Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Infrastructure Security & Network Fundamentals Chapter 10

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition 2 LANs, MANs, and WANs (cont’d.)

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Applying the OSI Model 3Network+ Guide to Networks, 6 th Edition Table 2-1 Functions of the OSI layers Courtesy Course Technology/Cengage Learning

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Network+ Guide to Networks, 6 th Edition 4

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition 5

© 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition 6

© 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Securing a Workstation Keep the operating system (OS) patched and up to date. Remove all shares that are not necessary. Rename the administrator account, securing it with a strong password. Install an antivirus program and keep abreast of updates. If no corporate firewall exists between the machine and the Internet, install a firewall.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionServers Servers are the computers in a network that host applications and data for everyone to share. The key management issue behind running a secure server setup is to identify the specific needs of a server for its proper operation and enable only items necessary for those functions.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Antivirus Software For workstations, this type of software is still a necessary component, particularly to prevent a PC from becoming part of a botnet. For servers, this type of software is most useful when users are allowed to place files on the machine. SDRC diagram

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionSwitches Can operate at either the data link or network layers of the OSI model. Creates separate collision domains for each port. A sniffer can only see traffic for the connected port. Can be attacked due to vulnerabilities in both SNMP and Telnet. Subject to ARP poisoning and MAC flooding.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionRouters Operates at the network layer of the OSI model Connects different network segments together Uses routing protocols to determine optimal paths across a network Forms the backbone of the Internet Can also be attacked due to vulnerabilities in both SNMP and Telnet

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionFirewalls Can be hardware, software, or a combination. Enforce network security policies across network connections. Different security policies will apply across the network, based on need. Security policies are rules that define what traffic is permissible and what traffic is to be blocked or denied. –Security policies should follow the principle of least access. –It is necessary to have a complete understanding of your network to develop a comprehensive security policy.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Other Firewall Techniques Basic packet filtering –Checks each packet against rules pre-defined on the firewall –Fairly simple, fast, and efficient –Doesn’t detect and catch all undesired packets Stateful packet filtering –The firewall maintains the context of a conversation –More likely to detect and catch undesired packets –Due to overhead, network efficiency is reduced

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third EditionVPN Provides a secure channel between users even though their signal is traveling on public networks Employs one of two types of encryption –Data encryption can be sniffed en route, but the contents cannot be read –Packet encryption uses tunneling and protects the data and the identities of the communicating parties Often done using IPsec

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond, Third Edition Intrusion Detection Systems Detects, logs, and responds to unauthorized network or host use Can operate in real-time or after the fact Two categories –Network-based systems –Host-based systems