Lecture CCNA security partner - Chapter 1: Network security concepts and policies

This chapter discusses how to develop a comprehensive network security policy to counter threats against information security. It also teaches you about possible threats and how to describe and implement the process of developing a security policy. It covers the identification of common vulnerabilities and threats, mitigation strategies, and the implementation of a security architecture using a lifecycle approach.

1

Network Security Concepts and

Policies

• To protect assets!

– Historically done through physical security and closed networks.

Purpose of Security

• With the advent of personal computers, LANs, and the wide-open world

of the Internet, the networks of today are more open.

The Network Today

• To provide adequate protection of network resources, the procedures

and technologies that you deploy need to guarantee three things :

– Confidentiality

– Integrity

– Availability of systems and data

Basic Security Requirements

• An asset is anything of value to an organization.

• A vulnerability is a weakness in a system or its design

that could be exploited by a threat.

• A threat is a potential danger to information or systems.

• A risk is the likelihood that a particular vulnerability will

be exploited.

• An exploit is an attack performed against a

vulnerability.

• A countermeasure (safeguard) is the protection that

mitigates the potential risk.

Data, Vulnerabilities, and

Countermeasures

Need for Network Security

• Business goals and risk analysis drive the need for network security

• Dealing with Risk :

7 7

Need for Network Security

Adversaries, Methodologies, and Classes

Adversaries, Methodologies, and Classes

of Attack

• Methodologies :

– Step 1 Perform footprint analysis (reconnaissance).

– Step 2 Enumerate applications and operating systems.

– Step 3 Manipulate users to gain access.

– Step 4 Escalate privileges.

– Step 5 Gather additional passwords and secrets.

– Step 6 Install back doors.

– Step 7 Leverage the compromised system.

Adversaries, Methodologies, and Classes

of Attack

Threats Classification

• Enumeration and fingerprinting

• Spoofing and impersonation

• Man-in-the-middle

• Overt and covert channels

• Blended threats and malware

• Exploitation of privilege and trust

IP Spoofing Attacks

TCP Three-Way Handshake

Sequence Prediction

Trust Exploitation

Trust Exploitation

Confidentiality and Integrity Attacks

Man-in-the-Middle Attacks

IP Source Routing Attack

Overt and Covert Channels

• Separation and rotation of duties

• Hierarchically trusted components and protection

• Mediated access

• Accountability and traceability

Evaluating and

Managing the Risk

Risk Analysis and Management

• Every process of security should first address the following questions:

• Which are the threats the system is facing?

• Which are the probable threats and what would be their consequence, if exploited?

• The threat-identification process provides an organization with a list of

threats to which a system is subject in a particular environment.

Risk Analysis

• Quantitative

• Qualitative

Building Blocks of Risk Analysis

• Assets and their value

• Vulnerabilities

• Threats, their impact, and rate or probability of occurrence

List of Assets and Their Value

A Lifecycle Approach to Risk

Management

Security Policies

The three reasons for having a security policy are as follows:

• To inform users, staff, and managers

• To specify mechanisms for security

• To provide a baseline

A properly defined security policy does the following:

• Protects people and information

• Sets the rules for expected behavior

• Authorizes staff to monitor, probe, and investigate

• Defines the consequences of violations

Security Policy Components

Components of a Comprehensive Security Policy

Secure Network Lifecycle Management

Organization-wide Integration of IT Governance, Risk Management,

Compliance