10Base-2 10Base-T UTP cat 3, UTP cat 5 100Base-T 100 Mbps UTP cat 5, fiber 1000Base-T 1 Gbps UTP cat 5, UTP cat 5e, UTP cat 6, fiber 10 GbE 10 Gbps UTP cat 5e, UTP cat 6, UTP cat 7, fiber 40 GbE 40 Gbps fiber

Network Taps http://www.ciena.com/insights/articles/How-to-hack-an-optical-fiber-in-minutes-and-how-you-can-secure-it.html

VIRTUAL PRIVATE NETWORKS PAGE 517 VIRTUAL PRIVATE NETWORKS How might you have used a VPN in the past? Remote Access Remote Communication Anonymous Web Browsing Avoid Geo-Blocking Gaming

VPN Architecture Internet ISP Access Server VPN Device Office Telephone Line VPN Device Employee’s Home Internet Backbone VPN Tunnel VPN Tunnel Office VPN Device Backbone

VPN Encapsulation of Packets Packet from the client computer Packet in transmission through the Internet PPP IP TCP SMTP ATM IP L2TP PPP IP TCP SMTP ISP Telephone Line Access Server VPN Device Employee’s Home Packet from the VPN VPN Tunnel PPP IP TCP SMTP Outgoing packets from the VPN are sent through specially designed routers or switches. Internet VPN Device Access Server VPN Encapsulation of Packets Backbone

Regular VPN (no split tunnel) “Split Tunneling” Enables more efficient routing of high-bandwidth traffic Regular VPN (no split tunnel) Split Tunnel

NETWORK ADDRESS TRANSLATION PAGE 525 NETWORK ADDRESS TRANSLATION Hides identity of internal client computers Efficiently allocates IP addresses internally using only a few “public” addresses 10.0.0.1 Internet 10.0.0.2 130.18.86.1 10.0.0.3

Dynamic NAT: To communicate with outside world, traversing an NAT-enabled device (firewall, router, etc.) The combo of address and port is written to NAT table and ensures the return traffic reaches the appropriate source. It is difficult for an outsider to directly contact a host behind the NAT device, since the table entry is established and deleted in the same session. Source:

Network address translation Are you using NAT? IPConfig: Have an private IP address? and still interact with the Internet? Have a private IP address? but your IP address and an IP-checked address are different? YES YES NO YES Private IP addresses: Class A 10.0.0.0 – 10.255.255.255 Class B 172.16.0.0. – 172.31.255.255 Class C 192.168.0.0. – 192.168.255.255

Not a private IP address Uh oh…

IPv4 Addresses 4 byte (32 bit) addresses Dotted decimal notation Strings of 32 binary bits Dotted decimal notation Example: 128.192.56.1 1 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 1 64 16 4 1 128 32 8 2 Sum up the values of the 1 bits: 32 + 16 + 8 = 56

Hiding IP addresses Spoofing HTTP Forward Proxy Proxy Chaining Works much like NAT Caches frequently requested content Proxy Chaining TOR (underground proxy system) Valid and illegal reasons IP Traceback Technology Forward Proxy

Circuit switching / packet switching “Permanent,” point-to-point connection Three Phases of Communication Often take the form of “dedicated circuits” Packet Switching Attempts to alleviate two shortcomings Circuit reserved by the packet, not the connection