Security+ Guide to Network

Security Fundamentals,
Fourth Edition

Chapter 5
Host, Application, and Data Security
 Objectives
• List the steps for securing a host computer
• Define application security
• Explain how to secure data using loss prevention

Security+ Guide to Network Security Fundamentals, Fourth Edition 2

 Securing the Host
• Three important elements to secure
– Host (network server or client)
– Applications
– Data
• Securing the host involves:
– Protecting the physical device
– Securing the operating system software
– Using security-based software applications
– Monitoring logs

Security+ Guide to Network Security Fundamentals, Fourth Edition 3

 Securing Devices
• Prevent unauthorized users from gaining physical
access to equipment
• Aspects of securing devices
– Physical access security
– Host hardware security
– Mobile device security

Security+ Guide to Network Security Fundamentals, Fourth Edition 4

 Securing Devices (cont’d.)
• Physical security
– Restricting access to equipment areas
• Hardware locks
– Standard keyed entry lock provides minimal security
– Deadbolt locks provide additional security
• Keyed locks can be compromised if keys lost,
stolen, or duplicated
• Lock Picking
• [Link]
• [Link]
• [Link]
• [Link]
• [Link]
Security+ Guide to Network Security Fundamentals, Fourth Edition 5
 Figure 5-1 Residential keyed entry lock
© Cengage Learning 2012

Figure 5-2 Deadbolt lock

© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 6

 Securing Devices (cont’d.)
• Recommended key management procedures
– Change locks after key loss or theft
– Inspect locks regularly
– Issue keys only to authorized users
– Keep records of who uses and turns in keys
– Keep track of issued keys
– Master keys should not have identifying marks

Security+ Guide to Network Security Fundamentals, Fourth Edition 7

 Securing Devices (cont’d.)
• Recommended key management procedures
(cont’d.)
– Secure unused keys in locked safe
– Set up key monitoring procedure
– Mark duplicate master keys with “Do not duplicate”
• Wipe out manufacturer’s serial number to prevent
duplicates from being ordered

Security+ Guide to Network Security Fundamentals, Fourth Edition 8

 Securing Devices (cont’d.)
• Cipher lock
– More sophisticated alternative to key lock
– Combination sequence necessary to open door
– Can be programmed to allow individual’s code to
give access at only certain days or times
– Records when door is opened and by which code
– Can be vulnerable to shoulder surfing
– Often used in conjunction with tailgate sensor

Security+ Guide to Network Security Fundamentals, Fourth Edition 9

 Figure 5-3 Cipher lock
© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 10

 Securing Devices (cont’d.)
• Alternative access method: physical token
– ID badge may contain bearer’s photo
– ID badge emits a signal identifying the owner
– Proximity reader receives signal
• RFID tags
– Can be affixed inside ID badge
– Read by an RFID proximity reader
• Badge can remain in bearer’s pocket

Security+ Guide to Network Security Fundamentals, Fourth Edition 11

 Figure 5-4 RFID tag
© Cengage Learning 2012

Figure 5-5 Mantrap

© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 12

 Securing Devices (cont’d.)
• Access list
– Record of individuals who have permission to enter
secure area
– Records time they entered and left
• Mantrap
– Separates a secured from a nonsecured area
– Device monitors and controls two interlocking doors
• Only one door may open at any time

Security+ Guide to Network Security Fundamentals, Fourth Edition 13

 Securing Devices (cont’d.)
• Video surveillance
– Closed-circuit television (CCTV)
• Video cameras transmit signal to limited set of
receivers
• Cameras may be fixed or able to move
• Passive deterrent
• Fencing
– Barrier around secured area
– Modern perimeter fences are equipped with other
deterrents
– 8’ with strands of barbed wire slanted at 45% angle
Security+ Guide to Network Security Fundamentals, Fourth Edition 14
 Table 5-1 Fencing deterrents

Security+ Guide to Network Security Fundamentals, Fourth Edition 15

 Securing Devices (cont’d.)
• Hardware security
– Physical security protecting host system hardware
– Portable devices have steel bracket security slot
• Cable lock inserted into slot and secured to device
• Cable connected to lock secured to desk or immobile
object
• Laptops may be placed in a safe
• Locking cabinets
– Can be prewired for power and network connections
– Allow devices to charge while stored

Security+ Guide to Network Security Fundamentals, Fourth Edition 16

 Figure 5-6 Cable lock
© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 17

 Securing Devices (cont’d.)
• Mobile device security
– Many security provisions that apply to laptops apply
to mobile devices
– [Link]

• Mobile devices’ unique security features

– Remote wipe / sanitation
• Data can be remotely erased if device is stolen
– GPS tracking
• Can pinpoint location to within 100 meters

