MODULE 4

IMPLEMENTING NETWORK SECURITY

SUBTOPIC 1
Network Components
There are several common components that make up a network:
Device
Media
Network adapter
Network operating system
Protocol

Device - A device is a unit of physical hardware or equipment that provides one or more computing
functions within a computer system.

Media - refers to various means of communication.

Network adapter - NIC - Network Interface Card.

Network operating system - A network operating system provides services for computers connected to a
network.

Protocol - A protocol is a standard set of rules that allow electronic devices to communicate with each
other.

Network Devices
A router is a hardware device which is used to connect a LAN with an internet connection. It is used to
receive, analyze and forward the incoming packets to another network.

A switch is a hardware device that connects multiple devices on a computer network

A firewall is a network security device that monitors incoming and outgoing network traffic and permits
or blocks data packets based on a set of security rules.

A load balancer is a device that acts as a reverse proxy and distributes network or application traffic across
several servers.

An all-in-one security appliance provides protection against a multitude of threats without adding to your
device-management burden.

Using Dedicated Firewalls to Protect a Network

A firewall is a system that is designed to protect a computer or a computer network from network-based
attacks.

The OSI Model (Open Systems Interconnection Model) is a conceptual framework used to describe the
functions of a networking system.
Physical Layer
The lowest layer of the OSI Model is concerned with electrically or optically transmitting raw unstructured
data bits across the network from the physical layer of the sending device to the physical layer of the
receiving device.

Data Link Layer

At the data link layer, directly connected nodes are used to perform node-to-node data transfer where
data is packaged into frames.

Network Layer. The network layer is responsible for receiving frames from the data link layer, and
delivering them to their intended destinations among based on the addresses contained inside the frame.

Transport Layer
The transport layer manages the delivery and error checking of data packets.

Session Layer
The session layer controls the conversations between different computers.

Presentation Layer
The presentation layer formats or translates data for the application layer based on the syntax or
semantics that the application accepts. Because of this, it at times also called the syntax layer.

Application Layer
At this layer, both the end user and the application layer interact directly with the software application.

OSI Model and Security

Identify threats and targets.
Identify how threats will impact your network.
Secure your network by layers.

Any discussion about network security requires a discussion and understanding of the Open Systems
Interconnect (OSI) reference model.

When to Use a Hardware Firewall Instead of a Software Firewall

There are two basic types of software firewall:
Host firewall
Network firewall

Network firewall: The other type of software firewall is a firewall application installed on a server used to
protect network segments from other network segments.

Ingress traffic is traffic that originates from outside the network’s routers and proceeds toward a
destination inside the network.

Egress traffic is network traffic that begins inside a network and proceeds through its routers to its
destination somewhere outside of the network.
VLAN - Virtual Local Area Network
A virtual LAN (VLAN) is any broadcast domain that is partitioned and isolated in a computer network at
the data link layer.

Subnet
It is any broadcast domain that is partitioned and isolated in a computer network at the data link layer

IDS - Intrusion Detection Systems

Intrusion detection systems (IDS) are designed to detect unauthorized user activities, attacks, and network
compromises.

IPS - Intrusion Prevention System

An intrusion prevention system (IPS) is very similar to an IDS, except that in addition to detecting and
alerting, an IPS can also take action to prevent the breach from occurring.

NIDS - Network-based Intrusion Detection System

A network-based IDS (NIDS) monitors network traffic using sensors that are located at key locations within
the network, often in the demilitarized zone (DMZ) or at network borders

Wireless IDS
The WIDS is the software that detects an attack on a wireless network or wireless system.

Network IPS
Intrusion Prevention System (IPS) is a network security/threat prevention technology that examines
network traffic flows to detect and prevent vulnerability exploits.

Wireless IPS
A wireless intrusion prevention system (WIPS) is a network device that monitors the radio spectrum for
the presence of unauthorized access points (intrusion detection), and can automatically take
countermeasures (intrusion prevention).

Guidelines for Applying Network Security Administration Principles

• Manage network devices so that they are configured according to security policies.
• Maintain documentation for all current server configurations.
• Establish and document baselines.
• Implement strong ACLs and implement implicit deny.
• Update antivirus software regularly.
• Configure only required network services.
• Disable unused interfaces and unused application service ports.
• Create and implement a DRP.
• Apply security updates and patches.
• Encrypt sensitive data.
• Check event logs for unusual activity.
• Monitor network activity.
SUBTOPIC 2
Network Monitoring Systems
Network monitoring software is designed to monitor and manage the network traffic flow over a network.

