ExamInsight For CompTIA Security+ Certification Exam SY0-101 (ExamInsight)

ExamInsight for CompTIA Security+ Certification Exam SY0-101 Tcat Houser, CTT+, A+, Network+, Server+, Security+, etc Helen O'Boyle, CTT+, A+, Network+, Security+, MCSD, etc With Ian Kayne and Angella Hebert Michael Woznicki, A+, Network+, I-Net+, Server+, CCNA Published by TotalRecall Publications, Inc. 1103 Middlecreek Friendswood, TX 77546 281-992-3131 THIS IS BOOK IS GUARANTEED: See details at www.TotalRecallPress.com This Book is Sponsored by BeachFront Quizzer, Inc. Copyright © November 14, 2002 by TotalRecall Publications, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the United States Copyright Act of 1976, No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means electronic or mechanical or by photocopying, recording, or otherwise without the prior permission of the publisher. Copyright 2002 AlphaGeekProductions The views expressed in this book are solely those of the author, and do not represent the views of any other party or parties. Printed in United States of America ISBN: 1-59095-225-1 UPC: 6-43977-22101-8 The sponsoring editor for this book was Bruce Moran and the production supervisor was Corby R. Tate. Printed and bound by Data Duplicators of Houston Texas Printed and bound by Lightning Source, Inc. in the USA and UK Authors: Tcat Houser, Helen O'Boyle, Ian Kayne, and Angella Hebert

Technical Editing: Michael Woznicki Design Concepts: Bruce Moran, Tcat Houser This publication is not sponsored by, endorsed by, or affiliated with CompTIA, Inc. CompTIA®, A+®, Network+™, Server+™, I-Net+™, Linux+™, Security+™ The CompTIA logos and the Network+ logo are trademarks or registered trademarks of CompTIA, Inc. in the United States and certain other countries. All other trademarks are trademarks of their respective owners. Throughout this book, trademarked names are used. Rather than put a trademark symbol after every occurrence of a trademarked name, we used names in an editorial fashion only and to the benefit of the trademark owner. No intention of infringement on trademarks is intended. This publication does not constitute an endorsement of any mentioned product by the authors. Disclaimer Notice: Judgments as to the suitability of the information herein for purchaser's purposes are necessarily the purchaser's responsibility. BeachFront Quizzer, Inc. and TotalRecall Press extend no warranties, make no representations, and assume no responsibility as to the accuracy or suitability of such information for application to the purchaser's intended purposes or for consequences of its use. Tcat Houser-This is for Bob Wallace (1949-2002). Bob -- you did more than propel the PC industry when you left Microsoft to create PC-Write. You made a great mentor to me. I promise to do my best to continue in the finest traditions you taught me. Helen O'Boyle-My work on this study guide is dedicated to the denizens of the Virginia Commonwealth University computer labs, without whose presence in my life as friends, mentors and occasional adversaries of a white hat who just wanted to learn, I might never have discovered how enjoyable the field of computer security could be, or learned as much about it as I did there. Ian Kayne-This is for Gillian and Eddie. Angella Hebert-I dedicate the success of this effort to all of my loved ones who gave us moral support through our days of hell in production (Marc, Tristan, Antoine, and Étienne), the team members of this successful effort for all roles played, and to the author I owe my sanity to, Tcat. You are a strong leader with your expertise. You push me to the challenge. I thank you! Michael Woznicki-I dedicate this book to my wife, who through the entire editing process was very supportive and understanding. Without hesitation I would do it all over again with her by my side. About the Authors Tcat Houser Tcat Houser (CTT+, Network+, I-Net+, Server+, Security+, MCSE+I, etc) has garnered other milestones such as IBM PSE and Microsoft MCSE/MCT. This is the result of almost 40 years of 'fussing with electronics'. When not writing or teaching, he is doing research. Tcat accomplishes so many tasks because to him, it isn't work, its fun, and he has fun 18 hours a

day, 7 days a week. You can reach him by sending mail to [email protected] or [email protected]. Looking back at the last book where I (Tcat Houser) was the lead author (I-Net+ Exam Prep 1576105989), the independent reviews were very good, and most readers understood that I had two intentions. First, ace the test. Second, supply the information to be a reference manual and/or alert the reader to upcoming technologies so as today's hero, the reader was not tomorrow's zero. In the two years since that release, I led a number of career changes through CompTIA and wrote my own courseware. Building on that learning, you have this release. Helen C. O'Boyle Helen C. O'Boyle (CTT+, Network+, I-Net+, Server+, Security+, MCSE, MCSD, etc) has been working with computers for 20 years and holds degrees in Business/Information Systems and Mathematics from Virginia Commonwealth University. She first became involved in computer security in the mid-1980's, and has expertise in network security analysis, firewalls, computer forensics and penetration testing on several platforms. Helen is experienced in network administration and software development on UNIX, Windows and enterprise-class IBM mainframes, and has consulted for organizations of all sizes. She offers readers a real-world, pragmatic perspective on security. Along with Tcat, she enjoys bringing clarity to explanations of complex IT concepts. You may email her at [email protected] or [email protected]. Contributing Authors and Editors Ian Kayne By day I'm a technical specialist with a focus on Internet & Security technologies. By night I'm a scene coder, laying down C++ with Win32, MFC and DirectX code purely for fun. I enjoy a challenge, whether it's building pen-resistant systems or getting this mesh and that pixel shade to render faster. Working with everyone in different time zones and across the Atlantic has been fun. Certain people will understand the reference to Spirit ;). Angella Hebert By day I am a full-time mother of three, by night I do crunch sessions. I reside in Montréal, Canada, and have a BS in Social Psychology, as well as, an Associate's in Business Accounting. In this effort, I rendered my English skills, Linguistic skills, and of course the 'Practical' Social Behavior knowledge. No rest for the wicked! (No pun intended). This effort has been wonderful due to the diversity of our geographical placements, as well as, the personalities of the people involved. Chad Rees Design and WebMaster. Michael Woznicki

Michael Woxnicki (A+/Net+/iNet+/Server+/CCNA/CCDA/CIWA/CIWP/CNX-A) When not working on a network, or working as a technical editor/reviewer or even in a classroom teaching, Mike spends time with his wife of 7 1/2 years and 3 wonderful children. Mike enjoys listening to music and working towards new certifications and is currently involved in a major security revamp of several networks.

About the Book Part of the TotalRecall: IT Certification System Series, this new book fills the gap existing in the complete study aid material available for candidates preparing to set the CompTIA Security+ Exam. This book covers information associated with each exam topic in detail and includes information found in no other book. This manual is designed to provide information to help readers study for and pass CompTIA's Security+ certification exam. Every effort has been made to make this manual as complete and accurate as possible. Just reviewing the table of contents, you will see that through TotalRecall Publications, I was given the freedom to build on what I have learned from running a Voc Tech school. For example, the chapter numbers are written in Base 2. The goal here is to reinforcement, learn binary math, since that is how much of computing works. In this release, we teamed up with other alpha geek around the world with the end result is you will not find another Security+ book with more geekie details, if you need them. This title (ExamInsight to) is a 'I want to make sure I know everything about Security+ before I spend a couple hundred bucks on SYO-101.' If you are already in Security networking, and don't want/need a complete certification/reference/killer idea book, try the ExamWise For Security+: The IT Question Book Series: ISBN # 1-59095-266-9 from www.TotalRecallPress.com. If you are in the game for in-depth understanding, this is this book for you. Helen and Tcat encourage questions from and support the readers of this work. To us, it is another form of Networking, and we look forward to hearing from you. [email protected] or [email protected]

Frequently Asked Questions Q: I'm interested in Security+. What details do you have? A: The body of knowledge is 2 years practical experience. US pricing is currently $175 for CompTIA members and $225 for non-members. The wording on the CompTIA site leads us to believe this may be special introductory pricing only. Exam number is SY0-101[1]. Number of questions is 100, with 90 minutes to complete, requiring a score of 764 on a scale of 100900 to pass. (This means 83%)

B. This work is based on the objectives as provided to the public by CompTIA[2] as of November, 2002. [1]

http://www.comptia.org/certification/security/objectives.htm

[2]

http://www.comptia.org/certification/security/objectives.pdf

How To Read This Book Battle-scarred field computer engineers and Information Technology (IT) Trainers designed this book, ExamInsight For Security+ Certification. Rest assured that while it is obviously quite different from the typical book you have seen, we had several reasons for any variation from the typical tech book. First and foremost you cannot, we repeat cannot know it all. Relax, sit back and learn what is critical and pertinent, then build on that information step by step. Get those basics down and then grow with that information. We strongly suggest that regardless of your experience level, read casually from this page forward to the end for the first time through. We separate what portions of information are nice to know and are historical in nature, we also share real world tips. We know that learning from a book to pass a certification exam is far from all that you need to know to be functional in the real world.

Humor Our philosophy continues with blending humor, real-world lessons learned, and continued support. At least this way, you know why sometimes our industry can be both brilliant and 'FUBAR'd' all at the same time. That is one acronym we won't spell out for you! The tone is informal, slightly politically incorrect, at least more so than other books, less so than Maximum PC magazine.

Continued Support We encourage questions! We find that if you are patient, and go through and complete the exercises this will reinforce your learning and the information will stick with you. We ask the average student to plan on a minimum of 10 hours of study time after completing the course. A visual person you say? We have included lots of pictures and screen shots of the topics under discussion to help you correlate what you are reading with what you will see live.

Real-World Lessons Microsoft has a favorite term, heard on their campus. They call it, 'Eating our own dog food.' They mean they use their own tools to create new work. (This is great until some test version of an email distribution system running the campus dies.) Since you the reader are attempting to learn the INs and OUTs of the IT industry, we have brought you what it looks like to 'eat your own dog food.' This book doesn't have the traditional label of introduction. Instead, we used a popular form in IT as your first clue to look for whenever you are unpacking a new piece of computer hardware or software. It is called, Readme.1st, READ.ME, or Read.Me!, or other clearly labeled warning that is too often ignored. The bottom line for ANY PC is, either On or Off. Binary means two. Computers work in binary. So, to assist you in thinking in binary, the chapter numbers are in binary. As a purchaser of this work, you are automatically entitled to join your fellow readers and authors on a private email list. Experience tells us that learning is more fun and easier when done with a group. To join the others, send an email to: [email protected] Subject: Subscribe SecurityPlus If everything goes right you will get an email telling you to respond. (This is to prevent someone else from using us for creative revenge, on you.) If you don't get a reply, check your email to see if you sent Plain Text (that helps). Got a thought about this book? Praise us or pan us by writing to: [email protected] We always read each email, and unless we are teaching a class, we respond within hours.

The Why of this Book Tao is Chinese for 'how'. The how of ExamInsight For… reflects elements of our Tao in the classroom. The old saying, 'Tell them what you are going to tell them. Then tell them. Finally tell them what you told them' has merit. The way the human mind works best is by as many different input styles as possible and repeat as much as possible. With that in mind, you will hear some points said one way, then referred to or re-stated again. We compared notes throughout the process quite frequently. And when we felt that a point was a 'gotcha', in the real world, we each spoke our piece. A wise person could consider the repetitions a ‘gotcha meter'.

Icon Alerts These are the symbols or keys to information alerts; use them as another study aid.

Historical Owl!

This is material that is not directly testable by CompTIA and the Security+ test, but may either help you 'pull on the thread' so you can see why something is. Geek Owl! This is material that is too deep for CompTIA and the Security+ test. But knowing it will help you put the topic together. Future Owl! This indicates a topic that should be on your radar screen. CompTIA generally only tests for what are 'commonly accepted' items in the industry. Future Owl tells you about something coming up. You will look good in a job interview and/or should know about something that will be hot tomorrow, sooner rather than later. Real World OWL! (a.k.a real world) describes tips for understanding the difference between by the book and the real world out there in IT.

Who is? Success OWL The OWL is an honest presentation of how the computer industry looks to us. You will notice in our logo, Success Owl is setting on a branch with leaves. The gold of the OWL'S feet and the green of the leaves signify the money you can make in this business. The Branch is you. The branch represents your strength, energy and diligence in achieving your goals. Like any serious players in the computer game, we have to run very fast just to attempt to keep up. Each of the OWL's feathers is something to learn. No matter how fast you run, you cannot get to the top. (You just fly for more gold.) Further, each Feather learned will become obsolete too quickly for comfort. That is what this industry is about -- IT is in a constant state or refreshment and therefore a lively, never boring chosen field. Finally, once the decision to get on the IT knowledge is entered, there is no getting off. Life long study is mandatory.

Security+ 2002 Exam Specifics Status: Security+ became available December 2, 2002. This book is based on all available data for Security+. To register for the exam, see the Security+ section of the CompTIA web site for the most upto-date registration link. The following material is the public statement from CompTIA from the web site http://www.comptia.org regarding Security+.

Exam Skills Measured and Weighting 'The skills and knowledge measured by this examination are derived from an industry-wide job task analysis and validated through an industry wide survey. The results of this survey were used in weighting the domains and ensuring that the weighting is representative of the relative importance of the content. This examination blueprint includes weighting, test objectives and example content. Example concepts are included to clarify the test objectives and should not be construed as a comprehensive listing of the content of the examination.

Number of questions asked for: 100 Time allowed: 90 Minutes Static or Adaptive: Currently Static Scoring: 764 Minimum Pass Score - 100-900 range Test Fee: $175 USD for CompTIA Corporate Members and $225 USD for non-members 1.0 General Security Concepts

30%

2.0 Communications Security

20%

3.0 Infrastructure Security

20%

4.0 Basics of Cryptography

15%

5.0 Organizational / Operational Security

15%

Total

100%

Note: All percentages are approximate and are subject to change.

Introduction This courseware is designed for use in two ways. 1. Instructor-led course 2. Self-study

Welcome! This manual has been designed to provide information for students to pass (green bar) the CompTIA Security+ certification test.

Intended Audience The material for the student has been designed for a student seeking Security+, and possibly using this as a stepping-stone to CISSP. This material provides a direct road map of what to expect when taking the Security+ test. This material is reflected in the Test Objectives and Wise Owl Tips. It is highly recommended that students pay special attention to the Wise Owl Tips prior to taking the Security+ exam

Self-Study Students This manual may also be used for self-study purposes. The courseware was written for the student who has almost no networking experience, and requires some additional instruction on theory. We suggest reviewing the Test Objectives and Wise Owl Tips in your initial reading of this study guide.

Chapter 0000: Read.Me "Security isn't technology. Security is a process, though it is enabled by technology." James Christiansen CSO, General Motors

Overview This domain requires the knowledge and skills to identify, security concepts, following established basic procedures for system security. Each chapter directly relating to test objectives are detailed in this section. This brief chapter is for *everyone*. It doesn't matter if you are a manager, a technical guru or a marketing specialist. While the body of this work examines security issues in depth, here you will discover the overview of security. In July 2002, Bill Gates gave an update on Microsoft's Security Initiative. In short, it took the company two months, not one to begin to clean up the software holes, at a cost of 100 million bucks. (And that's just the beginning!) More importantly, his memo called upon users doing their part. Giving this work a quick glance could leave the reader with a thought similar to, 'we're doomed.' This certainly does not have to be the case. Security is not an all-or-nothing proposition. It involves analyzing the various risks faced by the organization, and taking the appropriate steps to bring the risk down to a level acceptable to the organization. In this title you will discover that: • • • • •

Security is an ongoing challenge, not a one-time fix. Consider it job security. Security costs can be quantified and given a positive Return On Investment (ROI). Security approaches must be balanced between physical security, technical security and people. The biggest challenge in security is people. While there are no absolutes, many attacks are easily stopped.

We begin your overview by examining the above listed points. As the chief security officer of GM stated, security is a process. Forget for the moment that new holes are found in systems that have existed for years (such as the veritable Apache web server), and, remember that new technologies give rise to new issues. Because security is not a pleasant thought for most of us, there is a human tendency to just pretend it doesn't exist or at best, demand a 'fixit!' so it doesn't have to be thought about again. Sorry! That isn't how the world works. Any psychology student can tell you that the fear of the unknown is a very powerful emotion. This in fact is what drives the irrational need to either ignore security issues or demand a one-time permanent solution. There is an old saying 'knowledge is power'. That truism builds on the behavior of human fears of the unknown. This leads to the next bullet point. Security costs can be quantified and can be given a positive ROI. While more on this matter is discussed in the legal chapter, the Secure Business Quarterly reports, 'Results

demonstrate that efficient gains greater than 3 percent are realized when introducing appropriate security. The quantifiable benefits are decreased maintenance costs and obvious savings due to the reduction of successful attacks.'[1] If the functional ROI is not a motivator for you, consider the legal ramifications. Not taking prudent security measures will vary in outcome, depending on your industry. If you are lucky, you will be explaining this as a lesson learned while interviewing for your next job. If you happen to work in an industry that requires not only security, but also filing a Suspicious Activity Report (SAR) and you fail to do so, you may not have to worry about finding a new job. The Federal government could be providing you a job, along with food, shelter and clothing for a long time in the Iron Bar hotel. [2] Continue our high-level view by considering the next bullet point. Security is a matter of balancing technical, physical and people issues. The first point in this bullet is balance. Balance is a reference to both the degree to which you invoke a solution on one of the three points, and balancing the points of physical, technical and personal against themselves. A strong caution is offered here and now. This book was written to provide you the data to pass the CompTIA Security+ as well as give you data to be successful in the real world. CompTIA is short for Computer Technology Industry Association. This makes a reasonable assumption that Security+ as a test focuses on the technical portion in what we refer to as the Triangle of Security (which it does-some policy level knowledge is tested, but that's in the minority). This means we have gone beyond the Security+ test and given you a map to succeed and excel in the real world. When you pass Security+, you have our pat on the back, but that does not make you a security guru. Another group has put a fair amount of effort into security, whose focus is not just on the technical side. This group is called the (ISC)2, or International Information Systems Security Certification Consortium, Inc., and they offer the CISSP, or Certified Information Systems Security Professional, certification. This is a higher-level certification that requires several years of documented field experience as part of the certification process. The core of the CISSP philosophy is Planning Policies, Procedures and People. As a Security+ professional you may be reporting to a CISSP. Keep in mind they have more experience and training on the actual implementation for what your authors have called the Triangle of Security. You may be a specialist in technicality, and that is wonderful, but a specialist in the U.S. Army is called a specialist too, and that does not make his title 'commanding officer.' Remember your role on the team, and don't be too smug with your new certification. This human thought brings us to the next bullet point.

The biggest challenge in security is people. There is a term for this challenge: social engineering. There is one school of thought that suggests social engineering is not part of the security issue. The argument attempts to split technology from people. While your authors understand the difference, this is a work concerning security and we have kept in mind that people are part of the security issue-a statement with which CompTIA's exam objectives agree.

The first part of your effort here is ‘selling' the idea that security is in the other person's best interest. It was Samuel Clemens (also known as Mark Twain) who, in his essay 'What Is Man?' stated that, 'every one of us acts at all times in his own interest.' The trick is to supply the data to the users in a form through which security can be properly applied to suit their own best interests. Your authors do not mean to imply that most workers don't care about their jobs. Social engineering, which is the most successful form of attack used by the outside intruder, often specifically takes advantage of workers' desire to be helpful to coworkers, vendors or other business partners while doing their jobs. For example, the intruders' first phone call to an employee reveals the name of the person in charge of the phone system. The second phone call wants to know the make and model of the phone system. This gives the intruders the data to make the third phone call -- to get a person do perform some simple step, as requested by (insert obtained name from the first call). With this, the intruders just got an employee, who thought they were doing their job, to prop open a door on the phone system for the intruders. A perfect example for this attack is the Kevin Mitnick scandal. We have carefully chosen one example to highlight as a typical method into your network that is not often thought of…..your modem. Modems tend to be forgotten because they are not as new and super fast as a network broadband connection. Even at 28Kbps, a modem that is not monitored for a few days can be the loophole allowing a fair amount of data to slip out undetected. This brings us to the last bullet point, involving Risk Assessment, and then we offer you some good news. In order to apply security measures intelligently, you should be aware of the risks faced by your organization. We can't give you a list of them, because they're different for all organizations. For example, US government computers containing national-securityrelated information may be worth spending millions of dollars and tens of thousands of hours of staff time to protect, to ensure the confidentiality and integrity of the information on them. The likelihood of a sophisticated person specifically targeting these systems, because of the data they contain, is relatively high. Likewise, the potential for major consequences, should this information fall into the wrong hands, is great. In contrast, your child's computer used for homework assignments probably merits a less rigorous approach to security-although if your child keeps a diary, they might be ready to insist to you that it deserves the level of security applied to systems containing national secrets! The sad reality today is the fact that most computer networks have little to no protection. Our guess is this is the 'I don't want to think about anything bad' approach. In our research we found two disturbing issues. First, an unprotected computer will be at least probed for information within 2 to 3 days of being plugged into the Internet. This is a statistical average[3]. There are reports at honeynet.org of being invaded within 15 minutes of going on-line. Brian & Tom's Linux book goes so far as to suggest that if a computer has a broadband connection to select 'no Ethernet' as the selection when first installing a Linux configuration[4] due to multiple reports of being hacked within 10 minutes. Second, most of the numerous ‘bad guys' out there are what are known as ‘script kiddies'. This means they grab some software designed to probe for gross lapses in security. Once one

of the many targets has been identified, they run additional software that will cause havoc. While this may seem like bad news, it's partially good news. The script kiddie has virtually no technical knowledge. The typically self-taught script kiddie has little more understanding than a monkey that has learned to 'push button-get bananas'. It is the sheer number of script kiddies existing, and the randomness with which they select targets that make reports of being hacked within minutes a reality. This doesn't sound like good news, does it? Aah, but there is good news. Because the script kiddie is pretty clueless about the underlying technology, and there are so many completely naked targets, a digital equivalent of checking to see if the car door is locked makes the typical site uninviting unless they can walk right in. Security specialists call these simple security precautions Low Hanging Fruit (LHF). Chapter 0011, 3.4.3 Honey pots, reveals the depth of this statement with an email (used with permission) between one of your authors and Fred Cohen. Mr. Cohen is one of the pioneers of computer security with hundreds of publications on the topic over a 20-year period and popularized the term ‘computer virus'[5]. Furthermore, he has one of the most popular 'honey pot' programs ever. Script kiddies are relatively easy to spot and stop. Since they tend to use 'canned' exploits, many successful attacks can be prevented by keeping your systems up to date with patches. Still more can be prevented through the use of an Intrusion Detection System which recognizes patterns of attacks. Both of these topics are discussed in more depth in later chapters. We are sorry to report there are elements (human and otherwise) that are potentially more damaging than the script kiddie. And, that is our next topic, [1]

Volume one: Issue Two http://www.sbq.com/sbq/rosi/sbq_rosi_efficiencies.pdf

[2]

CFR Part 21 Minimum Security Devices and Procedures, Reports of Suspicious Activities, and Bank Secrecy Act Compliance Program http://www.occ.treas.gov/fr/cfrparts/12CFR21.htm

[3]

http://www.honeynet.org/papers/stats/

[4]

http://www.orbdesigns.com/pages/btlb/ch03/btlb/btlb_c03.html

[5]

http://www.cknow.com/vtutor/vthistory.htm

0.1 You're Saved….If If you have scanned the first couple pages of this book you understand there are tradeoffs for every choice. Your authors wish to caution you about *any* 'solution' that appears to be a cure-all. Over 100 years ago, the western United States had marketing types who rode in wagons selling magic in a bottle to the citizens in less than pleasant conditions. They were known as ‘snake oil' salesmen. Any marketing guru that promises a sure-fire cure to end all should be considered a 21st century version of snake oil. There are numerous legitimate solutions that drastically aid in a challenge.

And again, there are no absolutes in this game. The worm Code Red ripped through the Internet because of holes in Microsoft's Web Server, IIS in early 2002. By the time the year was half over; successful attacks on Linux systems ran 2 to 1 over Microsoft systems. The best solution today is probably tomorrow's ‘less than best,' and may become ‘fish wrap'. As this introduction has pointed out several times, security is a process, not something you throw some attention to and forget. Any zealot telling you something to the effect that Linux is secure and Windows isn't has not done their homework. And if Redmond suddenly starts proclaiming that Windows is more secure than Linux, well that's marketing. The reality is everybody, including Apple, is a target, simply because it is there. In this introduction, we have thrown a number of terms at you. In the interest of clear communications, we would like to introduce a couple more.

0.2 Hacker Vs. Cracker Language is a fluid thing. In days of old (in Internet Time) a hacker was a person who studied for possible vulnerabilities in a system and reported the results. A cracker was a term for someone who did bad things to a system once they discovered some vulnerability or came upon the work of a hacker's results. http://www.hackers.com/ is on a mission to be a seeker of knowledge without the destructive use of this information. As people who need data to successfully perform in a Security+ role, the goal of hackers.com is in alignment with our needs. Given that, we understand the need to help show language differentiation and support their goals. Hacker is a knowledge seeker. A cracker is the bad guy seeking to hurt you. We make our point with the RFC included below. In case you are wondering, RFC stands for Request For Comment. This is a process in which a thought is proposed on how to do something technical on the Internet, such as transfer files, access remote systems or route packets among networks. There are thousands of these entries, and some of them are just plain funny. This particular RFC is humorous and still makes the point. The original memo is plain text -- emphasis has been added. Geek Owl! RFC 968 Network Working Group

V. Cerf

Request for Comments: 968

MCI

December 1985

'Twas the Night Before Start-up' STATUS OF THIS MEMO This memo discusses problems that arise and debugging techniques used in bringing a new network into operation. Distribution of this memo is unlimited. DISCUSSION

Twas the night before start-up and all through the net, not a packet was moving; no bit nor octet. The engineers rattled their cards in despair, hoping a bad chip would blow with a flare. The salesmen were nestled all snug in their beds, while visions of data nets danced in their heads. And I with my datascope tracings and dumps prepared for some pretty bad bruises and lumps. When out in the hall there arose such a clatter, I sprang from my desk to see what was the matter. There stood at the threshold with PC in tow, An ARPANET hacker, all ready to go. I could see from the creases that covered his brow, he'd conquer the crisis confronting him now. More rapid than eagles, he checked each alarm and scrutinized each for its potential harm. On LAPB, on OSI, X.25! TCP, SNA, V.35! His eyes were afire with the strength of his gaze; no bug could hide long; not for hours or days. A wink of his eye and a twitch of his head, soon gave me to know I had little to dread. He spoke not a word, but went straight to his work, fixing a net that had gone plumb berserk; And laying a finger on one suspect line,

he entered a patch and the net came up fine! The packets flowed neatly and protocols matched; the hosts interfaced and shift-registers latched. He tested the system from Gateway to PAD; not one bit was dropped; no checksum was bad. At last he was finished and wearily sighed and turned to explain why the system had died. I twisted my fingers and counted to ten; an off-by-one index had done it again.. Vint Cerf December 1985

A recent study was released on the personality of a hacker. Quoting InfoSecNews[6] . 'In a study consisting of a questionnaire and longer-form answer section started at the hacker convention H2K and Def Con 8 in 2000, Bernadette Schell, dean of Business Information Technology, University of Ontario Institute of Technology and John Dodge, professor at the School of Commerce and The Department of Math and Computer Science at Laurentian University, profiled 216 hackers and their style of thinking, coping with life, and problemsolving.' The researchers found that the respondents, whose median age was 25, have "extremely low" tendencies towards terrorist and obsessive traits and possess "relatively balanced temperaments,' according to Schell. 'Respondents also tested as particularly creative,' she said, noting that the top score for creativity was 20 and that 62 percent of those polled scored 15 or higher on the test.

The combination of creativity and problem-solving styles revealed a commonality between hackers and a group that might not expect they have much in common with hackers: corporate presidents and chief executive officers. 'The combination of analytical and directive problemsolving styles is shared by both hackers and corporate executives,' Dodge said.

[6]

http://www.c4i.org/isn.html

0.3 Security Tao Tao is a term that generally means that the subtle reality of the universe cannot be described. While choosing the word Tao would seem to suggest it is not possible to describe security, our goal is to give you an outline on the general ‘how' of security, without pretending to say, ‘step by step, here are all of your answers'. In simpler times of living in a non-computerized domain, the number one challenge was physical security. There was no computer called the domain controller, or network cable to defeat. A person defeating domain security would be destroying his own family and possessions, effectively reducing the threat. This allowed physical security to be evaluated to a high science. Without boring you with details, such as the openings in the walls that were slanted to deflect incoming arrows, let's look at the logistics of protecting a village. The basic plans are the same today. Villagers would work outside the castle walls in fields. The castle had watchtowers placed so a complete view of any possible threat could be observed, while allowing for preparation time. When a watchtower sounded an alarm, the villagers would retreat behind the castle walls, the drawbridge was raised and defensive counter measures were lit up (often literally). Defenders with long bows had the advantages of height and protection from the castle walls. They would begin by sending arrows out in an attempt to break the solid front of the attackers. If there were dry fields between the opposing factions, the arrows would be on fire, to create a ‘wall of fire' (firewall) causing further delay and damage to the attacker. Assuming this was a serious attack, the defenders would then pour hot oil on the advancing attackers from atop the castle walls. Catapults would be used to throw rocks and/or fireballs at the rear of the attacking force destroying supplies. With proper planning, a castle would have stores of supplies to outlast a siege (blockade) while the opposing force had no practical method to penetrate the castle walls. The elements briefly described here demonstrate a defensive system that while old is still effective. It is known as a zone of security. Zones of security offer a defensive point while buying time to either start heating up oil to pour on the attackers or to page an administrator to begin counter measures. Another common element is that zones of security start out as simple physical/psychological barriers, and eventually end up including more hardened elements. Today, you may find concrete barriers preventing parking within a given distance of an airport functioning as the outside perimeter. The closer in you come to the airport, you find closed circuit TV and police. Move to the inside of a terminal and you find in addition to the closed circuit TV and police, plain clothes (undercover) security forces, along with inspections. This is a modern day example of zones of security. Zones of security are not limited to physical attributes. This concept can and should be applied to all forms of security.

0.4 Security Checklist Regardless of physical or network considerations the following points need to be addressed. They are: • • • • • •

Proof of identity (authentication) Access permissions (authorization) Eavesdropping prevention/Encryption (confidentiality) Protection of information from modification (integrity) Proof of involvement (non-repudiation) Connectivity between parties (availability)

An effective overall security plan addresses these six issues. Typically this requires a collection of resources. A single element may offer more than one attribute. For example, strong encryption of data addresses both confidentiality and integrity. Other methods must be used to satisfy the other factors. Physical security should be modeled with the same principles. Consider a system involving access cards without connectivity. This makes checking a centralized database (authorization) or logging access (non-repudiation) difficult at best. Later chapters of this book provide more information about the items on this checklist.

0.5 Security Through Obscurity More than one article has suggested security via obscurity. The theory goes that if you select a less than popular OS (operating system), such as AIX from IBM or an older Mac selection, as the OS of choice, the black hat would feel 'it isn't exciting' enough, and finding published flaws would not be as easy, so they would move on to other LHF. The sole devil's advocate we could find to this argument came from Writing Secure Code[7] by Michael Howard and David LeBlanc. On page 34 '…it is trivially easy for an attacker to determine obscured information.' Other parts of this book show many examples of how such information can be found. Showing that some security recommendations are a matter of opinion, co-author Helen chimes in here with a somewhat-dissenting view. While running an obscure OS won't protect you from an attack that specifically targets your site (as Howard and LeBlanc point out, using an obscure platform might make it a bit more difficult, but not impossible), it does discourage those attackers who are looking for any old random site running a certain popular OS (like Linux) that is vulnerable to the latest 'script kiddie' program. If you can eliminate the effectiveness of a large percentage of the random attacks without losing required functionality, it may be worth considering. Appendix B, 'The Ten Immutable Laws of Security' and Appendix C 'The Ten Immutable Laws of Security Administration', originally by Scott Culp of the Microsoft Security Response Center, make Howard and LeBlanc's book a must-have on the reference shelf of every IT person. These lists can also be found on the Microsoft Technet web site, at http://www.microsoft.com/technet/columns/security/10imlaws.asp and http://www.microsoft.com/technet/columns/security/10salaws.asp.

Technical Oxymoron From a technical viewpoint we face an oxymoron. Under the single umbrella of security we have two opposing solutions. One is to filter out potentially bad stuff, such as closing ports or examining traffic for something bad. The other solution is to encrypt at some level of the OSI model, to help ensure that only authorized individuals can do anything on your network. The challenge lies in the fact that once you encrypt at a given layer of the OSI model, you can no longer filter traffic because it is encrypted! Whoever came up with the phrase, 'the devil is in the details' may well have been thinking of the challenges in security. [7]

Howard, Michael and David LeBlanc, Writing Secure Code, Microsoft Press, November, 2001, http://www.nerdbooks.com/item.html?id=0735615888

0.6 Resources We have divided this work into three separate thoughts. The primary is to give you what you need for the real world. The second is to let you smoke Security+. The third is to be a resource, not only as a stand-alone book but your guide to the best expert authorities of a specific sub-topic. Since the specifics of security change with the clock, we will point you to the best sources we have found. Since this opening chapter is a generic chapter, we offer you a generic email list of great value. That is the INS list at attrition.org. It was from that list we were alerted of an article at the ComputerWorld site, even before the email alert from the ComputerWorld web site came to one of your authors. The particular article can be found online[8]. In an effort to both entice you, as well as, a small offering that we are not just making this up, we offer a few lines from Dan Verton, posted July 18, 2002.

'A hacker nicknamed RaFa is the ex-leader of the now defunct World of Hell defacement group, which racked up thousands of Web site defacements before disbanding last year. He said that in addition to making simple configuration mistakes, most administrators don't keep up with updates and patches released by their software vendors.' "They don't update services running on the system, and, they set up permissions and software settings the wrong way on the Web server," said RaFa. "Think about all of the zero-day exploits I've used. The vendors knew about 90% of those." 'However, the real problem is not laziness, it's trust,' said Genocide, the leader of the Genocide2600 hacker group. 'Most administrators and corporate managers simply trust that they are secure,' he said. "That is their first and biggest mistake," said Genocide. "People believe that since their company may not have anything that someone would want they are free from attack. What administrators really need to do is treat every day as if they were at war and as if the enemy were always planning an attack,' he added.

"It's the companies, administrators and CEOs that don't see it that way who become the easy targets," said Genocide. "They are the ones who don't keep their firewalls, intrusion-detection systems and software upgraded."

[8]

www.rootkit.com

0.7 Summary In closing, you learned that there are steps within easy reach that help you achieve a positive ROI, if by chance you were either a high profile target or a random site seen as a ‘personal challenge' by an intruder because of your LHF. These steps allow you to cut them off, and sleep at night. By balancing the triangle of security -- physical, technical and people-and ongoing efforts you will accomplish all that you set before you. You discovered there are many resources available to you, and failure to protect yourself and your company could bring you serious legal and professional difficulties.

Chapter 0001: Domain 1.0: General Security Concepts (30%) "He knows not his own strength that hath not met adversity." - Benjamin Jonson

Getting Ready - Questions 1. Bell La-Padula features A. B. C. D.

DAC Quack MAC All choices are correct

2. Kerberos features A. B. C. D.

Scalability for large environments Authentication over untrustworthy networks Asymmetric encryption Creates three session keys

3. CHAP features A. B. C. D.

A three-way handshake: Encrypts the process using RC4 Repeats the challenge at random intervals Is stronger than Kerberos

4. All SmartCards utilize: A. B. C. D.

Biometrics SecureID Tokens Certificates All choices are correct

5. A SYN DoS attack operates by A. B. C. D.

Sending repeated TCP SYNACK packets Sending repeated UDP SYNACK packets Sending repeated TCP SYN packets Sending repeated UDP SYN packets

Answers 1. *C. MAC Explanation: MAC (Mandatory Access Control) 'Division (B): Mandatory Protection The notion of a TCB that preserves the integrity of sensitivity labels and uses them to enforce a set of mandatory access control rules is a major requirement in this division. Systems in this division must carry the sensitivity labels with major data structures in the system.' DoD 5200.28-STD [1] §http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.pdf http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.pdf http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.pdf DAC or Discretionary Access Control is, by definition, optional. The reference to Bell LaPadula is derived from a white paper published in November 1973 by David Ellott Bell and L. J. LaPadula Titled Secure Computer Systems: A mathematical Model This mathematical discourse is the basis for DoD Class B Trusted Computer systems. 2. *A. Scalability for large environments *B. Authentication over untrustworthy networks Explanation: Kerberos is an authentication system created by MIT to allow for the exchange of private information on an untrusted network.[2] Kerberos uses symmetric encryption and the Authentication Server (AS) creates two temporary session keys[3]. 3. *A. A three-way handshake *C. Repeats the challenge at random intervals Explanation: The Challenge-Handshake Authentication Protocol uses a three way handshake that is repeated on a random basis[4].Generally speaking[5], Kerberos is more

secure than CHAP. Note that both Kerberos[6] and CHAP[7] have issues 4. *C. Certificates Explanation: Basic smart cards have a limited storage capacity (around 16k). A Certificate Authority issues a certificate to the owner of the smart card, which is stored on the card itself. When authentication is required, the user presents the physical smart card (by placing it in a card reader), and supplies a PIN number. The PIN 'unlocks' the card, and allows the certificates stored on it to be retrieved and checked for authenticity. A biometric option for reading the fingerprint of the owner is an option not a requirement[8]. Similarly, some SmartCards involve the use of SecureID tokens, but this is also optional. 5. *C. Sending repeated TCP SYN packetsExplanation: Since TCP uses a 'virtual circuit', the circuit must be set up at the beginning of the conversation. UDP does not require a conversation setup, so no UDP choice is correct. The SYN attack occurs by sending SYN requests, rather than by responding to them[9]. This is a function of the design of the protocol. The normal TCP circuit request involves a three-way handshake: the source system sending the initial SYN request, the target system replying to that SYN with a SYNACK, and then the source system replying to the target with another ACK. When the target system receives a SYN, it sends its SYNACK and keeps the request open for X time, waiting for the final ACK. If the ACK is not received, the request stays open, consuming resources on the target system. If repeated SYN's are sent, and not completed with ACK's, this could exhaust the target system's resources and cause it to be unable to accept additional network connections. [1]

http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.pdf

[2]

http://www.webopedia.com/TERM/K/Kerberos.html

[3]

http://www.contrib.andrew.cmu.edu/~shadow/kerberos.html#general

[4]

http://whatis.techtarget.com/definition/0,,sid9_gci213847,00.html

[5]

Http://www.ecse.rpi.edu/Homepages/shivkuma/teaching/sp2001/ip2001-Lecture15.ppt

[6]

http://www.netscapeworld.com/nl/win_unix/08222002/

[7]

http://stealth.7350.org/chap.pdf

[8]

http://www.linuxnet.com/cardsec.html

[9]

http://www.niksula.cs.hut.fi/~dforsber/synflood/result.html

1.0 General Security Concepts Security can be broken down into three thoughts, often called the AAA of security: Access control, authentication and auditing (or accounting, to some). This domain looks at these concepts as well as some common practical issues you’ll run into when administering security for an organization, including cracker attacks, malicious code, social engineering and vulnerabilities caused by running non-essential services and protocols.

1.1 Access Control Access Control, the first item in the AAA of security, involves the process by which you restrict access to computing resources. It is a combination of Authentication (proving who you claim to be) and Authorization (what are you allowed to see, presuming you are whom you claim you are.) Access control allows you to enforce the security principle of least privilege—that is, individuals should be assigned the minimum privilege level required to carry out their assigned tasks. Only those individuals authorized to access resources are permitted access to them. (In practice, the OS default often allows everyone access. But the theoretical reality is that access could be restricted.) The capabilities and methods of access control are often different on different operating systems. Access Control on an AS/400[10] is different than on a UNIX or NT based machine[11]. The Security+ test examines three different types of Access Control, which we will cover in the next section. Before moving on to 1.1.1, we would like to point out that all three types of control have some degree of being real. That is, enforcement of access control is handled by the operating system and cannot be bypassed. Why make this point? Any Windows 3.x/9.x/Me Operating System is DOS based, despite any claims to the contrary by the vendor in Redmond, WA. We are not knocking DOS, which is a useful stand-alone operating system for some purposes. But you do need to be aware that these operating systems offer NO security at the local machine level. Any user walking up to the machine can access any files stored on it. “But you have to login!”?. No, you don’t—you can press the ESC key at the login dialog, and while you won’t have network access, you will have access to the local machine and the contents of its disks. A degree of security can be bolted on at the network level, requiring that users provide a user ID and password known to the network before they access network resources—but this only controls access to network resources, not those on the local machine. With Office 11, Microsoft will be encouraging pre-Windows-2000 users to upgrade, and we certainly don’t disagree from a security perspective. Real security can be found in the Bell La-Padula[12] model, among others, discussed in section 1.1.1. Success Owl!

Access Control Access control involves the process and mechanisms used to restrict access to computing resources. Access control is enforced by the OS and cannot be bypassed using legitimate OS functionality.

1.1.1 MAC/DAC/RBAC (Also see 5.5.5) Within the topic of Access Control, we can look at three specific types of access control.

Mandatory Access Control Mandatory Access Control (MAC) is military-strength access control. In the absence of a permission that specifically allows you access, you are not getting in. Every thing in the system is an object and every object gets a classification label, which usually represents the sensitivity of the object, such as “top secret” or “confidential”. Individual users, called subjects, are also assigned a privilege level, called a clearance. To determine whether or not a given individual can access a certain object, the object’s classification level and the user’s clearance level are compared. There is an established hierarchy to the labels (or levels), such that anyone authorized to see “top secret” information can also view “secret” and “general access” information since those are less sensitive, but someone authorized only to view “general access” information can’t necessarily see the more sensitive “top secret” information. Success Owl!

MAC Labels Labels may be used to define projects as well. This means that while you may have a top-secret clearance, you are not automatically granted access to a secret project if that particular project is not assigned to your area.

The Bell-LaPadula formal model of access control uses mandatory access control. It is based on several properties, including: •

•

•

star property (or * property), also called the containment level, which states that an untrustworthy user can only write (append information) to objects whose security level is greater than or equal to their own (to make sure that someone with a high clearance level doesn’t accidentally share sensitive information with someone having a lower clearance level—i.e., it prevents “information leakage”) simple property, which states that a user can read data only if its security level is as sensitive as, or less sensitive than, their clearance level (think about a 4-star general being entitled to see more data than a 1-star general) tranquility property, which states that the security level of an object cannot be changed while it is in use by the computer system (this sidesteps the problem of what to do with users actively using an object who are no longer permitted access when the object’s security level changes) Success Owl!

Bell-LaPadula The Bell-LaPadula model describes a mandatory access control model that is used by the military. It determines whether an access is permissible by comparing an object’s (or data item’s) assigned hierarchical classification level and the subject’s clearance level. If the user’s clearance level is at least as high as the classification level of the object, the access control rule permits the access. Otherwise, access is denied.

•

Figure 1. MAC uses both hierarchical classification and the subjects clearance level

Another MAC-based model is the Lattice-based access control model. It shares with the BellLaPadula model the idea that objects and users are each given a hierarchical security level label, and that you determine whether or not a user has access to an object, by comparing their labels. As with Bell-LaPadula, if the user’s clearance level is at or above the classification level of the object, access is permitted. Geek Owl! Bell-LaPadula and Lattice Sometimes the terms “Bell-LaPadula model” and “Lattice-based model” are used interchangeably, but the original version of the Lattice-based model did not include the Bell-LaPadula’s requirement that a user is not permitted to write into a document with a lower security level than the user’s security level, and thus, technically did not prevent disclosure of higher-level information to lower-level users as well as does the Bell-LaPadula model. Success Owl! MAC & Lattice Another MAC model is Lattice-based[13] access control, sometimes also referred to as the Bell-LaPadula model.

Discretionary Access Control Discretionary Access Control (DAC) is based on the user’s identity and the access control rules in effect on the system. DAC is the type of access control most commonly found in the PC and network computing worlds. NT/Windows 2000, Linux and UNIX for the most part use DAC. While MAC restricts the copying of data, DAC does not. Instead, DAC leaves decisions like, “to copy or not to copy,” up to the user’s discretion. If you have read access on a DAC-based system, you can copy the data (via copy/paste) if you wish. On MAC-based systems, which contain special safeguards to prevent copying of sensitive data, that cannot happen. Why might this be important? If you were permitted to copy the data as well as view

it, you could potentially store it in a separate file you control, and set up your own list of users allowed to access it—including users not permitted access to the original file, in violation of the mandatory access control on the data. One DAC model is owner-based DAC, in which the owner controls access to resources they own. For example, the user can grant or deny access to others, and define exactly what types of access (such as read or write) are permitted. DAC usually involves an Access Control List (ACL) on each system object (file, device, etc.), which specifies which users can have access to that object, and what type of access (such as read, write or execute) they can have. ACLs offer no protection against malicious programs like Trojan horses which typically run with the logged-in user’s permissions. If a user runs a Trojan horse, virus, etc., these programs can access whatever objects that user is permitted to access. (Refer to 1.5.2) An alternative to ACLs is to use capability lists for each system user, specifying what resources the user is permitted to access, and the types of access permitted. (Note that the difference is that an ACL is assigned to an object, and a capability list is assigned to a user). Success Owl!

