Securing the Borderless Network March 21 2000 Ted

Securing the Borderless Network March 21, 2000 Ted Barlow

Securing the Network Introduction The Internet has fundamentally changed the way networks are designed

Securing the Network Old Model How things used to be. . . • single host environment • mainframe security systems • hierarchical controls • well-defined access paths • dumb terminals • centralized storage/processing of data Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network “New” Old Model “Fortress” Security Model Internet Firewall Protocols: SMTP FTP

Securing the Network New Model “Freeway” Security Model Viruses Java SMTP SSL VPN S/MIME H. 323 Trojans Active. X HTTP Internet Internal Network Firewall DMZ Credit Validation Network Web Server Application/ Database Vendor Extranet Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Risks What are the Risks? • Denial of Service • DDOS (Distributed Denial of Service Attacks) • Defacement • 3693 web server defacements in 1999 (www. attrition. org) • 130 government sites (. gov) • Loss of private data • CD Universe (~350, 000 credit card numbers) • Breach of internal networks and systems Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Design and Build How do you Build a Secure Internet Application Environment? • Incorporate security reviews early in the design process • Design with future strong authentication methods in mind • Design for explosive growth • Encrypt entire path from client to backup tapes for critical data • Establish security baselines and perform security hardening before going live on the Internet Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Infrastructure Key Components of the Secure Network • Border routers • DMZ • Firewalls • Encrypted data paths • Intrusion Detection System (IDS) • Content Security (CVP) Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Firewalls The Firewall/DMZ Environment • Begin with a secure screening router • Choose a firewall that is extensible, scalable • Packet filtering vs. application proxy firewalls • Firewall appliances and next generation firewalls • Network address translation (NAT) will improve DMZ security • Build firewall redundancy Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Firewall Comparison Choosing the Right Firewall Solution PROS Packet Filters • Application Independent • High Performance • Scalable • Good Security • Fully Aware of Application. Proxy Gateways Layer Stateful Inspection • Good Security • High Performance • Scalable • Fully Aware of Application Layer • Extensible CONS • Low Security • No Protection Above Network Layer • Poor Performance • Limited Application Support • Poor Scalability • More Expensive Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network IDS Is Intrusion Detection Necessary? • Definition – the ability to detect and defend against defined attack patterns • Host based & network based • Network IDS can be integrated with firewalls to automatically respond to attacks • Host based IDS can detect changes to operating system programs and configurations Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Application/Database Server Internet Design Case Study Backup Server External Router Intrusion Detection System (IDS) DMZ Internal Router Internal Network Outside Internet Web Server Inside Intranet Web Server Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Design Case Study Web Server App Server IDS Backup Server DMZ External Router DMZ Internet IDS Console CVP Server NAT IDS NAT Internal Router Copyright 2000, Deloitte Touche Tohmatsu Internal Network

Securing the Network Maintenance How do you Maintain a Secure Internet Application Environment? • Keeping ahead of security exploits is a full time job • Actually review and report on firewall, IDS and system logs • Develop incidence response (IR) procedures and IR team • Periodically review and audit system and network security configurations Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Future Developments What is coming in Network Security? • Better, cheaper authentication mechanisms • Open network security models • System, application level “firewalls” • Windows 2000 Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Future Developments Windows 2000 Security • • • Kerberos Authentication Infrastructure Certificate Authority (CA) Security Configuration Editor IPSec Support Encrypting File System (EFS) Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Future Developments Kerberos Authentication Windows 2000 supports several authentication models: Kerberos for internal authentication and X. 509 certificates for external authentication. Kerberos can be configured to use private or public key authentication. Keys are managed by the Domain Controller (DC) in the Key Distribution Center (KDC). A User is granted a ticket or certificate which permits a session between the user and the server. Important security considerations: • The KDC MUST be physically secured • Susceptible to password dictionary attacks • Administrators still have complete access Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Future Developments Certificate Authority (CA) This is a Public Key Certificate Server built into Windows 2000. The server manages the issuing, renewal, and cancellation of digital certificates. Digital certificates are used to initiate encrypted sessions such as Secure Sockets Layer (SSL) for secure web-based communications. Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Future Developments Security Configuration Editor This is a Microsoft Management Console (MMC) tool that eases security administration. Allows administrators to create security baselines by defining templates with global security parameters, and then perform security analyses against the templates. Manages security policies, file system access control, and Registry permissions. Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Future Developments Internet Protocol Security (IPSec) Defines security policies at the lowest possible layer: the network communication layer. Enables encryption and decryption of network packets before they leave the network interface card (NIC). Supports the use of public keys (RSA) or private keys (DES). Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Future Developments Encrypting File System (EFS) Allows users to encrypt files and directories that only they (and administrators) can decrypt. EFS creates a separate 56 -bit encryption key based on the Data Encryption Standard (DES) algorithm. The administrator’s key can unlock any encrypted file in the domain. This service is very fast and encryption/decryption occurs without the user noticing. Copyright 2000, Deloitte Touche Tohmatsu

Securing the Network Summary of Best Practices • If possible, create a separate trusted network (DMZ) • Choosing the right firewall solution is key • Application security is only as strong as system and network security • Design the infrastructure to facilitate monitoring and data backups • Intrusion Detection Systems – you can’t defend what you don’t detect Copyright 2000, Deloitte Touche Tohmatsu