Types of Network Monitoring Systems

• Behavior-based
• Signature-based
• Anomaly-based
• Heuristic.

Web Security Gateway

A Web security gateway is a type of security solution that prevents unsecured traffic from entering an
internal network of an organization.

DMZ - Demilitarized Zones

DMZs are designed to provide access to systems without jeopardizing the internal network.

NAT - Network Address Translation

Network Address Translation (NAT) is a technique used to modify the network address information of a
host while traffic is traversing a router or firewall.

There are two main types of NAT:

Static NAT is used when the translated device needs to be accessible from the public network.

Dynamic NAT. This is more commonly used when many hosts on the internal network need to access the
internet and don’t have a requirement for a static address.

VPN - Virtual Private Network

VPN (Virtual Private Network) is a technology that uses encrypted tunnels to create secure connections
across public networks like the internet

VPN Concentrator
A VPN concentrator is a type of networking device that provides secure creation of VPN connections and
delivery of messages between VPN nodes.

Virtualization
Virtualization is the process of running a virtual instance of a computer system in a layer abstracted from
the actual hardware.

Cloud Computing
Cloud computing means storing and accessing data and programs over the Internet instead of your
computer's hard drive.

Cloud Computing Deployment Models

Private
Public
Community
Hybrid
Cloud Computing Service Types
SaaS - Software as a Service
PaaS - Platform as a Service
IaaS - Infrastructure as a Service

DNS - Domain Name System (or Service or Server)

The DNS is a service used on the internet for resolving fully qualified domain names (FQDN) to their actual
Internet Protocol (IP) addresses, using a distributed network of name servers.

HTTP - Hypertext Transfer Protocol.

HTTP is the protocol used to transfer data over the web.

HTTPS
HTTPS, the secure version of HTTP web browsing, uses the SSL protocol.

SSL/TLS
SSL - Secure Sockets Layer. SSL (Secure Sockets Layer) is the standard security technology for establishing
an encrypted link between a web server and a browser

TLS - Transport Layer Security. TLS is a cryptographic protocol that provides end-to-end communications
security over networks and is widely used for internet communications and online transactions

Secure Sockets Layer, is an encryption-based Internet security protocol. It was first developed by
Netscape in 1995 for the purpose of ensuring privacy, authentication, and data integrity in Internet
communications. SSL is the predecessor to the modern TLS encryption used today.

TLS is the up-to-date encryption protocol that is still being implemented online, even though many people
still refer to it as ‘SSL encryption’.

SECURE SHELL (SSH)

Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an
unsecured network

Telnet
TELNET (TELecommunication NETwork) is a network protocol used on the Internet or local area network
(LAN) connections.

Some of the applications supported with SSH include the following:

1. Secure logon
2. Secure remote command execution
3. Secure file transfer
4. Secure backup, copy, and mirroring of files
5. Creation of VPN connections (when used in conjunction with the OpenSSH server and client)

SNMP - Simple Network Management Protocol

Simple Network Management Protocol (SNMP) is a set of protocols for network management and
monitoring.
ICMP
The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite.

IPSec
Data security in transit
Data authenticity and integrity
Anti-replay protection
Non-repudiation
Eavesdropping and sniffing protection

Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts the
packets of data sent over an Internet Protocol network

NetBIOS
Applications communicate across network
Connection communication over sessions
Connectionless datagram communication
Name registration
Vulnerable to analysis by malicious users
Implement strong passwords
Disallow root access
Disable null sessions

File Transfer Protocols

FTP is used to transfer files between computers on a network.
SFTP (SSH File Transfer Protocol) is a network protocol that provides file transfer and manipulation
functionality over any reliable data stream.
FTPS (FTP/SSL) is a name used to provide a number of ways that FTP software can perform secure file
transfers.
TFTP - Trivial File Transfer Protocol is a file transfer protocol similar to FTP, but is much more limited.

Ports and Port Ranges

A port is:
Endpoint of logical connections

Numbered from 0 to 65,535

Split into three blocks:

Well-known ports
Registered ports
Dynamic ports

SUBTOPIC 3
Network Administration Security Methods
• Flood guards
• Loop protection
• Port security
• MAC limiting
• MAC filtering
• Network separation
• VLAN management
• Implicit deny
• Log analysis

Flood guards serves as preventive control against denial-of-service (DoS) or distributed denial-of-service
(DDoS) attacks.