DAC DAC models include owner-based, access matrix, centralized, decentralized or distributed. DAC is often implemented via ACLs. An ACL specifies the types of access different users can have to an object. ACLs are not a defense against Trojan horse programs.

Role-Based Access Control Role-Based Access Control[14] (RBAC) allows you to define permissions and privileges based on a user’s functional role within the organization or community. One of the most challenging problems in managing large networked systems is the complexity of security administration. Today, security administration is costly and prone to error because administrators usually specify access control lists for each user on the system individually. Role-based access control (RBAC) is a technology that is attracting increasing attention, particularly for commercial applications, because of its potential for reducing the complexity and cost of security administration in large networked applications. With RBAC, security is managed at a level that corresponds closely to the organization's structure. Each user is assigned one or more roles, such as “human resources rep” or “accounts payable data entry clerk”, and each role is assigned one or more privileges that are permitted to users in that role, such as the right to access certain applications. Security administration with RBAC consists of determining the operations that must be executed by persons in particular positions, assigning employees to the proper roles, and then granting the required permissions to each role. Complexities introduced by mutually exclusive roles or by role hierarchies are handled by the RBAC software, making security administration easier. Additionally, administrative burdens are reduced because when a user is added or deleted from the system, it is not necessary to go to every access control rule involving that user, and update it. Instead, adding the user to the appropriate roles (or deleting them) automatically includes (or excludes) the user in the appropriate access lists.

Some operating systems, such as UNIX and Windows, implement a degree of role-based security by placing each user into one or more groups defining that user’s role in the organization, and controlling access to files and other objects by granting permissions to certain groups. Success Owl!

RBAC RBAC allows access control to be defined in terms of organization structure and roles. For example, you can define that a customer order clerk can access your accounting system’s order entry application, but not the check writing application.

Figure 2: RBAC works well because it combines rules Real World Owl! DAC or RBAC? Does your organization use role-based access controls, or are your access controls primarily user-based? If you primarily employ user-based access controls, how often are you updating ACLs? If you’re doing this very frequently, you might save time by moving to a more role-based access control policy. [10]

http://www.inetmi.com/pubs/aaTut.htm

[11]

http://directory.google.com/Top/Computers/Security/Authentication/

[12]

http://www.informatik.uni-bremen.de/~hs/Lehre/L9.pdf

[13]

http://www.list.gmu.edu/journals/acm/survey96(org).pdf

[14]

http://csrc.nist.gov/rbac/

1.2 Authentication Authentication, the second item in the AAA of security, is proving in some way that you are, who you say you are, giving you the right to claim a certain identity. Three types of mechanisms can be used to establish authentication: • • •

Something you know, such as a password Something you have, such as a Smartcard Something you are, which may be a fingerprint, an eye scan (iris or retinal) or a voice pattern

We look at some of the most common authentication mechanisms below. For more information on these techniques, and others, consult the book, Authentication[15] by Richard E. Smith. Success Owl!

Authentication Authentication is proving who you are, by one or more of the following: • • •

Something you know (password) Something you have (Smartcard) Something you are (biometric data)

1.2.1 Kerberos[16] Kerberos[17] is an authentication mechanism often used on larger networks, particularly those on which contain UNIX machines. The idea behind Kerberos is to provide authentication and authorization services in an environment where authentication requests originate from machines that are not trustworthy, and travel across a network that is not trustworthy. Kerberos was designed to provide authentication that is secure over a network whose traffic might be intercepted at any time, reliable, transparent to the user (for example, it shouldn’t get in someone’s way by repeatedly requesting a user’s password) and scalable for use in environments with many hosts. It was developed in the mid-1980s by MIT as part of its Project Athena, and a free implementation of the latest version of the protocol is available from MIT, pleasing those who don’t want to trust any cryptosystem without inspecting the program’s source code. Later versions of Windows NT (Windows 2000 and beyond) use an authentication mechanism based on Kerberos, so you’re probably using it, even if you’re not aware of it.[18] For more of the nitty-gritty technical details of the Microsoft Windows 2000 Kerberos implementation, see Secure Networking with Windows 2000 and Trust Services[19] by Feghhi and Feghhi. To learn more about interoperability between the MIT Kerberos implementation and Windows 2000, check out a list of tips[20] compiled from the experiences of various US universities, as noted in the footnote. Similar to Windows, the architecture of Kerberos allows for multiple administrative domains, so that different organizations and organizational units can control their own user accounts. In the Kerberos world, these administrative domains are called “realms.” As in the Windows

world, it is possible for users to authenticate in one realm and then use services in another, if that remote realm trusts the original realm in which the user authenticated.

How does Kerberos authentication work? A complete explanation of the Kerberos protocol is beyond the scope of this book, but briefly, here’s a (very) simplified explanation as to how Kerberos authentication works. Success Owl!

Kerberos Kerberos uses symmetric encryption, with secret keys, but does not send the user’s password across the network, in encrypted or unencrypted form. Instead, the key is used to encrypt information exchanged between the client and server.

A user authenticates himself when he logs into the network. He provides his user name, and the user workstation then connects to a special “ticket-granting service” on a specific network host called an Authentication Server (AS), for login verification. The AS issues the user a credential (encrypted with that user’s key, known by the server) called a “ticket.” The client machine holds on to this ticket, and uses it to demonstrate the user’s identity when requesting network services. Success Owl!

Authentication Server The AS also creates two session keys, which are temporary in duration, lasting only as long as that session lasts. One of the session keys for the user’s connection with the ticket-granting service, as well as an expiration date, is included in the ticket. The AS retains the other session key. Distributing the keys in this manner allows both sides of the session to communicate with each other in a secure, encrypted fashion, if desired.

If the user supplies a valid password, the session key is used in later attempts to connect to network services—it is sent to the service as proof of the client’s identity, along with a special message called an “authenticator” (with information like the client name, IP address and current time). The service can then decide whether or not the user is authorized to use the service, based on their identity, and allow or disallow the connection attempt. Optionally, mutual authentication can take place; with the server proving its identity to the client as well as the client proving its identity to the server (see section 1.2.7). Kerberos assumes the use of a strong password, since it employs conventional encryption mechanisms. The Kerberos authentication mechanism uses an encrypted password. According to the creator of Kerberos (MIT), various versions of Kerberos are vulnerable to buffer overflows and DoS attacks (1.4.1). Additionally, the Kerberos protocol is somewhat subject to “replay” attacks in which legitimate packets are captured and later “replayed” from an impostor’s machine, although this has been mitigated somewhat by the addition of timestamps to packets. Additionally, it is indirectly vulnerable to brute-force password guessing attacks.

Success Owl!

Kerberos Assumptions Kerberos includes some innovative solutions to problems posed by conventional symmetric cryptography. Kerberos assumes the use of a strong password since it uses a secret key and conventional symmetric encryption. However, it does not send the password over the wire. Kerberos authentication uses session keys that are valid only as long as the session lasts. It also uses tickets to avoid needing to re-authenticate the user each time they request access to a new network resource.

Kerberos can be vulnerable to buffer overflow, replay and brute-force password guessing attacks. Real World Owl! Does it require any open router ports? Kerberos uses TCP port 88 and UDP port 88. When performing authentication across a router boundary, you may need to open those ports on the router.

1.2.2 CHAP Challenge Handshake Authentication Protocol, described by RFC 1994, authenticates a user by way of a “three way handshake”. First, the server sends the client a challenge message. (IE, the server “challenges” the client.) Second, the client uses the message that is sent, along with the ID and the secret (the user’s password), to create a special code value called a hash, typically using MD5, and sends the hash back to the server. (IE, the client responds with the other half of the “challenge handshake”.) Third, the server performs the same hashing function. In theory, the MD5 hash values will be equal, which gives authentication. This is repeated at random intervals during the session. By changing the ID value with each session, a replay attack is not possible. See 4.1.1 for explanations of hashing and MD5. CHAP is most often used for PPP authentication. Firms such as Cisco and Microsoft have produced variations on the basic CHAP model, such as Microsoft’s MS-CHAP, with extensions specific to the Windows NT environment. Geek Owl! CHAP Issues Although like Kerberos, CHAP avoids sending the password over the wire, it still has security issues. In particular, the challenge/response mechanism is only as strong as the secret used to calculate the response. This means that users still need to choose good passwords—for example, not words that appear in any dictionary. Also, the protocol itself contains some weaknesses, including information disclosure, as documented in the paper, “Cheating CHAP.”[21] Success Owl! CHAP 3-Way Handshake CHAP uses a 3-way handshake in which the server sends the client a “challenge” message, the client responds with a message encrypted into an

MD5 hash using its password, and the server verifies that the message was encrypted with the right password by encrypting the same message with its version of the user’s password and making sure both messages’ hash codes match. CHAP protects against session hijacking by performing this handshake multiple again at random times during a session.

Figure 3: CHAP can re-challenge at random times

1.2.3 Certificates The “bottom line” goal of certificates is to establish trust among clients, so that repeatedly providing a password to authenticate oneself is not required, and so that a communication partner may have greater certainty that the person on the other side of the conversation really is who they say they are. Certificates are generally issued by a Certificate Server. By using key information distributed in certificates, a user can: • • •

Encrypt a message (Privacy) Confirm a message was not modified (Integrity) Confirm the sender identity (non-repudiation)

Not all certificates are valid for all uses. For example, if the organization issuing the certificate did not carefully verify someone’s identity before issuing them a certificate, it might not be wise to rely on the identifying information in it. Frequently Certificates are called digital certificates. Refer to sections 4.3.1 and 5.5.2 for more information. Certificates are discussed in greater detail on the section on public key infrastructure.

1.2.4 Username/Password Although digital certificates are becoming more popular, most systems today require each user to identify himself to the system by furnishing a username and password. This is an example of authenticating yourself based on “what you know.” We’ve already seen this in our discussions of authentication protocols like Kerberos and CHAP. The username is unique to each individual user. It is a humanly readable name which typically, 'under the hood', is associated with a number set or hashed value that was generated at the time the user account was created. The password is supposed to be kept secret and should be sufficiently long enough to prevent a brute force (trying all the possible permutations of letters) attack from succeeding. Furthermore, a password should not be a name found in a native language to prevent a dictionary attack. It should also not be something easily guessable such as the username, the user’s first name, their child’s name, etc. Different OSs and applications perform user/password validation with different levels of intelligence and naiveté. For example, some encrypt the password before sending it across the wire, some don’t. Some store the password in strongly encrypted form on the server; some store on the server it using weak or no encryption. As networks became more common, network “sniffers” which inspect traffic as it travels across a network became more common, and computers got faster (permitting encryption to be brute-forced), engineers began looking for better solutions that provided a higher level of security. Simple user/password authentication is still used today by a variety of services, but many security professionals and real-world-savvy network administrators recommend avoiding those services and going instead for those that use stronger authentication methods, due to limitations in the user/password approach: • • •

the often-existing requirement that the password be sent over the network, sometimes without being encrypted the ease with which passwords can be stolen (or guessed) by unauthorized personnel, and then used to impersonate someone’s identity the fact that passwords are often entangled with “people” issues that complicate security—staff use their children’s and pets’ names as passwords for ease of memorization, they write down passwords too complex to remember, and tend to dislike changing their passwords on a regular basis

1.2.5 Tokens A token is usually a hardware device (most commonly assumed to be an RSA SecureID token-type device), which changes an ID code on a frequent basis, normally 60 seconds. Tokens are used to authenticate yourself via “something you have” and “something you know”—along with every SecureID token, you are issued a PIN number. These SecureID devices are slightly smaller than a box of TicTacs, and have an LCD screen on the front. The screen displays a seeded number that changes every 60 seconds. When you connect to the server (normally via a VPN tunnel etc), you enter your PIN number followed by the number showing on your token. The server then authenticates you based on that, as the

server has the same seed as your token, knows your PIN, and can therefore confirm that the two match. This complies with the "something you have and something you know" model. The other token way tokens are used in authentication is simply as data. On some systems, when you authenticate yourself, you are given a special set of data, known as a token, identifying you to the system. In the future during your computing session, when you need to furnish authentication information (for instance, to other network services), rather than sending the user and password again, you send this token data. Possession of this “virtual token” is proof of your authenticated identity.

1.2.6 Multi-Factor In the introduction we said something like, “a password or pass phrase is something you know. A device such as a smart card is something you have. Biometrics is something you are.” Multifactor authentication involves the use of any two or more of these concepts together, requiring the user to furnish more than one type of proof of identity before access is granted. This greatly increases security, by reducing the odds that a lost smart card or accidentally disclosed password will give someone access to the network or system. There is a high probability you use Multifactor authentication very often. The password (something you know) is weak; it is a mere 4 digits and numeric only. Yet most of us find that combining this incredibly weak password with something you have to be sufficient security. If you haven't guessed yet, it is your ATM/Check Card/Debit Card.

1.2.7 Mutual Authentication Also refer to 4.3 Mutual authentication involves both parties authenticating themselves to each other. It’s a two-way transaction. IE, the server authenticates itself to the client and the client authenticates itself to the server. As described in section 1.2.1, Kerberos can be configured to use mutual authentication. Another option is for a client and a server to trust a third party, such as a certificate authority, which can authenticate each party to the other. Why bother to do this? Shouldn’t the client trust their organization’s server? MAYBE. But most likely, the answer to, “Shouldn’t the client trust that arbitrary e-commerce site they reached via a web link?” is PROBABLY NOT. The client may want to verify that it is connecting to the real server it requested, rather than an impostor run by a malicious user. If you’re connecting to an e-commerce web site, and about to provide your personal information and credit card number, you might want to make sure that the server really is the one you think it is. Malicious users have perpetrated more than one web scam by duping users into entering credit card information into a fake copy, run by the scammer, of a well-known ecommerce site.

1.2.8 Biometrics Biometrics provides authentication based on something you are (physiological) or something you do (behavioral), not something you know, such as a password.

Currently the most popular biometric mechanism involves software that measures how long you hold a key on a keyboard and the speed at which you type. This keystroke-analysis software would be an example of a behavioral biometric device, which works because your typing style is almost as unique as a fingerprint. It is popular because it is non-intrusive (as opposed to “hold still while the laser scans your eyes”) and also the least expensive option. Other behavioral biometric options include voice recognition and signature scanning. See also section 5.1.1.2 for more information on biometrics. Physiological biometric options include fingerprint scanning, iris or retinal scanning of the eye and, as visitors to some Disney theme parks have experienced first-hand, various types of hand-scanning. Different biometric identification mechanisms are appropriate for different situations—when authenticating employees, citizens, and customers—and not all may be perceived as acceptable in all situations (do your customers really want to be authenticated at your site with their fingerprints?). Success Owl!

Biometrics Biometrics provides authentication based on something you are (physiological) or something you do (behavioral), rather than something you know, like a password. An example biometric technique would be fingerprint scanning.

For more information about biometrics, at a management overview level, including discussions of privacy and the uses of biometrics in various vertical markets, see the book Biometrics[22] by Nanavati et al. Real World Owl!

To Encrypt or Not To Encrypt? That is the Question What types of authentication are in use on your network? Don’t forget to look into the types of dial-up networking (PPP) and web application authentication used. Why are those important? They may not encrypt passwords as strongly as your network logon, or not encrypt them at all. Experience says users like to re-use the same password in multiple places. What if you’ve taken care to make sure your network logon does not involve transmitting a password across the network … but an in-house web application frequently does exactly that, and some users use the same password for your network and that web application?

[15]

Smith, Richard E., Authentication, Addison-Wesley, 2001. http://www.nerdbooks.com/item.html?id=0201615991 [16]

http://www.ietf.org/rfc/rfc1510.txt

[17]

http://www.faqs.org/faqs/kerberos-faq/user/

[18]

Todd, Chad and Norris L. Johnson, Hack Proofing Windows 2000 Server, Syngress, November, 2001, http://www.nerdbooks.com/item.html?id=1931836493

[19]

Feghhi, Jalal and Jalil Feghhi, Secure Networking with Windows 2000 and Trust Services, Addison-Wesley, February, 2001, http://www.nerdbooks.com/item.html?id=0201657783 [20]

Windows 2000-MIT Kerberos Interop Trip-ups Draft,” http://ldapproject.berkeley.edu/calnet-ad/ad-test/kerb_interop_trip-ups.html [21]

Krahmer, Sebastian, “Cheating CHAP”, http://packetstormsecurity.nl/groups/teso/chap.pdf, February 2002. [22]

Nanavati, Samir, Michael Thieme, Raj Nanavati, Biometrics, John Wiley, October 2002. http://www.nerdbooks.com/item.html?id=0471099457

1.3 Non-essential Services and Protocols By simple math, the more services and protocols a host has running, the more targets an attacker has to aim at. As an example, if he can’t find an exploit for “Sulphur FTP Server v1.0”, running on the host, he can move on to attacking “Ravian SNMP Management Tool v2.3”. An important question to ask is, if the host in question is simply a file and print server, are these extra services required? They may be installed by default as part of the operating system, but they provide potential routes into an organization by the unwary system administrator. Similarly, unnecessary, but open ports on boundary firewalls are inviting targets for attackers to probe. You can often reduce your network’s vulnerability to both random and specifically targeted attacks, simply by disabling non-essential components and protocols. Success Owl!

Better the Odds The more services and protocols running on a host, the more potential vulnerabilities it has. Disable or filter out access to all services and protocols except those that are absolutely necessary.

When determining which services to run, and which to disable, there are two possible approaches you can take. First, you can choose the optimistic route. This involves leaving everything exactly as it is, and only removing services and closing access points (such as firewall ports), as they become an issue. An example of this involves the IIS.htr remote overflow exploit[23]. An optimistic system administrator may put a default installation of IIS onto the corporate network and hope for the best. Then, when the .htr advisory is released, the system administrator may choose to disable the .htr extension filter only. Unfortunately, because the administrator was on holiday and didn’t read the advisory until 3 days later, the corporate web server was already broken into and “Trojaned” (see 1.4.2) before the hole was closed. Now, the administrator has a lot more than just an IIS extension filter to worry about. This is why the second approach is recommended: it’s proactive, rather than reactive. The second approach is the pessimistic route. You take the view that nothing on your network is required, and close every port, service and share before issues arise. This involves changing settings on servers (disabling unused services, removing shares) and on the

routers and firewalls (setting up “rules” that restrict connections to and from ports on your organization’s machines, allowing only those types of connections which are specifically needed). You then open only the ports that are specifically required and justifiable, while keeping firewall rules extremely tight. Let’s look at some specific examples. A corporate web server that is publicly accessible from the Internet would only require port 80 inbound to be opened on the firewall—a web server should never independently make a connection outward, and unless it’s running other services (for example, SSL, which uses port 443), it should never be on anything other than port 80. This methodology extends to services on servers themselves, as well. That is, unused options or subsystems of services should be disabled as well. For example, the IIS exploit mentioned above would be ineffective against this corporate web server if the system administrator had disabled unused IIS extensions prior to deploying it. This approach does not stop at boundary firewalls, routers and servers. “Defense in depth” is an important concept. Don’t rely on a single barrier to protect your sensitive data and system operations. Instead, erect multiple zones of security around your resources, to help ensure that they cannot be compromised if a single security mechanism fails due to a software bug, operator error, etc. Apply the same level of security to your internal systems as you would to your external systems. Remember that according to various studies up to 80% (average +/- 70%) of data compromises come from within. (These numbers vary widely, with recent figures trending substantially lower—around 30%. Nevertheless, keep in mind that internal attacks generally are more likely to be successful, and result in higher-valued losses, so even if they are in the minority, they’re worth paying attention to.) The exact specifics of doing this vary based on where you are disabling things. Each router manufacturer typically has its own command language or menu system for enabling and disabling TCP/IP protocol ports. Similarly, each OS has a different way (sometimes more than one) to control services and TCP/IP. It’s best to see your vendor’s documentation for the most up-to-date information on how to do this. The good news here is that extensive preventive pessimistic tweaking is becoming less necessary as operating systems evolve. More and more frequently, we’re finding services, like FTP on certain Linux distributions, and the IIS web server on Microsoft Windows .Net Server, disabled by default “out of the box”. Remember of course that a balance must be struck between functionality and security. If your organization is impeded from conducting business due to excessive security restrictions, your salary may be drastically affected! Section 5 deals with Operational and Organizational Security. Real World Owl!

Have a Test Bench Find a server on your network that you can use for an experiment (this usually means, a server not in active use at the present time!). Ideally, choose one that can be accessed from the net. What services are running on it? On many systems, you can get a good start on determining this with the “netstat –a” command, looking up the port numbers listed for each

local connection, in a recent port numbers list, such as the one from the Microsoft Windows 2000 Resource Kit[24]. For UNIX and Linux systems, you can also consult inetd.conf, to find out what servers are available, but which don’t run until they receive a network request for that service.

Pop Quiz 0000.00

Pop Quiz 0000.00 Questions 1. Kerberos design assumes that A. B. C. D.

Mutual authentication must take place Mutual authentication is optional Passwords are encrypted Passwords are in cleartext

2. The process of sending data to a target system and analyzing its responses in order to learn about that system is known as? A. B. C. D.

TCP/IP Hunting Spoofing Dos OS Fingerprinting

3. A popular backdoor program is known as A. B. C. D.

PC Anywhere Microsoft RDP Net Spoofing NetBus

4. Backdoor programs A. B. C. D.

are how virus program install themselves are sometimes found as rootkits require formatting the drive for safety after they are found all choices are correct

5. Modification of the source IP numbers in a packet is called A. B. C. D.

firewalling the Mitnick transaction normal spoofing blind spoofing

Answers 1. B. *Mutual authentication is optional

C. *Passwords are encrypted 2. D. *OS Fingerprinting 3. D. *NetBus 4. B. *are sometimes found as rootkits C. *require formatting the drive for safety after they are found 5. C. *normal spoofing D. *blind spoofing [23]

http://www.eeye.com/html/Research/Advisories/AD20020612.html

[24]

“Port Assignments and Protocol Numbers”, http://www.microsoft.com/windows2000/techinfo/reskit/samplechapters/cnfc/cnfc_por_zqyu. asp

1.4 Attacks To make a general statement, you can split malicious attacks into 2 broad categories— Protocol/Service based and Application based. While application based attacks strike at flaws in pieces of software (such as the IIS Unicode attack, which allowed attackers to traverse out of the website directory structure and into the operating system of the machine running it), protocol attacks (such as Teardrop) strike at the standardized mechanisms used to transfer data on a network. No matter whose implementation of that protocol you’re using, it will generally be vulnerable to a protocol-level attack if one exists. In some instances, the protocol or service can be used against itself. An attack is frequently based on an exploit that is specific to an OS or program. A technique known as OS Fingerprinting is used to determine the OS used on a particular target, and therefore the potential exploits which might be usable. OS Fingerprinting is accomplished by sending various TCP/IP packets, designed to provoke somewhatunusual responses in certain vendors’ TCP/IP implementations, to a target and observing the results. When known OS-specific responses are received in response, the fingerprinting program can identify the OS that the target is running (and often the version and even service pack/patch level). Success Owl!

OS Fingerprinting OS Fingerprinting is a reconnaissance technique used to determine the OS that a machine is running. An attacker may use this technique to find any machine running a certain OS, so that he can try out an OS-specific exploit, or he may use it to find out what OS a specific target machine is running, so that he can select an appropriate exploit to use to attack it.

Figure 4: While not a speedy as Linux version, NMAP for Windows is still a powerful tool Real World Owl! NMAP & More What can an attacker find out about your servers? Use one of the tools they use, and find out! If you want to see how well an OS’s TCP/IP behavior can identify your server’s OS, check out the Nmap tool, available at http://www.insecure.org/nmap. Nmap is available for both Linux and Windows. If using Windows, we recommend sticking with the command-line version of the Windows program, since the GUI front-end seems to still have some bugs as of November 2002.

1.4.1 DoS/DDoS One of the more popular attacks of recent times is the DoS attack, or “Denial of Service.” A DoS attack does just what its name suggests—denies legitimate users access to some network or system service. It’s based on a simple premise—the attacker attempts to flood the target with large amounts of data, with one of two results: • •

The network it sits on becomes saturated with this data and is thus unusable. Eventually, a device on the network (such as a firewall or router) or the targeted host itself will succumb to this flood of data, and stop serving legitimate requests

A variant on this attack—DDoS, or “Distributed Denial of Service”—produces the same result by sending a coordinated flood of data from multiple hosts, generally from multiple locations around the Internet. These hosts are usually machines that the attacker has previously broken into and “Trojaned” with a “DDoS client” such as Trinoo, whose purpose is to stage a DoS attack on a target system. At the attacker’s signal, these hosts spring into life and start sending data to the target as quickly as possible. This type of attack is becoming more of a concern as more home users gain broadband connections and place systems on public networks without properly securing them first. Success Owl!

DoS/DDoS

A Denial-of-Service (DoS) attack is an attempt to flood the target with data, so that either the target network is saturated with data, or the target host is saturated with requests, resulting in services being denied to legitimate users. A Distributed Denial-of-Service (DDoS) attack is a DoS attack implemented by staging a DoS attack against a target from multiple systems simultaneously. Trinoo is a classic DDoS tool Not only are DDoS attacks a pain for the target system and its network, they can also seriously hinder the function of hosts/networks used to stage the attack, and waste the time of the admins of all the involved networks. Can you imagine, as the administrator of your company’s network, getting a call from a far-off network administrator complaining that they’re getting one of these attacks from your direction? Presuming that you verify that the packets really are being sent out from your network (rather than being forged, and merely claiming they’re from your network), you then have to do two things: • •

Get rid of the problem packets, generally by yanking the source machine off the network Find out exactly how much of your network has been compromised, and take appropriate corrective action

Given that the (probable) script-kiddie has actually gotten ON to your network, as opposed to poking at it from the outside (as with the target of the DDoS), you’ve got work to do, and probably something to explain to management. In this way, being an unwilling assistant to a DDoS attack tends to have consequences that are more annoying, for a longer time, than being the target of one. Author Helen says, “Trust me, I’ve been there on both sides. Despite my best efforts, someone got in via a zero-day Linux exploit and my domain became an unwilling participant in someone’s attempt at revenge on a fellow IRC user they decided they just didn’t like. Unless you’re Amazon.com or a site which loses tens of thousands of dollars for every minute of network downtime, it may be worse to be unwittingly on the sending side of a DDoS attack, than to be the target.” There might even be legal liability for maintaining a system security configuration that allows someone to get into your network and stage a denial-of-service attack against a target -- and the target may indeed come knocking on your door if it experiences significant losses. Of course, this assumes that you can actually identify the source of the DDoS. All bets are off if you are the victim of a DDoS attack staged with software that forges the ‘source’ IP address in the attacking packets. In that case, you, the target, are likely to have a very bad day (until ISPs start communicating and narrowing down where the attack is coming from, by looking at traffic through their networks).

Figure 5: First a Black Hat installs a backdoor to make machines on fast connections (DSL/Cable) to make many ‘Zombie’ machines. At a synchronized time, all the zombies direct requests to a single site

An early DDoS attack To help you understand how a DDoS happens, here is a brief account of a recent incident. February 2000 gave rise to the first widespread amplified attack. The nature was serious enough to involve the Federal Bureau of Investigation (FBI) and the President of the United States. The first site attacked was Yahoo!. The Information Technology group initially thought it was a case of equipment failure. The flood peaked at one Gigabit per second, and the service was down for five hours. Buy.com was the next target, the next day. Coming from different points, the flood ran about 800 Megabits per second, from different sources. Later that afternoon, it was time to sink eBay. This firm did not release information about the amount of data traffic involved. Their only response to questions when pressed for technical details was, “We are taking multiple measures to fight this.” How was the attack accomplished? High performance computers with access to large Internet connections were targeted by port scanning to find security holes, allowing access to the root account. As mentioned in chapter two, a daemon is a servant. The attacker installed Unix daemon on the machines. Using strong encryption, the attacker told the daemons what IP addresses to attack. Using a client machine, the attacker launched the entire distributed daemon at once. The missing piece in the equation, in the heat of the battle was, where all this processing power and Internet access with such bandwidth originating from? The attacker planted the daemons on some of the most powerful computers with ‘fat pipes’ at the locations with the least security—namely, large college campuses. To make these attacks harder to block, attackers normally spoof the source IP address of the data to appear as though it originates from a different network. This makes it harder for the

network administrators (whose devices this flood is passing through) to filter and drop the data. Due to their simplicity DDoS attacks are a favorite tool of “script kiddies”, a term used to describe amateur hackers with little skills, who just use tools and exploits created by other people without really understanding what they are doing. It takes surprisingly minimal work and skill level to run an automated IIS hack script against an IP subnet, successfully break into a number of unsecured web servers, and then, Trojan them for use in a DDoS attack.

How and Why do these attacks work? Unfortunately, having sufficient bandwidth to cope with the flood of data is not necessarily enough to protect you. These attacks not only exhaust bandwidth, they can be specifically targeted to take down hosts on the network by resource exhaustion. For example, if XYZ Corp has a single web server sitting on a 10gigabit line to the Internet, it is unlikely that an attacker could summon enough DDoS clients to sufficiently exhaust the bandwidth on XYZ Corp’s network segment. However, they may attack the web server directly. To understand how this can be done, let’s briefly examine how the TCP protocol works, and explore how characteristics of the protocol can help an attacker stage an attack called a “SYN flood”. When a user somewhere on the Internet wishes to view a web page on XYZ Corp’s web server, they type the domain name into their web browser. After name resolution has taken place, and the client machine knows the IP address of the web server, it sends a TCP SYN packet to it. The web server then allocates the client a port to communicate on and replies with a TCP SYNACK packet. Finally, under normal circumstances the client will reply with a TCP ACK packet; the TCP session will be established and the HTTP data will be transferred from web server to client. This SYN-SYNACK-ACK conversation is known as the TCP 3way handshake. One of the more famous DoS techniques is to modify this TCP 3-way handshake so that the opening part of the handshake, the Request to SYNchronize, is sent again and again, without closing the sequence by accepting the acknowledgment from the first request. The modified handshake is produced by a low-level program specifically designed to create the SYN Flood DoS situation by making repeated connections to a server and sending SYN requests, without terminating the TCP conversation properly with an ACK. Since the server does not think that the conversation’s handshake has been completed, it keeps each SYN request in its table of “connections in progress.” As more and more partially open connection requests accumulate in the target’s system tables, the target eventually reaches the point of being unable to handle additional requests. When this happens, the server is unable to accept new connections, and thus, legitimate users are prevented from accessing the server. Generally the time that the TCP stack waits before resetting a port is more than enough for an attacker to send new requests to exhaust more resources. As you can see, this type of attack is called a SYN Flood, as flooding the target with SYN packets is precisely what it does. Success Owl!

SYN Flood A SYN flood is a DoS technique in which the attacker initiates many TCP connections to a server, but omits the final portion of the TCP 3-way handshake, leaving the target’s reply to it un-ACK’d. This results in many half-open connections on the target system, which use up its resources,

eventually causing that system to deny access to legitimate users. There are many other variants on the DoS attack. ICMP (more commonly known as “ping”, after the command line tool) floods are used to send ICMP_ECHO packets to a single host, which quickly and exponentially exhausts bandwidth on the target host’s network. The reverse ICMP flood, or Smurf attack, sends a ping to the broadcast address of the target network. Because packets sent to the broadcast address are seen by and responded to by all hosts on the network, you potentially have hundreds of machines replying to one single ping packet. As you can imagine, this would also quickly exhaust the available bandwidth. Success Owl!

More DoS Attacks Other DoS attacks include variants on the ping flood, IGMP fragmentation, out-of-bounds nukes and teardrop attacks.

What can I do? DDoS attacks are hard to prevent, and are, unfortunately, a fact of life on public networks. However, there are some simple precautions you can take. First of all make sure you have a good relationship with your ISP and that you have an emergency contact number to reach a technical person. Time wasted calling around to find the right person to help means time wasted getting your public services back online. Second, many operating systems & TCP/IP stack implementations provide an option to change the timeout on a TCP conversation. If you are able to reduce the amount of time before the reset of an unfinished TCP connection occurs, you will make it harder for an attacker to continually keep the server’s resources occupied. Some operating systems such as Windows 2000 and routers also include specific SYN Flood attack protection options. Real World Owl!

Preventing SYN Attacks Research whether your OS provides the TCP handshake timeout option, or other SYN Flood protection options. For example, some Windows 2000-related information is available from Microsoft and assorted third parties. This documentation also includes references to several other sources of DoS and DDoS defense information.[25] Does your OS provide useful configuration options? If so, experiment (on a non-production machine!) with smaller values for the timeout, and see if you can reduce it without impairing the ability of other systems to connect to that machine, and also check out other options designed to help protect your system against DoS and DDoS.

Third, consider whether to configure your boundary routers and firewalls to drop ICMP packets. This is both a blessing and a curse. It does reduce the effectiveness of ICMP floods by preventing any responses from inside your network (note that it cannot by definition prevent ICMP packets from actually arriving at your network boundaries), however, troubleshooting network connectivity problems becomes much more difficult without the help of the good old ping and traceroute (or tracert for Windows users) commands, which use ICMP and won’t get through an ICMP block.

Finally, be a good netizen. If client machines on your private networks have access to public systems, implement a technique known as “source filtering” on the firewalls and routers at the boundaries of your network. Source filtering prevents spoofed IP packets from leaving your network, as any device they pass through will check the source address against the known local network numbers. If the source IP address does not match an internal subnet, the packet is considered bogus, and discarded. We’ll discuss this more in section 1.4.3, on Spoofing.

1.4.2 Backdoors A backdoor is a deliberate configuration or specific program designed to allow access to a system without requiring the usual security checks. This doesn’t necessarily mean it’s solely for a hacker’s benefit. A system administrator may indeed leave a backdoor into all client PCs that he installs for users just in case they inadvertently lock themselves out. However, the type of backdoor we are concerned with here is the malicious kind. Malicious backdoors range from simple to complex and feature-laden. One of the simpler backdoors is NetBus, a Trojan (see section 1.5) that allows complete remote access to any system it’s installed on. It provides a remote-control type desktop, much like PCAnywhere or Microsoft Terminal Services, giving an attacker complete control over a machine as if they were physically in front of it. NetBus is relatively unsophisticated though, and easy to detect. A far more complete backdoor package is BackOrifice. BackOrifice even provides a configuration screen where you select the modules you wish to include and the overall configuration of listener ports, behavior, etc. When you’ve set your configuration, BackOrifice builds a custom executable for you to distribute as you wish. There are a wide range of modules available for BackOrifice, including port mappers, remote control, key capturing and application binding (where your BackOrifice executable attaches itself to system files like a virus). Success Owl!

Back Doors A backdoor is a program or deliberate machine configuration designed to allow an unauthorized attacker access to a system without the usual security checks, such as user authentication. Malicious backdoors include the NetBus and BackOrifice programs.

What’s a Rootkit? In addition to providing an unauthorized way into the system, a malicious backdoor may include additional functionality to hide itself or provide additional capabilities to the attacker. For example, backdoors are often paired with software packages known as rootkits. Rather than attaching themselves to application programs and running on top of the host operating system, rootkits attempt to drill down to the kernel level or OS utility level and replace, modify or divert core operating system functions. A rootkit is not a type of attack, but rather a set of utilities that an attacker can install on a system once compromised. In effect, they support the use of a system by intruders through a backdoor. These utilities alter system data files, configuration/registry entries, and even system-supplied programs and operating system libraries. As a basic example, a rootkit with a filename rootkit.exe may contain

programs to prevent any process (like Windows Task Manager) from showing this file in its output. This makes them very difficult to detect, as they are operating at the kernel level and effectively filtering what applications and users are allowed to see. Normally, rootkits are seen under (and originally come from) UNIX based operating systems, however, versions are available for Windows[26]. Rootkits take their name from the UNIX system administrator name “root”, which has complete control over the system—they literally are “kits to provide you with root access” and ways to maintain it by hiding your activities and the existence of the rootkit itself on your system. Success Owl!

Rootkit A rootkit is a set of one or more utilities used to replace core OS functions, with the goal of giving additional capabilities to an attacker, including the ability to hide their presence from legitimate system users. Rootkits are often used in conjunction with, and may even be built in to, backdoor programs by script kiddies.

One of the more insidious facets of rootkits (also true of Trojans, worms and viruses, described in section 1.5) is their creation and purpose. To code a Trojan or rootkit requires a detailed understanding of the target system’s architecture and some considerable coding ability. But to use these tools requires only a few point-and-click type operations, which again makes them favorite tools of the script kiddie. Searching Yahoo for “+rootkit +download” returned almost 1,400 matches, which seemed to be split between tools to detect rootkits, and tools to create them. Check out www.rootkits.com, or http://www.megasecurity.org/Tools/Nt_rootkit_all.html for more information.

How do backdoors get onto a system? Generally, backdoors can appear on a system when an attacker does one or more of the following: • •

•

•

Exploits an OS or application bug on the target system, to transfer a file to that system, then run the file to create the backdoor Sends an email that the user is tricked into opening. Opening the email runs the program that creates the backdoor. (With some email clients, just previewing a malicious message may be all it takes to install a back door). Replaces a legitimate copy of a program available for download by the Internet, by one with backdoor functionality, which is unwittingly downloaded by users and installed Includes undocumented backdoor functionality in a purportedly legitimate application. When that application is installed, the back door is as well

Figure 6: A computer used for non-business use can become infected with a back door Frequently overlooked as sources of backdoor access, user-installed applications that have legitimate purposes can be misused by unauthorized users. As we mentioned at the beginning of this section, not all backdoors are developed or installed by those with malicious intent. Nevertheless, a user who installs VNC on his office computer so that he can access his desktop machine from home creates an inviting target for an attacker, especially if he has not configured a session password. NetCat, a network administration tool, can also become a potential backdoor. With a single command under Windows, it’s possible to get NetCat to bind a command shell to a port so that incoming telnet sessions on the port receive a DOS prompt as if they were sitting at the local machine. Legitimately installed network diagnostic tools can be quickly turned against the infrastructure by an attacker.

Figure 7: Once a back door in installed a secure tunnel through a firewall can give a black hat an ‘in’ which cannot be discovered due to the encryption

How do we stop back doors? Most modern anti-virus software will quickly pick up backdoor software, however, very new Trojans or rootkits can be easily missed. In this instance, detection becomes much harder. (One lesson to take from this is that you should keep your anti-virus signature file as up-todate as possible, to maximize the number of backdoors it can detect.)

Even if your anti-virus software doesn’t identify a particular backdoor, analysis of network traffic and processor/memory utilization will usually yield some clues. Once a computer has had a backdoor installed, it generally cannot be considered safe to use until it has been wiped and rebuilt from scratch. Take the machine off the network immediately (but do not power down, as that may remove evidence) and perform your forensic investigations. Once you have finished, power the machine down, boot from a write-protected “clean” floppy disk and remove all data & partitions from the system. Then reboot using your operating system install floppies or CD, and reinstall the operating system from scratch. Success Owl!

Infection = Nuke ‘em The safest way to recover when you find out that one of your systems has had a back door installed is to completely wipe that system’s disk and reinstall the OS, after taking the machine off the network and performing whatever forensics are required. Doing anything less than that risks leaving some remnant of the back door, or the means used to install it, on your system and leaves the system more open to attack.

Backdoors are also one of the best reasons for ensuring your firewall rules are correctly configured. Someone installing a backdoor which listens for network connections can often set it up to listen on any unused TCP/IP port. Stick to the “Deny by default” methodology and ensure that your firewall prevents all but the minimum requirement of traffic to pass through it. Yes, this means denying access even to ports on which you “know” you are not running services—just in case someone else decides to start a bogus one up on one of those ports. If, an attacker configures their Trojan to listen for incoming connections on port 31337 and your firewall only allows traffic to pass on port 80, you’re making it much harder for them to gain further access into your network. Real World Owl!

netstat –a to the rescue Is your system running any of the common backdoor programs? Take that list of “netstat –a” results that you generated earlier and inspect it for known backdoor ports per the list in the SANS Intrusion Detection FAQ.[27]

1.4.3 Spoofing The word “spoof” or “spoofing” is defined as “a hoax” or “to deceive”. When applied to networking, spoofing is the practice of making data appear to originate from a source different than its true origin. We’ve already talked a bit about how this technique, combined with DDoS, can cause major headaches.

How TCP/IP permits spoofing To understand how spoofing can happen; we need to go back to the origins of TCP/IP itself. TCP/IP was originally developed by the Advanced Research Projects Agency (ARPA), which is the research arm of the Department of Defense, in the 1960’s and 1970’s. Its goals included

flexibility (to handle applications from file transfer to voice over IP), redundancy (allowing for multiple routes between two sites, so that communication didn’t depend on a particular path through the inter-network being available) and decentralization (so that the destruction of one machine couldn’t bring down the network). TCP/IP is very good at adapting to changes in the network structure, since it is packet-switched rather than circuit-switched. For example, if you are sending packets from site A to site D, and in between the packets pass through sites B and C, if site C goes down TCP/IP detects the problem and finds another route to D, and the conversation continues normally. The applications communicating with each other don’t even need to know that there was a problem. This packet-switching approach is part of what makes TCP/IP a viable protocol suite for decentralized networks like the Internet—since administrators of Internet sites control only their own networks, the Internet needs to be smart enough to maintain communications even if some intermediate site disappears in the middle of a conversation. At the time TCP/IP was designed, ordinary users of machines on TCP/IP networks were expected to not possess elevated user privileges, such as Administrator or root. Most TCP/IP protocol details were implemented inside the operating system and this model meant that unprivileged users would never have the chance to interfere with packet structures or sequencing. The designers appear to have figured, “If you have physical access to a network device, or a privileged account on it, it must be OK for you to do whatever you wish with it.” This led to network nodes trusting the packets they received, despite the lack of any failsafe way to guarantee that each packet really did originate from the source IP address it claimed, adhered to the protocol specs, and had not been tampered with in between. This blind trust caused a few problems when TCP/IP began to be used outside of trusted networks. Because TCP is inherently a 2-way communication protocol (unlike UDP, which is a “fire and forget” protocol) with acknowledgements and packet delivery guarantees, there has to be a way to identify where the data is coming from and where replies should be sent. The origin of the packet is called the “source IP address” and is held inside every TCP packet’s header (a packet header is a section of information at the start of every packet sent across a network). Under normal circumstances, a user would load an application such as a web browser and type in the address of the website they wished to view. The network stack in their machine would create the appropriate packet (in this example, an HTTP request packet), add the packet header including the user’s machine’s IP address in the “source IP” field, and send it off across the network. However, if the user has sufficient privileges on their machine, it is possible for them to change the contents of the packet header before the packet is sent. This allows them to change the source IP address in the packet header, thus “spoofing” their IP address by making the packet appear to originate from a different source.

Problem #1—It enables a DoS attack to be an even greater nuisance In the example of a user browsing a website, this technique is fairly pointless. However, if this technique is used in conjunction with a Denial Of Service attack (as discussed in 1.4.1), an attacker can use this to their advantage. First, they can hide their true source IP address, which, in today’s world of lawsuits against hackers is a fairly strong motivation, making it difficult to trace them. Secondly, they can continually change the source IP address of the DoS packets, making it hard for network administrators to drop the packets at firewalls using source IP address filters. To take it a stage further, an attacker could spoof the source IP

address of the DoS packets to make them appear to originate from within the target’s network. While this technique may not always work, it can give poorly configured firewalls and routers a lot of difficulties. This is why we recommended in section 1.4.1 that you implement router rules against this. Success Owl!

Spoofing Spoofing is an attack in which packets are made to appear to originate from a system other than the one they really originated from. If your network monitor or Intrusion Detection System detects that you are receiving packets from the Internet which list an address on your internal network as the source IP address, it is likely that you are experiencing an IP spoofing attack

Figure 8: By forging IP header information at computer P, computer B falsely responds to computer A. Given enough packets a DoS occurs

Problem #2—An attacker can pretend to be from a trusted host In addition to obscuring the attacker’s identity during a DDoS, IP address spoofing can also be used to circumvent trusted host configurations. Kevin Mitnick publicized this as a technique he used to break into a bank’s transaction system. To see how this can happen, we’ll look at an example. To set the scene… A company has 2 systems to control its online automated purchasing service. System 1, let’s call it Freedom, controls the stock and picking system. System 2, let’s call it Spirit, controls the banking credit and debit system. Whenever an order or goods return request is placed, an application on Freedom reduces or increases the stock count as appropriate, and sends a purchase/refund request to Spirit. Spirit then connects to the bank and completes the transaction. Because both Freedom and Spirit sit in the company’s backend network, the inexperienced system administrator believes that it would be safe to configure them with a trusted host system only. In other words, he configured Spirit so that it would only ever accept connections from Freedom, because that’s the only host that should ever talk to it. Both systems are, however, completely secured and up to date with patches etc.

