Security of a Local Area Network By Nathan Wolverton
Security of a LAN n n n First step is to make the security policy in order to allocate resources Once that is complete, you can decide how to set up the LAN This is crucial because you have to know what area(s) needs to be secured the most
Ways to Block Unwanted Intrusions n n n Limit the number of computers that can connect at each port Set the ports on the switch to a certain MAC address If they still get in, disable insecure default configurations
Intrusion Detection Systems (IDS) n n Alerts the administrator in real time of unwanted activity IDS should be placed in front of public servers, behind firewalls to monitor traffic between internet and internal LAN, more sensitive subnets, outside of firewall to see what kind of attacks are being launched, and by a dial-up server or VPN concentrator
WLAN Security n n n WLAN should be protected by minimum of WEP. WPA is better WPA uses a username and password that is specific to the individual WEP uses SSID and a key to access the LAN Change default SSID name and do not allow it to be broadcasted. It should be something that is misleading. i. e coffeeshop instead of banksecrets RADIUS can be used to help secure the WEP shortcomings Reduce the broadcast range so that it covers only the intended area
RADIUS n n EAP-TLS(Extensible Authentication Protocol-Transport Layer Security) PEAP(Protected Extensible Authentication Protocol)
RADIUS Cont. n EAP-TLS Uses certificates to perform authentication n Server side certificates are used n Can enforce policies on users, specify the length of encryption key, and time interval for auto-renegotiation of the certificate n n PEAP Uses mutual certificates to perform authentication n This means that the client and server both must accept the authentication n
Ways to Practice Good Security n n n Encourage or provide the use of virus software, spyware software, and firewalls for the home PC so your workers make good habits Provide education to your employees in how to keep computers and information secure Hire a third party to try to hack into the LAN to advise you on security vulnerabilities. This will tell you the area(s) that need to be fixed
Security Services n n n Identification and Authentication- helps to ensure that the LAN is accessed only by authorized individuals Access Control- helps to ensure that LAN resources are being used in authorized manners Data & Message Confidentiality- ensures that data, software, and messages are not disclosed to unauthorized parties
Security Services (cont. ) n n n Data & Message Integrity- ensures that data, software, and messages are not modified by unauthorized parties Non-repudiation- members involved in the communication cannot deny having participated. Specifically the sender cannot deny sending message and receiver cannot deny getting the message Logging & Monitoring- uses of LAN resources can be traced throughout the LAN
Security Guidelines n n n Backup and Recovery - Backup of server files should happen on a nightly basis. Backup media should be stored in a safe environment, preferably off site. Users should be required to store important files on the server Keep operating system’s and application software up to date Dial up services should not be allowed. If necessary, should have host reboot upon disconnect
Security Guidelines (Cont. ) n n Physical Security should be limited to those that need to have access to the LAN server and related components Should be an administrator for each LAN Everything should be documented to ensure that security policies are being followed Close unused network ports in order to prevent unauthorized use and block IP Addresses that are known to abuse the security policy
Security of a LAN Review Questions n n n n What is the first step in securing a LAN? Design the security policy Should WEP or WPA be used to secure a WLAN? WPA What is one of two ways to fix the shortcomings of WEP? EAP-TLS(Extensible Authentication Protocol-Transport Layer Security) and PEAP(Protected Extensible Authentication Protocol) Where are some places Intrusion Detection Systems be placed? In front of public servers, behind firewalls to monitor traffic between internet and internal LAN, more sensitive subnets, outside of firewall to see what kind of attacks are being launched, and by a dial-up server or VPN concentrator
Скачать презентацию Security of a Local Area Network By Nathan
f1a983e52dc699db2c9ab7213ff6adca.ppt