Chapter 6

Evaluating Security Solutions for the Network

6.1. Security at the Network Edge

Many of the security risks that occur at the access layer of the network result from poorly secured
end devices.

User error and carelessness account for a significant number of network security breaches. Three
types of common security risks that occur at the access layer are: viruses, worms, and Trojan horses
Even if providing adequate security for end devices may not be in the scope of a network design
project, the network designer needs to understand the network impact of a security incident, such
as a worm or a Trojan, at an end device. The designer can then better determine which network
security measures to put in place to limit the effects on the network. Permitting network access to
only known or authenticated devices limits the ability of intruders to enter the network. It is
important to apply wireless security measures that follow recommended practices.
6.1.1. Security Measures

The vulnerabilities previously identified show that, for the most part, a network is an extremely
unsecure environment. Network designers must place security as a top priority in their designs.
Antivirus software is one way to prevent an attack, but software cannot prevent physical breaches
of the network or its applications. Consideration must be taken when designing any network to
secure the facilities and hardware from unauthorized access.

6.1.2. Providing Physical Security

Physical security of a network is important. Most network intruders gain physical entry at the
access layer. On some network devices, such as routers and switches, physical access can provide
the opportunity to change passwords and obtain full access to devices. Obvious measures, such as
locking wiring closets and restricting access to networking devices, are often the most effective
ways to prevent security breaches. In high-risk or easily accessible areas, it might be necessary to
equip wiring closets with additional security, such as cameras or motion detection devices and
1|Page
alarms. Sometimes it could be necessary to mark areas visibly to forbid unauthorized personnel
from entering the area. Some devices, such as keypad locks, can record which codes are used to
enter the secured areas.

6.1.3. Securing Access Layer Networking Devices

The measures listed here can provide additional security to networking devices at access layer:

 Setting strong passwords

 Using Secure Shell (SSH) to administer devices, instead of Telnet
 Disabling unused ports
 Switch port security can ensure only known and trusted devices have access to the network

6.2. Investigating Server Farms and Security

Most enterprise networks provide users with Internet-accessible services, such as e-mail and e-
commerce. The availability and security of these services are crucial to the success of a business.

What Is a Server Farm?

It’s difficult to manage and secure many distributed servers at various locations. It is recommended
to centralize servers in server farms. Server farms are typically located in computer rooms and data
centers.

2|Page
 Figure 6.1 Centralized Vs. Decentralized server farm configuration
Creating a server farm results in the following benefits:

 Network traffic enters and leaves the server farm at a defined point. This arrangement
makes it easier to secure, filter, and prioritize traffic.
 Redundant, high-capacity links can be installed to the servers and between the server farm
network and the main LAN. Additionally, number of high-capacity switches and security
devices is reduced. This configuration is more cost-effective than attempting to provide
similar level of connectivity to servers distributed throughout the network.
 Load balancing and failover can be provided between servers and networking devices.

6.2. Security, Firewalls, and Demilitarized Zones

Data center servers can be target of malicious attacks and must be protected. Attacks against server
farms can result in lost business for e-commerce and business-to-business applications and in
information theft. LANs must be secured to reduce the chances of such attacks. Hackers use a
variety of tools to inspect networks and to launch intrusion and denial-of-service (DoS) attacks.

3|Page
6.2.1. Protecting Server Farms against Attack

Firewalls are often deployed to provide a basic level of security when internal and external users
attempt to access the Internet via the server farm. To properly secure server farms, a more thorough
approach must be followed. Such an approach takes advantage of the strengths of the following
network products that can be deployed in a server farm:

 Firewalls
 LAN switch security features
 Host-based and network-based intrusion detection and prevention systems
 Load balancers
 Network analysis and management devices

6.2.2. Demilitarized Zones

In traditional network firewall design, servers that accessed from external networks were located
on demilitarized zone (DMZ). Users accessing these servers from the Internet or other untrusted
external networks were prevented from seeing resources located on internal LAN. LAN users were
treated as trusted users and usually had few restrictions imposed when they accessed servers on
the DMZ. Figure 6-2 shows a multilayer security topology. Designing multilayer approach to
security limits traffic and the potential for entire network from being breached by an intrusion.

Figure 6.2 Multilayer security

4|Page
Today’s networks are more likely to face an attack originating from access layer of internal
network than from external sources. As a result, the design of server farm security is different from
older DMZ model. A layer of firewall features and intrusion protection is required between servers
and internal networks, and between servers and external users. The sensitivity of data stored on
the servers and contained in the transactions traveling the network determines the appropriate
security policy for the design of the server farm.

High Availability

In addition to the highly secure feature, server farms are also required to provide high availability
for network applications and services. A highly available network is one that eliminates or reduces
potential impact of failures. This protection enables the network to meet requirements for access
to applications, systems, and data from anywhere, at any time.

Building in Redundancy

To achieve high availability, servers are redundantly connected to two separate switches at the
access layer. This redundancy provides a path from the server to the secondary switch if the
primary switch fails (see Figure 6-3). Devices at distribution and core layers of the server farm are
also redundantly connected.

Figure 6.3 Network Redundancy

5|Page
6.3. Virtualization

Many separate logical servers can be located on one physical server. The physical server uses an
operating system specifically designed to support multiple virtual images. This feature is known
as virtualization. This technology reduces the cost of providing redundant services, load balancing,
and failover for critical network services.

6|Page