So if the systems are secure, how can an attacker use this configuration to their advantage? The answer lies in IP spoofing. While the attacker can’t actually break into either Freedom or Spirit, he can control Spirit’s behavior by manually creating packets with Freedom’s IP address as the source. If the attacker crafts a packet containing data to make a transaction of £1million into a bank account, then sets the source IP address to Freedom’s IP address, when Spirit receives this packet it will check the source IP, see that it matches Freedom’s IP, process it as normal and the fake transaction will go through. While this is a slightly wild example, the theory is valid. Because the IP stack itself does not provide any measures for verifying the source IP address, systems that do not employ other measures are vulnerable to this type of spoofing attack.

Types of spoofing It should be noted that spoofing is broken down into two categories—normal spoofing, and “blind” spoofing, denoting the type of control an attacker has. Normal spoofing, which is a combination of IP spoofing and packet sniffing (see 2.5.4.1), is easier to control. Because the attacker is faking the source IP address of the packets he is sending, the responses from the target machine will obviously be directed to that source IP address, and not the attacker’s “true” IP address. This means that for the attacker to see the responses of the machine he is sending these spoofed packets to, he must sniff the network and use a packet capture & decoding tool to read the responses of the machine. Taking the Freedom/Spirit example again, when the attacker sends spoofed packets to Spirit with Freedom’s IP address as the source, Spirit will send its replies back to Freedom. To read these replies, the attacker must sniff the network and decode the packets as they are sent. To do this, the attacker must be able to place a network card on the same network segment as the hosts into promiscuous mode. However, tools such as Antisniff [28] are able to detect this. Blind spoofing removes the requirement for sniffing the network, and operates on a “best guess” principle. The attacker sends spoofed packets to the target as before, but instead of sniffing the network and reading the replies, he just guesses at what the replies will be in hope that when he has completed his attack, the system will have performed the actions he requested. The advantage here is that packets can be sent from any network that has a route to the target and there is no requirement for sniffing the reply packets on the target network. It does of course make the attack harder to perform because if it fails the attacker has no way of diagnosing what went wrong. At this point you should note that there are legitimate uses for changing a packet’s source IP address. The most obvious one is NAT, or Network Address Translation, where a device, such as a router, deliberately and legitimately rewrites packet headers. See 3.3.3 for more information. Unfortunately, the problems spoofing presents do not end here, as we’ll see in future sections.

How can we protect our network from spoofing? To help prevent against spoofing attacks being successful on your own network, set up a router filter that does not allow outside packets whose source address is set to a host in one of your internal networks, into your network. This will catch most (some?) spoofing attempts originating outside your network, directed toward your network. It will not catch attempts made from inside your network (spoofing the address of another internal host, perhaps in an attempt to gain privileges), or attempts made against a third party’s network in which your network is listed as the origin of the attack in the source IP address. Additionally, you should also filter outbound packets, ensuring that no packets with a source IP address that is not within your network are allowed to leave it—a malicious user is likely spoofing such packets. (If everyone did this, the spoofing problem would largely disappear. The fact that spoofing is still an issue clearly demonstrates that, amazingly, years after spoofing first became a common occurrence, not everyone has gotten around to this yet.) Real World Owl!

No Spoofing Do you have rules on your Internet gateway router to prevent spoofed traffic going in or out? If not, research how to add such rules on your particular equipment, and then do so. As with any network configuration modification, test this after hours before implementing it on your network—and be ready to reverse it at a moment’s notice if all of a sudden the CTO calls you asking why his network analysis program (which for some reason known only to deities tweaks source or destination IP address inappropriately) stopped working.

1.4.4 Man in the Middle The Man In The Middle attack, or MITM for short, is another attack made possible by lax security in the IP protocol. As we already know, a normal TCP/IP conversation takes place between 2 hosts, and involves the sending, receiving and acknowledgment of packets. An MITM attack can be compared to inserting a black box in between the 2 hosts participating in the conversation. If an attacker can place himself in a position where he is on the network between the two hosts, it is technically possible for the attacker to control what data is sent between the hosts. The attacker’s machine does not have to be physically between the two hosts… the other two machines just have to be convinced to route packets destined for the other host through the attacker’s machine. Going back to the Freedom and Spirit example above, assume now that Freedom and Spirit communicate with each other, but instead of using a trusted internal network, they exchange information across a public network. How does the attacker ensure that all packets sent between the two hosts pass through their machine? One way to do it would be for the attacker to set up a machine with two network cards, then send out fake ARP requests to force packet routing between those two hosts to go via his machine.

(Remember that ARP is used to link IP addresses to MAC addresses; the attacker can take advantage of the fact that nothing prevents someone from introducing ARP packets that contain misleading information.) Once the attacker gets the packets routed through his machine, he then takes the incoming packets from Freedom, decodes them and checks the contents. If he sees something he wants, for example a bank transaction he would like to divert, he can rewrite the data in the packet, and send it off to Spirit. By the same token, when packets come in from Spirit destined for Freedom, he can change the contents of those. He can also pass packets through unchanged, if he wishes. Success Owl!

Man In The Middle In a Man-in-the-Middle (MITM) attack, an attacker intercepts packets in the conversation between two network hosts, inspecting and altering them on the fly.

Figure 9: A Man In The Middle needs to be there from the beginning to be successful The effect is somewhat like the spoofing example presented above, however, this is far harder to detect. While the spoofing attack relies on sending brand new packets to a host, the MITM attack is actually changing data sent between hosts on the fly. Therefore, should you ever audit the data to find out why the bank transactions seem to have gone awry, you’ll see that data was sent by Freedom and received by Spirit in correct order, it just “got changed somehow”. Geek Owl! Man In The Middle Explored At this point, it may seem as though all hope is lost, and that no communication on a public network is safe. After all, wouldn’t every so-called hacker be doing this? Well, fortunately not. As in practice, this technique is very difficult to implement. First of all, we have the physical routing issue. As noted above, for this attack to work, an attacker must ensure that every single packet sent between the 2 hosts he is attacking is routed via his machine. Taking the Internet as an example, this is a huge technical issue. First of all you would need to be at least somewhat physically close to the target machines—no matter how hard you try, packets sent between 2 servers in London will not be easily diverted and routed via China. Second, an attacker has TCP Sequence numbers to contend with. In a nutshell, every TCP/IP connection negotiates a TCP Sequence between both hosts. Subsequently, every TCP packet sent between them has a TCP Sequence number included in the packet header. This number is changed for every packet by a

prearranged formula, decided on during the TCP handshake stage. This allows both hosts to ensure they are receiving all the packets in a TCP conversation, and to ensure that the packets are being assembled in the correct order. In other words, the TCP Sequence number is responsible for the quality control of the protocol. If the sequence number of a packet is wildly out of sequence or just plain wrong, the packet is discarded (with a few additional checks). If an attacker is unable to break the TCP Sequence formula, they won’t be able to initiate an MITM attack. Tools such as Nmap[29], mentioned earlier, have options to check the TCP Sequence formula of the IP stack on a machine and inform you how difficult it would be to “break” it. This particular attack strategy is called TCP Sequence Prediction, and crackers have access to tools that do it, so the stronger your TCP/IP implementation in this regard, the better. Third, speed is a major issue. Consider the speed with which packets are sent across a network, even a slow 10megabit link. While applications can quite happily send and receive data at this speed, it poses more of a problem for humans. To perform an MITM attack and change data on the fly through manual would be practically close to impossible, without it having a very noticeable impact on the speed of the connection between the two hosts. The only practical way to do it would be to write a custom application that searched for specific strings in packets and manipulated them to preset rules. This does of course introduce an element for error—one wrongly interpreted packet could cause a change that triggers IDS alarms, and gets an attacker caught. In addition, because the MITM attack manipulates packets already created and sent, you are removing the “luck” factor from a spoofing attack. For example, if you have correctly set up the MITM attack you can be assured, that provided you stay within the parameters of the data, any information you change will be readily acceptable by the destination host. However with a spoof attack, you are effectively working blind, as there is no guarantee that the target host will accept your data. One area where MITM attacks do stand out is in hacking standard telnet user-type connections. Because you’re dealing with a human user on one side, the speed of data transfer will be easily manageable. With a plain-text type connection, such as telnet, you’ll be able to see the user’s passwords and private information exactly as they access it. This is an excellent reason not to employ plain-text authentication and unencrypted command-line sessions on your trusted network. Success Owl!

Telnet and MITM Because telnet connections are very vulnerable to MITM attacks, you are advised to run telnet only over VPN connections, and to replace unencrypted telnet with an alternative such as ssh.

Encryption and secure protocols are one final area to be mentioned here. An MITM attack relies on being able to read the data contained in the IP packets. If an attacker can’t read the data, the attack is useless. Using secure protocols on your network will reduce the consequences of an MITM attack to almost zero. Currently there is no available hardware that

is able to break 3DES-encrypted data quick enough to make an MITM attack impossible if you’re employing 3DES for network communication. Bearing all this in mind, applications do still exist to perform MITM attacks. An example is SW-MITM[30]. It should be noted that the vast majority of tools to perform low-level IP hacks are only available on Unix-like operating systems. The reason for this is simply control. Under Unix, the IP stack is completely open for manipulation by anyone with sufficient privileges. Under Windows this is not the case. In every version of Windows, except XP, the network stack has been kept “private” to the operating system and low-level hacks, such as spoofing, have not been possible. To combat this, a few organizations have coded ports of network libraries such as Eeye’s LibNetNT, which do allow for low-level manipulation. Windows XP, however, contains “raw sockets” which allow for this manipulation natively. This issue has been massively debated and demands for its removal have been championed by Steve Gibson[31], who believes this to be extremely dangerous in functionality, despite it existing well before Windows XP was even dreamt of. For a reality check that the sky isn’t falling, see the recently released Windows .NET Server Security Handbook[32] by Peikari.

1.4.5 Replay Replay attacks are exactly as their name suggests. An attacker uses a packet capture tool to grab and save the packets in a conversation, then resends one side of the conversation to a host as he wishes. In the example of Freedom and Spirit, an attacker may capture a conversation between the machines in which a bank transaction is requested. The attacker may then resend all of Freedom’s packets to Spirit multiple times, causing Spirit to process the same transaction many times over. Success Owl!

Replay A replay attack is one that involves capturing and saving the packets in a conversation, resending one side (generally the client side) of the conversation at a later time, in order to accomplish something malicious such as identifying themselves as another user, or process the same transaction more times than it legitimately occurred.

Again, this type of attack is made possible due to lax security in the protocol. As we have already discussed, every TCP/IP conversation is stamped with TCP Sequence numbers. In theory, no two conversations will generate the same set of numbers due to differences in the seed used and client/server TCP/IP stack differences, amongst other factors. In addition, many operating systems implement pseudo-random number generation for the initial sequence number. It has been proved however than in many implementations, the formula for producing these numbers is weak, and TCP sequence prediction is not as difficult as could be. If an attacker is able to guess the sequence (or indeed flood the network with packets containing likely sequence numbers), he may be able to control, disconnect or insert arbitrary data into a user’s session.

There are countermeasures against this type of attack. Secure protocols such as IPSec operate at the network layer and extend the IP protocol while maintaining compatibility with existing TCP/IP stacks by using additional protocol numbers. The ESP (Encapsulating Security Protocol) portion of IPSec handles most of the security of the protocol, such as authentication, data protection and anti-replay measures. IPSec relies heavily on cryptography and IKE (Internet Key Exchange) to create session keys, which is outside the scope of this section. Cryptography is discussed in section 4.

1.4.6 TCP/IP Hijacking Hijacking involves the attacker forcibly taking control of a legitimate conversation between a server and a client, much as a non-electronic troublemaker might seize control of a car. Hijacking is generally the result of a successful attack using a different technique, such as a replay or MITM attack, allowing the attacker to impersonate a legitimate user. In other words, the intruder intercepts the source side packets and replaces them with new packets sent to the destination. The most common example of this is web session hijacking, where an attacker takes advantage of lax security to take control of a user’s browser session. Most web servers use cookies, small data files accessible by server scripting languages such as PHP or ASP, to authenticate and track users. When a user connects to a website and authenticates, an attacker may be able to hijack their session by loading a hacked cookie or by inputting a specific URL on a poorly configured web server into their browser. The legitimate user will most likely be kicked out, or at least be shown an error page indicating their login has failed. Another opportunity for session hijacking is provided by poorly configured server time-outs. If a web developer makes the session time-out (length of time of no activity before the web server disconnects the user) too long, it provides a larger window of opportunity for an attacker to hijack the session. Hijacking is not limited to web based sessions only. Like (and sometimes using) an MITM attack, hijacking is especially suited to telnet type plaintext connections, where an attacker can watch a TCP session being initiated and data being passed between client and server. If the attacker sees something interesting they can break into the conversation and take control of the user’s session for their own purposes. Success Owl!

TCP/IP Hijacking TCP/IP hijacking involves taking control of a legitimate conversation between a server and a client, intercepting the source side packets, throwing them away and replacing them with new packets sent to the destination. This can be accomplished in a variety of settings—a telnet connection can be hijacked by means of a MITM attack, and a web session can be hijacked by causing the victim’s system to load a “hacked” cookie.

There are several precautions you can take against this type of attack. The most simple is to re-authenticate the user before performing important actions. For web servers, creating unique session cookies also mitigates the risk somewhat.

The more unique the cookie, the harder it is to break and hijack. Finally, if possible, use secure protocols and the employ the same countermeasures used against replay attacks. An excellent resource for further study is available in the footnote[33].

1.4.7 Weak Keys An attack based on weak keys takes advantage of weak keys used to protect encrypted information, or weak passwords for user authentication. If an attacker can “break” a key, he can gain access to whatever that key is protecting—be it data, a logon credential, etc. The term “weak keys” usually relates directly to secure protocols, such as IPSec or SSL. As mentioned in 1.4.5, these secure protocols use cryptography and a key exchange protocol known as IKE to create a secure connection between 2 hosts using session keys. As discussed in chapter 4, a host must “decide” on a mathematical algorithm to use for encryption of secure sessions, such as DES, 3DES or RC4. 40-bit key lengths, and indeed 56bit DES are not considered secure, and modern hardware is allowing attackers (and researchers) to break these encryption algorithms quicker all the time. Unfortunately due to the legacy from old export laws from the USA restricting the export of strong encryption, a significant proportion of servers (especially web servers) still use these weak keys. Weak keys may also include those using only a subset of the permitted characters, or using predictable contents as the key (such as the name of the resource being protected). Success Owl!

Weak Keys The weak key attack takes advantage of the weakness of keys being used to protect encrypted information, including network sessions and password resources. The shorter the key length, the easier it is to break the encryption on a piece of data.

The obvious prevention technique here involves using strong encryption algorithms and strong keys, and combining this type of authentication with others. More will be said about this in the chapter on Cryptography. Much of the rest of this domain overlaps with Domain 4 Cryptography. It appears to be definitional in Domain 1, and more “How” based in Domain 4. Real World Owl!

Stronger keys = Increased data privacy Do you use encryption to protect files or VPN connections? How strong are the keys used to do so? If they’re only 40 or 56 bit keys, research alternatives that use stronger keys.

1.4.8 Mathematical The short story on mathematical attacks is that a key data set with fewer possible combinations is more likely to produce a weaker key. (See 1.4.11.1). Popular belief states that 40-bit encryption is weak, and 128-bit is strong. The idea is that the longer the key, the more possible combinations will need to be tried, to find the correct key value by brute force. This is only a general statement[34], as you will see when you look at WEP in 802.11.

Key length is only part of the story. Another part of the story involves the total number of possible key values. For instance, if a cracker knows that a key consists of 4 bytes, each of which holds a number between 1 and 10 (instead of a number between 0 and 255, the minimum and maximum values which can be held in a byte), that key is much weaker than a 4-byte key in which each byte can hold a number between 0 and 255. Why is this? The number of possible key values is smaller. There are only 10x10x10x10 (10,000) possible key values for the first key, and 255x255x255x255 (4.2 billion) possible key values for the second key, making the second one much more difficult to discover through “brute force” attacks than the first. “Brute force” attacks are discussed in more detail in section 1.4.11.1. Similarly, randomness of the key is important as well. Even 256-bit encryption is pretty useless if the key uses a simple pattern an attacker can figure out, such as 1,2,3,4,5,6 …. Another type of mathematical attack has less to do with predicting the key than it does with finding a way around the problem of not having it. For instance, it may be possible to “break” some encryption algorithms by finding a way to reverse them without discovering the original key (for instance, by finding patterns in how encrypted text is generated). Success Owl!

It All Adds Up Mathematical attacks include those based on the fact that a key is generally easier to break, the shorter it is, and the less the variety in characters used in the key, and those that somehow “break” an encryption algorithm by finding a way to reverse it without discovering the original key.

1.4.9 Social Engineering (Also Refer to Sections 1.6 and 5.1.2) In the introduction you learned that Social Engineering is the biggest challenge we face. Even the strongest cryptography in the world is useless if someone is fooled into giving away the keys to the city that allow an intruder to participate in an encrypted conversation, tunneling right through the firewall to an internal server. Lurking on the Internet, we have learned that the best 'black hats' rely on exploiting human nature more than any technical exploit. For example, they can exploit users’ willingness to give up information they can use to gain unauthorized system access, either by impersonating legitimate users or making themselves sound legitimate (for instance, claiming to be a tech support engineer working for a vendor). Kinds of information that can be gained via social engineering include: • • • •

modem telephone numbers user ID’s and passwords types of software running on important servers information about when certain processes take place on the computer (etc.)

Crackers can also exploit their knowledge of how naïve users think, such as:

• • • •

using weak passwords like “password” putting no password on the Administrator (god) account being willing to share passwords with others not carefully controlling network file shares

The best way to protect against social-engineering attacks is to educate your users on the importance of security, and the types of information that should not be given out to anyone without proper authorization (ideally in person or in writing, since someone could claim, “Joe, our network admin, asked me to call you and get your password,” when you, Joe, had nothing to do with the request). Think you’re clued-in enough to be immune to such attempts yourself? Don’t bet on it. We’ve seen tech-savvy senior admins fall for attempts made by would-be intruders thinking “outside the box”. The attacker doesn’t have to be able to out-think the admin every time to be successful… just once will often do. As with other types of attacks, your goal is to reduce the level of risk—not to completely eliminate it.

1.4.10 Birthday A birthday attack is a type of brute force attack. The name comes from the birthday paradox which states that, as few as 23 people brought together double the probability that two of the people share the same birthday. This may fly in the face of common sense; however it is not possible to argue with the math[35]. The high probability of duplicates within a relatively small number of samples means that it is possible to create a mathematically identical message digest (practically-unique identifier, discussed in the Cryptography chapter) for a different message or document. Statistically speaking, you’ll usually find a duplicate value before you’ve tried even half the possible combinations. Fortunately, the message that produces the duplicate will (in all probability) obviously be invalid (probably a string of gibberish characters rather than coherent words or whatever else the original message contained), and the recipient of such a message would be suspect of it even if the message digest were the same. Success Owl!

Happy Birthday? A birthday attack is a specific kind of brute force attack that takes advantage of the fact that multiple sets of source data can encrypt to the same hash value. For example, it could be used to find another message that would encrypt to the same MD5 hash value associated with an original message. Theoretically, this would let an attacker change the contents of the message. It is referred to as a birthday attack because it takes advantage of probabilities, much like the old trick in which you would bet your friend dinner that two people in a 50-person room shared the same birthday (and you would usually win, due to the odds increasing with each additional person in the room).

1.4.11 Password Guessing A 'black hat' will have in their toolkit several password guessing programs, which automate the process of rapidly testing many potential passwords for a given account. The most commonly used password guessing method is the dictionary attack (See 1.4.11.2) Typically systems help guard against this by logging login attempts, perhaps flagging unsuccessful attempts in big red letters. Also make sure that if your system offers the availability to lock a user account after some number of unsuccessful login attempts, that you use it (somewhere around 3 to 5 seems to be the “magic number” of attempts usually tolerated before you should get worried that someone’s trying to guess a password).

1.4.11.1 Brute Force In a Brute Force attack, muscle (in this case, CPU and/or network muscle) is applied to break through a particular security mechanism, rather than using particular intelligence or logic. “Brute force” is most commonly applied to password guessing, taking advantage of computer power available to an attacker, to try every possible password value, until the right one is found. Even just a couple years ago, brute force was considered difficult due to the lack of lost cost processing capable of the sheer crunching power needed. Today, the AMD 2000XP processor costs less than $100 USD and the 2400XP is shipping. That puts the brute force method within reach of anyone. Rather than go on with the usual blah blah about strong passwords, we are encouraging you to follow the footnote to a free Brute-Force Password Cracking Simulator[36]. Play with this simulator and you will discover that, in general, the longer the password, the more difficult a brute force attack becomes.

Figure 10: Even going for 256 characters, by brute force with a 1.5Ghtz CPU, this password can be broken in less than a day The simulator program is less than one megabyte in size and runs in Windows. Instead of actually attempting to “crack” a stored password, you just set the variables (including testing a real password) and it will calculate how long the brute force method takes. In one test Brute Force with a 1.5Ghtz processor would take 170 years, 309 days, 21 hours, 32 minutes, and 22 seconds to crack 4July1776. However, a dictionary password program would rip that same password almost instantly.

Figure 11: Just adding one special (high-order) character makes a brute force attack almost a month of effort with the same CPU

Success Owl!

Brute Force A brute force attack involves throwing computer and/or network power at a security mechanism until it is broken. Bruce force is commonly used to “crack” passwords, often for user accounts. It can also be applied to ZIP files and many other types of encrypted data. One way to protect against brute force password cracking is to use as long a password as possible, because the longer the password, the harder it is to crack via brute force.

Figure 12: This ten character pass phrase now takes the same CPU a few hundred thousand years to crack

1.4.11.2 Dictionary Currently in the *nix world, dictionary cracking is the most popular exploit. The FAQ of this work states that this is not a treasure map for folks who want to do damage. We have included the footnote to John the Ripper[37] because the download site appears right at the top of Google; so, we are not giving anything away here. John The Ripper works on both DOS and UNIX based systems and a CD can be ordered that contains 20 different languages. It is a whopping $15 USD airmailed to any address in the world. A popular non-free (after 15-day trial) package that can be used to audit Windows NT and 2000 passwords for susceptibility to dictionary attacks is LC4 (aka L0phtCrack 4), by @Stake.[38] By comparing a large number of common words sorted by popularity, the dictionary attack can be quite effective. Additionally, don’t think you’re safe from dictionary attacks if you tack a # or 4 on the end of your password, because dictionary attacks aren’t limited to just trying words that are in the dictionary. It’s common for dictionary attack programs to also propend and append special characters and letters to dictionary words, or even make common numeric/symbol substitutions for letters such as 0 for o and ! for I or L, when trying to determine a password. Success Owl!

Dictionary Attack A dictionary attack is a brute force attack in which common words from a dictionary are used to generate many thousands of potential passwords, which are compared with the real password in some way. If the comparison comes back valid, the attacker knows that the word they tried is the user’s password.

Both dictionary and brute force password guessing attacks can be carried out in one of two ways, one more difficult to detect than the other: •

Encrypting the current “trial” password and comparing it to a copy of the encrypted password that the user has obtained

•

Using some system facility (like a telnet logon) to submit the current “trial” password for login verification, and letting the system’s response tell you whether or not you’ve found the correct password

The first is typically more of a threat since it is more likely to be accomplished without triggering any system alarms, and thus go undetected until the intruder users one of the cracked passwords. It does, however, require that the user have access to the encrypted password values (possible on Windows via tools like LC4, and on UNIX systems that are not configured to use shadow passwords). Fortunately, this approach doesn’t work anywhere. The second method is still a threat, but normally systems can be configured to lock out accounts after a certain number of invalid password attempts, to help prevent attacks that involve password guessing. Be aware that depending on what applications are in use on your system, it may be possible to perform validation without logging any incorrect attempts, and thus not alerting anyone to the attack. How? Some network-based and web-based applications request user ID/password information. In some cases, this information is validated against OS user and password information using OS validation functions … but unlike the OS logon validation program, the application doesn’t write entries into system logs when it encounters invalid user/password combinations, or lock out a user from further attempts after a certain number of unsuccessful tries. This is yet another example of how additional services and applications installed on a system can increase its vulnerability. Real World Owl!

Benchmark and improve your user community’s password quality This is one of those exercises we hesitated to recommend, but ultimately had to come down on the side of, “ignorance is not bliss,” because avoiding this information yourself won’t prevent a cracker from obtaining it, and it’s better for you to know what information he or she could obtain, in advance.

If you are authorized (and we mean officially—ideally obtain your manager’s signature on a piece of paper stating what you’re about to do) and feel personally comfortable with the activity, download one of the password cracker programs which runs on your system of choice. If it allows you to target only a segment of your full password file, do limit your initial test to a couple dozen entries to reduce the amount of time it will take to run. And then start it up. If you’ve never run one on your system before, and your users are about par for the course, expect it to report a few cracked passwords. You can then use this information to discover which users need more education about password choices… or perhaps even to justify installing an enhanced new password validation program on the system. Rather than catching simplistic passwords after the fact, some operating systems and third-party products allow you to check a new password’s vulnerability to brute force attacks when the user first enters it, and to inform the user to select an alternate password if it seems not strong enough.

1.4.12 Software Exploitation Software is written by humans, and thus tends to be imperfect. In the quest to “ship” a product, or “go into production” with an in-house application, corners are cut and long hours are put in, and “bugs” (or flaws) tend to creep into programs unintentionally. Crackers can exploit some of these bugs. A later section looks at code deliberately designed for a malicious purpose. This section looks at code that wasn’t meant to be a security problem, but which someone figured out how to use, to cause trouble. Software exploitation often involves subjecting a program to an unusual condition it doesn’t handle well—such as sending an excessively large amount of data to the program, sending data of an unanticipated type (say, something that looks like an OS command or program statement rather than a last name), running the program while the system’s disk space is full, or running the program with some strange setting (used by the program) in the user’s login “environment”.

Buffer overflows A particular type of software exploitation that frequently makes the news these days is that of a buffer overflow. Generically speaking a buffer overflow occurs when an input string is used copy more data into a memory buffer than the program was programmed to handle. Software coders are famous for checking to see if something works and being blind to what happens “if”—in this case, the IF is, a user provided more data for one of these memory copy functions, than the programmer expected. The footnote has a great overview[39]. The most recent PITA virus in the buffer overflow category is Code Red[40]. The most famous buffer overflow occurred on November 2, 1988. The “Morris worm” caused incredible damage by exploiting a buffer overflow condition in the UNIX program fingerd (a “daemon”, aka server service) for the popular UNIX “finger” utility. Once a cracker has found a program with a buffer overflow problem, they can either: Send large amounts of random data to the program, causing that program to crash. If the program is a server that doesn’t automatically restart, that may cause a Denial of Service condition. Send specially crafted data, designed to overwrite portions of the program in memory, and alter its functionality (as did the Morris worm). If the program is running with Administrator or UNIX root privileges, this enables the attacker to cause arbitrary commands to be executed with these higher privileges. For instance, they might copy or delete files, run code to cause a worm to propagate, change the system configuration settings, etc. Sometimes buffer overflow exploits are automated in a “rootkit” or exploit script used by a script kiddie. Other times, they’re exploited by hand, by a more skilled, programming savvy tech.

Naïve web applications Another class of software exploits you’re likely to run into if you administer a web server involve poorly programmed web applications that don’t sufficiently check the validity of the data provided to the application by the web user, before using that data in the program. You’ve probably seen your share of web applications before. The way most web applications work is that a user fills in some data on a web form (such as name and address for a mailing list) and clicks “submit”, or clicks on an “order” button next to an item on an e-commerce site … then the data is transmitted to the web server and the application picks up the data and uses it. Just as programmers sometimes don’t anticipate the sheer magnitude of data a user would throw at a program (in a buffer overflow exploit), they sometimes don’t anticipate the creative types of data a user might type in to a web form field which asks for the user’s name. Depending on how thoroughly the application checks for invalid data, an attacker might be able to send data containing characters like a single quote mark, semi-colon, dashes, back quotes, percent signs or other characters or words which have special meaning to the web server, application running on the web server, or database and cause it to behave in unanticipated ways that allow the attacker to cause damage. In a particular exploit known as SQL injection, a user embeds database commands into data submitted to a web form. A complete explanation of this is far beyond the scope of this book, but the exploitation of software vulnerabilities in web applications is becoming more and more common, and those who follow the field of computer security are citing it as an area of concern. For example, the most recent OpenHack challenge, OpenHack 4[41], in which systems are made available over the Internet and users are invited to challenge their security, focuses on application security and involves both Microsoft and Oracle applications. Success Owl!

Attacking Legitimate Programs Software exploitation includes taking advantage of legitimate programs for malicious purposes, using techniques like: •

•

buffer overflows, which allow an attacker to overflow a program with data, causing it to crash or execute malicious code provided in the data by the attacker SQL injection, which enables the attacker to submit their own database commands to the system, possibly deleting, changing or displaying data they’re not authorized to access, like credit card numbers and customer lists

The important thing to remember about software exploits is that you can help protect your systems against them by keeping the software you run up to date, and by educating programmers in your organization on how to write secure code. Two excellent references on this subject are: Writing Secure Code[42] by Michael Howard and David LeBlanc, the Open Web Application Security Project Guide,[43] and Designing Secure Web-Based Applications for Microsoft Windows 2000[44 ]by Michael Howard et. al.

If you’re writing web applications, or know someone in your company who does, we can’t say it strongly enough -- THEY NEED THIS INFO. If they don’t think they need it, then, seriously, they REALLY need it, because it’s likely they’ve made a false assumption or two about what safe web application coding looks like. Real World Owl!

A Developer Reality Check How much do your organization’s programmers, particularly those writing applications that are accessible by users on the Internet, know about writing secure code? As a simple yardstick, ask them if they know how what buffer overflows and SQL injection attacks are, and how to prevent them.

[25]

“Configure NT and Windows 2000 stack to resist network Denial of Service”, http://is-ittrue.org/nt/nt2000/registry/rtips3.shtml [26]

http://www.rootkit.com

[27]

“SANS Intrusion Detection FAQ,” http://www.sans.org/newlook/resources/IDFAQ/oddports.htm

[28]

http://www.securitysoftware.com/antisniff/download.html

[29]

http://www.insecure.com/

[30]

http://packetstorm.acm.miami.edu/UNIX/misc/sw-mitm.tar.gz

[31]

www.grc.com

[32]

Peikari, Cyrus, and Seth Fogie, Windows .NET Server Security Handbook , Prentice-Hall, April, 2002, http://www.nerdbooks.com/item.html?id=0130477265 [33]

http://blinky-lights.org/script.html

[34]

http://www.counterpane.com/pitfalls.html

[35]

http://www.veracity.com/tutorial/sig_secure.html

[36]

http://www.alpinesnow.com/bpcs.shtml

[37]

http://www.openwall.com/john/

[38]

http://www.atstake.com/research/lc/index.html

[39]

http://www.enseirb.fr/~glaume/bof/report.html

[40]

http://www.cert.org/advisories/CA-2001-19.html

[41]

http://www.openhack.com

[42]

Howard, Michael and David LeBlanc, Writing Secure Code, Microsoft Press, November, 2001, http://www.nerdbooks.com/item.html?id=0735615888

[43]

http://www.owasp.org

[44 ]

Howard, Michael, Marc Levy, Richard Waymire and Doug Bayer, Designing Secure WebBased Applications for Microsoft Windows 2000, Microsoft Press, July, 2000, http://www.nerdbooks.com/item.html?id=0735609950

1.5 Malicious Code Malicious code is program code specifically written for a malicious purpose (rather than code written for a legitimate purpose, which a cracker figured out how to misuse). For example, you would call a piece of code malicious if it deliberately did something like: • • • • •

Delete files on your disk, or reformat your disk, without the user’s knowledge Report the contents of your email address book to a web server collecting email addresses for a spammer Display “Ha ha, you’ve been rooted!” and other such messages on your computer Replace certain system files with other files, causing programs to malfunction Capture your network password and email it to [email protected]

This section discusses some different types of malicious code you may encounter out in the field when administering or managing security for a network. Each type of code discussed below differs mainly in how it gets propagated from one user (or system) to another, and how it gets activated to do its dirty deed(s) once it gets onto a system, rather than in the functionality the destructive program itself provides.

1.5.1 Viruses This is a catchall phrase for any man-made code that is anything from annoying (WAZZU[45]) to destructive, such as a boot sector virus[46], which includes some way to attach itself to other files, called “host files,” and replicate itself. A virus can replicate either from file to file on a single system, or across a network (if it replicates automatically across the network without a user’s assistance, it is more precisely called a worm, another type of malicious code discussed in 1.5.4). Success Owl!

A Virus is… A virus is a program that attaches itself to a host file and replicates itself on a system. Usually when run, unbeknownst to the user, a virus performs some action that is either malicious or simply annoying. For example, a virus may delete or modify system files, or just produce a joke message on the user’s screen.

Viruses move from computer to computer by some user’s actions, rather than spreading automatically across a network. A virus typically gets into a system from an external source, such as a floppy disk containing software given to you by an office-mate, a file on a network share being copied onto your system and then executed to install it or “just see what it does,” an email message sent to you by a friend containing a file that claims to be a greeting card (to

get you to open it), or software that you download from the web or install from a very unlucky vendor’s CD distribution (the latter really has happened ). The possibility of transmitting a virus by email is why many email systems feature virus scanning for in-bound email, trying to limit the number of ways known viruses can enter a network. Geek Owl! Viruses are getting sneaky Over the years, the IT world has seen several different kinds of viruses, including: 1. Boot sector viruses which place their code in the hard disk’s boot sector, which is loaded every time the machine powers on 2. File infector viruses which attach themselves to legitimate executable programs, causing the virus to run each time one of those programs is launched 3. Script viruses which, like file infectors, attach themselves to existing legitimate programs (in this case, scripts like DOS batch files or VBscript or java script batch files), causing the virus to run each time the infected script is launched 4. Macro viruses that are embedded in files such as word processing documents and spreadsheets whose environments (such as Microsoft Word) support “macro” programming in documents to customize Word’s behavior when the document is open. These viruses are often attached to initialization macros that run whenever the document is opened, so that the user is not aware that they are “running” anything. Numerous measures can be taken to prevent, contain and perform damage control on virus infections on your network, including: •

• •

•

•

Enforcing a policy that users must run anti-virus software on their workstations (if some users complain that they don’t want to run your organization’s standard antivirus software xyzzy because locks their computer up when they try to run program frobozz, don’t let them out of the anti-virus utility requirement… find another one for them to try). Common packages are Symantec’s Norton Anti-Virus[47], McAffee VirusScan[48] and Grisoft AVG AntiVirus[49]) Virus-scanning all incoming email automatically, to guard against attachments that contain viruses being received and then opened or run by users Require users to use software which does not include macro capability, or require users to save files in formats not supporting macros (for example, Microsoft Word can save files in .rtf format, which doesn’t support macros, as well as in .doc format) Change PC boot sequence in CMOS to always try to boot from the hard disk first, so that a floppy carrying a boot sector virus won’t infect a workstation’s boot sector (and thus infect that PC) Set email clients to not automatically open attachments of certain types (like .EXE) Success Owl!

Wise Users Are Paranoid

Instruct users to check with the system administrator before opening an unfamiliar type of email attachment, any attachment they did not expect to receive, and any attachment from a user they do not know, as it could contain a zero day[50] virus. (Companies spent hundreds of thousands of dollars removing the ILOVEYOU virus from computers, when thousands of users opened a “Love Letter For You” that claimed to be from a familiar user. You see, it looked “just plausible enough,” and it’s those “just plausible enough” lies that are the most believable.) A virus is almost guaranteed to get through your defenses eventually no matter how careful you are—perhaps because it was just released out into the wild 6 hours ago, and your antivirus software does not recognize it, and thus didn’t stop its entry into your network. And then, once it’s been discovered, you may or may not have software that will remove it safely, since some viruses are so destructive that they cannot be removed without deleting all infected files. In that case, what will save you is a good, recent backup. If you are on a company network which features standardized clients (same type of PC, same OS and applications, etc.), a “Norton Ghost” style disk image program may allow for quick recovery in the case of multiple infections. Real World Owl!

Administrator, Survey Thyself What anti-virus program(s) is in use on your network? Is it installed and enabled on all systems? Have you found alternate anti-virus programs that work for those users who absolutely insist they cannot get their work done if the standard anti-virus software is installed on their computers, or are you letting them slide without an anti-virus program and just hoping they won’t get a virus?

1.5.2 Trojan Horses This one should tie tightly (at least in your mind) to social engineering. A Trojan horse pretends to be something useful or interesting, yet, is really a virus or other malicious code whose writer decided the best way to distribute it would be to include it in a program that claims to do something useful. Unlike a regular virus, a Trojan horse is attached to a particular executable, and typically isn’t capable of replicating and attaching itself to other files on your system. Typically the Trojan horse relies on gaining users’ interests with something that sounds fun or curious. Sometimes they masquerade as some sort of data file where a user is asking for help. Because Trojan horses appear to be legitimate code, but have hidden functions designed to do nasty things, they are difficult to detect with an Intrusion Detection System (IDS). As with viruses, prevention of Trojan horses on your system will largely be accomplished via anti-virus software and educating users not to open mysterious attachments. Success Owl!

Trojan Horse

A Trojan horse is a type of malicious code that appears to the user to be a legitimate program (or data file—even Word .doc files can contain Trojan horse code in the form of macros), but includes hidden functions designed to perform malicious actions.

1.5.3 Logic Bombs A logic bomb is a virus of some ilk with a time delay fuse. The most famous virus with a fuse was Michelangelo in 1992. More practically speaking, a really upset employee is more of a danger. They could install a program set to do something malicious at a later date, and then quit (or work their last day, if they were laid off), leaving the system to automatically fire off the malicious code days, weeks, or even months after they lost their access to the company’s computers. For that matter, this could also happen while they are still employed (but taking a vacation day, be in an all-day meeting, etc.—i.e., in a place in which they had an “alibi”), when the logic bomb “goes off”. Success Owl!

Logic Bomb A logic bomb is a piece of malicious code that is designed to not “fire” the malicious functionality until a certain date. An example of a logic bomb in a virus would be the Michelangelo virus. More commonly, upset employees, triggering some malicious functionality at some date in the future, may insert logic bombs into in-house programs.

To guard against this occurring, it’s useful to have multiple programmers looking at the same set of code (either using multiple coders, a la “Extreme Programming”[51], or a two step “code” and “code review” process), and for change control processes to be in effect, requiring that someone other than the program’s creator be assigned the responsibility (and the necessary system access permissions) to put any code into production. As we’ll see later in the cryptography section, a useful tactic in helping keep a system from being abused is to require that multiple people be involved in activities that lend themselves to abuse, such as installation of programs on in-house production (or client) systems.

1.5.4 Worms Worms are similar in nature to viruses. Both can consume resources and replicate themselves[52]. The Morris worm or the Internet worm is perhaps the most famous worm. The difference between a worm and a virus is that a worm can replicate itself across a network and consume resources, and it does not need to attach itself to other “host” programs[54]. Rather, it is capable of distributing and launching itself on its own, with no inadvertent “assistance” required from users whose computers are being infected. Success Owl!

Worm

A worm is a virus, usually containing malicious code, which can replicate itself and propagate across a network. Unlike a Trojan horse or many viruses, it does not have to attach itself to other “host” programs. Geek Owl! Meet Mr. Morris The most famous worm is the Morris Worm, which spread across the Internet by

exploiting bugs in the send mail SMTP transport agent and an Internet service called “finger.” Consider that the Morris Worm exploited a buffer overflow issue in the finger service back in 1988, and that programmers are still writing code vulnerable to this technique. Pessimists may proceed to predict the imminent death of the net now[55]. As with viruses and Trojan horses, worms can be detected with anti-virus software. (If you’ve now gotten the hint that you should be running some sort of anti-virus software, no matter how inconvenient it is to isolated users, on your network, good!) [45]

http://open.jeffersonhospital.org/tju/dis/virus/desc/wazzu.html

[46]

http://www.sophos.com/virusinfo/analyses/index_dosexe.html.

[47]

http://www.symantec.com

[48]

http://www.mcaffee.com

[49]

http://www.grisoft.com

[50]

A “zero day virus” is a virus not yet known to be in the wild, and you’re one of the lucky first people to “discover” it.

[51]

http://www.xprogramming.com/xpmag/whatisxp.htm

[52]

http://www.itworld.com/nl/unix_sec/09132001/

[54]

http://www.esecurityplanet.com/trends/article/0,,10751_1464281,00.html

[55]

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci860185,00.html Buffer overflows likely to be around for another decade

1.6 Social Engineering The Security+ Domain 1, as covered in this chapter, is definitional in nature. Given this, you need to know the definition of what social engineering is. Assuming you have been reading this work in a linear fashion, we won't bore you here! If you are skipping around, please read the introduction section which covers this topic nicely. We cannot stress the importance of fully understanding the challenges of social engineering attacks enough. For example, suppose your firm spends huge piles of money on fingerprint scanners. Tsutomu Matsumoto revealed two different methods for faking fingerprint scanners with 80% accuracy[56]. However if you are willing to settle for a first time accuracy rate of just over 50%, the article at puttyworld reveals a much simpler and low-cost method.[57] Social engineering is a favored attack because: The attacker is getting an authorized user to effectively defeat the security that has been put in place. This is the fastest and least expensive approach. Further this approach creates the least risk of detection for the intruder. A computer cannot detect a social

engineering attack, because no code is there to be detected. People can give away passwords and other valuable data, and even think they were doing the right thing (for example, thinking they were helping an authorized vendor service engineer)… and you, the network administrator, might not ever know. Success Owl!

Social Engineering Social engineering involves defeating established security mechanisms by enlisting the assistance of (usually unwitting) users to accomplish malicious things or acquire data that the attacker is not authorized to have. It is a particularly insidious technique because: •

•

no software tools are needed to acquire information like passwords and specific network addresses of file servers containing certain data (the attacker just convinces the user to tell them the information they want) unlike most attacks, an attack based on social engineering activities is not detectable via an automated system like an IDS or network monitor (it is carried out in simple conversation)

Success with both the Security+ test and the real world requires thinking outside the technical box to include physical security and people. Real World Owl!

How Easy It Is! Want to see how vulnerable your network user community is, to social engineering attacks? First, outline this activity to your boss and get his or her OK, because your colleague could end up receiving sensitive information. Also get agreement that the users will not be sanctioned for anything they do or say—this is an informational exercise, not one designed to place blame. Then, enlist an authorized co-conspirator, like a not-very-well-known network administration assistant, pick a couple target users at random, and see how much information your coconspirator can acquire about your network via social engineering alone. Formulate an appropriate education plan in response to the users’ behavior.

Pop Quiz 0001.00

Pop Quiz 0001.00 Questions 1. Select from the list below the DoS attacks A. B. C. D.

Ping flood IGMP fragmentation Out-of-bounds nukes Teardrop attacks

2. The correct description of a SYN flood is A. A session which omits the final portion of the TCP 3-way handshake B. A session which omits the first portion of the TCP 3-way handshake C. A session which omits the second portion of the TCP 3-way handshake 3. From the list below select the names of the program that are back door programs A. VNC B. NetBus C. BackOrifice 4. Spoofing involves forging the ____________ address of an IP packet. 5. The program that offers security over telnet is ________ Answers 1. A. Ping flood B. NIGMP fragmentation C. Out-of-bounds nukes D. Teardrop attacks 2. A. A session which omits the final portion of the TCP 3-way Nhandshake 3. B. NetBus D. BackOrifice VNC and Tight VNC are open-source remote control programs. While they may be seized, they are not hidden programs. 4. Spoofing involves forging the _Source_ address of an IP packet 5. The program that offers security over telnet is _SSH__ [56]

http://www.itu.int/itudoc/itu-t/workshop/security/present/s5p4.pdf

[57]

http://www.puttyworld.com/thinputdeffi.html

1.7 Auditing Auditing, the last item in the AAA of security, is the process of monitoring a system or network, looking for potential security exposures or incidents, and verifying proper operation and configuration. The “system” that you are auditing may be a network, a computer, or your computing environment as a whole (including disaster recovery, physical security, processes, etc.). The two most common approaches to system and network audit today include configuration analysis/log analysis and vulnerability scanning.

Success Owl!

Monitoring Auditing involves monitoring a system or network, looking for potential security exposures or incidents, and verifying proper operation and configuration. Auditing can be performed in many ways, such as analyzing logs (which provides information about past events on the network/system) and system/network scanning (which provides information about the current state of the system/network.)

Configuration and Log Analysis Configuration analysis involves the verification of machine and device configurations, including customization settings, installed options, etc. In configuration analysis, you examine the current state of the system, looking for ways to make it more secure. In effect, a configuration auditor follows a highly detailed checklist, comparing each element on the list with the object being audited, and noting where discrepancies exist. Logging is the process of recording interesting system and network events. It can be used strictly for informational purposes, or for accounting charge backs or system/network performance and load analysis. For example, you can log accesses to web documents on any web server, user login attempts, accesses to certain files in Windows 2000, system startup/shutdown, security policy changes, user account administration or uses of the UNIX “su” command. Where are these logs? On UNIX systems, many programs write logging information into the system’s syslog (which may be present on that system, or may be on another system on the network). On Windows systems, many programs write logging information into the Event Log (more properly, into the System, Security or Application event logs). Other programs, such as web servers, typically maintain their own logs created with special formats that can be read by tools specifically designed to easily “mine” the logs for information. Success Owl!