Loop protection increases the efficiency of STP, RSTP, and MSTP by preventing ports from moving into a
forwarding state that would result in a loop opening up in the network.

Port Security enables an administrator to configure individual switch ports to allow only a specified
number of source MAC addresses ingressing the port.

MAC limiting protects against flooding of the Ethernet switching table and is enabled on Layer 2 interfaces
(ports).

MAC Filtering refers to a security access control method whereby the MAC address assigned to each
network card is used to determine access to the network.

Network separation is the tool used for dividing a network into smaller parts which are called
subnetworks or network segments.

VLAN Management is a network switch that contains a mapping of device information to VLAN.

Implicit deny is a security stance treats everything not given specific and selective permission as
suspicious.

Log analysis is the term used for analysis of computer-generated records for helping organizations,
businesses or networks in proactively and reactively mitigating different risks.

Guidelines for Applying Network Security Administration Principles

• Manage network devices so that they are configured according to security policies.
• Maintain documentation for all current server configurations.
• Establish and document baselines.
• Implement strong ACLs and implement implicit deny.
• Update antivirus software regularly.
• Configure only required network services.
• Disable unused interfaces and unused application service ports.
• Create and implement a DRP.
 • Apply security updates and patches.
• Encrypt sensitive data.
• Check event logs for unusual activity.
• Monitor network activity.

Wireless Networks
• Portable
• Inexpensive
• No obtrusive cabling
• Introduces new, significant security issues

A wireless LAN (WLAN) allows users to connect to a network while allowing them to remain mobile.

Wireless standards are a set of services and protocols that dictate how your Wi-Fi network (and other
data transmission networks) acts.

802.11: There were two variations on the initial 802.11 wireless standard. Both offered 1 or 2Mbps
transmission speeds and the same RF of 2.4GHz.

802.11a - The first “letter” following the June 1997 approval of the 802.11 standard, this one provided for
operation in the 5GHz frequency, with data rates up to 54Mbps.

802.11b - Released in September 1999, it’s most likely that your first home router was 802.11b, which
operates in the 2.4GHz frequency and provides a data rate up to 11 Mbps.

802.11g offers wireless transmission over distances of 150 feet and speeds up to 54Mbps compared with
the 11Mbps of the 802.11b standard.

802.11n (Wi-Fi 4)

802.11ac (Wi-Fi 5) - Current home wireless routers are likely 802.1ac-compliant and operate in the 5 GHz
frequency space.

Wireless security is the anticipation of unauthorized access or breaks to computers or data by means of
wireless networks.

Wireless Security Protocols

WEP was included as part of the original IEEE 802.11 standard and was intended to provide privacy

WPA was designed as the interim successor to WEP. WPA2 is the security method added to WPA for
wireless networks that provides stronger data protection and network access control. WPA3, released in
June 2018, is the successor to WPA2, which security experts describe as “broken.”

Wireless Security Methods

• Configure access point settings.
• Adjust SSID settings.
• Enable encryption.
 • Configure network security settings.
• Adjust antenna and power source placement.
• Adjust client settings.

Understanding Service Set IDentifier (SSID)

The most basic component of the wireless network is the SSID
While there aren’t any specific security capabilities associated with the SSID, there are some security
considerations that should be taken into account:
• Choose your own SSID
• Follow naming conventions
• Turn off your SSID

Captive Portals
A captive portal is a web page accessed with a web browser that is displayed to newly connected users of
a Wi-Fi or wired network before they are granted broader access to network resources.

Site Surveys
Site surveys are inspections of an area where work is proposed, to gather information for a design or an
estimate to complete the initial tasks required for an outdoor activity.

Guidelines for Securing Wireless Traffic

• Keep sensitive data off of wireless devices.
• Install antivirus software on wireless devices.
• Harden wireless devices and routers.
• Use a VPN with IPSec.
• Conduct a site survey.
• Implement security protocols.
• Implement authentication and access control.
• Implement an IDS.
• Avoid relying on MAC filtering and disabling SSID broadcasts.
• Implement captive portals that require login credentials.
• Follow hardware and software vendors’ security recommendations.
• Document all changes.