Security+ Guide to Network Security Fundamentals, Fourth Edition 18

 Securing Devices (cont’d.)
• Mobile devices’ unique security features (cont’d.)
– Voice encryption
• Used to mask content of voice communication over a
smartphone

Security+ Guide to Network Security Fundamentals, Fourth Edition 19

 Securing the Operating System
Software
• Five-step process for protecting operating system
– Develop the security policy
– Perform host software baselining
– Configure operating system security and settings
– Deploy the settings
– Implement patch management

Security+ Guide to Network Security Fundamentals, Fourth Edition 20

 Securing the Operating System
Software (cont’d.)
• Develop the security policy
– Document(s) that clearly define organization’s
defense mechanisms
• Perform host software baselining
– Baseline: standard or checklist against which
systems can be evaluated
– Configuration settings that are used for each
computer in the organization

Security+ Guide to Network Security Fundamentals, Fourth Edition 21

 Securing the Operating System
Software (cont’d.)
• Configure operating system security and settings
– Hundreds of different security settings can be
manipulated
– Typical configuration baseline
• Changing insecure default settings
• Eliminating unnecessary software, services, protocols
• Enabling security features such as a firewall

Security+ Guide to Network Security Fundamentals, Fourth Edition 22

 Securing the Operating System
Software (cont’d.)
• Deploy the settings
– Security template: collections of security
configuration settings
– Process can be automated
• Group policy
– Windows feature providing centralized computer
management
– A single configuration may be deployed to many
users

Security+ Guide to Network Security Fundamentals, Fourth Edition 23

 Securing the Operating System
Software (cont’d.)
• Operating systems have increased in size and
complexity
• New attack tools have made secure functions
vulnerable
• Security patch
– General software update to cover discovered
vulnerabilities

Security+ Guide to Network Security Fundamentals, Fourth Edition 24

 Table 5-2 Estimated size of selected operating systems

Security+ Guide to Network Security Fundamentals, Fourth Edition 25

 Securing the Operating System
Software (cont’d.)
• Hotfix addresses specific customer situation
• Service pack accumulates security updates and
additional features
• Implement patch management
– Modern operating systems can perform automatic
updates
• Patches can sometimes create new problems
– Vendor should thoroughly test before deploying

Security+ Guide to Network Security Fundamentals, Fourth Edition 26

 Figure 5-7 Microsoft Windows 7 automatic update options
© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 27

 Securing the Operating System
Software (cont’d.)
• Automated patch update service
– Manage patches locally rather than rely on vendor’s
online update service
• Advantages of automated patch update service
– Administrators can force updates to install by
specific date
– Computers not on the Internet can receive updates
– Users cannot disable or circumvent updates

Security+ Guide to Network Security Fundamentals, Fourth Edition 28

 Figure 5-8 Automated patch update service
© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 29

 Securing with Anti-Malware Software
• Anti-virus
– Software that examines a computer for infections
– Scans new documents that might contain viruses
– Searches for known virus patterns
• Weakness of anti-virus
– Vendor must continually search for new viruses,
update and distribute signature files to users
• Alterative approach: code emulation
– Questionable code executed in virtual environment

Security+ Guide to Network Security Fundamentals, Fourth Edition 30

 Anti-Spam
• Spammers can distribute malware through email
attachments
• Spam can be used for social engineering attacks
• Spam filtering methods
– Bayesian filtering
– Local host filtering
• Blacklist
• Whitelist
– Blocking certain file attachment types

Security+ Guide to Network Security Fundamentals, Fourth Edition 31

 Pop-up Blockers and Anti-Spyware
• Pop-up
– Small window appearing over Web site
– Usually created by advertisers
• Pop-up blockers
– Separate program as part of anti-spyware package
– Incorporated within a browser
– Allows user to limit or block most pop-ups
– Alert can be displayed in the browser
• Gives user option to display pop-up

Security+ Guide to Network Security Fundamentals, Fourth Edition 32

 Host-Based Firewalls
• Firewall
– Designed to prevent malicious packets from entering
or leaving computers
– May be hardware or software-based
– Host-based software firewall runs on local system
• Microsoft Windows 7 firewall
– Three designations for networks: public, home, or
work
– Users can configure settings for each type
separately

Security+ Guide to Network Security Fundamentals, Fourth Edition 33

 Monitoring System Logs
• Log: record of events that occur
• Log entries
– Contain information related to a specific event
• Audit log can track user authentication attempts
• Access log can provide details about requests for
specific files
• Monitoring system logs
– Useful in determining how an attack occurred and
whether successfully resisted

Security+ Guide to Network Security Fundamentals, Fourth Edition 34

 Monitoring System Logs (cont’d.)
• Logs that record all activity from network devices or
programs:
– Used in operations, general audits, and
demonstrating regulatory compliance
• Logs for system security
– Operating system logs
– Security application logs