Classic Auditing One type of auditing involves creating logs where you: • •

Establish a baseline of “normal” activity Monitor against the baseline for abnormal results

What and where should you monitor? You cannot monitor everything in a typical environment (such as the completion of every print job) because you become flooded in data. The chairman of IBM has in his office the motto: “Think”. As a general recommendation: Monitor the obvious. Anything less than obvious to monitor is outside any firewall. Create a baseline of “normal” activity outside and monitor so you have an idea of what an attack looks like before someone gets in. For example, you may not want to log successful accesses of a certain data file, but you might want to know about unsuccessful accesses, because those are likely to indicate someone trying to read data they’re not authorized to see.

A key point about logging as an audit tool is made very well in Real World Linux Security[58] by Bob Toxen. If you can avoid it, never store a log where an attacker can get to it—and especially never store it where an attacker can modify it and erase his tracks, invalidating the usefulness of the log. In the UNIX/Linux world, it’s useful to direct log entries to a syslog on another machine. Geek Owl! Geekily Speaking Reading If you can tolerate the sub-optimal font sometimes used in the book, Auditing and Security[59] by Musaji provides a lot of raw data on configuration items to check in Windows NT and UNIX, as well as the AS/400. It claims to be the first book on IT security written specifically for auditors and has a companion web site at http://www.wiley.com/musaji. If you’re creating the nitty-gritty details of an audit policy for one of these platforms, it really looks like $85 well spent, to get this book—and Windows 2000 auditors will find information of interest in the NT section as well, even though it was not written with Windows 2000 in mind. A more generalized book on auditing is Network Auditing[60] by Smith, also with checklists. An interesting treatment of auditing a Windows 2000 system/network, complete with information on how to set up “Auditor” accounts (nicely demonstrating the security concept of “separation of duties”) and a list of useful Microsoft tools that assist in auditing, can be found in the Windows 2000 Security Handbook[61] by Philip Cox. Pros and cons of different types of auditing procedures are described in The Process of Network Security[62] by Thomas Wadlow.

System/Network Scanning A second type of auditing is vulnerability scanning, which may be accomplished by running system scanner programs from inside the organization, or may be accomplished by a penetration test in which someone attempts to gain access to system/network resources from outside the organization. Success Owl!

Scanning Scanning is the process of checking a system or network for exploitable (or potentially exploitable) vulnerabilities

Some things that can be detected by scanners include: • •

•

Servers running on each host (which might be unnecessary, and thus should be turned off) Vulnerability of services to known attacks (which imply that you should get an updated version of whatever software you’re using to provide that service, or possibly turn the service off until an update is available) Type of OS and service software running on a host (see also: OS Fingerprinting in section 1.4)

•

• •

• •

System architecture (if you want to try a buffer overflow exploit that only works on x86-based Linux systems, you not only need to make sure that the host is running Linux and the appropriate version of the software you want to exploit… you also need to make sure it’s an x86 machine) Rogue hosts set up by users without the IT department’s authorization, whose configuration may or may not be known Firewall rules in place (by examining TCP/IP replies, a scanner can sometimes differentiate between services that aren’t blocked by the firewall but aren’t running on a host, and services that are blocked by the firewall and may or may not be running on the host) Open file shares Insecurely coded web pages

If run against a single system, the scanning software may be run on the system itself (so that it has access to local files which might not be visible to external network connections), or it may run over the network. If run against a network, the software generally doesn’t even need to run on the same network being scanned. Why should you scan your network regularly? Simply, you should do this so that you know what the crackers know about your network, and have a chance to address it (hopefully) before THEY do. You can learn more about scanners in the paper, “Network Scanning Techniques” by Ofir Arkin.[63] Nmap[64] (for *nix and Windows), Nessus[65] (for Unix) and Sara[66] (also for Unix) are popular free network scanners. Many other commercial solutions exist, such as eEye Digital Security’s Retina[67] (for Windows), Internet Security Systems’s RealSecure Protection System[68] (management platform for Windows and sensors for Windows and UNIX) and WWDSI’s SAINT[69] (an updated version of the freely available SATAN scanner for UNIX). Many have said that for CEO-impressing reports, eEye’s award-winning Retina scanner is tops.[70] Historically, scanners have searched for vulnerabilities at the network layer and defective server software. A new frontier for scanners is that of web applications. Web application scanners (sometimes called CGI scanners, if used to scan for CGI script vulnerabilities) work at the application layer, and look for exploitable web pages (such as CGI scripts or JSP or ASP pages). This area of scanning is still relatively new, but tools written to specifically address it include Web Scarab[71] (a new open-source tool written in java, with preliminary alpha test release expected in September, 2002) and SPI Dynamics’ WebInspect[72]. In addition to running system scanners, another way you can check for vulnerabilities in your current system and network configuration is via penetration tests. Geek Owl! Running a Pen Test There are a variety of “pen test” scenarios, including: 1. attempting to access the organization’s machines from outside the network, with no background knowledge about the network 2. attempting to access the organization’s machines from outside, with some amount of background knowledge, possibly including the locations of

email, DNS and other servers, dial-in telephone numbers, etc. 3. attempting to access the organization’s machines from inside the network, with detailed background knowledge about the network and installed software, and perhaps normal user-level access to services customarily available to all employees Success Owl!

Definition of a Pen Test A penetration test is an exercise in which one or more people attempt to gain access to system/network resources. It may be conducted from inside or outside the organization’s network, and by using or not using certain internally known information, depending on what security is being evaluated by the test.

Network scanners and penetration exercises (not tests—the real thing) are two tools in the cracker’s arsenal. Employing these tools on your own network—before the crackers do— allow you to find and address weaknesses in your network’s security before they are exploited. Real World Owl!

Tracking Check your network’s logging configuration. Are all of the important events like user logons and logoffs, incorrect logon attempts, user account and security settings administration, system startup and shutdown, etc. being logged? If not, enable logging for those types of information.

[58]

Toxen, Bob, Real World Linux Security, Prentice-Hall, November, 2000, http://www.nerdbooks.com/item.html?id=0130281875

[59]

Musaji, Yusufali Fl, Auditing and Security, John Wiley, February, 2001, http://www.nerdbooks.com/item.html?id=0471383716

[60]

Smith, Gordon E., Network Auditing, John Wiley, April, 1999, http://www.nerdbooks.com/item.html?id=0471179752 [61]

Cox, Philip, Tom Sheldon, Windows 2000 Security Handbook, Osborne, November, 2000, http://www.nerdbooks.com/item.html?id=0072124334

[62]

Wadlow, Thomas, The Process of Network Security, Addison-Wesley, February, 2000, http://www.nerdbooks.com/item.html?id=0201433176

[63]

Arkin, Ofir, “Network Scanning Techniques”, 1999, http://www.syssecurity.com/archive/papers/Network_Scanning_Techniques.pdf [64]

http://www.insecure.org

[65]

http://www.nessus.org

[66]

http://www-arc.com/sara/

[67]

http://www.eeye.com/html/Products/Retina/index.html

[68]

http://www.iss.net/products_services/enterprise_protection

[69]

http://www.wwdsi.com/products/saint_engine.html

[70]

Peikari, Cyrus and Seth Fogie, Windows .NET Server Security Handbook, Prentice-Hall, April, 2002, http://www.nerdbooks.com/item.html?id=0130477265 [71]

http://www.owasp.org/webscarab/

[72]

http://www.spidynamics.com

1.8 Summary In this chapter, we looked at the topics in the first domain of the Security+ exam, General Security Concepts. You learned about the AAA of security (Access control, authentication and auditing/accounting). Within Access control, you explored the characteristics of different types of access control such as: • •

•

MAC (Mandatory Access Control, a lattice-based approach using labels, related to the Bell-LaPadula model) DAC (Discretionary Access Control, in which the owner of an object generally retains the right to distribute it to others, so a Trojan horse sent to the document owner could potentially be used to cause a document to be distributed) RBAC (Role-based Access Control, in which access permissions are based on user job roles such as Accountant, Regional Sales Director, etc.)

Within Authentication, you learned about the three types of authentication, based on: • • •

Something you are (biometrics) Something you have (such as a smart card) Something you know (such as a password)

You discovered key points about several authentication technologies, such as: •

•

• •

Kerberos (which uses tickets as identity tokens, employs temporary session keys and symmetric encryption, and is careful not to send the password over the wire, but can be vulnerable to attacks like replay and brute-force password guessing) CHAP (which uses a 3-way challenge/response handshake, repeated at random times during a login session, and which like Kerberos also does not send the password over the wire) Digital certificates (more about these later!) Passwords (which should not be sent over the network where they can be “sniffed” by users running network monitoring software, and should not be dictionary words or other short, easy-to-guess sequences)

• • • •

Tokens (hardware devices which can be used, often with a PIN, for authentication; they often also employ digital certificates) Multi-factor authentication (which uses a combination of 2 or more authentication techniques to reduce the probability of spoofing) Mutual authentication (in which both parties to a conversation authenticate themselves to each other) Biometrics (involves something you are, such as your fingerprint, or something you do, such as your typing style/rate)

You learned about different types of Auditing (the process of monitoring a system or network, verifying configuration and watching for security exposures), including configuration and log analysis and system/network scanning (using programs like nmap). You learned that it is best to disable and filter access to non-essential services and protocols, because the more unnecessary features available on a system, the more vulnerable it is. You discovered that would-be crackers may use OS fingerprinting to learn about a server before they attack it, and investigated the details of common types of “cyber attacks” such as: •

• •

•

•

• •

•

•

•

•

DoS/DDoS (the attacker floods a network with traffic and causes a denial of service to a machine or network, in the case of a Distributed DoS using multiple machines on the network to do it, via techniques such as ping flooding, SYN flooding and teardrop attacks; Trinoo is a common DDoS tool) Backdoors (give the attacker a way into the system without the usual security checks; NetBus and BackOrifice are common backdoor programs) Spoofing (made possible due to the design of TCP, involves the attacker misleads everyone as to their location and identity, by using a faked IP address in packets; in blind spoofing, the user sends packets to the target system but does not have access to that system’s replies) Man-in-the-Middle (MITM, often used to “take over” a telnet session, in which the attacker intercepts the packets in a conversation between two machines, altering some on the fly) Replay (the attacker captures the packets involved in one side of a network conversation and replays them later; can sometimes be used to spoof authentication/authorization) TCP/IP Hijacking (the attacker takes control of a TCP/IP conversation) Weak Keys (the attacker takes advantage of the use of weak encryption keys used to secure a conversation or data; generally 40-bit and 56-bit key lengths are not considered sufficient today) Mathematical (the attacker takes advantage of mathematical properties of an encryption technique to discover the original key or break the technique without need for the original key) Social engineering (the attacker uses interaction with people to learn about and compromise the network, taking advantage of their desire to be helpful by providing names, passwords, etc.) Birthday (an attack based on the high probability of duplicates within a small number of samples; attackers can take advantage of this to find duplicate texts that have the same “message digest” signature) Automated Password Guessing attacks like Brute Force (the attacker tries every possible combination of characters in an attempt to find a password) and Dictionary

• • • • • •

Attacks (the attacker tries each word appearing in a dictionary, to see if it matches the password) Software Exploitation (the attacker takes advantage of “bugs”, or malfunctions, in software with techniques like buffer overflow or SQL injection exploits) You explored different types of malicious code, which are programs written for a malicious purpose, such as: Viruses (programs that attach themselves to a host file and often automatically replicate around the system; can generally be detected by anti-virus programs) Trojan Horses (programs that masquerade as one thing, but include extra, hidden, malicious functionality) Logic Bombs (programs whose malicious functionality runs at some future date— when a set time has elapsed, when a user ID is no longer on the system, etc.) Worms (programs similar to viruses which can replicate across a network)

You learned that social engineering involves defeating established security measures by taking advantage of the fact that people are often the weakest link in any security system. It often uses no software tools at all, and thus cannot be detected automatically by traditional intrusion-detection technology.

1.9 Success Questions 1. Enforcing minimum privileges for general system users can be easily achieved through the use of: A. B. C. D.

A.RBAC B.PRVMIN C.TSTEC D.IPSEC

2. What process determines who is trusted for a given purpose? A. B. C. D.

Authorization Authentication Identification Accounting

3. Which of the following tools can you use to assess your network's vulnerability? A. B. C. D.

ISS Ballista SATAN No Answer is Correct

4. Which of the following services should be logged for security purpose? A. B. C. D.

bootp tftp sunrpc No Answer is Correct

5. An attack in which a duplicate MD5 hash to a message or document is known as a A. B. C. D. E.

Hash attack Birthday attack PGP attack All choices are correct No choice is correct

6. An attack against an authentication server can be accomplished by A. B. C. D.

brute force attack dictionary attack a server without a failed login attempt counter enabled Teardrop attack

7. Select the types of malicious code from the choices given A. B. C. D. E.

Viruses Trojan Horses Logic Bombs Worms Foxes

8. What is the name of the attack that masquerades as one type of program but has hidden functions? A. B. C. D. E.

Worm Logic Bomb Virus Trojan Horse All are correct choices

9. What is the name of malicious code that does not require a host program and can replicate itself across a network? A. B. C. D. E.

Logic Bomb Trojan Horse Virus Worm No choice is correct

10. The type of attack that cannot be detected with any technology is A. B. C. D. E.

Robbery Social engineering Trojan Horse Worm DoS attack

Answers 1. A. RBAC Explanation: Ensuring least privilege requires identifying what the user's job is, determining the minimum set of privileges required to perform that job, and restricting the user to a domain with those privileges and nothing more. By denying to subjects transactions that are not necessary for the performance of their duties, those denied privileges couldn't be used to circumvent the organizational security policy. Although the concept of least privilege currently exists within the context of the TCSEC, requirements restrict those privileges of the system administrator. Through the use of RBAC (role based access control), enforced minimum privileges for general system users can be easily achieved. 1.1.1 MAC/DAC/RBAC 2. A. Authorization Explanation: Authentication and identification are both related to determining who a user is. Typically authentication is performed prior to authorization, since except for cases of authorizing the activities of anonymous users (such as those viewing a web site), the system needs to know who the user is, before it is able to test for what the user is allowed to do. Accounting provides for the logging of system events, user activities, etc. 1.2 Authentication 3. A. ISS B. Ballista C. SATAN Explanation: ISS, Ballista and SATAN are all vulnerability scanning tools. These tools look for the same sorts of system information and system vulnerabilities that crackers look for, when analyzing potential intrusion targets. They are often used during penetration tests, in which technicians attempt to carry out an intrusion on a network or a particular system. 1.4.2 Back Door, 1.5.2 Trojan Horses 4. A. bootp B. tftp C. sunrpc Explanation: Requests for the following services should be logged on all systems: systat, bootp, tftp, sunrpc, snmp, snmp-trap, nfs. This list is rather UNIX-centric, nevertheless, it's possible for many of those services to be running on Windows as well (if you're running them, log them!). Auditing

5. D. All choices are correct Explanation: This refers to the math paradox that as few as 23 or more people are gathered in a room, there are better than even odds that some pair of them will share a common birthday. MD5 attacks appear most often in searches. Birthday Attack 6. A. brute force attack B. dictionary attack C. a server without a failed login attempt counter enabled Explanation: Password guessing is easily accomplished with software programs (Asmodeus or L0phtCrack) designed for this exploit. The two common approaches are brute force and dictionary. 1.4.11 Password Guessing 1.4.11.1 Brute Force Dictionary 7. A. Viruses B. Trojan Horses C. Logic Bombs D. Worms Explanation: Viruses, Trojan Horses, Logic Bombs and Worms are all forms of malicious code. Keep in mind that each of these terms has a specific sub-domain in the Security+ objectives. Malicious Code 8. D. Trojan Horse Explanation: Trojan horses are difficult to detect with IDS. They can be used for DDoS attacks. Sub Seven is a popular Trojan horse. A trojan horse tricks the user into installing the program when they think it is something else. A worm is a virus which can replicate across the network. A logic bomb is a program with additional features that trigger at a certain point in the future. A virus is a program which can replicate itself on a system, and is spread by something the user does, such as emailing a file or giving a coworker a disk. Viruses Trojan Horses

Logic Bombs Worms 9. D. Worm Explanation: Unlike viruses and Trojan horses, a worm does not need a host. The most famous worms are the Morris worm and Code Red A logic bomb is a program which triggers at some point in the future. A Trojan Horse is a program which piggybacks on a legitimate (or seemingly legitimate) program. A virus is a program which replicates within a system. Worms 10. B. Social engineering Explanation: Since social engineering is an attack on human nature against an authorized user it is not possible to detect with technology. 1.6 Social Engineering

Chapter 0010: Domain 2.0: Communication Security (20%) "The essence of knowledge is, having it, to apply it; not having it, to confess your ignorance." —Confucius

Getting Ready—Questions 1. _________is the protocol used for carrying authentication, authorization, and configuration information between a Network Access Server and a shared Authentication Server. 2. The __________ protocol transmits your logon credentials transmitted as cleat text. 3. To protect an organizational directory from unauthorized changes you effect changes you would select ___ or ___. 4. A Blind FTP server does not _______________. 5. WEP can be compromised by________.

Answers 1. _RADIUS_ is the protocol used for carrying authentication, authorization, and configuration information between a Network Access Server and a shared Authentication Server. RADIUS is a protocol for carrying authentication, authorization, and configuration information between a Network Access Server, which desires to authenticate its links and a shared Authentication Server. RADIUS uses a centralized database for simplified management. RADIUS is a standard published in RFC2138. 2. The PAP protocol transmits your logon credentials transmitted as cleat text. PAP - Short for Password Authentication Protocol, the most basic form of authentication, in which a user's name and password are transmitted over a network and compared to a table of namepassword pairs. Typically, the passwords stored in the table are encrypted. The Basic Authentication feature built into the HTTP protocol uses PAP. The main weakness of PAP is that both the username

and password are transmitted "in the clear" -- that is, in an unencrypted form. Contrast with CHAP, which uses challenges rather than cleartext password transmissions. 3. To protect an organizational directory from unauthorized changes you effect changes you would select SSL or TLS. Directory changes need to be protected from unauthorized changes. Use SSL or TLS to make changes to any LDAP type directory. 4. A Blind FTP server does not reveal directory or content data A blind FTP requires that a user know both the directory required and the filename(s). It can be set up in the UNIX environment with directory permissions set to 333 (write and execute for owner/group/world). 5. WEP can be compromised by Airsnort. "AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered." -- AirSnort home page

2.0 Communication Security Communication security involves the security of data and administrative information that is traveling on public and private networks. It is generally concerned with the privacy (can unauthorized users read it?) and integrity (can it be changed undetectably before it reaches its destination) of network traffic.

2.1 Remote Access Remote access involves giving users outside the bounds of your physical network (i.e. “remote users”), access to network resources, usually, by permitting them to join the network as an actual node. A special case of remote access is the Remote Access Service (RAS), provided by Windows, which allows a server connected to one or more modems to be used as a network access point by dial-in users. Communication security concerns are generally addressed by use of standardized authentication and authorization mechanisms (such as RADIUS, TACACS+ or a VPN’s proprietary user authentication/authorization scheme), and by encryption of traffic on the wire as protection against snooping and modification of data.

2.1.1 802.1X The IEEE 802.1X standard is a relatively recent protocol enhancement that creates a standard for how authentication is performed over an 802 standards-based network. It improves scalability and security of wireless LAN authentication, and allows for the use of multiple authentication mechanisms as needed.

Why is 802.1X needed? With a typical wired Ethernet LAN, the moment your station is added to the network, you have access to the wire. You may or may not be able to do much on the network if you don’t authenticate yourself to your organization’s domain controller, but you can usually sniff the raw packets that are reaching your network adapter. With a typical dial-up networking

connection, the situation is different, because PPP requires that you authenticate yourself to a server before you can connect via the network. You have to provide a user ID and password (or other authentication) to the network you’re dialing into, before you’re allowed access to the network. No password = no packets. Wireless networking follows the wired networking model above, rather than the dial-up networking model. If you have physical access to a connection (which in the wireless case means a wireless networking card that can communicate using the same technology as a particular wireless network access point), you can access its raw packets. In the 802.11b case, an attacker can parlay their ability to “sniff” packets from a wireless network, into the ability to connect to it, because it is possible to break the weak encryption typically used on 802.11b if you obtain a large enough sample of packets. This will be discussed in more detail, in section 2.6. The flaws in the attempts at communication privacy in 802.11b make additional layers of security valuable. Another reason to want to authenticate wireless users before allowing them to connect to your network is that you might always want to be able to identify who’s on a particular network connection. In the wired world, that tends to be easy to do, because physical connections tend to be assigned to individual offices and work areas. In contrast, multiple users can connect to a given wireless access point, just by walking up to the area in which it is located, carrying a machine with a compatible network adapter. They might perform a network action that identifies them, like logging in to a network to reach a data file stored on a file server. But then again, they might opt to just surf the Internet anonymously.

What is 802.1X? These issues open the door for the additional security features provided by 802.1X[1], which uses a specific form of the Extensible Authentication Protocol (EAP), called EAP Over LANs (EAPOL). EAP, as described in RFC 2284[2], provides an extensible authentication mechanism for use over PPP, allowing new authentication mechanisms (biometrics, smart cards, etc.) to be “plugged in” without the PPP protocol needing to understand them. EAPOL is an adaptation of EAP. It allows authentication information to be passed in network frames, rather than requiring that it be embedded in a higher-level protocol such PPP. This reduces network overhead for authentication, and removes the necessity to for the network to be running particular protocol suite such as TCP/IP. How does it work? The potential network client passes authentication information through a wireless access point to a centralized authentication server, who validates the logon and permits certain network activities based on the identity of the client. For instance, the authentication server may install a certain set of firewall security rules or a specific VPN configuration for that client’s address, based on user identity. Until a user is authenticated, the wireless network will only forward 802.1X traffic for that connection. Nothing else, such as attempts to browse the web, send mail, or obtain a local IP address via DHCP, will be permitted.

Figure 13: User requests login and receives a request to present “ID”. The request is passed to an authentication server which verifies the user and sends the OK to the access point which allows the user to log on. Optionally, 802.1X can also be used to return encryption keys to users, allowing the network to dynamically vary the encryption used by each connection, rather than requiring that all stations be pre-configured with a fixed key (currently a time-consuming activity). As we’ll see later when we discuss WEP encryption over 802.11 in section 2.6, this improves the privacy level of wireless communications. Success Owl!

802.1X 802.1X provides for an extensible authentication mechanism over physical media such as FDDI or wireless LANs. It can be used to improve the privacy of wireless LAN communication by dynamically varying the keys used to encrypt the wireless traffic.

802.1X is only the framework allowing EAP transactions to be passed on the media. It is not EAP itself. To get authentication functionality, you must choose a particular flavor of EAP, and install it on your authentication server. Here’s a listing of the choices: • • • •

Transport Layer Security (EAP-TLS) EAP Tunneled Transport Layer Security (EAP-TTLS) Built into XP, Win CE 4.0 RADIUS (FRC 2138,2139) LEAP[3], by Cisco

You can change the flavor of EAP that you use at any time, without needing to replace 802.1X-compliant access points, because the exact mechanics of EAP are transparent to the access points. Future Owl!

802.1X Currently, 802.1X authentication is outside the scope of 802.11-based wireless LANs. However, it is not expected to remain so. The 802.11i committee is specifying the use of 802.1X in combination with 802.11. Many vendors have already included support for 802.1X in their products, including enterprise application products and Microsoft Windows XP.

802.1X is not without its issues, though. For example, while great care is taken to authenticate the client, access points themselves aren’t subject to such scrutiny. So, theoretically, someone could pose as an access point and stage a man-in-the-middle type of attack. Additionally, while it can be used to improve the security of WEP by permitting more frequent key changes, it doesn’t provide any additional layers of encryption. Additionally, EAPOL itself

has proven to be susceptible to Denial of Service attacks, because attackers can spoof EAPOL logoff frames, logging a legitimate user off an access point, and then deluge the access point with EAPOL start frames so that no one else can access it. Future Owl!

WPA Wireless Protected Access[4] (WPA) support has been supported by a number of manufactures and is designed to replace WEP on existing equipment with software and firmware updates. Mandatory in equipment sold after July 2003. WPA uses mutual authentication and is forward compatible to the upcoming 802.11i security standard expected to be ratified in September 2003.

Figure 14: Currently a Rogue Access Point is very dangerous because it can be behind the firewall and go unnoticed.

2.1.2 VPN VPNs, or Virtual Private Networks, are secure “virtual” networks built atop physically connected networks. Generally, the physically connected network over which a VPN is implemented is a public network—that is, one that is generally accessible and has less security than the organization implementing the VPN desires. It is also possible for an organization to implement a VPN over a private network to provide an additional level of confidentiality for its most sensitive communications, to ensure that information cannot be gained by sniffing the internal LAN. Each node participating in a VPN is (or is connected to) an endpoint that knows how to wrap the virtual network’s traffic (which can be TCP/IP, Netware’s IPX/SPX, AppleTalk, etc.) in packets understood by the public network carrying its traffic (usually TCP/IP), and then, unwrap the packets upon receipt by the destination network or host. This wrapping/unwrapping process is known as tunneling, since it takes what is normally a data link layer protocol such as IP, and wraps it within a “tunnel” of an outer protocol instead of placing it directly on the wire. Tunneling may be accomplished by a special hardware box that

speaks the VPN’s protocol, or, by client software installed on computers that are individual nodes. VPN’s usually perform user authentication (by means of certificates, user/password, etc.), and traffic encryption to create a private network. VPN protocols providing these features include PPTP, L2TP, SSH and IPSec, all of which are discussed later in this section. For more information, see the VPN topic in section 3.1.8 later in this book. Success Owl!

VPN Protocols Common VPN protocols include: PPTP, L2TP, SSH and IPSec.

Figure 15: A “session within a session” can create a secure connection over a public network

2.1.3 RADIUS Remote Authentication Dial In User Service, or RADIUS, is the de-facto standard client/server protocol that authenticates and authorizes users connecting to a network, to access the network’s resources, utilizing a centralized database. If you use a dial-up ISP, it’s highly likely that RADIUS is used to validate your logon information when you connect. You can think of it as protecting the “radius” of a network by not letting in those who are unauthorized to be there. Its client/server architecture allows centralized administration of a user database, even if users’ locations may span an entire organization, town, state, country, etc. Being the de-facto standard, as specified in RFC 2865, the RADIUS protocol is supported by just about every device out there, new and legacy. In general, the way RADIUS based authentication works is: • •

A user dials in (via modem, DSL, etc.) as a client to a remote access server, and provides credentials (user/password) in response to the remote access server’s request The remote access server (itself a client to a RADIUS server) communicates the credentials to the RADIUS server, after encrypting it by computing an MD5 hash (see

•

•

chapter 4) of it using a “secret” shared between client and server (this is an example of one way in which credentials are communicated) The RADIUS server uses a user/password database or perhaps integration with a network-based authentication system like Windows passwords or LDAP to validate the password, and returns the results to the remote access server The remote access server then accepts or denies the connection

More info on how RADIUS works can be found in the footnote[5]. It is regarded by many as providing more security during remote access user authentication than its main competitors, LDAP and TACACS+.[6] Success Owl!

RADIUS RADIUS is a client/server protocol that authenticates users connecting to a network, usually by consulting a centralized database of users. RADIUS is a widely supported and popular authentication protocol, which many users consider providing better authentication security than its main alternatives, TACACS+ and unencrypted LDAP alone.

Figure 16: Security Databases are centralized in RADIUS Geek Owl! RADIUS Performance Recent scalability and performance advancements have included “Distributed RADIUS” in which multiple tiers of RADIUS servers are connected together and “forward authentication” in which requests goes up the RADIUS server tree via a proxy RADIUS protocol.

2.1.4 TACACS/XTACACS/TACACS+ TACACS is the Terminal Access Controller Access Control System, another client/server user authentication protocol similar to RADIUS, which works similarly to RADIUS. For authentication, it allows use of user/password information, Kerberos-style authentication that does not require keys being passed over the wire, or even dynamic password systems in which smart cards are used to generate one-time passwords.

Over the years, three generations of TACACS have been developed: • • •

TACACS, the original, which performs authentication and authorization. XTACACS, or Extended TACACS, which separates the tasks of authentication, authorization and accounting/logging. TACACS+, developed by Cisco, which builds on XTACACS by adding a two-factor user authentication (proving that a user is who they say they are through both something they know, like a password, and something they have, like a smart card), system and encrypting all client/server communication.

TACACS+ has some security vulnerabilities that may concern you if end-users have access to the network over which TACACS+ traffic travels: •

• •

• • •

Since accounting information is sent in clear text, and, the only verification performed is that the received accounting record packet length = the length that was sent, someone could intercept the communication and alter it or inject spurious accounting records. Encryption is potentially vulnerable due to the small size of the session id key used for encryption. Lengths of user passwords can be determined by watching traffic, because, the protocol provides for sending a password only as long as there are characters in the password. Theoretical issues with MD5 hashes (see section 1.4.10 on Birthday attacks, and chapter 4 on cryptography) A handful of overflow/resource hogging vulnerabilities in some popular implementations of the protocol, which can lead to denial of service[7] TACACS+ uses a Kerberos-style authentication mechanism that doesn’t require keys to be sent over the wire, but potentially leaves it vulnerable to similar exploits as Kerberos Success Owl!

TACACS+ Issue A security vulnerability with TACACS+ is accounting information is sent in clear text, and the only verification performed on received data is a check that the packet length did not change during transmission. This means that someone could alter accounting records without detection.

2.1.5 L2TP/PPTP L2TP (Layer 2 Tunneling Protocol) and PPTP (Point to Point Tunneling Protocol) are both Layer 2 tunneling technologies that implement a secure communication channel over an insecure connection.

PPTP PPTP is probably the most popular tunneling protocol today. A consortium inclusive of Microsoft, Ascend Communications, US Robotics and ECI Telematics developed it. Over the years it has gained prominence because of its use for remote access in Microsoft-based network environments. It implements tunneling over a PPP (usually dial-up) connection.

Typically users choose the VPN endpoint to which they are connecting after the PPP connection negotiation has completed, a situation that is known as voluntary tunneling. Microsoft’s PPTP implementation uses its RAS “shared-secret” encryption process with an RSA RC4 cipher based on a 40 or 128-bit session key. In the Microsoft implementation, the shared secret is the user password. In other implementations, the shared secret might be a public key (see PKI, later in this work).[9] PPTP typically lets you use any authentication mechanism, including PAP and CHAP, but if you want to use an encrypted tunnel, it requires that you use the more secure MSCHAP authentication mechanism. PPTP uses TCP port 1723 for communication with the destination host[10], so if, you are passing PPTP communication through a firewall make sure that that port is open. Because Microsoft made PPTP widely available with relatively simple installation, it is a popular choice. Earlier versions of Microsoft PPTP had significant vulnerabilities[11], and while their update of PPTP fixed most issues, it is judged to be still susceptible to password attacks.[12] Therefore, from a security standpoint, IPSec, discussed in section 2.1.7, is preferred. Success Owl!

PPTP PPTP is usually used to implement security over a PPP connection. It is a popular choice because it’s available in Microsoft Windows and relatively simple to implement. PPTP uses TCP port 1723. The Microsoft implementation of PPTP uses the RAS shared secret encryption process, using the RSA RC4 encryption algorithm and a 40-bit or 128-bit key. It supports PAP, CHAP and MS-CHAP authentication, but requires that you use MS-CHAP if you want to use an encrypted tunnel.

TCP/IP Background Information Now that we’re discussing encapsulation protocols, it’s worth taking a peek under the covers of TCP/IP and look at a concept you might not have encountered yet if your day-to-day tasks have mainly involved maintaining an existing TCP/IP-based LAN. IP is the base protocol on which all other protocols, including TCP and UDP are layered. One of the fields in the IP frame is an identifier for “protocol number”, which may be 1 (ICMP, including “ping”), 6 (TCP), 17 (UDP), or any one of numerous other values. The official list of protocol numbers is maintained by IANA, the Internet Assigned Numbers Authority.[13] The protocols we usually consider the base of TCP/IP, such as TCP and UDP, aren’t the only ones out there. There are additional protocol numbers for different routing and encapsulation protocols as well. For example, PPTP uses IP protocol 47 (GRE, General Routing Encapsulation). This is important to know, because when thinking about ports to open on routers and firewalls, to allow traffic to pass through, you might also need to think about opening the required IP protocol numbers as well. For that matter, if you’re really

unlucky, your site might have an older router or firewall that doesn’t support certain newer IP protocol numbers, and thus won’t allow them to pass through at all.

L2TP L2TP was intended as a replacement for PPTP by Cisco because they didn't care for some (rather lack of) features in PPTP. L2TP combines the best features from PPTP and Cisco’s L2F protocol, which was designed to facilitate tunneling over a variety of media/lower-level protocols such as frame relay and ATM, in addition to the IP-based tunneling supported by PPTP. L2TP supports PAP, CHAP, MS-CHAP and other authentication protocols. As opposed to PPTP, whose client access is normally implemented by software running on individual desktops, L2TP clients most commonly connect into their VPN by going through a special hardware device that handles the L2TP tunneling. While Windows 2000 is quite capable of supporting L2TP natively many firms don't want to consume the server resources with L2TP Additionally, with L2TP, the server side generally chooses the endpoint of the communication, a situation that is known as compulsory tunneling (in contrast to PPTP, where the endpoint is normally left up to the client). This scenario lends itself to the construction of hierarchically routed networks which gradually concentrate VPN traffic over fewer but higher bandwidth lines for more efficient transmission over a long haul.[14] IPSec is the preferred encryption mechanism used in conjunction with L2TP, but sometimes 40 or 56-bit DES may be used as well. L2TP and L2F use UDP port 1701 for communication on the source and destination hosts, so if you are passing L2TP through a firewall, you need to ensure that port is open. Success Owl!

L2TP L2TP was intended as a replacement for PPTP and L2F, combining the best features of both. L2TP supports PAP, CHAP, MS-CHAP and other authentication protocols. L2TP and L2F use UDP port 1701. PPTP, L2F and L2TP are all Layer 2 tunneling protocols.

2.1.6 SSH SSH, or Secure Shell, began as a replacement for traditionally insecure methods of accessing a host. “In the beginning,” there was telnet, the Internet system to Internet system version of a dialup modem terminal program like ProComm. And the geeks connected to other geeks’ systems over an academic Internet via telnet, providing user name and password to authenticate themselves; and, it was good! Then more geeks out on the West Coast at Berkeley said, “If we connect to a certain system all the time, and its administrators trust us, why should we always have to keep typing our passwords in?” By the way, it’s insecure to transmit passwords in

clear-text across the Internet the way telnet does, because anyone who can ‘sniff’ the bits on the network will be able to discover your passwords. “So let’s create another remote terminal access program which optionally uses our user and source host name to automatically authenticate us instead of requiring us to type in our user name and password?” and thus came up with another remote host access method, known as rlogin (or the infamous “Berkeley r- commands”). Alas, both of these mechanisms have flaws—both transmit the password, if used, in clear-text, so that it’s vulnerable to being sniffed. The r- commands have the added flaw of relying on DNS information, which can be spoofed by attackers, for authentication. SSH was developed as an answer to these issues largely replacing telnet, rlogin (and other rcommands such as rexec and rcp, a remote file copy utility), and adding the capability of forwarding secure X Window System connections (X is the underlying GUI used on most UNIX systems). It is implemented on servers through the use of SSH daemon that listens for incoming client connections on TCP port 22 by default. (The SSH daemon can also be configured to use any other unused TCP port, by updating a configuration file.) Someone looked at the technology in SSH, and decided it would make a good low-cost, general-purpose VPN protocol. Today SSH can be used over PPP, to create a VPN at a higher OSI layer, redirecting TCP/IP ports to allow encrypted services, and proxy X Window System traffic. The SSH 1.x protocol permits secure authentication by way of RSA key exchange between client host and server or individual user to server. The client host and user keys are normally 1K in length, and the SSH server key 768 bits. The SSH 2.x protocol, used freely by available clients and servers, avoids the use of the then-patented RSA algorithms, opting instead for the DH and DSA algorithms. SSH supports a wide variety of encryption options, including RC4, 3DES, Blowfish and AES-256, to ensure data integrity and privacy. (Note that all SSH implementations don’t support all possible encryption options. For example, OpenSSH[15] steers clear of patented algorithms.) Automagic port assignment is in draft stage and an RFC should be ready in early 2003. A draft document is available in the footnote[16]. The book Linux System Security[17] by Mann et.al. provides detailed coverage of setting up and troubleshooting authentication with SSH (as well as explanations of many open source security tools for Linux, including firewalls, scanners, log checkers, the open source Tripwire IDS, etc.) Success Owl!

SSH SSH is often used as a replacement for the telnet terminal communication protocol. Unlike telnet, SSH allows for secure authentication (it doesn’t send the user’s password over the wire in clear text) and encrypted communication. SSH uses port 22, the telnet port, by default.

It can also be used as a VPN tunneling protocol. Real World Owl! Open SSH Do you use telnet or rlogin in your organization? If your environment includes one or more UNIX machines, the answer is likely to be yes. If

so, consider deploying OpenSSH (or another SSH package) as a replacement.

2.1.7 IPSEC IPSec, or IP Security, is a set of standard protocols developed by the IETF (Internet Engineering Task Force) that supports the secure exchange of packets at the IP (network) layer. It is the most popular layer 3 tunneling approach for VPN’s. Unlike PPP, it supports only IP—which today is not the drawback it might have been several years ago when fewer organizations’ backbones were IP-based. IPSec is known for being flexible in configuration, with many options for packet authentication and encryption. IPSec uses public key encryption technology. That is, the sending and receiving devices share a public key with the server who has a secret “private” key. (Public key encryption is discussed in more detail in section 4 of this book.) IPSec establishes a Security Association (SA) for each side of a connection between a client and server. The SA includes the parameters needed to communicate over this connection, such as the type of encryption algorithm negotiated as compatible with both sides, a session key and an authentication algorithm (such as SHA1 or MD5). Session keys are negotiated at the startup of the initial connection via Internet Security Associations and Key Management Protocol (ISAKMP), which provides for key exchange and authentication, and uses digital certificates to allow its authentication to scale to the Internet.[18] The ISAKMP/IKE protocol uses UDP port 500 to pass its traffic. When a NAT is involved, it may use port 4500 instead. In addition to this initial SA, a separate SA is created for each protocol (AH or ESP, described below) and connection direction, as needed.[19] Success Owl!

IPSec IPSec, the most popular Layer 3 tunneling protocol, uses public key encryption technology. It establishes an SA (Security Association) for each side of the connection and negotiates session keys via ISAKMP (Internet Security Associations and Key Management Protocol), which uses port 500 to pass its traffic.

IPSec packet types IPSec packet types include the authentication header (AH) for data integrity and the encapsulating security payload (ESP) for data confidentiality and integrity. The authentication header (AH) protocol creates an envelope that provides integrity, data origin identification and protection against replay attacks. It authenticates every packet as a defense against session-stealing attacks. Although the IP header itself is outside the AH header, AH also provides limited verification of it by not allowing changes to the IP header after packet creation (note that this usually precludes the use of AH in NAT environments, which modify packet headers at the point of NAT). AH packets use IP protocol 51.

The encapsulating security payload (ESP) protocol provides the features of AH (except for IP header authentication), plus encryption. It can also be used in a null encryption mode that provides the AH protection against replay attacks and other such attacks, without encryption or IP header authentication. This can allow for achieving some of the benefits of IPSec in a NAT environment that would not ordinarily work well with IPSec. ESP packets use IP protocol 50. Success Owl!

IPSec Types IPSec packet types include: AH, Authentication Header, which provides integrity, data origin identification and replay attack protection. Uses IP protocol 51. ESP, Encapsulating Security Payload, which provides AH features except IP header verification, plus encryption. It can also be used with “null encryption” to protect against replay attacks. Uses IP protocol 50.

Transport and Tunnel Modes of IPSec IPSec supports Transport and Tunnel modes for encryption. The “Transport” mode encrypts only the data portion of the encapsulated packet, while the “Tunnel” mode encrypts both the data and the header portions of the encapsulated packet hiding more information about the underlying communications[20]. A typical transport-mode packet looks like:

Figure 17: A Simplified comparison of IP V4 and IPSec Transport mode. A more detailed drawing would be: IP Header + AH Header + ESP header + TCP/UDP header + payload + IPSec ESP trailer + IPSec ESP Auth The “Tunnel” mode is most commonly used to encapsulate existing IP traffic for communication between hosts on networks connected by IPSec-enabled routers. With

routers doing the IPSec encapsulation, no changes are required to software or drivers on the hosts—the IPSec encryption is effectively transparent. A typical tunnel-mode packet looks like:

Figure 18: A Simplified comparison of IP V4 and IPSec Tunnel mode. A more detailed drawing would be: Transit IP header + IPSec ESP header + original IP header + TCP/UDP header + payload + IPSec ESP trailer + IPSec ESP Auth The flexibility of IPSec provides for connecting multiple sites in secure VLAN using VPN technologies, or a road warrior to connect in transport mode where the road warrior doesn’t have control over a router and the tunneling mode would fail. Because IPSec creates an SA for both sending and receiving, each SA can be a different mode. For a concise, clear explanation of IPSec on Windows 2000 networks, check out Configuring Windows 2000 Server Security.[21] Success Owl!

IPSec Transport or Tunnel IPSec can be used in either transport or tunnel modes. Transport mode encrypts only the data portion of the packet and can be used with non-IPSec-enabled routers, or between a server and a client, so it is useful for allowing road warriors to connect the corporate network via public networks; the use is generally not transparent to client system, due to the need for IPSec to be installed and properly configured on the client Tunnel mode encrypts both data and header, providing more communication privacy; since tunnel mode can be implemented between cooperating IPSec-enabled routers, the use of IPSec in tunnel mode can be transparent to client systems

IPSec and Encryption Specific encryption technologies used by IPSec include:

• • • • •

Diffie-Hellman key exchange between peers on a public network (this is discussed in more detail in chapter 4) Public key cryptography for signing the Diffie-Hellman exchanges to guard against identity-spoofing and man-in-the-middle attacks Standard algorithms such as DES for data encryption Keyed (HMAC[22]) and non-keyed (MD5, SHA) hashing for packet authentication Signed digital certificates used to provide proof of identity[23]. Success Owl!

IPSec and Diffie-Hellman IPSec uses Diffie-Hellman key exchange to communicate key data without requiring the actual keys to travel across the network, and public key cryptography to sign the key exchange transaction packets, to ensure their integrity and origin.

IPSec vs. DoS Attacks Unlike PPTP, IPSec’s TCP control packets are authenticated, so DoS attacks that depend on the use of TCP control messages sent by attackers to which PPTP-based networks are vulnerable do not affect IPSec based networks.

IPSec Interoperability One thing to be aware of when using IPSec is that interoperability among different vendors’ implementations of the protocols is an on-going effort. As more and more standards are finalized, successful interoperability is becoming more the rule than the exception. But this is not always the case, particularly if you are integrating new hardware or software into an existing “IPSec” based network, test the new equipment on your network to make sure that it works well with your existing configuration. IPSec uses TCP port 1293 and UDP port 1293. Success Owl!

IPSec Ports IPSec protocol and port number information, to keep in mind if you are running IPSec across a router boundary: IPSec uses TCP port 1293 and UDP port 1293. ISAKMP uses UDP port 500 (sometimes UDP port 4500 when NAT is used). ESP uses IP protocol number 50 AH uses IP protocol number 51.

2.1.8 Vulnerabilities Vulnerabilities inherent in remote access solutions are mostly related to the ability to “sniff” passwords and data off the wire, perform man-in-the-middle attacks, and spoof user identities. These vulnerabilities are addressed by increasingly sophisticated authentication mechanisms,

which use certificate-based or Challenge-Response technology, rather than requiring plain text or encrypted transmission of authentication data through the use of increasingly complex ciphers. Other issues include a Trojan Horse on a remote machine. In this instance you have created a secure tunnel for the intrusion![24] Success Owl!

IPSec—A secure tunnel for Trojan Horses Remember that VPN’s don’t protect against the Trojan horses. If a Trojan horse is carried in and allowed access to traffic (such as web browsing, file transfer or email), a VPN won’t stop it.

There are also occasional implementation vulnerabilities in the code for devices and software that implement remote access, due to programmer error. These vulnerabilities are often exploited to cause a Denial of Service, by crashing the client or server. As with all other functionality implemented on computer systems, new bugs are being discovered in communication software all the time. Somewhat complicating things is that some communication code is produced as open source and often finds its way into multiple vendors’ implementations of a particular standard protocol. This means that an implementation flaw in a protocol that is used by numerous manufacturers can affect numerous devices sold by numerous vendors. [1]

www.drizzle.com/~aboba/IEEE/11-02-TBDr0-I-Pre-Authentication.doc

[2]

RFC 2284, http://www.ietf.org/rfc/rfc2284.txt

[3]

http://www.cisco.com/global/AT/veranstaltungen_seminare/downloads/files/03_wlan_secur ity.pdf [4]

http://www.wirelessnewsfactor.com/perl/printer/19852/

[5]

http://www.cisco.com/warp/public/707/32.html

[6]

Hill, Joshua, “An Analysis of the RADIUS Authentication Protocol,” http://www.untruth.org/~josh/security/radius/radius-auth.html

[7]

Solar Designer, “An Analysis of the TACACS+ Protocol and its Implementations,” BugTraq mailing list, http://online.securityfocus.com/archive/1/62742 [9]

“Understanding Point-to-Point Tunneling Protocol (PPTP),” Microsoft Corporation, http://msdn.microsoft.com/library/default.asp?url=/library/enus/dnwebtool/html/understanding_pptp.asp [10]

http://msdn.microsoft.com/library/default.asp?url=/library/enus/dnwebtool/html/understand ing_pptp.asp [11]

http://www.counterpane.com/pptp-paper.html

[12]

http://www.counterpane.com/pptp.html

[13]

http://www.iana.org/assignments/protocol-numbers

[14]

“Layer 2 Tunnel Protocol”, Cisco Systems, http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120t/120t1/l2tpt. htm [15]

Open SSH, http://www.openssh.org

[16]

http://www.ietf.org/html.charters/secsh-charter.html

[17]

Mann, Scott, Ellen L. Mitchell, Mitchell Krell, Linux System Security, Prentice-Hall, September, 2002, http://www.nerdbooks.com/item.html?id=0130470112 [18]

“White Paper – IPSecIPSec Executive Summary”, Cisco Systems, http://www.cisco.com/warp/public/cc/so/neso/sqso/eqso/IPSec_wp.htm

[19]

Shinder, Thomas W., Debra Littlejohn Shinder, D. Lynn White, Configuring Windows 2000 Server Security, Syngress, January, 2000, http://www.nerdbooks.com/item.html?id=1928994024. [20]

http://www.howstuffworks.com/vpn3.htm

[21]

Shinder, Thomas W., Debra Littlejohn Shinder, D. Lynn White, Configuring Windows 2000 Server Security, Syngress, January, 2000, http://www.nerdbooks.com/item.html?id=1928994024. [22]

http://www.ietf.org/rfc/rfc2104.txt

[23]

“White Paper – IPSec Executive Summary”, Cisco Systems, http://www.cisco.com/warp/public/cc/so/neso/sqso/eqso/IPSec_wp.htm

[24]

http://www.networkmagazine.com/article/NMG20020603S0004

2.2 Email Email, or electronic mail, involves the transmission of messages over a network. An email system consists of back-end storage for email files, programs that allow users to access stored email files (“read” email), send email, and programs that relay email back and forth among email servers (called “relaying”) and clients. Some email systems use proprietary communication protocols specific to a certain email system, and some use standardized protocols. In the Internet world, the two most common email-related protocols are SMTP (Simple Mail Transport Protocol, via TCP port 25) for sending mail, and POP3 (Post Office Protocol v3, via TCP port 110) used by clients to retrieve incoming email from its storage location on a server. A newer protocol providing a superset of the POP3 functionality allowing access to a hierarchy of mail storage folders is IMAP (Internet Mail Application Protocol, via TCP port 143). Success Owl!

Email Ports

Common email-related protocols include SMTP for sending mail, and POP3 and IMAP for reading mail. SMTP uses TCP port 25. POP3 uses TCP port 110. IMAP uses TCP port 143. Internet email consists of an envelope of headers (of the form Header name: value), each on a separate line, which are interpreted by email servers and email clients, followed by a content area containing the actual message sent. Typical headers include “To:”, “From:”, “MessageID:” (the serial number for the message), “Reply-To:” (if the reply address is different from the sender’s address), “Subject:”, and “Received:” (which is very handy when attempting to trace the source of Spam email, discussed in a later section). A standard used for email content encoding on the Internet, is MIME (or Multipurpose Internet Mail Extensions). Email was originally used solely to transmit text; and, the SMTP protocol used for email transmission was text-based as well. But then a funny thing happened… people realized email would be useful for sending things other than text, such as pictures or even programs. Enterprising techs came up with the idea of encoding binary objects as a series of alphanumeric characters so that they could be sent through email and decoded and viewed/used by the receiver. A number of standards for encoding email content were used over the years, but MIME was the one which took hold because of its flexible approach of using additional headers to specify the type of content included in each binary data segment. These headers are, in turn, interpreted by email client software, which determines which program to use to display or save the object, based on the object’s type. It’s those MIME headers, in conjunction with the settings in your email program, which let your email program know to open faxes with fax-viewer software, Excel documents with Excel, .doc files with Word, .mp3 files with your favorite player, etc.

2.2.1 S/MIME S/MIME, or Secure/MIME, provides sender authentication and message privacy for email. It was developed by RSA Security[25]), and uses standardized formats for message data and digital certifications -- the PKCS #7 data format for messages, and X.509v3 format for digital certificates used for authentication (see chapter 4 for more information). S/MIME is a scalable secure email solution in which the standard hierarchies used in managing X.509v3 digital certificates are used to handle the chores of public key exchange and certificate authentication. For symmetric encryption, S/MIME can use 3DES, DES and RC2 algorithms.[26] One popular package that supports S/MIME is Microsoft Exchange with the Outlook client. Netscape clients also support it—since S/MIME is based on the same PKI as SSL, it has proven straightforward to implement in web browser email clients. Unlike PGP, most implementations are not open-source-based, so implementations have not necessarily been as closely examined for potential security issues that PGP implementations have been. Success Owl!

S/MIME

S/MIME or Secure/MIME provides sender authentication and message privacy for email communications. S/MIME uses X.509v3 digital certificates to perform public key exchange and authentication, without requiring that users manually exchange public key information through other channels.

2.2.2 PGP PGP, or Pretty Good Privacy, provides much the same functionality as S/MIME, but with message data digital certificate formats designed from the ground up, rather than being based on existing standards. PGP uses the Public-Private key encryption method. By implementing PGP without relying on controlled/patented algorithms, so that it could be distributed anywhere without license fees or patent issues, the developers hoped that the idea of using privacy-enhanced email would really catch on. As in S/MIME, 3DES is used for symmetric encryption of message data, and SHA-1 for hashing. Unlike with S/MIME, individual users are responsible for exchanging their public keys with each other and deciding that they trust the public key they received as being proof of the other party’s identity before messages can be sent. Key exchange is usually accomplished via a network of public servers. Success Owl!

PGP PGP provides private, authenticated email communication through the use of public key encryption, as does S/MIME.

Unlike with S/MIME, users are responsible for exchanging public keys with each other and determining that they trust the public keys they receive. Geek Owl! Phil Zimmerman Back in the days when encryption code was considered munitions and eligible for export only under certain circumstances (read: only when the US government possessed the means to easily defeat it), the primary developer of PGP, Phil Zimmerman, got into a bit of legal trouble for exporting PGP code. To show you how obscure some laws related to computer security can be, the same code in printed book form, courtesy of MIT, instead of on floppy or CD was ruled eligible for export (at least for a short time).

2.2.3 Vulnerabilities Data privacy is a major issue in email, as with many other types of network communication. It isn’t enough to ensure that your data is encrypted during transport and storage—rather, you should also ensure it is encrypted with a strong algorithm. See this footnote[27] for a Windows screen saver that attempts to brute-force with S/MIME 40-bit RC2 keys, which are considered a weak encryption mechanism, if your goal is more than casual protection from prying eyes. Sometimes casual protection is enough, but often business requirements demand more security. Your organization would be advised to develop a policy for email security,

specifying to users which levels of encryption, if any, are to be used for which types of communication, how long email is retained, who is permitted access to it, etc.

Message privacy There are privacy concerns about email content during both transmission and storage. Since SMTP is not an encrypted protocol, unless you apply encryption at a higher level through something like S/MIME or PGP, the entire message is transmitted around the Internet in clear text, for all with packet-sniffing software to see (if they care). Also, as Microsoft found out during the anti-trust trial, old email can come back to haunt you in a variety of ways. In Microsoft’s case, internal memos mined from corporate email archives were presented as evidence by both sides. Did it help them or hurt them? It was probably a bit of both. Think about the potential for this when developing your retention policy. There’s no getting around it -- email has a disturbing tendency to hang around for longer than you expect, and to be seen by more people than you expect. Whether it’s an email by a curious user to “BEDLAM DL3”[28], asking what the list (distributed to all of Microsoft.com) was for, personal discussions on a company server that ended up in a temp file seen by a system administrator, an email from one administrator to another about an intrusion that was just detected (which was read by a cracker who then knew to cover his tracks), or messages that should have been sent encrypted that were deleted the next morning by the receiver (but which still sit on backup tapes, protected in the corporate data vault, a year later), the contents just tend to be much less private than you think they are. When in doubt about whether you really “should,” email something or not, just pick up the phone.

Header privacy Another issue with email is that of header privacy. For example, you might want to send multiple users copies of an email message. When you do this, consider your set of recipients and the content of your message—do you want everyone on the list to know the identity of the others who have received the message? You may not. In that case, rather than including all of the names on the “To:” line, consider sending the message “To:” yourself, and “Bcc:” (or blind carbon-copy) everyone else, or use a distribution list—both of these messages will preserve the privacy of other recipients’ identities. Similarly, some SMTP servers log sent and received message header information in a file readable by anyone with access to the server.

Message forgery Another email issue is forgery, or message spoofing, due to the lack of sender authentication in vanilla (as opposed to PGP or S/MIME) email. If you’ve gotten spam, you’ve probably seen forged email. By “forged”, we mean email whose “From:” information along with other possible identifiable information is deliberately incorrect. Email can be forged for a variety of reasons, such as not wanting replies (senders of “make money fast” pleas generally don’t want tens of thousands of replies telling them to bug off, in their personal mailboxes), not wanting their identity to be known (in the case of someone who

wants to communicate anonymously, just to protect their privacy), or wanting to pretend to be someone else (like the virus email which masquerades as an email from Microsoft Security). How do they do it? Sometimes, it’s as simple as changing the “Name” field in their mail program, but leaving the email address as is. (Not very effective, but it is occasionally done, particularly when someone is using a “throwaway” Hotmail or ISP account to send a large volume of junk mail, and doesn’t care how many replies the sending account receives.) At other times, users take advantage of a feature of the SMTP protocol—you can claim to be anyone, without having to prove to the mail server that you are that person, by manually issuing commands to the SMTP server (or using a program designed to issue these commands for you, supplying whatever identifying information you provide it).

Password security Another issue with email-related communication is password security. Many implementations of the POP3 and IMPA3 mail-retrieval protocols still require users to send their user name and password to the mail server in clear text (that is, not encoded, and in a form that can be easily observed by someone monitoring network traffic). Clear text passwords are a bad thing, particularly because they often allow access to resources beyond a POP3 server— like an ISP’s network, a UNIX host, a Windows user account, etc. Microsoft’s answer to this was to create a “Secure Password Authentication” mechanism for POP3 connections to Exchange, which is best described as a version of the NT authentication process with a few enhancements. While it avoids clear text passwords, this “solution” seems to cause other security issues, at least when the Outlook Express client is used for an SPA connection.[29]. One way to get around the issue of sending your password in clear text is to forgo using a POP3 or IMAP3 client and instead use your ISP or email provider’s “web mail” connection to send and receive mail via SSL.

Client-side issues Other email issues are more on the client side than the server side, taking advantage of a bit of social engineering combined with shortcomings in the client program. For example, be warned that some email client programs when encountering an emailed file called something.doc.exe, will ask you if you’d like to open “something.doc” (i.e., only listing the characters after the first period, not the second), and then proceed to gleefully launch a virus contained in the actual “something.doc.exe,” file when you say OK. Refer to 2.3.3.2

Implementation flaws And then, as always, there are implementation flaws. Both Sendmail and Microsoft Exchange are infamous for bugs affecting mail server security. Rather than go through a laundry list of bugs here, we’ll just say that there have been problems in both which could result in an attacker gaining system administrator privileges. See your vendor for details—they’ll have plenty of them. There is no excuse for not watching for security bulletins and keeping key software packages, particularly ones as widely used as those email servers, updated with the vendor’s latest security fixes. If you don’t, your mail server risks “death by script kiddie”.

Still other vulnerabilities involve purely content issues -- undesirable messages sent via email, including Spam and hoaxes—which are discussed in the next section. Success Owl!

Email Security Email security issues include: • •

•

• •

Real World Owl!

Header and data privacy during transmission, logging and storage Lack of sender authentication in protocols for sending mail makes sending spoofed emails (with forged sender information) easy (this is a reason to use S/MIME or PGP) Some mail-related protocols such as POP3 and IMAP still require the user to send user/password information in clear text or with weak encryption, allowing attackers to obtain user passwords Issues in email-related client and server programs Risk for transmission of undesirable content such as viruses

Email in the Real World How does your organization handle email? Do you have an email security policy? How much sensitive information can be gained about your organization by sniffing email packets as they travel around the network? You might want to look into implementing S/MIME or PGP.

2.2.3.1 Spam Spam is a registered trademark of Hormel, a US food company that has been gracious enough to not make a legal issue of its trademark being used for what is officially known as UCE or Unsolicited Commercial Email. (Thank you, Hormel.). UCE begins by 'harvesting' email addresses from web sites and selling millions of them for a fee to offer products or services. Based on my (Tcat) inbox, it appears that the number one purchaser of email addresses is the adult entertainment industry or phony products that offer to either improve my sex life or make me more attractive. I guess with an unusual first name it is difficult to determine if I am male or female, so I get offers to make something bigger for both genders. Home mortgage offers seem to be leading over credit card offers, followed by some phone services. UCE comes in two types of email. They are plain text or HTML based. Plain text is the easiest type of spam to filter out. I use key words to filter them out to a folder to delete en mass. HTML is quite a bit sneakier. Because HTML email can tell a site I opened an email at a certain date and time, the sponsor knows they have a valid email address that they resell at a higher price. It doesn't matter that I deleted it, since the mere opening of the email even in preview mode triggers a validation that the email has been received and read, validating the address. (Tip: Turn off that Outlook “preview pane” to keep Outlook from automatically opening these HTML-based Spam messages. Yes, it’s an inconvenience when viewing desired mail. And more Spam, caused by Outlook reporting a valid address back to a spammer’s web server is quite possibly more of an inconvenience.)

Geek Owl! Spammers Getting Even More Slimly Ed Foster of InfoWorld reported a new twist on getting user to agree to install a virus[30]. Tcat has been a big fan of using a personal firewall to not allow any outbound port 80 traffic with email. While that is pretty effective, some of the spammers are just going deeper as seen here.

Figure 19: Spam1 but wait! It gets worse. My second example is Spam sent attempting to sell Norton Utilities (a Symantec company)

Figure 20: Spam2.bmp now This is a company that is supposed to be selling us protection from such garbage. There are several ways to approach UCE. 1.0 Filter and delete 1.1 Create a set of rules in an email server or client. 1.2 Purchase a commercial program to filter and delete. 1.3 Use a service such as Spam Cop (http://www.spamcop.net)

2.0 Generally speaking DO NOT respond with a message telling them to remove you. This only confirms an email address. Various options are available for “filter and delete”. Most take advantage of the fact that much spam content LOOKS similar. Spam mail tends to use bright colors, capital letters, include phrases like “your account”, “deal of a lifetime”, etc. Spam filters look for these characteristics and isolate incoming email that matches them into a “spam jail” (where you can inspect the messages at your leisure) or deletes them outright. An effective-sounding, different technique is offered by SpamRipper[31]. It keeps track of valid senders, and isolates any email not from a valid sender into a holding area. In the meantime, it sends a reply to the new sender, containing a verification code. If that sender replies with the verification code, then from that point forward, all messages from that sender are considered valid. (Of course, you can also manually add and remove users from the “valid senders” list yourself.) Also Robert Jensen of Mailboxfilter.com has a pretty good looking offering. The company has a 30 day trialware version[32]. If you are not going to follow our advice of #2, be prepared for the time and expense of using whatever state/providence law available to take the fight to the ISP level of the firm that bought in to UCE to have your domain blocked. This is the most costly route in terms of time/money/energy, and (for me) has sometimes been worth it. For starters, DO NOT believe the “From: “address, as it can be spoofed. The best hints as to the email message’s origin are found in the “Received” header which almost always indicates the IP address or domain name of the mail server which was used to send the mail. This brief look at spam reveals it consumes computer & network resources as well as productivity time. Success Owl!

Spam Spam is unsolicited commercial email. It is a point of concern for business because it consumes computer and network resources and staff productivity time.

2.2.3.2 Hoaxes Email can be used as a channel for the distribution of hoaxes, which are bogus stories containing information that sounds credible… and tends to get passed on. The sheer volume of hoaxes is too numerous to even begin to discuss here. A popular example includes some government entity wanting to tax email[33], or the infamous Nigerian email scam[34] in which someone offers to transfer money to you in exchange for using your bank account as a dropbox for a larger sum of money—but instead uses your bank account information to steal from you. How prevalent are these hoaxes? One guy has collected dozens of variants on the Nigerian email scam letter here.[35]

Pop Quiz 0010.00

Pop Quiz 0010.00 Questions 1. On a VPN, traffic is decrypted at ______ ________. 2. Microsoft supports the _______________ and ______standards for use in extranets.

3. ____________is used by an extranet to connect multiple intranets via the Internet. 4. _________ is being seen as an alternative to S/MIME? 5. PGP provides cryptographic routines for_____, ______ and _______ . 6. TACACS+ is an update to TACAS and is backwards compatible. True/False . Answers 1. On a VPN, traffic is decrypted at every endpoint. A virtual private network (VPN) is a secure communications protocol that encrypts traffic between two endpoints. At each endpoint, the traffic is decrypted. Traffic can consist of one-to-one, one-to-many and many-to-many conversations. A typical application for a company would be to place a VPN at a satellite location. All traffic between the location, other satellite locations and corporate headquarters is automatically encrypted. 2. Microsoft supports the PPTP and IPSec standards for use in extranets. Microsoft supports the Point-to-Point Tunneling Protocol (PPTP) and IPSec. 3. Tunneling is used by an extranet to connect multiple intranets via the Internet. 4. PGP/MIME is being seen as an alternative to S/MIME? S/MIME(Secure Multi-Purpose Internet Mail Extensions) is a secure method of sending email that uses the Rivest-Shamir-Adleman encryption system. S/MIME is included in the latest versions of the Web browsers from Microsoft and Netscape and has also been endorsed by other vendors that make messaging products. RSA has proposed S/MIME as a standard to the Internet Engineering Task Force (IETF). An alternative to S/MIME is PGP/MIME, which has also been proposed as a standard. 5. PGP provides cryptographic routines for e-mail, file transfer and file storage. PGP (Pretty Good Privacy) is a software package originally developed by Phil Zimmerman that provides cryptographic routines for e-mail, file transfer, and file storage applications. Zimmerman used existing cryptographic algorithms and protocols and developed a system that can run on multiple platforms. It provides message encryption, digital signatures, data compression, and e-mail compatibility. 6. TACACS+ is an update to TACAS and is backwards compatible. False [25]

http://www.rsasecurity.com

[26]

“S/Mime Frequently Asked Questions”, RSA Security, Inc., http://www.rsasecurity.com/standards/smime/faq.html

[27]

http://www.counterpane.com/smime.html

[28]

Winser, Michael, “Bedlam”, UserLand discussion group archives, http://static.userland.com/userLandDiscussArchive/msg000484.html

[29]

[email protected], “Outlook Express and SPA,” http://www.security.nnov.ru/advisories/oespa.asp

[30]

http://www.infoworld.com/articles/op/xml/02/11/04/021104opgripe.xml

[31]

http://www.spamripper.com

[32]

http://www.mailboxfilter.com/download.html

[33]

http://www.tafkac.org/ulz/emailtax.html

[34]

http://www1.ifccfbi.gov/strategy/nls.asp

[35]

http://www.potifos.com/fraud/

2.3 Web The Web, by virtue of being a widely used Internet service, generates a lot of interesting network traffic. Traffic to and from the web on a daily basis ranges from the boringly mundane (that day’s headlines from a local newspaper’s web site), to the acutely personal (someone’s brokerage account number and password and the list of holdings in that account). As use of the web has grown, so has the list of technologies related to it. We look at a variety of these technologies and their security implications below. As far as the web server itself goes, the web server is responsible for receiving requests from clients and sending back to the client the data that satisfies the request. In many (perhaps most) cases, the client requests a file whose name ends in “.html” or “.htm”, which indicates a static text file stored on the server, then the server reads the file into memory and sends it back to the client. In other cases, the client requests a file ending in “.jsp” or “.asp”, which the server recognizes as being a program it should load and run, and then send the results of running that program back to the client. Standard operating system security techniques such as file access protections, as well as optional web-server-specific add on security techniques like configuration files specifying which directories on the web server are accessible to users, are used to control the data which can be retrieved by the web server and sent down to the client. This will be discussed in more detail in Chapter 3. Before we dive into a discussion of web-related technologies, just be aware that not all web security vulnerabilities are technological. Some take advantage of user naiveté. For example, just as there are email hoaxes, there are also Web hoaxes -- similar to email hoaxes except they are posted at a web site. Some sites are just for fun and actually are real[36], while others are fiction. Remember that anyone can host a web site—and anyone can register a domain name that sounds legitimate Quoting from the web site “The legend grows as it goes”. Hoaxes are “information” that sound credible and are passed on. Web Hoaxes promote fear and reduce productivity. In this section, we look into various technologies used to improve the security of web-based communications, as well as specific vulnerabilities related to the web. We also take a look at instant messaging (IM) communications.

2.3.1 SSL/TLS SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are related secure communication technologies that make use of public key encryption and key exchange, and X.509 certificates, discussed in more detail in Chapter 4. To use SSL and TLS, you need to generate a digital certificate (some platforms offer tools to do this) or obtain one from a certificate authority. Again, see Chapter 4 for more information. Success Owl!

SSL/TLS SSL and TLS use public key encryption and key exchange, and X.509 certificates for communication privacy and user/site identification. In terms of OSI layers, SSL and TLS sit above TCP/IP, but below application protocols such as HTTP or IMAP.

SSL SSL, or Secure Sockets Layer, is a protocol developed by Netscape for securely transmitting confidential information like credit card numbers across the Internet, between a web browser and web server, by means of public key encryption technology. It provides assurance that transmitted data remains private and unmodified, thanks to the encryption of traffic. It also provides a way for the sender to verify the server’s identity and determine that the server, to which the data is sent, is authorized to have the data. This is achieved by allowing the user to view the certificate information for the server (as we’ll detail in Chapter 4, certificates are digital “documents” containing identifying information verified by a trusted third party). In practice, most users never inspect server certificates, but theoretically, it could be done. A key part of an SSL communication session is the SSL handshake, in which the server authenticates itself to the client (see above), the client and server agree on an encryption algorithm and encryption keys to use for the rest of the conversation, and (optionally) the client authenticates itself to the server. SSL typically uses a 9-message handshake process, including an optional cipher selection, but it’s often simplified and described as a 6step handshake: 1. 2. 3. 4.

Client sends hello to server Server sends hello to client Server sends its digital certificate to client Client computes a preliminary secret key, and encrypts it using the server’s public key sent in the server’s certificate, then sends the encrypted secret key to the server 5. The client computes some additional keys and encryption initialization information to be used in the conversation, and sends a “finished” message to the server. 6. The server also computes additional keys and initialization information, and sends a “finished” message to the client

This is illustrated in the diagram below:

Figure 21. Originally SSLv2, as supplied with Netscape browsers, supported only DES encryption, which is considered weak today. SSLv3 adds support for optional encryption algorithm selection, so that an appropriate algorithm could be chosen for each application using SSL. SSL implementations can (but are not required to) support a huge variety of encryption ciphers, from 3DES to RSA, RC2 to DSA, MD5 hashing for message integrity verification (without encryption, if desired), etc.[37] Success Owl!

SSL SSL (Secure Sockets Layer) is a secure communications technology for HTTP (web based) transactions, which optionally uses public-key cryptography to encrypt messages, and X.509 digital certificates to identify the server to which the user sends data. SSL uses a 6-step handshake process to exchange authentication information between server and client, and agree on encryption keys. The two main versions of SSL are: • •

SSLv2, supplied with Netscape browsers, supports only the weak DES encryption algorithm SSLv3 allows for selection of an algorithm from a set of many possible algorithms; it includes support for conventional symmetric encryption algorithms like 3DES, public key algorithms like RSA, and non-encrypting hashing algorithms like MD5 which are used to verify message integrity without the overhead of encryption

Note that SSL is not the same as S-HTTP (Secure HyperText Transfer Protocol), which is designed to send individual messages securely, rather than set up and maintain a secure connection between two computers, as with SSL.

Typically, you will know that a site is using an SSL connection when you see a URL beginning “https:” rather than “http:”. If you want SSL communication to be passed through your firewall, traffic to the destination TCP port 443 should be permitted. Success Owl!

SSL is and needs SSL connections can be identified by URLs beginning with “https:” rather than “http:”. SSL uses TCP port 443.

Because SSL can be processor-intensive (as with any encryption), there are “SSL appliances” which can handle SSL processing on a separate device, so that the web server itself does not have to incur the encryption overhead. A detailed source for information on the history of SSL and TLS, and protocol specifics is Eric Rescorla’s SSL and TLS: Designing and Building Secure Systems.[38]

TLS TLS, or Transport Layer Security, is a transport layer protocol based on SSL and is considered to be a more flexible successor to it. Although TLS isn’t compatible with SSL v3.0, it is very similar, and the TLS protocol does contain provisions for a TLS connection to back down to SSL v3.0 functionality if required. Like SSL, it supports a wide variety of encryption options, and can use digital certificates for authentication. Unlike SSL, it is application-independent, and can be used to provide a secure channel for protocols other than HTTP, such as SMTP. When a connection is made, the TLS Record Protocol first calls the TLS Handshake Protocol, which enables both sides of a communication to authenticate themselves to each other (if desired—this step is currently optional) via X.509 public-key certificates, negotiate an (optional) encryption algorithm supported by both sides, and exchange key information. After that, the TLS Record Protocol uses the agreed upon encryption algorithm for data exchange, and the agreed upon hashing algorithm to ensure that the message was not altered during transport. The OpenSSL Project includes an implementation of TLS in addition to SSL. Implementations of SMTP, IMAP and POP3 have all been layered over TLS. Each of these, because of the encryption and additional authentication by TLS, has been assigned a new port number for incoming communication, so that clients contact one server for unencrypted communication, and another for encrypted communication. If you’re planning to allow connections to any of these through your firewall, be sure that the appropriate destination port number is open. A NetworkWorldFusion article has the scoop (as of 1999) as to what port numbers are used for which services.[39] Success Owl!

TLS TLS (Transport Level Security) is the next generation successor to SSLv3 protocol. It includes similar functionality and cryptography features was designed to be

more flexible than SSLv3, and can be used with application protocols other than HTTP, such as SMTP and IMAP. Much as SSL uses a separate port for HTTP over SSL, there are separate ports for each application protocol run in combination with TLS.

2.3.2 HTTP/S Each page (or URL) you visit on the web is accessed using a particular protocol which is specified prior to the “:” in the URL. Two common protocols are HTTP and HTTPS, with a third being S-HTTP.

HTTP HTTP, used for URL’s beginning with “http:”, is the HyperText Transport Protocol used for unencrypted general communications between web browsers and web servers. It takes care of packaging up page requests, page contents, variables, cookies and the like, and transmitting them between browser and server, or server and browser. HTTP communication occurs by default over TCP port 80, so, you would need to have that port open on your firewall in the direction of the web server (outbound if you just want to let your users surf; inbound if you want Internet users to surf your server).

HTTPS HTTPS, used for URL’s beginning with “https:” is HTTP with SSL encryption and authentication extensions. It performs the same function as HTTP, but does so in a more secure manner and is, thus, better suited for transmission of data requiring confidentiality. As mentioned earlier, it uses port 443 instead of 80.

S-HTTP As noted above, S-HTTP is an alternative to SSL for secure communications between a web browser and web server. It provides similar functionality, but uses different techniques to do so. Because of Netscape’s dominance on the Web, SSL took off as the primary secure HTTP protocol, and URL’s referencing S-HTTP, which start “https:” are rarely seen today. Success Owl!

HTTP HTTP is a protocol used for unencrypted communication between web browsers and web servers. It uses TCP port 80. HTTPS is a protocol used for SSL-encrypted and authenticated communication between web browsers and web servers. It uses TCP port 443.

S-HTTP is a lesser-used protocol for encrypted communication between web browsers and web servers. It does not use SSL, and is rarely used today. Geek Owl! HTTP/HTTPS HTTP and HTTPS used to be purely web browsing protocols, but a funny thing

happened on the way to the future. Network administrators the world over, started blocking firewall ports used for any services they did not feel were absolutely essential in the name of security (a good practice). Then users were sad, because peer-to-peer chat services, instant messaging, CD database lookup programs, and other fun but non-essential utilities that used ports blocked by firewalls stopped working. Then developers deployed fancy applications using technology like Microsoft’s DCOM, and found out that because of the way most network administrators had configured their firewalls, DCOM traffic didn’t get through. But developers everywhere, whowere boxed in by network administrators’ security efforts, eventually realized that almost every site allows port 80 and port 443 traffic through—and that hiding (or tunneling) their application-specific protocols inside HTTP, was a way to get them through the firewall’s port-level blocking. Much like using a VPN tunneled inside a normal TCP/IP connection hides what’s really going on in the virtual network from the tools that manage the physical network, tunneling an application inside another application protocol like HTTP hides the workings of that inner application protocol from utilities and devices which seek to observe or filter it. And thus, began the next chapter in the saga of hackers finding a creative way to accomplish something and security folks scrambling to prevent them from doing it. Today, many firewalls feature content filtering of HTTP traffic so that certain URL’s or URL patterns can be blocked, to prevent these other applications from piggybacking into (or out of) the site via HTTP or HTTPS.

2.3.3 Instant Messaging Following the official Security+ Domains outline from CompTIA, we now take a brief trip, in the middle of web technologies, into Instant Messaging. While it seems to us, to be a separate category on the level of Email, Web or Directory Services, we decided it was best to stay with the official outline. Instant messaging, or IM, is used to converse with others on the Internet in near-realtime, typically on a sentence-by-sentence basis. It is generally a direct peer-to-peer, personto-person communication technology rather than a “conference” technology such as IRC that allows multiple people to contribute to a group discussion shared among all participants. Additional features often provided by an instant messaging service in addition to this include: informing a user when someone in their “favorite users” or “buddy list” logs in or out, the ability to set a descriptive indicator to tell your “buddies” whether you are not to be disturbed, if you are available to take calls, etc., and transferring files in addition to text messages. Several instant messaging standards exist, and there is limited interoperability between them. Prominent instant messaging protocols include those used by ICQ (AOL’s entry in the Instant Messaging sweepstakes) and MSN Messenger. Geek Owl! IM For a time, MSN Messenger played a game of catch-up with AOL/ICQ trying to preserve compatibility between its clients and the protocol used by AOL’s clients. It seemed that new versions of each would be released every few hours,

as Microsoft caught up yet again, and AOL tweaked something to thwart Microsoft’s efforts. Things between them have cooled down since, but AOL is apparently under a government mandate to communicate with other vendors’ IM applications. We’ll see. In the meantime, many IM vendors are backing the SIMPLE (Session Initiation protocol for Instant Messaging and Presence Leveraging Extensions) protocol, an open alternative to the proprietary protocols in primary use today. Among other things, it specifies standards for voice transmission and conferences over the net. IM was originally a personal application, popularized by individual users around the Internet using IM to keep in close contact with friends around the world. Then corporate America realized that this technology had a use within the organization as well, increasing productivity by allowing staff to send short notifications to each other without creating yet another email message or dealing with the all-too-likely voicemail message they’d receive via phone. As a result of this shift, IM vendors have begun to put more emphasis on corporate-friendly capabilities such as conversation logging, confidential messaging, etc. As of late 2001, it is estimated that 180 million business users currently use IM of some sort, and that by late 2003, 70% of businesses will be using IM.[40]

2.3.3.1 Vulnerabilities Issues with IM in the enterprise today are many and varied. Since IM is often peer-to-peer as far as individual users go, there is less control over the activities of IM users than many technology managers would like. Who uses it, when and for what purposes are decisions that are left up to users.

Message Privacy Most IM systems do not natively support encryption, possibly leading to confidential information being transmitted via IM and then sniffed by an attacker. A recent Gartner Group survey[41] states that 58% of corporate security managers feel that their #1 threat is employees’ careless use of personal communications, such as Instant Messaging. Success Owl!

Future Owl!

IM Security A major security issue with Instant Messaging in a corporate environment is that it can be used to disclose confidential information, either through the inhouse user directly sending to another IM user across the Internet, or through someone “sniffing” the in-house network to mine unencrypted instant message communication between employees. Secure IM Much to the disappointment of fellow geeks, Tcat Doesn’t Do IM. The reason is the preceding Success Tip. And in 2003 that may change. AOL has broken its previous promise to support SIMPLE (Session Initiation Protocol for Instant and Presence Leveraging Extensions.) However Yahoo in the 1st quarter of 2003 is set to release an IM that will offer encryption based on SSL, authentication and name/space control through corporate directories, and

integration with auditing and protection tools. Similarly, Microsoft plans to offer a secure IM offering for business next year, as part of Windows .Net Server. Available today are multiple secure IM packages for internal corporate use (which lack interoperability with standards like AIM/ICQ), the Magi Secure IM proxy system which proxies AIM and MSN Messenger between corporate Internet gateways using PKI for authentication and SSL for confidentiality[42], and the Trillian IM client which can send encrypted messages via AIM and ICQ. Given this, along with the current state of speech to text and enough wireless hot spots, 2003 may become the year I feel the technology will be advanced enough to use IM without losing sleep over security.

Malicious Code Other issues include the potential for IM clients to perform file transfers, causing Trojan horses, back doors, viruses[43] and worms[44] to be copied from user to user, particularly if you allow users to connect to external IM users on untrustworthy machines. You can somewhat protect yourself against IM viruses through the use of an IM-specific antivirus program like BitDefender by SOFTWIN, currently available for popular IM platforms like ICQ, MSN Messenger and mIRC.[45] If you’re interested in IM security for different platforms, the Schweitzer book mentioned in the previous footnote has good coverage of the kinds of attacks that have been aimed at users of various IM services.

Unauthorized Use of Internet IM Port blocking may not be effective to prevent connectivity to external IM services. For example, AOL IM will search for ANY open port to pass through, rendering a firewall or proxy server ineffective[46].

Lack of User Authentication Additionally, there’s little in the way of authentication. In most cases, the IM program starts up when the user logs in. If the user walks away, they are still logged into the IM program and anyone can potentially walk up to their PC, click on a buddy within the organization’s accounting department, send a message asking for customer Jane Doe’s credit card number, and order themselves a nice new stereo from their favorite net electronics provider without the accounting clerk’s knowledge that the person who submitted the credit card number request was unauthorized to do it. (After all, in IM today, messages tend to be sent in text rather than by voice, so they lack even the primitive authentication mechanism we have with voice conversations, that of, “Does that voice sound like the person I expect to be talking with?”) As noted above, some solutions have started to address the need for user authentication via PKI, but commonly-available clients have yet to support authentication beyond, “If you know the user ID, and you know the password, you must be that user.”

Lack of Logging and Audit Trails There are also issues with record keeping. For one, users can keep logs of IM conversations, and store them on their personal computers. Depending on the organization’s policies on

keeping logs of written communications in a central place (or not at all, or only for 30 days, or whatever), this could be an issue. Another potential issue is simply the equivalent of “call detail recording” for IM conversations. Some organizations would like a centralized audit trail that lets them know which users within the organization are communicating via IM, and when they’re doing it.

Software Flaws And of course, need I even mention this? There are implementation flaws in just about everything. If a way hasn’t been found yet in your preferred IM client, to allow someone to send you a file to be stored under a pathname of their choosing, to run a command of the attacker’s choosing on your system, or to accomplish some other impolite activity that would generally be regarded as a security threat, just give it time. Monitor your IM vendor’s site for updates, and install them.

2.3.3.2 - 8.3 Naming Conventions Briefly, the term “8.3 naming convention” harkens back to the days of old, when MS-DOS only permitted filenames of the form AAAAAAAA.BBB (that is, up to 8 characters, followed by a period, followed by up to 3 more). Later, Microsoft introduced long file names, but kept in Windows the ability to refer to each file by a short, or 8.3, name. For example, you might see a folder called “Program Files” on a Windows system. Its “8.3 name” is typically “PROGRA~1”. Windows knows how to translate from one name to the other, and will accept either name for that folder, when accessing it. Why? This is done to maintain compatibility with (the now nearly 10 years old) application programs which were written in the old 8.3 days, and only understand file names if they’re in the 8.3 format. The fact that some programs still truncate file names to fit this convention (particularly the suffix, the 3 characters), has occasionally been used by crackers to sneak by an access control rule, getting it to allow access to a file which should not be accessible by having the rule check for access to a file of one name (either the long or 8.3 name), and the actual access occur to the OTHER file, due to a bug in the program’s code. Additionally, Windows files are not limited to containing a single “.” followed by a threeletter extension. A filename like “my.doc.exe” is perfectly legal. And this gives rise to another type of security issue which we covered briefly when discussing email-related vulnerabilities. Some programs start at the beginning of a filename, look for a dot, then take the next three characters as its extension, or file type. Why is this not good from a security standpoint? What if your mail program’s settings allow users to open files of type “doc” but not of type “exe”? Is a file named “my.doc.exe” going to be looked at as a .doc file or an .exe file, by the mail program, when checking to see if the user is allowed to open it? Or if the mail program is set to ask the user whether or not they want to open the file, with the email client ask the user if the file “my.doc.exe”, or just “my.doc”, should be opened? Generally, the only way to know for sure is to test it. More than one Trojan horse has been distributed by not adhering to conventional naming, e.g., watchthisporn.jpg.exe etc.[47] For instance, the infamous ILOVEYOU virus spread by claiming to contain an attachment whose name displayed in Outlook as LOVE-LETTERFOR-YOU.txt.

In reality the attachment that millions of users opened was named LOVE-LETTER-FORYOU.txt.vbs, and when opened, it ran a script that propagated the virus. It’s also made its way onto the Kazaa file-sharing service, disguised as everything from videos to other executables.[48] Success Owl!

8.3 can be 8.3.3.3 The ways that Microsoft Windows and Windows applications sometimes treat filenames can lead to vulnerabilities. For example: Some programs do not display the last three “extension” letters of files. Malicious users can take advantage of this to slip a dangerous file through defenses and encourage users to open a file whose true purpose is hidden The fact that data files can be known by multiple names, a full long name, and a shorter name modified to fit into the old 8.3 naming convention, can enable malicious users to through defenses which may have restricted access to a file under one of its names, but not the other

2.3.3.3 Packet Sniffing As noted earlier, a significant security issue with IM is that packet sniffing enables an attacker to view any unencrypted traffic on the network, including IM traffic. If a user within your organization is using IM to communicate with, say, a supplier or support person across the Internet, it’s possible that customer numbers, system or network passwords, and all manner of other information you’d rather see kept private, is traveling in clear text across the Internet, from your network to the other party’s. Of course, this point of vulnerability has an up side in other situations. A Network based IDS (Intrusion Detection System) can use packet-sniffing to observe an entire network looking for previously discovered attack signatures, and take action to warn administrators and safeguard the network. Success Owl!

Network IDS (NIDS) A Network IDS (NIDS) can use packet sniffing to scan a network for known attack signatures, warning administrators and taking steps to safeguard the network if one is found.

2.3.3.4 Privacy As noted earlier in this section, there are privacy issues with the use of this technology, because most IM systems do not support encryption or authentication. See the comments above on packet sniffing. Further there are legal ramifications that vary based on industry (such as finance or health-related) and geography. Clearly it is impossible to detail all of them here. Check your local resources. Success Owl!

Deputy Dan and IM There may be legal ramifications to the use of IM between your internal

network and the Internet, or between employees within your internal network, due to privacy concerns. Real World Owl! IM in the Real World, Today What Instant Messaging software is used at your organization? Do you use a secure IM package such as Trillian, or do you require that IM conversations travel across a VPN? Does your organization require that records be kept of all written communications, like the brokerage industry, or have strong confidentiality requirements such as in healthrelated industries (HIPAA)?

2.3.4 Vulnerabilities And now, following the numbering of the objectives as furnished by CompTIA, it appears we’re back to discussing vulnerabilities related to the web. Thanks for sticking with us during that brief detour into IM. In addition to the vulnerabilities related to the categories below, which are described within the individual headings, there are various other types of other security issues with the web.

Logging and Privacy The logging that occurs on a web server can compromise user privacy by providing a history of the user’s visits to a site. In addition to recording which IP addresses (which may uniquely identify a particular user) visited, which web page, and the time and date, some browsers provide more information such as the name and version of the browser program used for the access, the user’s email address, and other details. Perhaps more damaging to individual privacy are browser history, “favorites” or “bookmark” lists, and the cache of visited pages maintained on client machines, detailing the most recent pages accessed by that user, and the ones they’re most interested in (favorites). It is, thus, no surprise that utilities are available to clear these sources of information about a user’s browsing habits. Assisting with this logging can be “web bugs”, which are small URL’s (often 1-pixel images) designed for automatic retrieval when a user visits a web page or reads an HTML-based email message. When retrieved, they trigger log entries (as would any URL retrieval). Web bugs can legitimately be used for statistical analysis or may be used to track a specific person. You can find out what web sites use web bugs by installing the free Bugnosis software on Internet Explorer[49]. More information about web bugs is available in the Bugnosis FAQ.[50] Correspondingly, there are also web sites such as http://www.anonymizer.com, http://www.the-cloak.com and http://www.idzap.com, specifically set up to allow users to view the contents of other sites anonymously, without revealing their IP address or other identifying information to the site. Why worry about anonymity on the web? The issue of Identity theft has become enough of an issue that the US Federal Trade Commission has set up a toll-free hot line @ 877-ID-Theft.

Dependence on “Security through Obscurity” Sometimes webmasters opt to protect information on a web server not through actual security measures, but merely by “security through obscurity”. That is, they restrict access to a document by not listing links to it on their web site, and by only providing the exact URL of the document to those they feel are authorized to have access to it. The problem with this is that once someone has that little-known URL, they’re free to pass it on to others, who can then access the document without authorization. Geek Owl! Malformed URL’s Among those who do web site security audits, one of the “tricks of the trade” used to learn more about a web site is to alter known valid URLs in certain ways, to try to come up with additional valid, but not advertised, URLs which can be used to reveal data and program source code. For example, if you know that the web site contains a valid URL, “http://www.mysite.com/shop/ordlist.asp”, you might also check to see if “http://www.mysite.com/backup/shop/ordlist.asp”, “http://www.mysite.com/shop/backup/ordlist.asp” or “http://www.mysite.com/shop/ordlist.asp.old”, in hopes that one of those other URLs will enable them to gain more access to a version of the ordlist.asp file. Real World Owl! Real World Back Doors Does your web site have any old files on it, in “backup”, or “old” directories, or perhaps prior versions of files whose names end in “.old” or “.backup”? Do the permissions on those files or directories allow anyone but authorized administrators to access them? If so, remove the backup copies or ensure that you have set permissions on them so that arbitrary web users cannot access them.

Web Pages that Show Up Everywhere Speaking of web search engines, yet another web-related security issue is similar to the issue of email retention. Once a piece of information is out on the web, it really DOES seem to consciously WANT to be free. Geek Owl! Be Careful What You Post Search engines can also introduce some issues. One of the contributors to this book believes that once Google has picked up a page on one of his websites that's not linked to by his or *any* site on the web, and says he says can prove it via Hitbox tracker amongst other things. Google is a powerful search tool for people looking for stuff they shouldn't have access to! For example, documents get picked up by random surfers and reposted to other sites (with or without the original webmaster’s permission), or a search service like Google snares a copy of it for indexing purposes, kindly, squirreling it away in its cache for searchers’ convenience later. After all, it’s quite an inconvenience to an attacker when he sees the memo about the default password policy for new system accounts, which he found through Google, is no longer on-line at its original site. Google empathizes with the attacker, and provides him a cached copy of the document, as originally indexed, from its own terabytes (petabytes?) of

disk upon request. One of your authors discovered the default password policy for a state government division this way, during an audit. Also, to ensure that no bad site design ever goes unremembered by history, there’s the Internet Archive Wayback Machine[51]. This is a time-based web archiving service that takes snapshots of web pages periodically allowing it to serve as a history of the evolution of web sites throughout the months and years. As with the Google cache, in addition to providing a look at what the site was like at a certain time, it could also provide access to data that the site has since thought to remove from public view.