Security+ Guide to Network Security Fundamentals, Fourth Edition 35

 Monitoring System Logs (cont’d.)
• System event logs record:
– Client requests and server responses
– Usage information
– Account information
– Operational information
• Security application logs
– Anti-virus software log
– Automated patch update service log

Security+ Guide to Network Security Fundamentals, Fourth Edition 36

 Figure 5-9 Microsoft system event and audit record log viewer
© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 37

 Monitoring System Logs (cont’d.)
• Benefits of monitoring system logs
– Identify security incidents, policy violations,
fraudulent activity
– Provide information shortly after event occurs
– Provide information to help resolve problems
– Help identify operational trends and long-term
problems
– Provide documentation of regulatory compliance

Security+ Guide to Network Security Fundamentals, Fourth Edition 38

 Figure 5-10 Anti-virus log
© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 39

 Application Security
• Aspects of securing applications
– Application development security
– Application hardening
– Patch management

Security+ Guide to Network Security Fundamentals, Fourth Edition 40

 Application Development Security
• Security for applications must be considered
through all phases of development cycle
• Application configuration baselines
– Standard environment settings can establish a
secure baseline
– Includes each development system, build system,
and test system
– Must include system and network configurations

Security+ Guide to Network Security Fundamentals, Fourth Edition 41

 Application Development Security
(cont’d.)
• Secure coding concepts
– Coding standards increase applications’ consistency,
reliability, and security
– Coding standards useful in code review process
• Errors (exceptions)
– Faults that occur while application is running
– Response should be based on the error
– Improper handling can lead to application failure or
insecurity

Security+ Guide to Network Security Fundamentals, Fourth Edition 42

 Application Development Security
(cont’d.)
• Error handling practices to avoid
– Failing to check return codes or handle exceptions
• Or improperly checking them
– Handling all return codes or exceptions in the same
manner
– Divulging potentially sensitive data in error
information

Security+ Guide to Network Security Fundamentals, Fourth Edition 43

 Application Development Security
(cont’d.)
• Verify user responses to the application
– Could cause program to abort
– Necessary to check for XSS, SQL, or XML injection
attacks
• Input validation
– Performed after data entered but before destination
is known
– Not possible to know which characters are
potentially harmful

Security+ Guide to Network Security Fundamentals, Fourth Edition 44

 Application Development Security
(cont’d.)
• Escaping (output encoding)
– Preferred method for trapping user responses
– Ensures characters are treated as data
• Not relevant to the application
• Fuzz testing (fuzzing)
– Software technique that deliberately provides invalid,
unexpected, or random data inputs
– Monitor to ensure all errors are trapped

Security+ Guide to Network Security Fundamentals, Fourth Edition 45

 Application Development Security
(cont’d.)
• Application hardening
– Intended to prevent exploiting vulnerabilities

Table 5-3 Attacks based on application vulnerabilities

Security+ Guide to Network Security Fundamentals, Fourth Edition 46

 Application Development Security
(cont’d.)
• Patch management
– Rare until recently
– Users unaware of the existence of patches or where
to acquire them
– More application patch management systems are
being developed today

Security+ Guide to Network Security Fundamentals, Fourth Edition 47

 Securing Data
• Work today involves electronic collaboration
– Data must flow freely
– Data security is important
• Data loss prevention
– System of security tools used to recognize and
identify critical data and ensure it is protected
• review “Right Management Services (RMS)”
– Goal: protect data from unauthorized users

Security+ Guide to Network Security Fundamentals, Fourth Edition 48

 Securing Data (cont’d.)
• Data loss prevention typically examines:
– Data in use (example: being printed)
– Data in motion (being transmitted) – review “IPSec”
– Data at rest (stored) – review “BitLocker” & “EFS”
• Content inspection
– Security analysis of transaction
– Takes context into account

Security+ Guide to Network Security Fundamentals, Fourth Edition 49

 Figure 5-11 DLP architecture
© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 50

 Figure 5-12 DLP report
© Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition 51

 Summary
• Physical access security includes door locks of
various types
• Portable devices can be secured with a cable lock
• Remote wipe / sanitation can erase device
contents from a distance if stolen
• Security policy must be created, then a baseline
can be established
• Third-party anti-malware software can provide
added security

Security+ Guide to Network Security Fundamentals, Fourth Edition 52

 Summary (cont’d.)
• Monitoring system logs is useful in determining
how an attack occurred
• Protecting applications that run on hardware
– Create configuration baselines
– Secure coding concepts
• Data loss prevention (DLP) can identify critical
data, monitor and protect it
– Works through content inspection

Security+ Guide to Network Security Fundamentals, Fourth Edition 53