Software Flaws And finally, all together now: Web servers and browsers, just like other software programs, have implementation flaws that have either been discovered, or will almost certainly eventually be discovered. Keep the server, including the web software server itself AND ALL OTHER HELPER PROGRAMS ON THE WEB SERVER, like Perl, PHP, database interfaces, etc., up-to-date. The same goes for browser software, and its helper programs (“Macromedia Flash, anyone?”) up-to-date. We’ll say more about this in Section 3.5.3, when discussing web server hardening. There are many other aspects of web vulnerability—too many to list here. Check the WWW Security FAQ [52] for additional information on the vulnerabilities discussed in section 2.3.4. The following are specific areas of web vulnerability that you should know about for Security+.

2.3.4.1 Java Script Java Script refers to program code which is transmitted to your PC from a web browser, as part of a web page you’ve requested, and which runs as part of the page after being downloaded to your PC. Success Owl!

Java Script Java Script is human-readable program code that can be included on a web page. When a client PC receives the page, the Java Script code on it runs within the user’s browser.

Java Script can also run on the server side of a web connection, with many of the same vulnerability concerns as CGI, discussed in section 2.3.4.6 … but we’re assuming that this objective refers particularly to client-side Java Script and the data-privacy and data-integrity issues that result on desktops from its use. Java Script got its name from its resemblance to Java program source code, but the two are no more closely related than that. It is frequently used for displaying an animation when the page loads, highlighting buttons as you move the mouse over them, causing menus to expand or contract when you click on various menu items. In addition to being seen on the web, Java Script is also found in many HTML emails, particularly ads and, most particularly, Spam. As noted earlier in our discussion of Spam, the ability of HTML emails to touch web links and execute script code merely by being displayed in Outlook’s preview pane is a security issue.

This is particularly true because, whether you’re talking about Java Script in an HTML email message, or on a web page, it can sometimes be used to do some more “interesting” things. For example, in certain versions of Netscape’s browser, it can be used to retrieve the contents of users’ “bookmark” files (listing web pages they’ve marked as particularly interesting) and send the info to a server. In versions of another browser, it allows harvesting cached cookies from previously visited sites during that surfing session, and sending them (and any information in them, such as full name, address, SSN, financial data, passwords, etc.) to the nefarious server. It can also be used to facilitate a type of attack known as cross-site scripting, in which script code is transferred from a web server to the client via an innocent-looking URL, executed on the client, and used to gather information about the user, redirect them to a bogus web site, or (possibly) even to execute commands on the client’s machine. For more information about cross-site scripting, see The Cross-Site Scripting FAQ.[53] Although some security sites recommend turning off Java Script support entirely (if your browser allows you to do that) in order to avoid future data privacy compromises, this often impairs the functionality of web pages and is not generally a realistic option. Java Script code is written in plain text, and can be viewed by anyone who browses to a web page containing it. This has some security implications from the point of view of intellectual property. Any Java Script code appearing in a web page is effectively open source, available for the taking by anyone who thinks a particular effect is “neat”. I’ve seen the same code in one place on the net, with copyright notice in comments, and in a completely different place, with the same script variable names and everything, sans copyright notice. A specific vulnerability in Java Script was discussed in The Register[54]

2.3.4.2 ActiveX ActiveX is a Microsoft technology for downloading miniature executable programs (generally called ActiveX controls) to client machines and then executing them to enhance the user experience of the web site. Like Java Script and Java applets, ActiveX controls are most often used to provide fancier graphics or enhanced user interface functionality, beyond what is supported by HTML. Unlike Java Script and Java applets, ActiveX controls consist of machine code instructions, and must be specifically compiled for the processor and operating system on which they will run. This means that at this point, and probably the foreseeable future, they’re usually limited to running on Windows/Intel machines (since other processor architectures like Alpha have fallen out of favor with Microsoft). It’s possible to write ActiveX controls that will work with PocketPC devices, but due to the limitations of the PocketPC platform, and the requirement that if you do this, you’d have to have separate pages aimed to Windows/Intel and Pocket PC platforms, ActiveX controls are primarily used on the web only for Windows/Intel machines. ActiveX technology is somewhat similar to Java technology in that both provide a way to automatically download and run programs within the web browser window, but the two differ considerably in terms of their security model. In the Java applet model, any action that might be used for suspicious purposes (such as writing a file to disk or doing other things to interact with the electronic world outside the java applet’s safe run-time “sandbox”) is considered

suspect (and often denied). In the ActiveX model, the programmer can write code to do whatever they please. The emphasis is not so much on prevention (since a control downloaded from any arbitrary web site is free to do whatever it wishes on the user’s computer), as it is on using digital code signing (discussed in 2.3.4.5) to enable a victim of an ActiveX-based attack to determine who was responsible for it and to go after them. Think of this process as a digital signature to verify the origin of the component. This is not necessarily the best model for secure client/server communications in situations where the client has any reason to distrust the server (read: most Internet web browsing). One reason this doesn’t help security much is that there are plenty of things an ActiveX control can do to compromise the security of a client machine (like read data off the user’s system and send it up to a web server), that users typically cannot even detect—what good is accountability, if users never suspect there’s a problem? The other reason is that while digital signing guarantees that someone proved their identity to the some certifying organization, there’s no guaranteeing that the certifying organization was someone other than a random geek in a basement with a signature-generating program on his PC, or that the user will even bother to check to see that the source of the digital signature was a respected site. Real World Owl!

Checking Site Certificates Do you check site certificates when making secure connections, and ActiveX control security information when you surf to a web page that wants to download an ActiveX control? If so, good for you. If not, we figured that.

Because ActiveX controls are distributed to client machines as compiled code which is effectively unreadable by curious users (as opposed to Java Script’s text or Java’s somewhatreversible “byte code”), they provide an additional level of intellectual property security—it’s more difficult for someone to steal your fancy new button lighting effect and adapt it for their own purposes, if they can’t see the code. Success Owl!

Active X ActiveX is a Microsoft technology for creating small executable programs, called ActiveX controls, which are downloaded from web servers and run on client PC’s.

ActiveX uses digital code signing in the form of a digital certificate (usually signed by a trusted authority like VeriSign) to identify the origin of the control. The digital signature identifies the control’s source, so that you know whom to blame if a problem with the control is encountered, but does not guarantee that the functionality of the control is not malicious.

2.3.4.3 Buffer Overflows We discussed buffer overflows earlier in section 1.4.12, on software exploitation. Now we look at this vulnerability in more detail. A buffer overflow is a condition which occurs when a software program tries to copy too much data into too small an area in the computer’s memory (called a buffer), causing the data to fill up that area and proceed to overwrite other areas of memory that follow

the original area. Generally it results from programmers making an incorrect (too small) assumption about how much data is being moved.

How do they work? Computers move data back and forth in memory by means of variables, which are blocks of memory, each of which has a location in memory and a size. If you think of each variable as being a pitcher of a certain size and in a certain location on a table full of pitchers, a buffer overflow might look like a huge pitcher of orange juice being poured into a small one, and the overflow juice, which needs somewhere to go, accidentally seeping over the edge of the small pitcher into the pitcher next to it (the next variable in memory). If the pitcher next door originally held fine Australian red wine, and the overflow replaces, or “overwrites”, any or all of the wine with orange juice, the next person who tries to use that pitcher of wine is going to find an unpleasant surprise. Much the same thing happens with buffer overflows on a computer. The excess data overflows into adjacent areas of memory, overwriting what was there. Since the previous contents of that memory were likely in use before it was overwritten, when the software program next accesses that memory, they’re going to find unexpected contents, which may cause the program to misbehave or even crash. A more severe case of buffer overflow occurs when the excess data overflows not just the part of memory holding the program’s data, but also the part holding the program’s executable code. Program code works like a list of instructions. The computer goes through the list of instructions in order, performing each one on the list, just like you would when assembling a piece of IKEA furniture. If part of that list is overwritten by excess data from a buffer overflow, well, the computer doesn’t know any better, and it will continue to treat what’s there as a list of instructions, and try to follow them. If what’s there is random gobbledygook, the program will probably crash. If its carefully crafted gobbledygook that just happens to look exactly like the program code which would, for example, delete an important system file, it’ll do that too. The art of exploiting a buffer overflow, thus, requires knowledge of how to construct such sequences of instructions in computer machine language, as well as, knowledge of how to get those sequences to be executed.

How are they exploited? A buffer overflow can be exploited directly by a malicious user in a variety of ways. For example, providing a bogus URL that is thousands of characters long to a web server has been known to crash a web server. The URL doesn’t have to be valid. It doesn’t have to point to a real web page location … the trick is just in jamming thousands of unexpected characters of any sort down the throat of the web server. At the end of the thousands of unexpected characters might be a bunch of binary data, which is designed to end up in just the right place in memory, that after the buffer overflow takes place, the computer will see that binary data as instructions, and run them. Success Owl!

Buffer Overflow A buffer overflow occurs when a software program tries to copy too much data into too small an area of computer memory, causing the data to fill up that area and overwrite other areas of memory near it. This may crash the

computer or enable an attacker to execute program code of their choosing on it. Buffer overflow vulnerability can be exploited by providing a very large amount of data in response to a web form. In some situations, the data may include binary data designed to cause the server to execute particular functions when it receives the huge piece of data.

Why do they occur? As we mentioned earlier, this is not a new problem. The first high-profile buffer overflow exploit occurred in 1988, as part of the Morris Worm. It seems like new buffer overflows are being discovered multiple times a week these days—in web servers, database servers, compressor libraries, scripting languages. No code seems really immune to the problem, for multiple reasons: Programmers don’t always write perfect code (why else do you think we keep urging you to stay up-to-date with patches and updates?) Today’s systems are made up of so many layers of program code, often supplied by half a dozen or more different sources, that it’s as difficult to know what’s going on under the hood of a program as it is to know exactly what’s going on under the hood of your car, with the hood down. A programmer might know the code they wrote, but three layers down is another piece of code written by a different company that is called by another part of the program again not written by our hapless programmer, which passes data in a careless way and causes the overflow.

How to avoid them? What to do? If you deploy internally written web applications, do make sure that your programmers are educated as to the pitfalls of buffer overflows in code and how to avoid them, and, of course, stay up-to-date on patches and updates for your web-related software. Some excellent sources on writing secure code are discussed in section 1.4.12; we won’t repeat them here.

2.3.4.4 Cookies A cookie is a piece of information sent from a web server to a web browser, and then (usually) stored by the web browser on the client machine for use at a later time. Geek Owl! Cookies Cookies are a technique developed to personalize content (for instance, by storing information about a user, that can be incorporated into pages from that site in the future) and to make up for a limitation of the web. As originally designed, a web server sat around and handled requests for web pages, without trying to remember who asked for what page last, what data they submitted in that web form asking for their address, etc. Each page request was treated as a separate task, completely unrelated to any tasks (other page requests or web page

form data submissions) that came before it. This type of behavior is referred to as “stateless” because the server does not keep track of the “state” of any of the clients who might have requested web pages from it. Because many web applications need to keep track of where a user has been (and who the user is), the idea of a “magic cookie” was born. The way it works is that the web server passes the browser a “cookie” which may contain data gathered by the web server (such as the user’s email address) or maybe simply a “magic number” understood internally by the web server that identifies which connection (series of transaction) this page request is associated with, and, whenever the browser contacts the web server, it sends back the cookie, thus, identifying itself to the web server. The cookie is often (but not always) stored as a text file on disk. Cookies themselves contain a variety of information, such as the host to which the cookie should be sent, as well as, whatever unique identifying information (or other data) that the web server wants you to furnish whenever you try to contact it. Those who worry about such things might be concerned that a cookie can contain anything on your hard disk should be consoled by the fact that cookies can only contain information that you once provided to the web server that created the cookie. If you didn’t give the web server your social security number, the site can’t store it in a cookie. Success Owl!

Cookies A cookie is a piece of information sent from a web server to a web browser, which is usually stored on the user’s PC for future use. Depending on what information a user has provided to a web server, sensitive data may be in any cookie the web server asks to be stored on that user’s PC. Cookies can only contain information that was provided by the user to the web server.

While sites could store into a cookie information like the user ID, password, credit card numbers, etc. that you provide them, they generally don’t (knowing that it’s not a good practice), and instead opt to not store that information at all, or store it on their own secure servers, using a “magic number” cookie to look it up later, as described above.

Cookies and Privacy A generic problem with cookies is that every time your browser sends a cookie back to a server, it’s giving someone information about you or your browsing habits. In the case of an e-commerce site using the cookie to look up the contents of your shopping cart from the last time you visited the site; this might not be something you mind. In the case of advertisers’ sites using cookies to inform a service like Doubleclick which sites you visit, so that they can construct a more complete profile of your browsing habits, this might be something you mind. To look at it from the other perspective, if you are a webmaster and you are using that sort of tactic to track users’ activities, you’re taking a risk as well –your user base may someday deluge your organization with bad publicity for its privacy infringing techniques.

Although most cookies are of the harmless shopping-cart-pointer variety, there are a number of services out there like Doubleclick that use them to learn more about you. To combat this, browsers offer a number of cookie management security features. For example, you can: • • • •

• •

Delete some or all of your cookies Automatically accept or reject cookies from certain sites of your own choosing Disable all use of cookies by your browser (which leads to frustration, since many sites don’t work right without them) Have your browser warn you when it is about to send a cookie to a server, and give you the option of not sending it (which may, as in the above case, lead to the site not working properly because it insists on receiving a cookie from your browser) Choose to save cookies only for the duration of this web browsing session (as opposed to permanently on disk) Disallow cookies that are to be sent to sites other than the main one you’re browsing (which protects against the kind of cross-site tracking done by Doubleclick and its ilk)

Using cookies for authentication Another issue with cookies is that they are sometimes used to cache authentication information. For example, being able to provide a cookie to a site when requested, might be interpreted as proof that you’re allowed to access the site. If someone copies the cookie from your disk, or captures it by sniffing the network, and then installs it in their Cookie directory on another machine, they’ve managed to gain access to the site without authenticating themselves. Not a problem? What if that cookie contains a session ID that is used by a bank’s web banking application to identify which checking account you’re viewing the balance of right now? (Aahh, thought you might start to care right about now…. ;-) Practically speaking, these issues are becoming less of a concern, as sites use more sophisticated methods to maintain session state, and developers are taking more steps to help minimize the damage done by a compromised cookie, such as tying the cookie to the IP address of the machine for which it was created or including time limits in the cookie which are checked by the server before every use. If too much time has elapsed since the cookie was first created (when the user first logged in, for example), your session is considered expired and you are asked to authenticate yourself to the web server again. Nevertheless, there are still creative ways found occasionally to obtain and then use unauthorized cookies, such as those detailed at http://www.sidesport.com/hijack/ just last year, at prominent sites like Hotmail and Yahoo. Periodically an attacker will brag about finding yet another way to read someone else’s web-based email, the site will be taken down, the bug fixed, and life continues. Geek Owl! Cookie Management Do you know what cookies are on your machine, and what they’re used for? If you’re like many of us, you rely solely on your browser’s cookie management functions. Third party cookie managers provide more functionality, often with more ease-of-use. One highly recommended cookie manager is Cookie Crusher[55], by The Limit Software.

2.3.4.5 Signed Applets Signed applets are those applets whose authenticity and data integrity is guaranteed by their author, whose authenticity is in turn guaranteed by a trusted certifying agency such as VeriSign. While the term “applet” is used mostly in the Java world, then, “signed applet” therefore refers to a signed piece of downloadable Java code. Other types of code, such as ActiveX controls can be signed as well. Success Owl!

Signed Applets Signing an applet enables its authenticity and data integrity to be guaranteed by its author, whose identity is verified for by a trusted third party, called a certificate authority. This process is discussed in more detail in Chapter 4. As noted in our discussion of ActiveX, signing an applet does not protect against malicious code; it just gives you an idea of who to blame when you notice something has gone wrong.

2.3.4.6 CGI CGI stands for “Common Gateway Interface”, and it amounts to a way of executing an external program or “script” by sending to the web server a URL request containing the name of the program to execute, and optionally some data for it. The server then runs the program or script, and sends the output (if any) back to the client, providing dynamic content, in contrast to the “static”, fixed page images displayed when “.html” pages are retrieved. For example, there are CGI programs to display web counters, maintain web site guest books, add entries to web “blogs”, display the time using pictures of the relevant numbers, etc. An example of a URL that invokes a CGI script with no data passed to it, would be http://www.internic.net/cgi-bin/whois . As you can see, it is similar to a traditional “static” URL referencing an HTML page, except that the final path element doesn’t include a “.htm” or “.html” suffix. When you need to send data to the script, the URL gets a bit more complex. An example of a URL that invokes a CGI script, passing data for the script, would be http://www.internic.net/cgi-bin/whois?whois_nic=helenworld.com&type=domain. As you can see, it’s composed of the name of the CGI script, followed by a “?” that tells the web server when the data starts, then pairs of the form “dataitem=value”, separated by “&”. The primary security issue with CGI scripts is that it’s very difficult to get them right. Most system administrators of large UNIX sites can tell at least one horror story about some way a user found to make a UNIX shell script running with root permissions, do something other than what it was originally intended, like perhaps copy any file on the system, regardless of file access permissions set on it. CGI scripts[56] are vulnerable to the same sorts of misdirection issues that affect UNIX shellscripts, and should be written carefully. For further information on how to write more secure CGI scripts, see the WWW Security FAQ[57].

2.3.4.7 SMTP Relay An SMTP relay is an SMTP email server that accepts connections from users, usually in a different location from the server, wishing to send email. It receives the message they wish to send, and then “relays” (sends) that message on to the SMTP server that delivers mail for the recipient’s domain. SMTP uses TCP port 25. Sites wishing to make connections to other SMTP servers (« send mail ») must have outbound access to the SMTP port, and those wishing to receive connections from other SMTP servers (« receive mail ») must have inbound access to their SMTP server enabled. Practically speaking, this means that access to port 25 on your mail server should be provided for both inbound and outbound connections. Success Owl!

SMTP Relay An SMTP relay is an SMTP server that accepts incoming mail from users in a different location, determines where it needs to be sent, then forwards that mail to the SMTP server at the recipient’s domain. SMTP uses TCP port 25. (Why are we repeating these port numbers? Because you Need To Know them for exam success, and we want to ensure that we’ve given you every opportunity to see them .)

Why are SMTP Relays needed? Not everyone has an SMTP server running on his or her local network. If they don’t have a local SMTP server, they would use an SMTP relay to get their outbound mail onto the Internet. Many dial-up Internet users simply use the SMTP relay provided by their ISP. Telecommuting users with dial-up Internet connections may wish to send email via their employer’s SMTP server, so that the email headers show it originated from inside the company. SMTP relays are a fine thing. Without them, Internet users around the world who depend on clients such as Eudora and Outlook express to send mail would never be able to get a message out to the Internet.

What are the security implications? Alas, there’s a down side to SMTP relays, which we hinted at when discussing Email and spam earlier in this section, due to the way SMTP works. Users connect to SMTP servers for the purposes of sending email, and then simply start dumping message data into them, without authenticating themselves to the SMTP server. Connecting to your ISP’s SMTP server is generally the same as connecting to another—after all, everyone uses the same standard protocol to send mail. What, then is to stop a spammer from connecting to ANY ISP’s SMTP server to send mail, as a way of helping obscure their identity? The answer is, very little, at least in the SMTP protocol itself. Although SMTP servers didn’t start out this way, most now provide the administrator with the capability to block connections from anyone except users who are connecting from addresses in the SMTP server’s Internet domain, as a way of prohibiting anyone and everyone from using that SMTP server as a way to dump zillions of spam messages into the Internet. Others

add a requirement that the users authenticate themselves when connecting to the SMTP server. SMTP relays that do not perform this connection domain check and do not require authentication are referred to as “open relays”, and numerous administrators regard them as evil. Some administrators, on a perennial quest to rid their corner of the Internet of junk mail, maintain “black hole lists” of sites whose SMTP servers are open relays, and refuse to accept any email from those domains. This can be a minor nightmare for an administrator of one of the blocked domains who has a user who needs to send email to the other domain, and who has fixed the original open relay issue that landed them on the “black hole list” to begin with. Maintainers of these lists tend to be much more enthusiastic about adding sites to a black hole list, than they are about removing repaired sites from the list. Success Owl!

Open SMTP Relays

SMTP relays that are unprotected, called Open Relays, can be used to send spam. Geek Owl! Spammers and Open Relays Open relays are so abused by spammers, and getting all those responsible for open relays to close them is so difficult, that some ISP’s have tackled the problem closer to the source -- by keeping their users away from any SMTP servers not controlled by the ISP. For instance, Earthlink does not allow users to connect using TCP port 25 (SMT), to machines outside of the Earthlink network. If you are a telecommuter who needs to be able to contact your employer’s SMTP server from home, make sure that the ISP you select allows it. Real World Owl! Closing SMTP Relay Holes Can you contact any of your organization’s email servers from outside your network without authentication? Find out by dialing in to your ISP (not your internal network), set your email client program’s SMTP server address to the IP address of your email server, and try to send some email. If it succeeds, you should investigate (ASAP) how to restrict your server to accepting connections only from hosts on its network. [36]

http://www.cheeseracing.org/

[37]

“Introduction to SSL”, Netscape, http://developer.netscape.com/docs/manuals/security/sslin/contents.htm

[38]

Rescorla, Eric, SSL and TLS: Designing and Building Secure Systems, Addison-Wesley, October, 2000, http://www.nerdbooks.com/item.html?id=0201615983

[39]

Snyder, Joel, “How can TLS increase email security?”, http://www.nwfusion.com/newsletters/gwm/0329gw1.html [40]

“Instant Messaging Overview”, Serverwatch

[41]

http://www.guardent.com/pr2002-06-03-Survey.html

[42]

http://www.endeavors.com/secure_im.html

[43]

http://searchwindowsmanageability.techtarget.com/originalContent/0,289142,sid33_gci830 983,00.html [44]

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci841963,00.html

[45]

Schweitzer, Douglas, Securing the Network from Malicious Code, John Wiley, September, 2002, http://www.nerdbooks.com/item.html?id=0764549588

[46]

http://searchwindowsmanageability.techtarget.com/originalContent/0,289142,sid33_gci830 794,00.html [47]

http://www.examnotes.net/forums/showthread.php?s=&threadid=56952&perpage=10&pag enumber=1 [48]

http://www.theregister.co.uk/content/55/22119.html

[49]

http://www.bugnosis.org/

[50]

“Web Bug FAQ”, http://www.bugnosis.org/faq.html

[51]

http://www.archive.org

[52]

http://www.w3.org/Security/Faq/www-security-faq.html

[53]

“The Cross-Site Scripting FAQ”, http://www.cgisecurity.com/articles/xss-faq.shtml

[54]

http://www.theregister.co.uk/content/55/22949.html

[55]

http://www.thelimitsoft.com

[56]

http://www.phrack.com/show.php?p=49&a=8

[57]

http://www.w3.org/Security/Faq/www-security-faq.html

2.4 Directory A Directory Service is the full-featured electronic version of the white-pages. It allows clients to perform property-based retrieval of information stored in the directory. For example, the directory might store information about users, network services and printers. Types of information about, or “properties of” users that are maintained in the directory might include their name, department, position, telephone extension, and email address—and can include anything else of interest to those who manage the directory (as long as the directory software allows for it). Directories are used for far more than simple information lookup by the curious. For example, they can be used to distribute public-key information (public keys will be discussed in the Chapter 4), locate the “closest” server providing a specific network service like electronic mail, authenticate users and control access to resources. Directory servers can also be set up to

communicate among themselves and exchange information so that they know about information managed by other directory servers.[58] The most common protocol in use today for retrieval of information from directory services is LDAP, discussed below. SSL/TLS is often combined with LDAP to encrypt traffic.

2.4.1 SSL/TLS Secure Sockets Layer (SSL), and its more flexible successor, Transport Layer Security (TLS)[59], described in RFC 2246[60], are popular standards for encryption of Internet communications, which operate just above TCP/IP[61]. They were discussed in general in section 2.3.1. SSL and TLS also have specific application in the area of directory services. Information provided by directory services can include sensitive details about the enterprise and its network configuration—types of data that you wouldn’t want an attacker with a network packet sniffer to have. Therefore, many directory services can make use of encryption when sending data back and forth between directory service client and server. If your directory service supports an encrypted communication path, use it. If you’re using vanilla LDAP, consider moving to LDAP over TLS, which provides such encryption.

2.4.2 LDAP LDAP, the Lightweight Directory Access Protocol, is the most common directory access protocol in use. It implements a tree-structured directory and is a subset of X.500, which was specified in RFC 1487 in 1993. Nobody follows X.500 completely because it is too much of a monster, so in 1995, RFC 1777 defined LDAPv2. LDAP requires TCP port 389 to be open on your firewall in the inbound direction if you want to allow LDAP-based Directory Service traffic between your internal LDAP server and other hosts on the Internet. You would open it in the outbound direction if users behind your firewall needed to make queries of an LDAP server located outside of your network, on the Internet. Most common directory services, such as Microsoft Active Directory (which stores the security policy information for the network and its users, among other things), Novell eDirectory (the service formerly known as NDS), Netscape iPlanet and OpenLDAP (an open-source project) communicate via LDAP. As noted above, one issue with LDAP-based directory services is that queries and responses can be sent across the network in unencrypted form. Success Owl!

LDAP Specifications LDAP (Lightweight Directory Access Protocol) is the most popular directory access protocol. It implements a tree-structured directory and is based on the X.500 standard. LDAP uses TCP port 389. To receive and respond to LDAP queries made from hosts on the Internet, open this port on your firewall, in the inbound

direction. If you are concerned about sensitive information from your directory being captured from your LAN via packet-sniffing, consider running LDAP over SSL/TLS to encrypt the directory service traffic, or using another type of encryption provided by your directory service. In addition to using LDAP for information purposes, you can use it to distribute public key information or as an authentication protocol like RADIUS, TACACS+, Kerberos or NIS. [58]

Greenblatt, Bruce, Internet Directories: How to Build and Manage Applications for LDAP, DNS, and Other Directories, Prentice-Hall, August, 2000, http://www.nerdbooks.com/item.html?id=0139744525 [59]

http://www.kegel.com/ssl

[60]

ftp://ftp.isi.edu/in-notes/rfc2246.txt

[61]

http://developer.netscape.com/docs/manuals/security/sslin/contents.htm

2.5 File Transfer Transferring of files generally speaking should almost always be secured. Plain vanilla FTP (File Transfer Protocol) sends data in clear text. FTP uses port 20 and 21 for data and control on both TCP and UDP[62]. That means account information such as passwords is subject to being read. Additionally, because data is also transmitted without encryption, files being transferred are subject to alteration via a man-in-the-middle attack. These issues are more of a concern in some environments (say, an Internet user logging in to the company’s FTP server across a public net connection) than in others (when FTP is being used over an internal VPN). For those situations in which the plaintext nature of FTP is inappropriate, a potential solution is S/FTP, discussed in the next section. Success Owl!

FTP FTP uses TCP and UDP ports 20 and 21. To accept FTP connections from the Internet, open these ports at your firewall in the inbound direction. To allow users behind your firewall to connect to FTP servers out on the Internet, open them in the outbound direction.

2.5.1 S/FTP S/FTP is Secure FTP. Secure FTP enhances the original FTP protocol by allowing it to run over an encrypted connection provided by SSH or SSL, taking advantage of the authentication and encryption features in those protocols. Two versions of the SSH protocol exist. The now outdated (and unsupported) SSH1[63], and the newer SSH2. A variety of programs exist for SSH2, from commercial offerings to Open SSH[64].

Geek Owl! OpenSSH and a Trojan Horse Note that a Trojan horse was inserted in the Open SSH code distributed between July 30th and August 1, 2002. If you downloaded Open SSH in that time, you are strongly advised to check the web site.

2.5.2 Blind FTP/Anonymous FTP site administrators who want to limit what users can do on their FTP site often use two methods: blind FTP, and anonymous FTP.

Blind FTP One option is to set up a directory to allow only blind FTP access. Blind FTP means that the user cannot see the names of any files in the directory. They can only retrieve a file if they know its full name. If the directory is configured to allow uploads, the user can upload a file to the site, but they and other users cannot see it in the FTP site’s directory once it has been uploaded. Geek Owl! *NIX and Blind FTP In the UNIX world, a blind FTP directory is often created simply by settings the directory’s permissions to –wx-wx-wx (or 333).

Anonymous FTP Anonymous FTP allows you to gain FTP access by using the login “anonymous” and a password usually of the form “[email protected]”. Once logged in as the anonymous user (who is actually not a “real” user on the system in most cases), you have limited privileges sufficient to allow you to transfer files from and sometimes to designated areas. Blind FTP is often combined with Anonymous FTP, so that users who do not have actual accounts on the FTP server can only access files on the server that they specifically know are there. Success Owl!

Blind FTP and Anonymous FTP Blind FTP means that the user cannot see the names of files in the FTP site’s directory. They can only download from the FTP site files whose names they already know, and when they upload a file, it does not appear in the directory. It can be combined with Anonymous FTP that allows users to login to an FTP site without an actual system user ID and password by using the special login “anonymous” and their email address as the password.

2.5.3 File sharing In addition to concerns about data being sniffed across the network, there are also concerns about proprietary data being shared with those not authorized to have it, and with users “borrowing” others’ FTP sites to share files with the rest of the Internet.

For example, you may decide that only certain employees can put files up for FTP on your site, because you want files to be reviewed for sensitive material before they are made available on your site. Similarly, you may wish to limit users’ ability to upload files into only one or two directories, in order to restrict the locations that can be used by random net users looking for a location in which to store their latest Warez for download by their friends around the Internet. Another issue with file sharing is that users may go outside the bounds of FTP, to the world of peer-to-peer (P2P) file sharing services. Since services like Napster, Gnutella and Kazaa is client based, they’re more difficult for the organization to control than a centralized FTP site. What if an employee shares their entire hard drive via Napster and their hard drive includes confidential source code? Similarly, what if P2P users are using up a significant portion of your organization’s bandwidth? It tends to be challenging to prohibit P2P connections through technology alone (as countless schools could tell you, if you asked them). The best defense is an appropriate use policy, backed up with technology to prevent what you can, and catch as much of the rest as possible.

2.5.4 Vulnerabilities We’ve already touched on many file transfer related vulnerabilities, mainly surrounding disclosure of file contents and user/password information. Data can be unwittingly disclosed if files are accidentally made available via FTP, or if you think you’ve put them in a directory accessible only to a certain authorized user, which ends up being accessible by all anonymous users as well. Data can also be disclosed through packet sniffing, described below. Issues in FTP can have interesting consequences, depending on the device with the flawed software, for example, a Cisco PIX firewall[65] was found to have FTP vulnerability. As with BSD TCP/IP code, some FTP server software such as wu-ftpd has really made the rounds of the community. When vulnerability is found in wu-ftpd, it tends to affect a large number of systems. Since FTP includes the ability to send and receive files, many exploits involve creating malicious files on the server, and causing trouble. For example, they could upload a virus that would be run by an unwitting tech support rep, or force a buffer overflow to create a DoS situation or gain unauthorized access[66].

2.5.4.1 Packet Sniffing Since vanilla FTP is clear text, using a packet sniffer to see the data as well as user/password information is relatively easy to do. In 2.5.1 we mentioned performing file transfers over SSL or SSH2. Another version of encrypted FTP uses the freely available BlowFish encryption algorithm (448-bit Encryption and can be found for free in the footnote[67]. Success Owl!

FTP Access

With FTP access, a malicious user can upload a virus, or exploit a web server flaw like a buffer overflow, and cause a Denial of Service to legitimate users, or even gain unauthorized access to the server. Another security vulnerability in FTP is that unless a technology like S/FTP is used, data and user/password information are transferred in clear text form, and can easily be sniffed from the network or even altered during transfer. [62]

http://www.iana.org/assignments/port-numbers

[63]

http://www.ciac.org/ciac/bulletins/l-047.shtml

[64]

//www.openssh.com/

[65]

http://www.cisco.com/warp/public/707/pixftp-pub.shtml

[66]

http://www.wwdsi.com/demo/saint_tutorials/FTP_vulnerabilities.html

[67]

http://www.eftp.org/

2.6 Wireless For the most part, humans have a tendency to not believe something unless they can directly observe it with one of the five senses. Frequently, even when presented with evidence, humans have a way of denying the data. It took the medical society a long time to believe Anton Van Leeuwenhoek when he discovered life that could not be seen without his new invention, the microscope. Similarly radio waves cannot be directly observed without equipment. This fact alone makes data sent by this means a difficult risk to manage. Compound the issue with the realization that radio waves can glide through walls and glass like it wasn’t there and you have the recipe for a security risk that at first seems impossible. Fortunately, radio is not a new technology and its behaviors are well known. Continue on and discover how you can use wireless technology to your benefit and minimize the security risks. Think of throwing a stone into a still pond. At the point of impact, the waves travel outward in a circle decreasing in strength, as it gets larger. If the wave of water does not hit an object, it eventually disappears. If it does hit an object, such as a large stone in the water, the wave action bounces back. Radio waves behave in a quite similar fashion. The difference is since a radio wave is electromagnetic; metal is used.

2.6.1 WTLS The Wireless Application Protocol is another wireless technology that was created for wireless resources with limited capability such as a cellular phone. Among the protocols within WAP is the security layer, Wireless Transport Layer Security (WTLS), which provides privacy, data integrity and authentication for WAP communication. It is an evolution of the TLS/SSL protocols specifically suited for the low-bandwidth, high-latency, less robust, wireless scenario. It uses both conventional symmetric and public key cryptography.

As pointed out by Markku-Juhani Saarinen[68] at the University of Jyvaskyla, Finland the WTLS protocol design limits the effectiveness a Certificate Authority such as VeriSign can have while supporting WTLS. It appears that this research has been taken to heart as seen in the papers available from the wapforum.org[69]. If you visit the site you may notice the group is in the process of quietly renaming itself to the Open Mobile Alliance. Success Owl!

WAP/WTLS WAP (Wireless Application Protocol) is a protocol for communication between low-bandwidth, high-latency wireless devices.

Future Owl!

WTLS (Wireless Transport Layer Security) is the WAP security protocol that provides privacy, data integrity and authentication for WAP communication. Better Wireless Security[70] The Wi-Fi Alliance's specification, called WPA (Wireless Protected Access), includes mechanisms from the emerging 802.11i standard for both data and network access control. For encryption, WPA has TKIP (Temporal Key Integrity Protocol), which uses the same algorithm as WEP but constructs keys in a different way. For access control, WPA will use the IEEE 802.1X protocol, a recently completed standard for controlling entry to both wired and wireless LANs. With WPA, each user will have his or her own encryption key, and that key can be set to change periodically. In enterprises, user authentication will be handled by an authentication, a system that can be expanded to handle more users much more easily than could WEP.

2.6.2 802.11x 802.11 is really a family of wireless speeds and technologies, which CompTIA identifies with the term 802.11x. Be careful not to confuse this with 802.1X, covered in section 2.1.1. The first was plain 802.11 with no letter extension, which was released in 1997 with a data rate of 1 to 2Mbit. Two years later both 802.11a and 802.11b specifications were unveiled. The b version quickly caught on because of reasonable speed (11Mbit) at a price point far lower than 802.11a with a maximum throughput speed of 54Mbit. Later standards include 802.11g. and 802.11i, a security enhancement to 802.11, which incorporates 802.1X authentication and improved encryption 802.11x networks consist of one or more wireless access points (sometimes called “wired access points”), which act as “wireless hubs”, and one or more devices such as laptops or PDA’s with wireless network cards. Optionally, the wireless access points may be connected to a wired network as well. Geek Owl! All Ethernet <> All Ethernet While 802.11 are Ethernet, not all Ethernet is the same. Wired Ethernet uses collision detection, while 802.11 (wireless Ethernet) uses collision avoidance. This behavior difference is subtle but critical. In wired Ethernet (802.2, 802.3) if two data packets attempt to share the wire at the same time, the irresistible force

meets the immovable object and they both die. That forces a resend of each packet (held back by a random time-out on each transmitting unit). With 802.11, each wireless node broadcasts its intention to transmit telling the other nodes to wait their turn. This is great until one node cannot see the wireless signal due to interference. This is called the hidden node problem. The access point solves this by using the old serial protocol Request To Send/Clear To Send (RTS/CTS) and does not grant one of the nodes a CTS after the RTS.

What info do you need to join an 802.11 LAN? The way 802.11b works is that if you possess a couple pieces of information, which are shared among network users, you can access the network. There is generally no individual authentication when gaining access to the network. The two pieces of information required to communicate over an 802.11b LAN are the SSID and, if encryption is enabled, the WEP key. The SSID[71] (Service Set Identifier) is a 32-character identifier that is attached to each packet, identifying the wireless LAN to which the traffic belongs, so that multiple wireless LANs can exist in the same physical area. Much like multiple Windows workgroups can exist on a single physical LAN, and an individual can select the workgroup to join by setting its name in their system configuration, a user can select the 802.11b LAN to participate in by setting the proper SSID. All users who desire to communicate with each other typically set their SSID to the same value. Since the SSID can be “sniffed” from the network via programs that monitor wireless LAN activity, and once known, anyone can set their wireless network adapter’s SSID to the desired value, the SSID really is only a LAN selection feature for user convenience, not an access control feature designed to add security. The second piece of information is the WEP (Wired Equivalent Privacy) key, discussed in the next section. Success Owl!

Wireless Requires To connect to an 802.11b LAN, you must know (or discover) the SSID (Service Set Identifier) and WEP (Wired Success Owl!: Equivalent Privacy) key used on the network.

2.6.3 WEP/WAP

WEP To protect an 802.11b network from unauthorized, use and “snooping”, you can enable packet encryption via WEP. Different cards have different levels of support for WEP. WEP works by using a RC4 encryption scheme, (Refer to encryption for details on RC4) with a key that can be 40, 64 or 128 bits in length. (New models released in the 2nd half of 2002 now offer 256-bit encryption.) The design in 802.11 for RC4 uses a shared key. The access point sends a random number at the registration request. The receiving node assigns the key with a secret key that was pre-shared. The access point checks the results and allows the node to sign on. Data between the devices is encrypted by one of the values listed.

The method described is known as one-way authentication. Stated another way, the access point knows it is from some group of computers that has the pre-shared key and cannot identify a specific computer. Given this, it is possible for a rogue computer to pretend it is an access point. When enabling WEP (Wired Equivalent Privacy) on a network, the encryption key must be the same among all the devices, including the wireless base station providing network connectivity. Another difficulty with WEP is that it is possible to “break” this WEP encryption and gain access to the network. Geek Owl! RC4 Issues Another issue with WEP is RC4 being used in wireless. RC4 was designed for a synchronous stream. The nature of wireless communications is such that the signal can be dropped very easily. The designers address this challenge by changing the key for every packet. This uses up unique keys very rapidly, which forces key reuse. Key reuse breaks a cardinal rule in RC4 design. This is the good part of WEP. The less than stellar news in the design of 802.11b and WEP is the use of RC4 has as part of the logic a number known as an initialization vector or IV that is not encrypted. Too many product offerings start the IV at the number we call 1 then use 2 for the next IV, followed by 3, etc. So, scoop up about 5 million packets of data and you can figure out the WEP pattern. In a large wireless network with heavy usage the combination of keys is used within hours, as proven by research at the University of Maryland[72] and the Berkley campus of the University of California[73]. A single intruder sending an email to a valid email address on the wireless network further reduces security since the intruder knows what the unencrypted message contained, narrowing the search pattern. If an intruder doesn’t want to work hard they simply use the lazy approach and use a program such as Airsnort[74], wepcrack[75] or airtraf[76]. The moral to the story is change keys often. Although theoretically Wired Equivalent Privacy is supposed to be as secure as an actual wired network, the reality is that that isn’t the case. As you can see, the challenge with WEP is that for a variety of reasons, is it cannot withstand the attention of compromising attacks. Because of this, if you are deploying a wireless network, you should strongly using hardware that allows you to control access to the wireless LAN based on MAC address, or consider a tunneling protocol between wireless devices and access points. Still, keep in mind that in most situations, WEP on is better than no WEP. It will stop some potential attackers, and probably slow down others. Even if you assume that your WEP protection will be subverted, the fact that you attempted to employ that protection is one way to demonstrate that you were not negligently making your wireless network available to the world with no protection whatsoever.

Success Owl!

WEP = RC4 Wired Equivalent Privacy (WEP) uses RC4 encryption. The same encryption key must be used among all devices, including the wireless base station providing network connectivity.

Although WEP is theoretically as secure as a wired network, practically speaking, WEP has proven vulnerable to attacks in the real world. Geek Owl! TKIP In the future, 802.11i will include support for TKIP (Temporal Key Integrity Protocol) security you can add to hardware with a firmware upgrade. TKIP is a temporary improvement to WEP security; eventually, it will be replaced by AES just as TKIP is replacing WEP. To read more about it, see http://www.secadministrator.com/Articles/Index.cfm?ArticleID=27064 and the Future Tip Better Wireless Security previously mentioned. Real World Owl! Real World Wireless Does your organization have a wireless network (or two? or more?)? Check to make sure that you’re using the longest WEP key your hardware supports. Also investigate running VPN software over your WLAN connections, to protect your network from unauthorized access.

WAP WAP has two meanings. The first, older, meaning is Wireless Application Protocol. WAP is a newer protocol in the TCP/IP suite. At first look, it appears that existing protocols such as HTTP and TCP fill the need. These protocols were designed with the idea, that a device has continuous connection and can send multiple requests for data. Wireless devices have considerable constrains regarding power, processing and display parameters. Other considerations such as signal fade, long latently times, security and low bandwidth all contributed to the need to release WAP. WAP addresses these issues in creative ways. Instead of uncompressed text strings, data is sent in compressed binary packets. Hyper Text Markup Language (HTML) is replaced with the Wireless Markup Language (WML), based on the Extensible Markup Language (XML) format. This allows data to be optimized for smaller displays found in hand-held devices such as Web enabled Personal Communication System (PCS) phones and Personal Digital Assistants (PDA) such as the Palm Pilot and Hand Spring units. WAP differs from other offerings by using UDP instead of TCP for lower overhead, in combination with the new Wireless Transaction Protocol (WTP) on the transport layer. A feature of WTP is a small session re-establishment protocol that allows a transmission to continue from the drop point without the overhead of the initial session. WAP overcomes the limitations of being UDP based by the WAP Gateway. This service acts as a proxy server between the wireless device and the wired Internet. By eliminating the need for multiple routes, considerable overhead required for TCP is removed. Part of the

functionality of the WAP Gateway is to act as a translator between the connection-oriented TCP protocol and WAP’s connectionless UDP protocol. A second meaning for WAP is Wired Access Point. This is the junction between 802.11 a/b/g wireless data traffic and the wired network. In fact 802.11 uses WAP with the Wireless Markup Language to communicate with the Wired Access Point. In some countries, WAP/Web enabled PDA and PCS devices are very popular. Success Owl!

WAP A WAP is a wired access point, which is the “wireless hub” like device that enables 802.11 a/b/g wireless devices to connect to the organization’s wired network.

2.6.4 Vulnerabilities Think back to the rock in the pond analogy. A larger rock will make stronger waves than a smaller rock. Minimizing transmission power reduces the changes your data will leak out of the intended area. Antenna placement will also have an effect[77]. Real World Owl!

Wireless Configuration As pointed out in the main text body, antennas make a HUGE difference in how your wireless network performs in all aspects. What you may not realize is that authors doing research learn a great deal about how a company performs customer service. A huge tip of the hat goes to Sharon Cantor and Hyperlink Technologies[78], Inc. for kindly supplying photographs of antennas.

Figure 22: Wireless antenna HG2408p looks like a smoke detector! Photograph provided by Hyperlink Technologies © 2002 Used with permission

Figure 23: Wireless antenna HG2409p looks like a interior security sensor. Photograph provided by Hyperlink Technologies © 2002 Used with permission Attempt to place antennas as far from exterior walls as possible. Typically the interface between the wired network and the transceiver is placed in a corner in an effort to hide the electronics. That places the network signal outside and easy to intercept. In effect, you have

put an Ethernet jack for your network in the parking lot. Besides controlling power output and antenna placement and configuration, consider shielding, the next topic.

Shielding issues The building in which the wireless network is operating can be used as a shield for itself, reducing the potential for unauthorized access to the LAN. The downside could be a negative impact on pagers and cellular phones. An additional plus is this reduces your risk of a wireless denial of service attack. Geek Owl! Shared Frequencies Keep in mind that 802.11b operates at the same frequency of a microwave oven. Something as simple as disabling the safety interlock of a consumer microwave oven creates a DoS weapon with up to 1000 watts of 802.11b interference. A more determined black hat may invest in a ‘heavy duty’ antenna, capable of handling up to a 300W[79] input from the inner workings of a microwave antenna. If you are lucky enough to be designing for a new construction, consider metal studs and run a bare copper ground wire from the studs to a grounding rod. Before installing dry wall attach very thin layers of aluminum to the metal studs. More often retrofitting an existing site will be your task. Steps to attenuate the signal include metallic window treatments and metallic paint on wall surfaces. At minimum, use a laptop with a wireless network card attached loaded with the vendor’s software to reveal signal strength and perform both an interior and exterior ‘walk through’. Document the authorized locations. This needs to be done on a regular basis. Wireless LANs can be bought at the store and plugged into a hub by users without the knowledge of the company. Gartner has estimated that at least 20% of companies have rogue Wireless LAN installations[80]. Geek Owl! et tu, Microsoft? The issue of rogue wireless LAN’s is so widespread Microsoft CEO Steve Ballmer recently took advantage of it as told to InfoWorld.[81] "I was in a hotel in Sun Valley last week that was not wired," Ballmer recalls. "So I turned on my PC and XP tells me there is a wireless network available. So I connect to something called Mountaineer. "Well, I don't know what that is, but I VPN into Microsoft. It worked! I don't know whose broadband I used," he chuckles. "I didn't see it in Bill's room. I called him up and said, 'Hey, come over to my room.' So soon everyone is there and connecting to the Internet through my room." Now suppose it wasn’t Microsoft employees using the Mountaineer wireless LAN to tunnel into Microsoft. If this was a group who wished to cause the Redmond firm grief, they could have done so without worrying about covering their tracks since a search would go directly to the owner of Mountaineer. “Oops.”

Unauthorized access As mentioned earlier, unauthorized access to wireless LANs is a significant issue. One thing you can do is use hardware that allows you to specify the MAC addresses of devices allowed to have access to the network. Networks that are large enough to make preenrolling MAC addresses impractical should look at a VPN (How a VPN works is described in Encryption) before the connection to a wireless network. Options such as the Cisco Aironet utilize the Cisco Lightweight Extensible Authentication Protocol (LEAP) to ensure mutual authentication between wireless clients. This includes a back end RADIUS server, dynamic WEP keys, and changes the Initialization Vector (IV) on a per packet basis. Vendors such as Fortresstech offer products such as Airfortress[82] that is placed between the Wired Access Point and the rest of the network. Other vendors have updated drivers for their wireless offerings to improve security on existing products. Not worried enough about unauthorized access by “war-driving”[83] users with Pringles can antennas? Let us tell you about a few more tools used by that crowd. Netstumbler is a free windows-based wireless sniffer that looks for a SSID being broadcast. Note that, as we mentioned earlier, you must have the correct SSID to join a wireless network. Netstumbler is useful for finding the rogue access point that was set up without thinking of the ramifications. Additionally, a Linux based sniffer called Kismet is totally passive and can find a wireless network without revealing itself in the process. It is also able to capture data from signals too weak to fully participate in a wireless LAN. Kismet was created to work hand-in-glove with the free protocol analyzers such as Ethereal[84] for Windows or tcpdump[85] for Linux or Windows. Ethereal does an incredible job in many ways. As an example, check out their site[86] to see how easy it is to see email messages. With so many sites running open wireless networks, it can be difficult for a busy war-driver to remember all the sites they have found. Kismet solves this issue by adding support for GPSDrive[87] to map all the sites found. If you don’t have the time to try all this yourself, the creator of Kismet has done a great job of showing how all this can work together. Just point your browser to the footnote[88].

More 802.11b Lockdown Tips While changing defaults such as the SSID, change the password on access points. Turn off DHCP and assign static addresses, if possible. Make sure hardware has upgradeable firmware. Consider configurations that are “closed”. Some vendors offer non-open options, such as turbo mode, if not, use an access point that does not broadcast an SSID. The coverage on wireless security to this point has been a discussion on locking down the wireless LAN. 802.11b is also used for public access. Some sites are ad hoc, meaning that people who don’t mind sharing a bit of their broadband access run them. One site created to help find these sites is http://www.freeap.com. The other approach is offered by firms such as Boingo[89] Wireless who offers paid subscriptions to ‘hot spots’. Project Rainbow[90] is sure to

make commercial hot spots very commonplace. Since public access is the point, WEP would not be running. Be sure to install a personal firewall[91] before joining a hot spot. If your business can take advantage of any ad hoc or commercial hot spot, remember to access any web page containing internal corporate data via https, instead of http. One final option in the wireless LAN that is worth exploring is 802.11a, seen next.

802.11a One other option (for the moment) is to spend a little more money and install 802.11a. While more expensive, it operates in a different frequency, reducing (for the moment) the available hardware that can be used against you. Another possible advantage is the fact that 802.11a has a much shorter range. Bandwidth of 54Mpbs (up to 75Mbps in some vendors’ unique implementation) is sufficient for real-time video. Encryption in some products goes up to 156bit encryption and the range is considerably shorter in the 5Ghtz spectrum. The same antenna site mentioned above offers 5Ghtz units. In the real world, changes are happening in Internet Time, so keep your eyes and ears tuned in.

2.6.4.1 Site Surveys More sensitive environments may wish to either hire a firm to perform a Technical Surveillance Counter Measures (TSCM) sweep on a periodic basis. Extremely sensitive sites would be wise to consider installing in place monitoring in addition to periodic searches for light based Infra-Red (IR) or cellular phone based unauthorized equipment. [68]

http://www.wapforum.org/what/technical.htm

[69]

http://www.cc.jyu.fi/~mjos/wtls.pdf

[70]

http://www.infoworld.com/articles/hn/xml/02/10/31/021031hnwifi.xml?s=IDGNS

[71]

http://80211-planet.webopedia.com/TERM/S/SSID.html

[72]

http://www.cs.umd.edu/~waa/attack/v3dcmnt.htm William A. Arbaugh University of Maryland

[73]

http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html Nikita Borisov, Ian Goldberg, and David Wagner

[74]

http://sourceforge.net/projects/airsnort

[75]

http://wepcrack.sourceforge.net

[76]

http://www.elixar.net/wireless/download/download.html

[77]

http://www.80211-planet.com/tutorials/article/0,4000,10724_1116311,00.html Article on running a Site survey by Jim Geier

[78]

http://www.hyperlinktech.com

[79]

http://www.hyperlinktech.com/web/hg2415p.html

[80]

http://www.eweek.com/article2/0,3959,7744,00.asp

[81]

http://www.infoworld.com/articles/op/xml/02/07/22/020722opcurve.xml

[82]

http://www.fortresstech.com/AirFortress%20Overview.htm

[83]

http://www.nwfusion.com/columnists/2002/0902schwartau.html

[84]

http://www.ethereal.com

[85]

http://www.tcpdump.org

[86]

http://www.ethereal.com/introduction.html#screens

[87]

http://www.kraftvoll.at/software

[88]

http://www.kismetwireless.net/screenshot.shtml

[89]

http://www.boingo.com

[90]

http://zdnet.com.com/2100-1105-944732.html

[91]

http://www.theguardianangel.com/firewall_comparison.htm

2.7 Summary In this chapter, we looked at the topics in the second domain of the Security+ exam, Communication Security. You discovered key characteristics of remote access technologies designed to give users access to your network without being physically on the LAN, such as: • •

•

•

•

802.1X, which can improve privacy on wired and wireless LANs via a standardized, extensible authentication mechanism called EAP VPN’s, or Virtual Private Networks, which use encryption and a public network such as the Internet to create a secure network between two points or networks; protocols used to create VPN’s include PPTP, L2TP, L2F, SSH and IPSec RADIUS, a popular authentication protocol that centralizes the user database and is often used to validate users dialing in to their ISP; in RADIUS, the dial-in server is a client to the RADIUS server TACACS and TACACS+, which do not interoperate even though they sound the same (TACACS+ also has issues with sending accounting data in clear text, allowing it to be altered undetectably if intercepted) PPTP, a layer 2 tunneling technology available on Microsoft Windows, which uses TCP port 1723, can be used to provide data integrity and encryption for a VPN

• •

•

L2TP, a layer 2 tunneling technology intending to replace PPTP and L2F (an older version of L2TP), which uses UDP port 1701 SSH, the Secure Shell protocol, which started out as a more secure replacement for telnet and evolved into a general purpose tunneling protocol allowing the use of a wide variety of encryption protocols, provides secure authentication and encrypted communication; it uses port 22 by default IPSec, a layer 3 tunneling technology, which is a standard protocol suite for secure IP communication using public-key encryption

You explored the details of IPSec, which uses TCP port 1293 and establishes a Security Association (SA) for each side of the connection, and uses the ISAKMP protocol over UDP port 500 to negotiate session keys for a conversation. IPSec includes AH (Authentication Header, IP protocol 51) and ESP (Encapsulating Security Payload, IP protocol 50) protocols; both allow for packet integrity but only ESP supports packet encryption. You learned about the difference between running IPSec in transport (encrypts only data, can be used with nonIPSec enabled routers and may require software installation on clients) and tunnel (encrypts header and data, generally used from router to router and invisible to clients) modes. You also learned about email security, including common email protocols such as SMTP (using TCP port 25, for sending mail and transferring mail among servers), POP3 (port 110) and IMAP (port 143). You discovered that POP3 and IMAP are used by clients to retrieve their email from servers. You learned about common public key encryption mechanisms for email, such as S/MIME (which uses x.509 digital certificates) and PGP. You learned about email vulnerabilities in the authentication, transmission and storage of message data, as well as in the programs used for email communication. Spam, which consumes corporate resources and staff time, and various ways to corral it were unveiled to you as well as the social engineering issue of email hoaxes. Next, you learned about basic web security, including the SSL and TLS encryption protocols which use X.509 certificates and public key encryption. You discovered that URL’s beginning “https:” use SSL communications over TCP port 443 (the HTTP/S protocol), and that the SSL conversation startup uses a 6-step handshake. SSLv3 improved upon SSLv2 by supporting additional encryption techniques, besides the DES encryption used in SSLv2. It was mentioned that TLS is a general-purpose evolution of the web-oriented SSL protocol, which is not compatible with SSL but can back down to SSLv3 operation if needed, and that implementations of many popular protocols such as LDAP and SMTP have been layered over TLS. S/HTTP (“shttp:”) is an older standard for encryption of web communications which has fallen out of favor as the popularity of SSL increased. You explored the security-related aspects of content such as javascript (which is a humanlyreadable programming language often used to download and run scripts within the user’s browser, generally to display fancy menus or animations) and ActiveX (compiled, nonhumanly readable program code, used for purposes similar to javascript; ActiveX programs use “digital signing” to identify the origin of the downloaded component, but unlike javascript don’t try to isolate the client user’s machine from potential damage by the ActiveX program). Digital signing, used by both ActiveX and java components, lets you be (somewhat) sure of the origin of a component, but does nothing to protect against damage. Once again, we also looked into buffer overflows, which are a common technique for attacking a web server; web server buffer overflows are often exploited by sending huge amounts of data when posting a web form.

Still on the topic of web servers, you discovered the risks inherent in cookies, which are pieces of information sent from the server to be stored on a client machine, often based on information provided by the user to the web server. One issue with cookies is that they often store sensitive information on the client machine, or information which can be used to determine where the user has been on the web (a privacy concern); another is that if a site uses cookies for authentication, an attacker can copy a cookie from one machine to another, to impersonate the user of the original machine. You learned about CGI scripts, which are executable programs that run on a web server, including the fact that it’s difficult to get them right and they can often be exploited by providing unpredictable input. You also looked at Instant Messaging (IM) security issues, such as the risks of transmitting confidential information unencrypted, and lack of authentication of IM users that may allow identity spoofing and disclosure of information to unauthorized people. One issue that may arise whenever files are transferred is the 8.3 character file naming convention, where file names with an 8.3.3 character name like play.txt.exe might use a second extension to fool a program or user into thinking an attachment is one type of file, when it’s really another— allowing a virus to propagate. IM started as a tool for individual users and lacks corporatefriendly features like centralized logging and authorization. IM traffic can be difficult to block, as some popular IM programs simply search for the first open port and use that for their communication. You discovered that open SMTP relays can be used to send spam email, since they allow unauthenticated connections from anyone on the Internet, and that it is a good idea to restrict access to any SMTP server you control to avoid getting a reputation of tolerating spammers. SMTP relays in general are a good thing, because they’re how email gets from one domain to another; but relays that accept connections from untrusted sources are a bad thing. You explored Directory services, which allow a user to look up information about a corporate network and/or its users. You learned that most popular directory services including Microsoft Active Directory and Novell eDirectory use the LDAP protocol (TCP port 389) for directory queries, and that to allow users on the Internet to query your directory server, you would need to open inbound TCP port 389 on your firewall. LDAP is a tree-structured protocol based on the X.500 standard which does not encrypt its communication. Optionally, you can combine LDAP with TLS to encrypt the traffic. LDAP can be used for purely informational purposes as well as distribution of public keys, and may be used as an information source by authentication protocols like RADIUS, TACACS+ and Kerberos. You learned that another area of exposure is file transfer. Usually on the Internet, this is accomplished by FTP, which uses TCP and UDP ports 20 and 21 for its data and control connections. Because FTP, like other early application protocols such as telnet, transmits password information and data in clear text, you are advised to use an alternative program such as S/FTP which offers a secure authentication mechanism and an encrypted channel for data, running over SSH or SSL. To safeguard the files on your FTP server, you might implement “blind FTP” by configuring your FTP server so that users can only retrieve files whose names they know. Usually, FTP server users are required to authenticate themselves and have a user/password on the server. Alternately, you might use anonymous FTP, so that authentication is required.

Since the risk here is that now anyone can access your FTP server, if you use anonymous FTP, you should limit (maybe eliminate) directories to which users have write access, perhaps offering only “blind” access to those directories so that users who don’t know they’re there, can’t use them. Since most FTP servers have experienced high-profile bugs, make sure you update the server software regularly and carefully monitor use of your site to detect problems quickly. File sharing, by using P2P services such as Kazaa or simple Windows File & Printer Sharing (NetBIOS) connections is another area of concern, because such user-controlled services can be used to make confidential information available to unauthorized people, as well as being a waste of bandwidth and source of (possible) pirated data such as music for which the company could become liable. Attackers can use file transfer mechanisms to upload viruses or exploit denial-of-service or buffer overflow vulnerabilities. Wireless security and too frequently the lack of security along with the future efforts have been explained in detail. You learned how Wireless Transport Level Security (WTLS), the security layer within WAP (Wireless Application Protocol) is used to improve wireless network security, providing secure data transmission and authentication. It uses TLS/SSL-like protocols, and symmetric and public-key encryption. In the last major topic area, you discovered key facts about 802.11x networks, such as the need to know the network’s SSID (Service Set Identifier) and if encryption is enabled, the WEP (Wired Equivalent Privacy) Key, in order to connect. Unfortunately, you also learned that those items can be snooped directly off the network or determined by analyzing enough sniffed traffic. If the WEP Key and SSID don’t both match those in use by other network devices, including the wired access point (WAP) connecting wireless devices to the network, communication will not be successful WEP employs RC4 encryption and often uses a weak 40-bit key, although it can also use 64 or 128-bit keys (depending on your equipment). WEP is theoretically as secure as wireless networks, but practically speaking due to encryption issues has proven to be less secure. This will be improved in the future with the use of TKIP (Temporal Key Integrity Protocl), and eventually AES encryption. You learned that a primary vulnerability of wireless LAN’s is access by unauthorized individuals outside your organization, and that in addition to employing a VPN on top of your 802.11 LAN, physical measures such as careful antenna placement and shielding of a building can also be taken to reduce vulnerability to unauthorized access. If your wireless network hardware allows you to lock down access to only devices with certain MAC addresses, use it!

2.8 Success Questions 1. Which of the following is a MUST have for all implementations of IPSec? A. B. C. D.

Security Association Security ID Serial number Version number

2. With IPSEC, in each encrypted session we can find ____________ SA(s). A. A One B. Two

C. Four D. Eight 3. WEP offers A. B. C. D.

In theory, the same security that a wired LAN does Greater protection than a wired LAN Less protection than a wired LAN No choice is correct

4. VPN provide A. Access to a private LAN using a public infrastructure such as the Internet B. Two firms to conduct business, accessing private data areas using a public infrastructure such as the Internet C. All choices are correct D. No choice is correct 5. TACACS+ is an update to TACAS and is backwards compatible. A. True B. False 6. Email can be encrypted with A. B. C. D. E.

PGP S/MIME Symmetric key Public-Private keys SMTP

7. List the vulnerabilities of email A. B. C. D.

Spam Hoaxes IM D SNMP

8. SPAM carries what sort of costs (choose all that apply) A. B. C. D.

Loss of productivity Loss of bandwidth Revenue drain supporting un-wanted traffic Credit card fraud losses

9. SSL and TLS are similar but different, how? A. Both create a secure channel between a client and a server. TLS and SSL interoperate completely.

B. Both create a secure channel between a client and a server. TLS supports older SSL connections. C. Both create a plaintext channel between a client and a server. TLS and SSL interoperate completely. D. C Both create a plaintext channel between a client and a server. TLS supports older SSL connections. E. No choice is correct 10. LDAP is a structure based on a A. B. C. D.

Lattice Tree Web of Trust No option listed is correct

Answers 1. *B. Security ID All implementations of IPSec must have a security association. The security association is a one-way connection that affords security services to the traffic carried by it. This means that in an encrypted session, there are two security associations - one for each direction. The Authentication Header (AH) or the Encapsulating Security Payload (ESP), but not both offer security services. 2. *B. Two All implementations of IPSec must have a security association. The security association is a one-way connection that affords security services to the traffic carried by it. This means that in an encrypted session, there are two security associations - one for each direction. Security services are offered by either the Authentication Header (AH) or the Encapsulating Security Payload (ESP), but not both. 3. *A. In theory, the same security that a wired LAN does The acronym for WEP is Wired Equivalent Privacy (Protection). It refers to encryption of radio waves using RC4 (shared-secret) key encryption. The correct answer is, in theory. WEP has been shown to not offer a great deal of protection. And it is better than nothing. A number of measures can be taken to increase the security of WEP. (Disable SSID broadcasts, reset the IV key frequently). 4. *C. All choices are correct "The definition of a VPN has always been the network of secure links over a public IP infrastructure. Technologies that fit in this category included Point-to-Point Tunneling Protocol, Layer 2 tunneling protocol and IP Security" -- Quote from Network World: VPN definition gets fuzzy. 5. False Despite the similarity of the Acronym’s TACACS+ is NOT compatible with TACAS (Terminal Access Controller Access Control System)

6. *A. PGP *B. S/MIME *C. Symmetric key *D. Public-Private keys Both PGP and S/MIME are used to encrypt email. A symmetric (shared-secret) can be used between parties, or Public-private keys (such as PGP or S/MIME) 7. *A. Spam *B. Hoaxes Spam and hoaxes waste time and money. IM and SNMP are vulnerabilities of networks, but are not specifically issues with email. 8. *A. Loss of productivity *B. Loss of bandwidth *C. Revenue drain supporting un-wanted traffic Because it is cheap to purchase email addresses, there is a great deal of spam. The sheer volume of spam costs productivity time deleting it, consumes bandwidth, requiring additional bandwidth to be purchased. Depending on the content of spam, a user subjected to it could suffer a credit card fraud loss, but that is not the main issue with Spam. 9. *B. Both create a secure channel between a client and a server. TLS supports older SSL connections. SSL/TLS/WTLS provides a secure communication channel between a client and a server. TLS and SSL are not interoperable. TLS improved support for different types of encryption (Diffie-Hellman, Digital Signature Standard and Triple DES). 10. B. Tree LDAP is based on X.500. Both LDAP and X.500 are based on a tree structure.

Chapter 0011: Domain 3.0: Infrastructure Security (20%) “Things alter for the worse spontaneously, if they be not altered for the better designedly." -- Francis Bacon

Getting Ready—Questions Answers 1. If you wish to allow only certain departments to surf the Internet you would set up a ________________.

2. A router operates on layer 3. This means a packet sniffer can access________________________________________. 3. A subnet can be isolated from sniffing either a ________ or a __________. 4. A modem that is not part of the "official" modem pool in a firm is susceptible to _____ _________. 5. The technology that enables the use of one-time passwords or pass phrases is called _____________. Answers 1. If you wish to allow only certain departments to surf the Internet you would set up a firewall. In the real-world differences in products are blurring. "Building the Perfect Box" -Information Security October 2002 Page 16… A circuit level firewall will allow application access control. This may be included in some proxy servers. 2. A router operates on layer 3. This means a packet sniffer can access only the subnet that the packet sniffer exists on. A router performs by directing IP traffic based on source and destination IP addresses. That would limit sniffing to the sub network area. If the packet sniffer is at the router, it can monitor everything that moves through the router. (Of course, if a cracker can manipulate the router to route additional traffic over to the subnet the cracker has compromised, that traffic can be seen as well. They key is that the packets have to be passing through the subnet on which the sniffer is installed.) 3. A subnet can be isolated from sniffing either a switch or a router. While a router will limit exposure via directed IP traffic, a switch will screen to the sub-net level by using MAC addresses. Do be aware that deploying switches does not make you totally immune to sniffing, as switches were not designed to segment traffic for security reasons, and many have at least one vulnerability that reduces their effectiveness for security. 4. A modem that is not part of the "official" modem pool in a firm is susceptible to war dialing. This is a very old form of hacking that is beginning to rise in popularity again. It is trivially easy to find a freeware program to dial numbers to log phone numbers that have modems attached, then checking to see if the connection has a back door. Such a modem could potentially be used by an attacker to bypass restrictions in place at the organization's official dial-ins or their Internet firewall. 5. The technology that enables the use of one-time passwords or pass phrases is called smartcards. Smart cards and other access tokens rely on one-time-only passwords, challenge-response phrases or public-key security to dramatically increase authentication strength

3.0 Infrastructure Security In this section, we’ll talk about the components of a network, and the security implications of them. We’ll also discuss security-related processes such as intrusion detection and increasing the security of networks, operating systems and applications, which is known as “hardening”. This section is a practical look at what you want to consider when securing your network -everything from the bits and bytes traveling across a network cable to the server applications running on it. “Why cover everything from hardware devices to applications in a single section?” you might ask. Well, to partly reinforce the point that a network is only as secure as its least secure component. You can have the most secure Internet gateway whatsoever, but, if one random user has installed a modem on her PC and uses that modem to connect to her personal Internet account, your internal network is exposed.

3.1 Devices Networks include a variety of physical devices, and each type of device has its own security considerations. Some of these provide additional security for your network, and some are likely to be points of exposure. We’ll cover some of the most common network devices in this section.

3.1.1 Firewalls In the non-computer world, a firewall is a fireproof wall used as a barrier to prevent the spread of fire.[1] In the computer world, it’s a barrier intended to prevent undesired access to computer and network resources, keeping those on the outside of your network out, and those on the inside of your network, compliant with company policies on network use. In chapter 1, we mentioned using firewalls to block or open access to different TCP/IP protocols, as a means of controlling access to resources. For example, if you want to allow selected users to surf the web, but not allow access to the Internet by others, you could set up the firewall to allow only port 80 and 443 connections from those users’ workstations outbound to the Internet. When a firewall is protecting an entire network, it is normally a separate system that is not used for any other task on the network. It may be ordinary PC’s running specialized software, or perhaps, a customized hardware ‘box’ specifically manufactured to provide firewall functions. Is there anything else a firewall can do for the network? In addition to providing access control based on port numbers and source/destination address, firewalls can provide other functionality such as: •

• •

Access control based on time of day or an authenticated user ID, allowing access to a service only during certain times of the day or by certain user ID’s, and disallowing it at other times or for other users Session logging, useful for tracking connection utilization Intrusion detection and notification (and optionally, network reconfiguration in response to an intrusion)

Additionally, some provide a facility known as Network Address Translation, or NAT. Most commonly, this feature allows computers on your internal, non-Internet-addressable network

to gain access to the Internet, by automatically translating internal network addresses to external network addresses. The benefit of this is that your internal IP numbers are not known or accessed by Internet hosts. Any internal nodes, for which NAT is not performed, are effectively isolated from the Internet (unless, of course, someone compromises one of your internal systems and uses that as a springboard to get to other internal systems). There are two main types of enterprise network firewalls: application-level and network-level (sometimes called circuit level). Each has its advantages and disadvantages, as we’ll see in the upcoming sections. Success Owl!

Firewalls Firewalls protect the network and its computers from unauthorized access. They are usually placed between the Internet and a company’s internal network, and can be used to: • •

Block connections from internal hosts to the Internet Block connections from Internet hosts to services on internal machines Firewalls can restrict access based on many criteria such as TCP/IP port number; source address; time of day; destination address and, authenticated user ID (for application level firewalls).

Figure 24: Firewalls can utilize a complex set of formulas. This example is denying FTP

Application-level Firewalls Application-level firewalls involve the use of one or more “proxy” programs on the firewall, which act as intermediaries between internal and Internet hosts. Usually, a separate proxy program handles each different protocol passing through the application-level firewall. The proxy program accepts a connection request from one side of the firewall, notes the desired destination address, and then creates a connection request of its own that is sent to the ultimate destination if it determines through its rule base that the connection should be allowed. The proxy then carries on two separate, simultaneous conversations: One

between the network client talking to the firewall, while thinking it’s talking to the server and one between the firewall and the server, which thinks it’s talking directly to the client. At no time are the internal system and external system directly connected to one another. Instead, the firewall proxy carefully passes each side’s requests and responses to the other while keeping external systems from being able to play low-level TCP/IP games with internal systems, and trying to isolate each side from bad input that might exploit vulnerabilities in server or client software. When determining whether or not to allow a connection, an application-level firewall can look at many criteria, including packet source address, destination address, source and destination port numbers, and possibly other items such as user ID, user group, individual commands in the protocol, etc. Since the proxy programs have knowledge of the protocols, and control each conversation, it’s possible to define rules based on subcommands within the protocol. For example, you could allow certain users to issue the FTP “put” command to save a file to your FTP server, but disallow “put” access to all others. This very flexibility is also a limitation, because if an application-level firewall doesn’t have a proxy program for a protocol, the protocol can’t pass through that firewall at all, as some users of Microsoft Proxy Server were unhappy to find out when trying to create connections to the Internet with proprietary client/server software. This means that an important question when evaluating application-level firewalls is, “Does it support all of the protocols I want to pass through the firewall?” Another limitation of application-level firewalls is that their use is often not transparent to client workstations. Workstations may need to be configured to send traffic to the firewall proxy by, for example, specifying a proxy server address in browser settings. (Fortunately some browser manufacturers make it possible to do this in a somewhat automated fashion, such as by reading settings from a centralized configuration file). Because application-level firewalls do so much work to verify and maintain each connection, they’re also the slowest type of firewall. If you’re buying firewall software to install on your own computer, and plan to use application-level proxies, don’t scrimp on the computer’s processor or network cards! Success Owl!

Application-Level Firewalls Application-level firewalls act as proxies between the client and server sides of a conversation, examining packets from each side of the conversation and passing them to the other side if permitted. Pro’s: Because application-level firewalls have detailed knowledge of application protocols, they can offer finger-grained access control to application features; also, they tend to do a better job of protecting systems from low-level TCP/IP attacks because the two ends of a conversation are not directly connected Con’s: Client configuration changes are generally required, and they tend to be the least efficient type of firewall, due to the overhead of maintaining two connections for each proxy conversation being held.

Network-level Firewalls Network-level firewalls work at the individual packet level, inspecting specific fields within the packets and comparing them with user-defined rules that determine whether or not the traffic should be allowed through the firewall. Typically the rules take into account any combination of the IP protocol number, packet’s source address, destination address and source and destination TCP/UDP port numbers. Typically, you can either “allow” access to an address (or subnet), or “deny” it. For example, you might wish to “deny” incoming connections to your company’s FTP server, by all IP addresses on the Internet except those belonging to certain collaborators. Or, you might want to “deny” all incoming connections to your network on the commonly used SQL Server port. Unlike application-level firewalls, network-level firewalls are transparent to workstations on the network. No configuration changes are necessary to hosts when implementing or finetuning the rules on a strictly network-level firewall. On the downside, unlike with applicationlevel firewalls, direct TCP/IP connections between external Internet hosts and internal systems are permitted. This potentially means that your network’s security could be compromised if a weakness in the lower levels of TCP/IP on any of your workstations was to be discovered and exploited by someone out on the Internet. With an application-level firewall, since packets are recreated on the firewall before being directed to internal hosts, only the firewall itself is likely to be susceptible to attacks that take advantage of flaws in the lowest levels of a TCP/IP stack. There are two varieties of network-level firewalls: packet filters, and stateful packet inspection fire walls. Success Owl!

Network-Level Firewalls Network-level firewalls inspect packets as they travel by on the network, comparing them with user-defined rules that determine whether the traffic is allowed. Any unauthorized packets are blocked. Pros: transparent to network clients, faster than application-level firewalls Cons: direct TCP/IP connections between “inside” and “outside” hosts are permitted (allows for potential low-level TCP/IP attacks), can’t perform protocol-specific validation to the level of an application-level firewall Two types of network-level firewalls include packet filters and stateful packet inspection firewalls.

Packet filters are the simplest firewall technology. They examine each packet going across the firewall’s network interface(s) individually, and compare it to the known rules on the firewall. Because packet filters typically do little processing, they tend to be the fastest type of firewall. However, with increased speed comes less functionality—unlike application and stateful inspection firewalls, a packet filter does not look at each packet in the context of the conversation in which it is occurring.

Success Owl!

Packet filter firewall A packet filter is a network-level firewall that examines each network packet individually, and decides based on the contents of the single packet alone, whether to allow it through.

Stateful packet inspection firewalls take the idea of packet filtering one step further, by considering the “state” of the connection when a packet is inspected, when determining whether or not to allow the packet through. A stateful packet inspection firewall keeps track of all active and pending network connections through the firewall. It knows which side (external host or internal host) initiated a particular connection, the status of that connection, and possibly a bit about the expected packet contents for conversations using application-level protocols like SMTP or FTP, plus the standard packet-filtering details known by stateless networklevel firewalls. By knowing connection status, a stateful packet inspection firewall is better able to protect the network from packets with spoofed addresses trying to masquerade as legitimate packets in that conversation. The tradeoff is that configuration of rules for this type of network-level firewall can be more complex than for simple packet filters. Success Owl!

Stateful Inspection Firewall Stateful packet inspection firewalls are a type of network-level firewall that keeps track of open network connections and examine each network packet in the context of the conversation it is part of, when determining whether to allow the packet into the network.

Personal Firewalls In addition to these two prominent types of enterprise firewalls, a new category of firewalls has come into existence in recent years: that of the personal firewall. Typically, a personal firewall is installed by an end user for protection of a single system or small (generally home) network that is connected to the Internet. Generally, a personal firewall is installed directly on one of the computers that need protection, rather than requiring a stand-alone piece of specialpurpose hardware, or its own PC. Personal firewall packages such Zone Alarm[2], Norton Personal Firewall[3] and Kerio Personal Firewall[4] offer a subset of features of larger firewalls, generally being lighter on logging and management capabilities not needed by most home users, and adding a few features intended to appear to home users, like "Winroute Pro" (which does packet filtering).

Figure 25: While not a ‘simple’ as some Personal Firewalls, Kerio is quite customizable and can prevent HTML based Spam Email from ‘phoning home’ Why mention personal firewalls in a book primarily concerned with enterprise computing? If your employees are dialing in from home over the Internet, and then connecting to your machines via ssh, web applications, etc., you should care about whether their computers are vulnerable to attack from the Internet, just as you should care about whether their computers are virus-free. In late 2000, it is believed that a hacker gained access to Microsoft source code, through the machine of a Microsoft employee (possibly their home machine).[5] Just as an anti-virus program would alert a user if a worm appeared on their system, some personal firewalls could alert them whenever outbound connections are made to other systems—possibly warning them of an outbound communication they weren’t aware of, which was being made by an illicit program. How important is it for you to care about your employees’ home machines? Consider this: a large software vendor is implementing a procedure where the machines of employees remotely connecting to their network will be security-checked in some fashion before the connection is allowed to be used.

If we buy it, will it protect us? ICSA Labs reports that, “an alarming number of firewalls aren’t functioning as intended.”[6] This is largely due to the “people” component in the firewall configuration process, rather than shortcomings in the firewalls themselves. Many firewalls are simply improperly installed or configured. Geek Owl! Which one should I get? It depends, on many factors, because firewalls vary greatly in functionality. Many people consider Checkpoint the market leader in network firewalls, but the cost and complexity of their solutions tends to be overkill for the typical small office. Other companies, whose networks are full of Cisco’s’ networking equipment, like Cisco’s PIX. Still others, particularly those constrained by cost and those who like to inspect the source code for their security devices, like open source firewalls such as the network-level IP tables in Linux. Several independent organizations certify firewalls, including ITSEC, TCSEC and Common Criteria. Commercially, ICSA and West Coast Labs Check Mark provide somewhat more-limited certification. It appears that Tiny is getting out of the firewall business. Kerio and Tiny at one point appeared to be the same code base with different marketing. One of your authors has been both fooling around with a new version of Kerio and lurking on a newsgroup for the currently beta product[7]. Early indications are that the new

Kerio is vastly more powerful, and in the current beta, equally more complex. Other users swear by the popular ZoneAlarm firewall. So, it is important that staff is trained on proper firewall configuration and security techniques, and that firewall configurations and rules are documented. Again, security isn’t a one-time action that is taken and then is over with. It is a process! A single setting can sometimes turn on (and thus, OFF) packet inspection, turning a firewall with a well-designed rule base into a box that blindly passes along every packet it sees. In addition to regular audits of your firewall rules and configuration, and perhaps an occasional penetration test by staff (or a consulting group) using an outside Internet connection, what else can be done to maximize the security of a firewall? Check with your firewall vendor regularly to ensure that you are running the most up-to-date software, which is likely to be the most resistant to known vulnerabilities. Follow popular mailing lists like BUGTRAQ, and Usenet newsgroups related to your firewall platform to keep up with potential issues. As with any network device, if the vendor has a security bulletins list, sign up for it and take the recommendations posted on it. For example, sometimes a vendor suggests temporarily disabling a feature until a patch for a security vulnerability involving it is tested and released. Ignore these (we know many people will, often based on, “I don’t have the time”) at your own peril, and don’t say you weren’t warned.

3.1.2 Routers A router is a network device that connects networks, forwarding packets to and from them as needed. This prevents sniffing by limiting the network segments through which a packet passes. It determines how, and where to forward packets based on internal routing tables that may be hard-coded on the router and not subject to change, or may be dynamically updated by other routers on the network as the best routes to different destination networks change. Generally, a router contains at least two network interfaces, and in larger networks, often more. Connected to each interface is a specific network or network subnet. Packets come into the router from each interface; the router compares each packet’s destination address with its internal routing tables, and sends the packet out the appropriate interface, on its way to its destination. Often the only router on a small business network is one with only two interfaces, one for the internal network containing the organization’s workstations and other devices, and one for the company’s Internet connection. Originally deciding which network to send a packet to, to move it toward its ultimate destination, was all the functionality that routers provided. In the case of the small business router described above, a router would often do little more than serve as an expensive connector between the internal network and the Internet, with very little in the way of routing decisions to make. In larger networks, routers can be employed to segment traffic and regulate traffic among segments, helping to ensure that network performance is as optimal as possible and limiting the amount of traffic that can be spied on by those who install a network “sniffer” to inspect packets traveling along the wire. By limiting the number of nodes through which a packet passes, routers also reduce the potential for man-in-the-middle attacks.

As networks evolved, router manufacturers enhanced their products, adding a number of security-related features. One of the most notable is packet-filtering functionality similar to that found in many firewalls. In the Cisco world, the packet filtering rules are called Access Lists, or ACL’s. There are simple ACL’s which only allow or deny traffic based on a single IP address, and extended ACL’s implementing a fuller set of packet-filtering criteria, including source address, destination address, protocol family (TCP, UDP, ICMP), and port. For example, the following command creates an extended ACL that denies access to the POP3 port on your internal mail server, 192.45.4.72, from all external systems: # Access list 101 deny TCP any 192.45.4.72 0.0.0.0 (eq telnet) Success Owl!

Routers A router connects multiple networks together and forwards packets among networks. Routers protect against sniffing and man-in-the-middle attacks by sending to a subnet only the traffic that needs to be there, limiting the number of nodes with access to packets.

Sometimes packet filtering is implemented on routers via access lists. Geek Owl! Router Configuration Other security features commonly found in routers are configuration options to protect malformed or possible vulnerability-exploiting packets from being forwarded to other network interfaces, and to prevent packets with spoofed source or destination addresses from entering or leaving the network. How does the router know a spoofed address when it sees it? If the router sees a packet coming into it from an external interface, and that packet’s source address is set to an IP address within the internal network, odds are that the address was spoofed. Similarly, the router knows that packets coming into it from internal networks should not have external network source addresses—if they do, that may be a sign that someone is using one of your systems as part of a DoS or DDoS attack. Blocking such outgoing packets is just a matter of being a good net neighbor. If everyone did this, a number of DoS techniques would be much less effective, since they rely on the ability to send out packets with a spoofed source address equal to one on the target’s internal network. A key point is: Don’t depend on your ISP to do this address-check for you, even though it’s pretty clear that they could. Some ISP’s, even large ones, are notoriously unconcerned about security. For example, one unnamed ISP connected to one of the “Baby Bells” has been overheard telling small business customers that individual businesses don’t need to bother with a firewall, because the ISP’s staff monitors the network very carefully—as if all the monitoring in the world would protect against a carefully-executed intrusion. Just like when you’re walking around in an unfamiliar city after dark, you have to watch your own back.

Security issues with routers Routers communicate using special protocols known as “routing protocols”, which include standard protocols like RIP, RIPv2, OSPF, BGP and vendor-defined protocols like Cisco’s IGRP. These protocols, like many other Internet protocols, have security vulnerabilities, particularly in the area of spoofing. For example, RIP (v1) can be easily spoofed because its messages are not authenticated, so anyone can send update messages via RIP; RIPv2 relies on optional clear text authentication, transmitting passwords across the network where they can be intercepted and used in later spoofing attacks. Even OSPF can be spoofed if the protocol is not used in cryptographic authentication mode.[8] Once you’ve succeeded in spoofing a router message, you can do a number of things, like redirect switched network traffic to other segments so that it can be sniffed, create a “black hole” denial of service attack by advertising a non-existent router with a priority route for all traffic, etc. Generally, the stronger the protocol’s authentication is, the less vulnerable it is to spoofing. Of course, this implies that those with access to router passwords maintain their confidentiality. In keeping with the evolution of the Internet, later protocols tend to incorporate better authentication than earlier ones. When you have a choice, opt for these newer protocols like OSPF, and use the authentication features they provide. Like firewalls, routers are implemented substantially in software, and from time to time, security issues are found in that software. Therefore, the guidelines we offered for firewalls also apply to routers—watch for software updates and install them when they are available, subscribe to vendor security bulletin lists and other security discussion lists. Also, similar to firewalls, routers can be challenging to configure properly. Be sure that your network administrators with router configuration responsibility have been trained on proper techniques, and possibly even certified by your router’s vendor as having satisfactory knowledge of router administration. Also make sure that you have changed all default passwords. You should turn off SNMP unless you know that your device is not vulnerable to recent SNMP issues, and if you don’t turn off SNMP, remember to change the SNMP community name. Reasons you want your routers to be secure include the fact that a compromised router can help someone mask their identity, create sniffing situations and just in general cause packetrouting chaos by changing access control lists, NAT settings, static routes between networks and subnets (which can facilitate MITM attacks), etc.[9] Real World Owl!

Hardening Routers A couple quick activities will neutralize many router security issues. Do you know your router password? Does it appear on the Internet in a list of default device passwords like this one[10]? If so, or if it looks easy to guess, or has been the same since you got your job 3 years ago, change it! Is SNMP turned on, on your router? Unless you need it and know that your router is running firmware not vulnerable to recent SNMP issues, turn it off. (It’s enabled by default on many routers.)

To be a good neighbor, make sure that your router filters any packets inbound to the network whose source address is an internal network address, and any packets outbound from the network whose source address is an external network address. And, of course, check for firmware updates.

3.1.3 Switches A switch is a network device that, like routers, forwards packets between LAN segments, providing somewhat of a subset of the functionality of a router, at a lower price. The simplest switches generally operate at the data link layer (OSI Layer 2), and base packet-forwarding decisions on physical device locations (for example, destination MAC address) rather than on supplied network-level rules for packet routing using IP network addresses, as in full routers. Switches are useful in controlling access to network packets traveling on a wire. Since switches avoid making a packet sent by one host available to all other hosts on the switch (unlike hubs), the potential for sniffing is greatly reduced. Success Owl!

Switches Switches, like routers, forward traffic to the network connections as required. Switches work at a data-link layer, using MAC addresses, rather than at the network layer used by routers. Unlike hubs, they do not automatically make a packet sent by a host on the switch available to all other hosts connected to that switch. Only the network links and nodes directly involved in the conversation see the packet, so opportunities for packet-sniffing are reduced.

Of course, a caveat to this is that switches have been designed primarily to enhance network performance, not network security.

Security issues with switches It is possible to barrage some switches with an excessive amount of traffic from unused MAC addresses, causing the switch to overflow its MAC address table and reconfigure itself into working just like a hub. Once the switch is in hub mode, traffic is no longer restricted and sniffing is once again possible. With another switch, frames are always forwarded to all ports on the switch and the switch processor is relied upon to explicitly tell all ports except the correct one to drop the frame. If there is an excessive amount of processing on the switch (say, from handling bad packets) the processor may not get around to telling the other ports to drop the frames and the frames are sent out on all ports, as with a hub.[11] Another way to sniff switched traffic is to use spoofed ARP packets to misinform the switch of the MAC addresses for the hosts whose traffic you wish to sniff.[12] Switches can be targets for attackers, who can gain access to administrative features of managed switches by using default passwords, or sniffing switch passwords sent in clear text via SNMP or telnet.

As with routers, improper configuration can be an issue limiting the effectiveness of a switch as a traffic isolation device. Also, as with all hardware, it’s important to watch for security-related firmware updates and install them when available.

3.1.4 Wireless Two wireless LAN technologies in use by many organizations today are 802.11 (seen in section 2.6) and Bluetooth. Other wireless data technologies which work over long distances include packet radio, cell phone, microwave and satellite communication.

Security issues with Wireless Two primary issues with wireless connectivity are connection reliability and access control. When planning wireless connectivity, be sure that you know the level of reliability you need for your connections, and make sure you have it before “going live”. We know of an organization that deployed a p Because data in the air is accessible to anyone who can intercept it, the use of strong encryption is required if you want to preserve the confidentiality of data traveling across your wireless network. This can be implemented via a VPN connection, or by running the application used across the wireless link over a protocol such as TLS that allows for encryption to protect data integrity and confidentiality. Because wireless LAN nodes can be so convenient to set up, many organizations have taken to implementing them, particularly when “temporary” solutions are required.

3.1.5 Modems Modems allow users to use telephone lines to call in to a network, computer, or fax machine from a remote location. Most modems today use the V.90 standard, theoretically communicating at up to 56kb/sec, although they are limited to 53kb/sec (kilobits per second) by the telephone network. Older modems may communicate at 33.6kb/sec, 28.8kb/sec, 14.4kb/sec, or even 9600bits/sec or slower. Other devices that connect a home PC with a cable Internet connection or DSL connection are often referred to as “cable modems” or “DSL modems”, but they more closely resemble routers than modems in the traditional sense. Employees working at home, providing after-hours support, exchanging data among business partners, sending and receiving faxes, and accessing the network from off-site company locations that do not have permanent network connections, use modems in corporate settings most commonly for telecommuting. Modems can be internal (on cards which plug into a PC or laptop) or external (separate boxes outside the computer). External modems typically connect to computers via serial or USB connections. In the case of a serial connection, and probably also for USB, a “tap” can be inserted between the computer and modem, so that communications can be intercepted and recorded, compromising data privacy. For that matter, an appropriate device between computer and modem could even take over the conversation.

Security issues with modems If your users have modems at home, and directly dial into your network, this means that there are modems waiting for incoming calls on your internal network, and therein is the problem. Anyone who knows (or finds) the telephone number to these modems can call them and attempt to access your network. Relying on “security through obscurity” by selecting a modem telephone number that doesn’t resemble any of your corporate phone numbers won’t protect you. It just makes it a bit more difficult for those specifically targeting your organization. Oh, and by the way, we’ll bet you don’t change your dial-in numbers any time an employee who knows them leaves your organization, do you? (Author Helen states with certainty that she can still recite, completely from memory, a dial-in number she used 12 years ago as a consultant.) The bottom line on relying on “security through obscurity” for dial-in modem numbers is: Assume that one way or another, people you don’t want to have your modem phone numbers, eventually will. Given that, you need to protect your network by making sure that when personnel dial in to your network, they properly authenticate themselves. Non- or poor- password dial-ins negates most (if not all) of the good done by a very well configured firewall between your internal network and the Internet. One way to combat the dial-in security issue is to use only modems or server software with “callback” capability. That is, when they receive an incoming call, they call back one of a set of pre-determined numbers, and let the user’s PC answer, before offering a connection to the network. Unless someone resets the callback number, callers at unauthorized locations will not be permitted access. This is an example of redundant security measures—in this case employing both a password or certificate, and corporate knowledge of a user’s location, for authentication. Of course, this mechanism isn’t practical when your users are dialing in from unpredictable locations like hotels around the world. Similarly, the security provided by callback technology is not foolproof. Although modems can be secured with Call Back via Remote Access Services (RAS), this RAS security can be defeated with Call Forwarding, in which the RAS Server calls back a predefined number—which has been forwarded to another number. This is another example of new features breaking previously good security. (Refer to 3.1.6) Another security issue is that of “rogue modems.” These are modems on individual workstations whose users who wish to access their PC from home “easily” “without going through all that security stuff we have on the network dial-in”. The users install remote access software on their PC at work, make sure the modem is turned on when they leave the office, go home and dial in directly to their office computer often without a password or any type of authorization gaining access to its files and network resources. Again, if THEY can dial in, ANYONE can dial in, if they find the phone number. So a very useful security precaution is to limit use of remote PC access software on your network, perhaps even regularly auditing for the presence of it on PC’s, and make sure when it IS used that strong passwords are employed. Would this “never happen” at your organization? We’ve seen it at a bank. If users in that environment would assume its “safe enough” to do, because “they’re only doing file transfers,” it could happen to you, too. Success Owl!

Modems and Firewalls

A common security issue with modems is that they provide a way into your network from the outside that gets around the firewall. You can limit access to dial-ins by using Call Back technology, but an attacker can sometimes defeat this by setting up call forwarding on the callback number so that it forwards the call-back to the attacker’s phone number of choice.

3.1.6 RAS RAS, an acronym for “Remote Access System” or “Remote Access Services”, authenticates users connecting to a network and then allows them access to the network. In most corporate networks, it refers to the RAS function available in Windows, though it can also apply to any technology allowing remote access to a system. Other possibilities include PPP dial-in servers on Linux and UNIX machines, remote access packages like PC Anywhere, and network services that allow remote access to a computer’s desktop from across the Internet, such as WebEx[13] or GoToMyPC[14]. How does RAS work on Windows? One or more Windows computers (or boxes implementing the same protocols) can be set up as “RAS servers” which accept modem connections via incoming telephone lines. Any user with a modem and the correct authentication information can access your RAS network, so you might want to consider additional levels of security such as utilizing the callback feature (in your modem, or in RAS itself), as mentioned in section 3.1.5. Typical RAS servers allow controlling access by user ID, time of day, and other factors. You can also set parameters such as the maximum number of incorrect logins per day per user ID (after which, that user will be locked out until the administrator resets their account). RAS can use a variety of communication protocols, some of which offer encryption. If you are using the most recent versions of Windows (Windows 2000 SP2 or higher), you can configure your RAS server to require that connections use strong 128-bit encryption[15] in order to minimize the chances of data sniffing or man-in-the-middle attacks. Since RAS gives users’ access to the corporate LAN as if they were another local user, you might worry that your entire network is wide open to any RAS users, but this is not entirely true. One interesting feature of RAS is that you can block certain protocol families from use over RAS. For example, if there are certain applications you want to be run ONLY by users who are physically in the office, you might design them to run under a protocol that you don’t pass through RAS, such as IPX. RAS can use a variety of authentication techniques during user login, including Password Authentication Protocol (PAP), Shiva PAP (SPAP), Challenge Handshake Authentication Protocol (CHAP), Microsoft CHAP (MS-CHAP). Of these, CHAP and MS-CHAP are more secure than PAP and SPAP, because the challenge approach does not require an encrypted (SPAP) or unencrypted (PAP) password to be sent over the wire from client to server. The benefits of the challenge approach are covered in more detail in the section on CHAP. Also, Windows 2000 and later versions support EAP, the Extensible Authentication Protocol, which is an extension to PPP that enables the use of third-

party modules to authenticate RAS users. For instance, smart cards, Kerberos or S/Key mechanisms can authenticate users, if the appropriate module is installed and configured. A handy feature of most RAS servers is that they can be configured to log incoming connections, giving you a record of when your network was accessed and by whom. If suddenly someone who never accesses the network via RAS hits it four times in the middle of the night, you might want to verify with that user that they did indeed call in, to make sure that an outsider didn’t just guess their password and log in with false credentials. Success Owl!

RAS RAS, or Remote Access Services, authenticates users connecting to a remote network (via dial-up or the Internet) and allows them access to network resources. It can use many different types of authentication. If using a standard user/password authentication method, CHAP and MS-CHAP are more secure options than PAP and SPAP. Because a RAS login can be attempted by anyone who knows the phone number (in the case of a dial-in server) or remote desktop IP address (in the case of a remote desktop accessible via the net), make sure that you log all login attempts and if possible, lock out accounts after a small number of unsuccessful attempts.

3.1.7 Telecom/PBX Your organization’s telecommunications facilities are also part of its IT infrastructure. The PBX, or Private Branch Exchange, is the controller of the telephone network within an organization[16]. It coordinates access to a limited number of “outside” telephone lines, each of which has its own telephone number, by a greater number of “inside” lines within the company. PBX’s are often used by medium and large-sized companies because it’s less expensive than connecting an outside line directly to each internal line. For example, a site might have 400 internal lines, or extensions, and 80 external lines. Another benefit of PBX’s is that users within the organization can reach other users connected to the PBX by dialing their short (3 or 4 digit) “extension” rather than a full telephone number. Many PBX’s contain what is known as a remote maintenance, or remote diagnostic, port that is used by the PBX vendor to reconfigure the phone system, upload and install software updates, download logs and perform other privileged operations. As you can see, a PBX is “phone system server” of sorts.

Security issues with Telecom/PBX The same type of vulnerabilities faced by an organization’s data network are also faced by its telephone network, including theft of service (through long distance toll fraud), compromise of data privacy or integrity, unauthorized access to privileged functions, denial of service, and opportunities for reconnaissance by an attacker interested in patterns of calls by one or more users.

An example of the risks faced by PBX’s is a situation in which an attacker gained access to a hospital’s PBX, and then for the next two years, periodically blocked calls to and from the hospital, connected internal staff to outside numbers they did not intend to contact, and placed bogus emergency calls that appeared to come front the hospital itself. [17] Common pitfalls to watch for, in terms of the security of your traditional PBX include: •

•

•

•

•

•

Default passwords on manufacturer-installed accounts (information on these can be found in the PBX switch documentation or from your vendor—you can be sure that potential intruders know what they are); Features that can be accessed via the phone system, such as voicemail or switch reconfiguration functions (typically, the password security on these features is not significant, and can be defeated by brute force); Leaving a modem connected to the remote maintenance port, even when you do not know of any scheduled maintenance that will require it, leaves open a path into the system for anyone who wants to try to use it; Software updates sent from the switch vendor to the system administrator—which may have been intercepted and tampered with before the system administrator received them (ideally, your vendor would send the update as a digitally-signed message to guard against undetected tampering); Hard copy of configuration information, possibly listing passwords and critical configuration details, being acquired by unauthorized personnel (“dumpster diving” can reveal this, and other, proprietary information). Social Engineering and PBX security should be monitored. Success Owl!

PBX = The Forgotten Hole A telephone network faces security concerns similar to a data network, including unauthorized use, compromise of data privacy or integrity and denial of service.

Specific actions to take, to secure a PBX, include changing all default passwords, not leaving modems connected to PBX maintenance ports, restricting administrative activities that can be performed with just phone access (and strong passwords, the user ID’s with administrative access), and watching out for social engineering attempts to gain information about the company’s phone system. Geek Owl! Computer Telephony Integration (CTI) Recently, PBX’s incorporating Computer and Telephony functionality have become popular, some sticking to their traditional physical line “switching” routes, and others incorporating VoIP (voice over IP functionality). Many of these systems, such as the Altigen[18] communications server runs on Windows 2000 and other widelyavailable operating systems, integrating telephony with applications like SQL Server and Microsoft Exchange to perform functions like “screen pops” (popping up customer information, looked up from the incoming caller ID information, on a service rep’s screen) or “call routing” (sending a call to an available tech support representative with the appropriate skills, based on the type of trouble call). Both these new computer

telephony solutions and traditional PBX’s may be network-enabled, to allow console access and transfer of PBX-collected information like Call Detail Records (CDR’s) to another computer, perhaps for billing purposes. If you’re using one of these systems, and it is connected to your LAN, be aware that anyone breaking into your LAN may also eventually gain access to your communications server. So, the standard precautions, of setting extremely strong passwords, monitoring the server for configuration changes, following up on unusual logins, etc., apply. When your communications server runs on a widely available OS, also add automated virus checking to your list of security measures. Real World Owl! Securing Voice Mail Does your telephone system provide off-site access to voicemail? Does the system require that users choose access codes of a certain length, or can users get by with a blank access code? Do you educate your users to choose codes more difficult to guess than “1111”, “9999” and “1234”? What about access codes that enable access to administrative features remotely? If your phone system supports this, have you changed the default access code for it?

3.1.8 VPN As mentioned in section 2.1.2, a Virtual Private Network, or VPN, simulates a private network over a public network (or less secure private network), allowing multiple sites to communicate securely. In this way, a VPN can support: • • •

traditional, host-based remote access (dial-in from a PC) LAN-to-LAN access (wide area networking) an extra level of communications security within an intranet (encrypting sensitive traffic so that it cannot be “sniffed” by personnel using your internal network) Success Owl!

VPN A Virtual Private Network (VPN) allows you to simulate a private network over a public (less secure) network.

Advantages of VPN’s Companies often establish VPNs which run over the Internet as a more cost effective, lower administrative overhead, more scalable alternative to a traditional (non-virtual) private network. VPNs are more cost effective because organizations can connect any physical locations together without requiring long distance data calls via modem or leasing expensive private communications lines between sites, equipping these sites with the appropriate communications hardware to support the private network. This saves the organization the monthly line and long distance costs. For example, if your field support engineers, equipped with laptops, need access to sensitive customer data from both their offices (with local LAN connections) and from out in the field at customer sites (by

modem); you might implement a VPN to allow them access to this information in a standard way, whether connected locally or remotely. VPNs offer lower administrative overhead and improved scalability because having users access the VPN through the Internet enables you to assign responsibility for that connectivity to the users’ ISP’s, rather than taking it on yourself. Additionally, your data center won’t need to maintain the equipment that would be involved with the private lines, which could include high-speed CSU/DSUs and a router port for each private line, a modem bank for those network participants who do not connect via leased lines, etc. This frees technicians to concentrate on other issues and eliminates the time and cost involved in upgrading your communications hardware when technology advances or your network expands. Primary security features offered by VPNs include: •

• • •

•

User authentication and authorization, usually through digital certificates or passwords, combined with policies, to ensure that only authorized personnel can access appropriate portions of the VPN Secure communications, by way of an encrypted communication tunnel, which keeps communication private, and tamper-proof, as it is routed through the Internet Protocol encapsulation, allowing protocols outside the Internet’s standard TCP/IP family, like IPX and AppleTalk, to be sent over the Internet Address space isolation, allowing use of private address ranges (and other internal Internet addresses to which your router may block access) within your VPN, even for hosts located outside the boundaries of your internal network Integration with firewall technology (with some VPN’s), for ease of administration

Figure 26: While not as secure as a direct connection, massive savings can be achieved when connecting remote offices A number of popular protocols are used by VPNs, including PPTP, L2TP, IPSec and SSH. Of these, IPSec is generally regarded as the most popular protocol for VPNs, with PPTP and L2TP following close behind, generally in Windows-based environments, and SSH popular in

UNIX-based networks. For more information on these protocols, see the section 2 topics discussing Remote Access, which discusses each in depth. VPNs can be implemented in firewalls, dedicated hardware or software. For example, a popular firewall solution that includes VPN capability is the Pix, by Cisco Systems[19]. Popular dedicated hardware solutions include Sonicwall[20], Netscreen (for both small and enterprise VPN’s)[21], and Nokia VPN[22]. There are also software-based solutions that integrate with firewalls, such as Checkpoint. Finally, some are software-based solutions such as SSH and SSL. The interesting thing about some of the software solutions (including SSH and SSL) is that they started out as protocols that provided encryption for specific applications, such as remote terminal access (SSH) and SSL (Web browsing), but were later found to be effective VPN protocols as well. Success Owl!

VPN’s are Cost Effective and offer Numerous Features VPN’s are a cost-effective alternative to implementing a private network via non-shared leased lines. VPN technology can be used to protect services accessed by both local and remote users. For example, a service used by both internal LAN users and by dial-up users on the road could be accessed via VPN. Some VPN security features include user authentication, encrypted communication, protocol encapsulation and filtering, the use of private address spaces within the VPN tunnel, and integration with firewall technology.

Security issues with VPN’s One security issue with VPNs is that your communication is at the mercy of the Internet. While communication using a VPN is generally secure, it’s not without potential problems. If an area of the net is slow one afternoon, your VPN communication speed for any communications traveling across that portion of the net, will be slow. If there’s an outage at an ISP, one or more sites may be temporarily knocked off your VPN. If an attacker decides to DoS one or more routers at sites involved in your VPN, their communications will be impaired. If a script kiddie exploitable flaw that crashes your particular brand of VPN is found, prepare to stop what you’re doing periodically and reset the VPN, until the vendor fixes the flaw. Another issue with VPNs is that, depending on the technology you use, you may find that some information about your network and communications, such as packets’ source and destination IP addresses, is not encrypted. If it is important to you to keep this information private, make sure that the VPN you select will do so, or perhaps incorporate the use of NAT in your network so that the only exposed address within your network is the NAT server. On a related note, another issue with VPNs is their potential susceptibility to “man in the middle” attacks, which intercept the communication, take note of the IP addresses involved and then impersonate either the client or server side. (Note that if good encryption is used, this is not trivial to accomplish.)

Another security issue with VPNs is related to encryption. If an attacker knows the information transmitted across your VPN is very valuable (perhaps credit card or wire transfer information), they may be willing to spend considerable amounts of time and money to attempt to break the encryption being used. Practically speaking, most VPN encryption mechanisms are sufficiently secure, but remember that DES was not considered reasonably breakable, 30 years ago. Be aware that the passage of time may render certain encryption mechanisms ineffective. Success Owl!

VPN security issues •

• •

•

Since the packets travel over the Internet, communication can be impeded or interrupted if there are Internet technical problems, or someone performs a low-level attack on your VPN server Depending on the VPN you choose, some information such as host addresses may not be encrypted Unlike networks based on private leased lines, VPN communications can be disrupted by DoS attacks or interfered with by Man-in-theMiddle attacks Some encryption options for VPN’s are not as secure as others; choose carefully

Before implementing a VPN, consider whether interoperability is a factor, as it often is when your VPN includes an extranet consisting of your network and your business partners’ networks. In that situation, it may not be feasible to merely dictate to your partners that they must use certain VPN hardware or software to communicate with your site. Your options may be limited to the hardware or software your partner’s existing VPN supports, in order to communicate with them. Windows includes VPN capability right out of the box, via PPTP and IPSec. On Linux, two packages commonly used to implement VPN’s are ssh (discussed in section 2.1.6) and FreeS/WAN, an open source IPSec utility. If it isn’t supplied as part of your favorite “distro,” check the http://www.freeswan.org site for download locations. Information about configuring FreeS/WAN can be found in Hack Proofing Linux[23] by Stanger et. al. For more information about VPNs, see Virtual Private Networking—A View from the Trenches[24] by Bruce Perlmutter and Jonathan Zarkower.

3.1.9 IDS An Intrusion Detection System (IDS) is a system for detecting attempts to break into or misuse a system or network.[25] It is, in effect, a burglar alarm for your network. As with firewalls, they may be implemented as a dedicated piece of special-purpose hardware, or a software package running on a network computer. What kind of activities can intrusion detection systems identify? It varies with the particular IDS, but can include detection of network scans (in which an attacker is sending traffic to your network to map it, or find systems with known vulnerabilities), spoofing attempts and common script kiddie

attacks such as denial of service attacks, attempts to connect to unsupported services, and receipt of network communication packets that violate standards. Success Owl!

IDS An Intrusion Detection System (IDS) is used to detect attempts to break into or misuse a system or network. Types of attacks an IDS can detect include network scans, packet-spoofing, DoS, other script kiddie attacks, unauthorized attempts to connect to services, improperly-structured TCP/IP packets, and improper activity on a system.

Where on the network should the IDS go? Routers go between subnets. Firewalls are most commonly seen between a company’s internal network and their Internet connection. What about IDS? The answer to this question depends on what you want to protect. You would position an IDS anywhere on your network that you want to look for suspicious activity—this includes both on the network and on individual hosts that may need more protection. For example, an IDS immediately inside your Internet firewall, but still outside the DMZ area (explained in section 3.3.1.1) will alert you before an attack takes place on your DMZ or internal network. The down side to placing an IDS so close to your Internet gateway is that hosts on the Internet tend to be probed quite a lot, and you may spend a great deal of time dealing with uneventful IDS alerts regarding things like network scans that didn’t result in any further attempts to access to your resources. In the case of a particularly sensitive business system, the administrators may want to build in as many layers of detection as possible, to enhance security, and IDSs may be located both on the network and on the host itself. The differences between host-based IDS and networkbased IDS will be discussed in more detail in section 3.4. At other times, you might position IDS in the DMZ between your company’s external (Internet-connected) firewall and its internal (internal network-connected) firewall, to detect any unwanted traffic that got through the first firewall, or within the internal network itself, if you’re more concerned about monitoring for intrusions into your internal network. Think about positioning IDS the way you’d think about positioning burglar alarm sensors. Perhaps you want motion-detectors within your yard, which turn on outside lights when movement is detected. But you’d probably reserve the sensors which actually ring the alarm, for inside your home, near doors and windows lest you be awakened by loud beeping every time a dog runs across your front lawn, or you run down to the kitchen for a snack, in the middle of the night! Then, if you ran a “Bed and Breakfast” in your home and were concerned about security, you might place additional sensors in private areas of your home, much like a company might run an IDS on their internal network NOT for the purpose of catching those who are outside trying to get in, but to monitor for suspicious activities by in-house personnel.

How does an IDS work? The exact details of how IDS detects potential break-ins vary depending on the IDS in use. IDSs can employ a variety of techniques to determine what constitutes an “intrusion”. These will be discussed in more detail in section 3.4, when we get into the specifics of network and host based IDSs. IDSs do more than just DETECT intrusions—they react to them as well. To go back to our burglar alarm analogy, an alarm would be of limited use if all it did was keep a counter each time a window is broken, without taking any other actions to inform responsible parties or discourage the intruder. When an IDS detects a suspected intrusion, it can page an administrator, display an alert on the console, log the suspicious incident, or even take steps to reconfigure the network to reduce the effect of the intrusion. We’ll discuss more about this in section 3.4.

IDS. Which one should I get? As the number of TCP network intrusions has increased over the years, more and more IDS’s have been developed, both commercial and non-commercial. As with firewalls, commercial IDS packages can be pricey. Examples of commercial intrusion detection systems you might want to research include: • • •

RealSecure, by Internet Security Systems [26] Dragon, by Enterasys [27] NFR, by Network Flight Recorder [28] (also available in a free research version)

The most popular open source network IDS, and possibly the most popular one period, is Snort[29]. SANS Intrusion Detection wizard Stephen Northcutt calls it, “the most advanced intrusion detection system money cannot buy.”[30] Additionally, a comprehensive list of public domain and shareware IDS software can be found at the COAST Intrusion Detection System Resources site[31]. If you don’t require network-wide monitoring for suspicious activity, check out the following host-specific IDS options, which are only some of the packages in the growing category of freeware, sometimes-open source, IDS’s: • • • •

Tripwire, by the Tripwire open source team[32] (also available in a commercial version) Tcpwrappers, by Wietse Venema[33] PortSentry, by Psionic Technologies[34] AIDE (Advanced Intrusion Detection Environment)[35]

The different IDSs have subtly different capabilities, strengths and weaknesses, so before committing to one, do your research! Make sure that the one you’ve selected does in fact detect the kinds of intrusions you care about, and that the system is able to respond with the types of actions you need. For example, if you need for the system to dial a pager, make sure that it can do these or at least that you can find a pager dialing program out on the net (they’re there…) and that the system can run it.

Be cautious in reading reviews. This industry is evolving rapidly, what with new “cracking” techniques constantly being developed, and new detection measures being created to identify them, so review comments true about the last version of a package may or may not still apply to the current version. When in doubt, check with the vendor.

Security issues with IDS We hinted about one of the potential IDS security issues above. Most IDS’s produce a large number of “false positives”, that is, events that are flagged as intrusion attempts, that aren’t really—or which, when investigated, end up being random, isolated “script kiddie” network probes that do not result in further activities. Going through all of these event reports, looking for the ones that the IT department needs to be concerned about, can be a timeconsuming activity which takes the administrator’s efforts away from actual security issues. Therefore, important skills to develop when your environment includes an IDS, are configuration of the IDS in a way that reduces the number of false positives (without missing any actual intrusions) and the ability to efficiently identify the events that are worth of further investigation. Additionally, depending on the technology used by the IDS, attackers have found ways to avoid detection by performing “stupid low-level packet tricks.” For example, if an IDS looks for a certain sequence of packets as a signature of a specific attack, the intruder may try to avoid this by fragmenting their communication into a series of smaller packets that don’t match what the IDS expects to see. Each of the fragments is separately examined by the IDS, and judged harmless. However, once the target system has received the fragmented packets, it puts them back together into their original form… and the attack can continue, undetected by the IDS. Part of this is aided by the open source nature of much IDS software, because an attacker can examine the source code, looking for potential ways to “fool” the IDS. Success Owl!

IDS Issues Security issues with IDS include the large number of “false positive” alerts that can distract an administrator from real issues, and the fact that altering low-level packet characteristics can sometimes enable an attacker to avoid detection. A false positive is a potential intrusion that is detected and acted upon by the IDS, which ends up not being a true intrusion at all. As noted above, false positives can consume much administrator time and attention.

This is not the last you’ll be hearing about IDS’s, which show up again in more detail, later in this major section. For more information, do check out Robert Graham’s excellent FAQ on this subject, including questions to ask an IDS vendor, further resources on the subject, and ways attackers attempt to avoid detection by IDS’s.

3.1.10 Network Monitoring/Diagnostic Most networks larger than small workgroups incorporate network monitoring or diagnostic tools, to assist with network management. In section 1.7, we touched on their usefulness for auditing.

These tools may be devices to monitor and diagnose hardware issues or physical cable issues, such as TDR’s (Time Domain Reflectometers). Sometimes an IDS includes some network monitor functionality, but the category of “network monitoring” is usually considered to be more generic than the capabilities provided by an IDS. There are also software packages that monitor and diagnose network issues. Some of these include tools which: •

•

•

monitor and capture network traffic (such as the Windows Network Monitor feature and the open source tcpdump network packet “sniffer”, which listens on the network for packets of interest and records them to a log) diagnose network configuration glitches (such as the “dig” and “nslookup” tools to investigate name server issues, “traceroute” to check a packet’s route across the Internet from source to destination, “netstat” to view current connections on a system, “ipconfig” to check which name server a system is using for name-to-IPaddress resolution, etc.). look for available system services and vulnerabilities (port scanners, described below)

A “port scanner” is a software-based network service investigation tool which will inspect a network and report the hosts on it and which ports/services are available on each host. Often used specifically for security auditing purposes, a port scanner may also be used to verify application server availability or for other non-security-related purposes. Some port scanner packages, like nmap[36], will report the OS’s run by systems on the network, and even whether or not packet filters or other monitoring tools are present on the network. These scanning tools were discussed in more detail in section 1.7 Auditing. Success Owl!

NIDS can be… Network monitoring/diagnostic tools can be hardware or software. Hardware devices include TDR’s and network devices like switches that provide status information via reporting protocols like SNMP Types of monitoring packages include packet sniffing/capture, network configuration analysis (DNS, routing, etc.) and port scanning tools that enable you to check for system vulnerabilities.

Security issues with network monitoring tools From an attacker’s point of view, the traffic-monitoring utilities provide opportunities for “sniffing” network packets, possibly uncovering passwords or the types of software in use on the network. And, the configuration-monitoring and service-monitoring tools let the attacker learn about the network and even “jiggle the doorknob.” They are interesting for the reconnaissance information they can provide, such as information about what applications are run on the network, user ID’s and passwords, how well-connected a site is, and of course, proprietary data.

It’s not enough to protect access to monitoring and diagnostic tools, when possible. You must also protect the information those tools collect from unauthorized access. If an intruder knows, or can determine, where your network monitoring logs are stored, and they gain access to them, they could view your logs (possibly obtaining authentication information such as passwords, or confidential company data) or even remove all traces of their visit to your network. So, it’s prudent to develop a policy for backing up important system logs to off-line storage on a regular basis, in the name of preserving potential evidence. Unfortunately, it’s not unusual at all for a system administrator to collect network traffic or application diagnostic information into a publicly-readable file, even though that information may include user passwords, sensitive data like credit card numbers, etc. Since it’s not feasible to guarantee that no one will ever run packet sniffer software on your network, remember that no packet on your network is immune from being captured by a sniffer, and keep the following in mind: •

•

•

Do not send sensitive information across the network unencrypted (this includes email, files saved to servers, credit card information submitted from a web page to an application server, etc. Use challenge/response authentication techniques instead of those that send passwords in clear text or encryption, in order to minimize opportunities for playback attacks and password stealing Consider probing your network for the presence of unauthorized sniffers periodically, to at least limit the amount of information they gather before being discovered and disconnected Geek Owl! State of the Art in NIDS The “state-of-the-art” in stealthy network monitoring involves monitoring to detect activities like port scanning and monitoring itself. Using techniques like looking for certain streams of packets, or examining packet delays and the responses of systems to specifically constructed packets, it is possible to determine that some sort of monitoring tool is in use on a network. If an attacker detects that monitoring is in use, he may try to “confuse” it by sending many meaningless packets in hopes that his traffic will get lost in the shuffle, or dropped before it is logged by a monitoring system struggling to keep up with the amount of network traffic, thus preventing a log of his activities. Real World Owl! Port Scanning Have you ever run a port scanner like nmap on your network? If not, and if you are authorized to run something like nmap on your network, go get it fromhttp://www.insecure.org. Set it to scan the full range of your network, and all low-numbered ports. (We’d suggest doing this after hours or over the weekend, in order to avoid subjecting the network to additional traffic during work hours). Did it find any systems on your network that you were unaware of? Did it find any enabled services you didn’t expect? Again, make sure you have authorization to do this, before you do. We are not requiring or even expecting the reader to participate in this real world exercise.

SNMP Finally, we want to say a few words about SNMP, the Simple Network Management Protocol (not a tool) that has been in the news lately, due to the security vulnerabilities inherent in it. As we noted earlier, many hardware devices like routers and switches are equipped with SNMP capability. The SNMP network management protocol is used to query network devices for information such as configuration, traffic and error counter values, etc. However, it has also been used by hackers, who take advantage of the fact that the primary way an SNMP query authenticates itself to a device is by providing the right “community name”—which the majority of network installations never change from the default, “public”, and those who do change it find that any password still leaves SNMP vulnerable to the same password-sniffing attacks that work on any system transmitting “secret key” authentication information across the network. Various security flaws in SNMP have recently led vendors to issue software and firmware updates for devices from switches to routers, or to recommend that SNMP be disabled on devices which are not firmware-upgradeable. SNMPv2 will feature improvements to authentication. The usual rule applies here: unless you specifically need SNMP, turn it off. Success Owl!

SNMP SNMP, the Simple Network Management Protocol, is used to query devices for status information, error counters and performance statistics. One security issue with SNMP is that many administrators never change their SNMP community name from the default, “public”, allowing anyone who can reach that device (even across the Internet, if your firewall doesn’t disallow it) and who specifies that community name, to retrieve device information. Another security issue is that even if the community name is reset to something else, the new community name can be discovered by packet sniffing the network. SNMP has had enough reported vulnerabilities that you are advised to disable it on your devices until SNMPv2 arrives. If you can’t disable it, at least make sure all SNMP-enabled devices are running the latest firmware.

3.1.11 Workstations Workstations are the computers on your network that are most likely to be used by end users. (At least, we hope that your non-system-administrator users don’t make a practice of doing their work on servers!) It’s a fancy name for a desktop personal computer connected to a network, usually one which uses files, printers or applications located on one or more network server computers. Workstations are used for day-to-day “work” by users, such as creating documents, writing programs, updating spreadsheets, running graphics packages, etc.

Geek Owl! PC vs. Workstation In “UNIX geek” circles, a distinction is sometimes made between “personal computers” and “workstations”, which are considered to be higher-powered PC’s, equipped with enhanced graphics capabilities, used for activities like animation or CAD/CAM. But in the corporate networking world, the terms “personal computer” and “workstation” are used interchangeably. Workstations typically sit inside the corporate network, with access to internal servers, resources like printers, and possibly the Internet. Users’ access to the Internet may be restricted by web filtering software and/or security measures on corporate firewalls and routers. Unlike a home PC user, who typically has unrestricted access to the Internet from their PC, most corporate workstation users find themselves behind a “guardrail” of some sort.

Security issues with workstations If you’re thinking about security, and have done any work in the help desk field, the fact that these devices are accessed directly by end users should send up a red flag. Remember our point that security is largely a “people” problem? Users can do an absolutely endless variety of interesting things with their computers, which don’t contribute to the security of a network. Some of the common security issues created by users sitting at their workstations include: • •

•

• •

• •

• •

Opening email containing a virus, which infects the user’s system and goes on to propagate itself around the network. Downloading and installing unauthorized company applications such as audio/video players or IRC clients that might contain security holes that could be exploited by malicious users inside or outside the network. Sharing their entire drive with no password, because Joe six cubes down wants access to their electronic library of customer support help documentation (this could be a huge issue if the organization has no firewall or router rules in place to block access to the drive from the Internet). Starting unauthorized services such as Microsoft’s IIS web server, which may be exploitable by others. Not adequately protecting information stored on their computer (for example, by setting the computer up to auto-login so that anyone who turns the system on can access the contents of it and possibly the network as well, or by not passwordprotecting sensitive information). Changing their network password to their first name and last initial. Connecting a modem to their network and setting up a “remote access” application like Timbuktu or PC Anywhere, so that they can dial directly into their computer, and thus your network, from home—probably without having to provide a password. Taking the CPU home for the weekend to finish some work (probably because they were read the riot act the last time they installed PC Anywhere). Going home for the night and leaving themselves logged in, with a proprietary document being edited.

Protecting information stored on the computer is somewhat of a challenge, since any time there is physical access to a system (as with most workstations), getting access to its disk is usually no more complex than inserting just the right boot floppy, or at worst, disassembling the box and taking its disk out. An exception to this is if encryption is used, either on the

system’s most private files, or on the entire disk. Similarly, if they can remove the machine from the office, there’s no telling where your physical asset or its proprietary data might end up! Dot-bomb layoffs and “five-finger severance” have resulted in tens of thousands of dollars of missing computers (and copies of source code) at just two companies one of the authors knows about. And airports today are full of notebooks accidentally left at gates by hurried travelers. Other workstation-based security issues can be more easily resolved. For example, to protect yourself against flaws in workstation OS and application software, keep all software installed on users’ machines up-to-date with the latest security fixes. Also, anti-virus software can scan all incoming email for potential viruses and can be employed on individual workstations to detect and contain a virus if one should appear. Windows system policies and careful assignment of user rights (no, every user does NOT have to be in the Power Users group) can prevent users from installing programs, controlling services, sharing drives to the network, etc. and set up screen savers to lock the workstation after 10 minutes without use. Restrictions can be set on user passwords to mandate an amount of time between password changes, strength of password, etc. It’s also possible to address some potential security issues with changes in hardware configurations. You might consider removing floppy drives, if your systems don’t absolutely require them, in order to eliminate a way in which data can be copied from the network. (Really, when was the last time you needed to use a floppy on a network workstation? And when you did, would it have been that great an inconvenience to go visit one of the few machines that had one?) And to keep users from booting from unauthorized CD-ROM’s or floppies and gaining access to the machine’s disk, consider setting the boot order in the machine’s BIOS to exclude the CD-ROM and floppy, and password protect the BIOS so that the user can’t change the boot order back him or herself. Don’t want your users attaching modems? You can make the task more difficult by removing or disabling the workstation’s serial port. Some of the security measures for workstations still come down to person-to-person communication. Let users know they’re responsible for their system, what happens on it, and what is stored in it. Inform users of your organization’s computer use policies so that users don’t unintentionally violate them and know the penalties if they deliberately do so. Success Owl!

Innocent Actions by Users Many workstation security issues are related to the actions of workstation users, such as: opening email containing a virus, installing unauthorized applications and running unauthorized services, not using a screen saver to lock their systems when away from their desk, sharing their files over the network without adequate protection, using easily “crack-able” passwords and setting up their PC for remote access from home with a modem and software like PC anywhere. Other workstation issues have to do with the ability to boot workstations into OS’s that allow direct access to local data without authentication, such as Windows 98, the potential for data loss via removable media, the ability to

change BIOS configuration information, and even theft of workstation hardware.

3.1.12 Servers In the context of hardware, a server is a device on the network that manages network resources[37] such as files, printers, email, Usenet News or databases. Servers can be positioned on an organization’s internal network or in the more public area of its network, called the DMZ (see section 3.3) that is accessible by Internet users. Servers can be general-purpose computers dedicated to managing one or more resources, or special-purpose “boxes” designed to do a few things well. General-purpose servers can be very similar to workstations, using similar CPU’s, memory, and peripherals. However, there are also some key differences between servers and workstations. Servers typically offer faster I/O (such as SCSI instead of IDE disks), more disk storage, more RAM and support for more processors than a workstation. With a server that is a general-purpose computer, you can change the functionality of the server by changing the software installed on it. This week, it’s a database server running Oracle on Windows. Next week, maybe it’s a file server running Linux. Contrast this to a special-purpose, dedicated server, which will probably only ever do what it was designed to do, be that acting as a fax server, a file server, etc. (Hackers, don’t start. We know that where there’s a will, there’s a way, to make even video game consoles run Linux. But in most cases, the vendor won’t explicitly support it!)

Security issues with servers The same flexibility offered by general-purpose servers can be their security downfall. If you can install other software on a general-purpose server, like a Linux or Windows system, so can an intruder who gains the sufficient privileges. They can install Denial of Service agents, their own monitoring software to alert them of an administrator’s presence on the system, Trojan horse programs in place of original system utilities, etc. On the other side of the customizability spectrum are the special-purpose, dedicated boxes. Most likely, an intruder who gains access to one of these special-purpose servers won’t be installing his own “cracker” programs on it, because they either run an uncommon proprietary OS, or hide a normal one (like Linux) behind layers of menus and don’t allow direct access to the OS. However, what this means is that if a security bug is identified in the firmware for this special-purpose server, you’ll have to live with it (or do without some or all of the server’s functionality) until the vendor supplies a patch. At least in the general-purpose server case, if a security flaw is found in one vendor’s FTP server, you have the option of installing a different one. Of course, a high profile security issue is that Internet users known as “script kiddies” regularly probe any Internet-accessible servers for known holes. It is also possible for internal servers to be attacked inside the corporate network, for instance, by a disgruntled employee seeking access to salary data. No matter where the server is located on the network, it is potentially susceptible to unauthorized access. We mention this because sometimes organizations focus primarily on external threats and fail to consider the possibility of internal threats. The degree of security applied to internal servers depends

both on corporate culture and the sensitivity and value of the information on those servers. It’s legitimate to decide that too much security on internal servers would have an adverse affect on sharing of information, researcher freedom, or developer efficiency. Success Owl!

Servers are a priority Servers are usually a security priority, because they hold valuable resources that need to be accessed by multiple users. Because they supply critical functionality or contain important data, servers tend to be a primary target for hackers. Placing a server within the internal network and not allowing access to it from the Internet does not necessarily mean that it is not vulnerable to attack, because attacks can originate from the internal network (via a disgruntled employee) as well as from the Internet.

Physically, servers are often kept in more secure physical environments than workstations, because their higher value (in terms of their function, data, or hardware itself), need for closer monitoring, or need for being located centrally for ease of performing tasks like backups which can require physical access to the machine if the backup is not performed over the net. This means that the systems aren’t out in the middle of the office, where any user can access the keyboard of a server that a systems administrator didn’t log out of, or boot it with a floppy disk or CD-ROM that would let them access the server’s contents without a proper password. Another consideration related to server hardware is uptime, or the amount of time the server is performing its job vs. the amount of time it’s down for maintenance, repair, or due to software or hardware glitches (called “downtime”). If a workstation goes down, one user is usually inconvenienced. If a server goes down, potentially hundreds (or more) of users can be inconvenienced by an inability to get their work done, resulting in missed deadlines, idle employees and time spent finding workarounds to the situation. Another potential result of excessive downtime is that millions of dollars of revenue can be lost, as EBay found out when a 22-hour outage over June 10 and 11, 1999, cost them an estimated $3 million to $5 million in listing fees refunded to sellers and caused a drop of nearly 30% in their stock price.[38] Since the stakes are high, there is often tremendous incentive to do whatever it takes, to increase uptime. Some common measures to increase uptime include: • •

•

Connecting servers to UPS equipment … or even diesel generators. Purchasing “high availability” servers that support redundant hardware, such as RAID arrays, multiple network cards, power supplies and fans, and hot swappable components that can be replaced without shutting the system down. Clustering servers so that if one goes down, the others can take over the workload Success Owl!

Uptime Answers To increase uptime, consider connecting servers to UPS (uninterruptible power supply) equipment or generators,

implementing multiple-system clustering so that if one server goes down another can take over and using “high availability” hardware with RAID arrays, hot-swappable devices and redundant components. Specific security measures for different types of servers will be discussed in more detail in later sections.

3.1.13 Mobile Devices Mobile Devices participating in your network include everything from Pocket PC and Palm Pilot handheld organizers, to notebook computers, to RF scanners used for managing inventory.

Security issues with mobile devices The key security vulnerabilities of mobile devices are that their portability can lead to easier theft or loss (thus loss of the data stored on the device) and that they usually communicate with the network via a wireless communication mechanism. To guard against loss due to the disappearance of the device, you can take measures such as: • • •

Ensure that data collected by the mobile device is uploaded to the network as quickly as possible, to minimize the amount of data lost if the device goes AWOL Password access to the device, if possible, to make it more difficult for an unauthorized person to view the data on it Install encryption software and make sure that any proprietary information stored on the device is encrypted

Also, when using a mobile device over the airwaves, make sure that any sensitive communications are encrypted. If you’re communicating via 802.11 or other technologies that can be “broken” by curious attackers, you may want to employ an additional layer of encryption on the connection as well. We’ve already discussed VPN software for Windows and Linux platforms. VPN clients are also available for PocketPC 2002 (such as Checkpoint’s VPN-1 client) and Palm (such as Mergic’s PPTP client) based handhelds. Success Owl!

Mobile Device Security Tips When using a mobile device, keep in mind these guidelines: • • • •

Always set a password on the device so that if lost, it will at least take a bit of effort to get to the data Encrypt information stored on the device Consider encrypted communications when using wireless network technology Do not store data only on the mobile device; if using the mobile device for data collection, upload it as soon as practical

Geek Owl! Fun (or Trouble) with PocketPC ActiveSync ActiveSync is the protocol used to synchronize the contents of a PocketPC based

PDA with a desktop PC. Pocket PC synchronization can take place via direct serial connections or via network connections. It turns out that both types of connections are vulnerable to security issues that can compromise data on PocketPC devices or cause DoS situations. ActiveSync serial connection authentication is controlled by a simple 4-digit PIN. If a hostile PC furnishes the correct PIN to the PDA, it can sync that PDA, possibly installing Trojan horses or viruses, and uploading data stored on the PDA. (Brute forcing a 4-digit PIN doesn’t take much time. Note that banks are aware of that, and an ATM would probably eat your ATM card after 5 or 10 incorrect tries to prevent compromise due to PIN-guessing.) ActiveSync over TCP/IP uses port 5679. Anyone with access to port 5679 on a PC running ActiveSync (this includes internal users as well as Internet users) can stage a DoS attack on that ActiveSync server in several different ways. We don’t intend here to single out Microsoft—it’s just that this is a handy illustration of the issues inherent in mobile devices, which people are only now beginning to think about. Mobile devices such as PocketPC’s (and the Windows CE OS on which they are based) have only recently begun to be widely deployed in real world scenarios. As a result, the real world security implications of such devices are still being discovered. [1]

American Heritage Dictionary of the English Language, Fourth Edition, Houghton Mifflin Company, 2000. [2]

http://www.zonelabs.com/store/content/home.jsp

[3]

http://www.symantec.com/sabu/nis/npf

[4]

http://www.kerio.com/us/kpf_home.html

[5]

http://www.vnunet.com/Analysis/1113409

[6]

Firewalls FAQ, ICSA Labs, http://www.icsalabs.com/html/communities/firewalls/faqs/index.shtml, 2000. [7]

http://www.kerio.com/us/beta_section.html

[8]

Russell, Chris. “Understanding Dynamic Route Protocol Vulnerabilities”, Information Security Alliance, Rev 1, October 7, 2001. [9]

Anonymous, Maximum Security, Sams, June, 2001, http://www.nerdbooks.com/item.html?id=0672318717 [10]

http://www.aaws25.hemscott.net/Default%20password%20list.htm

[11]

Turner, Aaron D., Network Insecurity with Switches, http://synfin.net/docs/switch_security.html

[12]

Switching and VLAN Security FAQ, http://www.fefe.de/switch

[13]

http://www.gotomypc.com

[14]

http://www.webex.com

[15]

Worsham, Michael, “Beef up RAS security,” http://searchsystemsmanagement.techtarget.com/tip/1,289483,sid20_gci788334,00.html, Dec 21, 2001. [16]

http://www.phrack.com/show.php?p=49&a=5

[17]

Kuhn, Richard, “Security for Private Branch Exchange Systems”,

[18]

http://www.altigen.com/

[19]

http://www.cisco.com

[20]

http://www.sonicwall.com

[21]

http://www.netscreen.com

[22]

http://www.nokia.com/vpn

[23]

Stanger, James, Patrick T. Lane and Edgar Danielyan, Hack Proofing Linux, Syngress, July, 2001, http://www.nerdbooks.com/item.html?id=1928994342

[24]

Perlmutter, Bruce and Jonathan Zarkower, Virtual Private Networking – A View From the Trenches, Prentice-Hall, November, 1999, http://www.nerdbooks.com/item.html?id=0130203351 [25]

Network Intrusion Detection Systems FAQ, http://www.robertgraham.com/pubs/networkintrusion-detection.html#1.1, Version 0.8.3, March 21, 2000. [26]

http://www.iss.net

[27]

http://www.enterasys.com/ids/

[28]

http://www.nfr.com/

[29]

http://www.snort.org

[30]

Northcutt, Stephen, Donald McLachlan, Judy Novack, Network Intrusion Detection: An Analyst’s Handbook (2nd Edition), New Riders. [31]

http://www.cs.purdue.edu/coast/ids

[32]

http://www.tripwire.com

[33]

ftp://ftp.porcupine.org/pub/security/index.html

[34]

http://www.psionic.com/products/

[35]

http://www.cs.tut.fi/~rammer/aide.html

[36]

http://www.insecure.org/nmap

[37]

Definition of “server”, http://www.webopedia.com

[38]

Breymer, Lynn, “Just what I didn’t need – a little downtime”, http://home.techies.com/Common/Career/199907/Main/Verge070199_m.jsp

3.2 Media Security+ looks at two types of media: network communications media that allows devices on the network to communicate with each other and removable media for data storage. Information can also be exchanged via wireless networking, which is not considered physical “media.”

3.2.1 Coax The initial cabling for Ethernet networks was coax. Thicknet, or 10Base5, is used for longer network distances up to 300 meters and up to 10mb/sec speeds. You can recognize it by its large cable diameter and typically orange or bright blue color. Thinnet, or 10Base2 is used for shorter network distances up to 183 meters and up to 10mb/sec speeds. Geek Owl! Cable Characteristics Thinnet has a smaller diameter than Thicknet; is more flexible; and, is easier to work with than Thicknet. For example, to connect a computer to a Thicknet segment, you have to install a transceiver onto the Thicknet cable, and then connect the computer to the transceiver with a transceiver cable. In contrast, to connect a computer to a Thinnet segment, you only have to add another length of Thinnet cable to your existing network, put a “Tee” connector on it, then connect the Tee to the computer network card’s 10Base2 port and possibly put a terminating resistor on one end of the Tee if the computer was at the end of the bus network. For the most part, coax network segments have been replaced by fiber and UTP/STP. However, coax may still be in use within some organizations.

Security issues with coax A primary security consideration of coax-based network segments is reliability. Thinnet was used in many small networks in the late 1980’s and early 1990’s because it was the least expensive alternative at the time, and easier to work with than the “frozen garden hose”-like Thicknet. However, Thinnet is also less reliable than other alternatives. Because coax is used to implement bus topology networks, a fault could bring down the network. 10Base2 cabling, which looks very similar to cable TV wiring, is very flexible and susceptible to problems due to kinks, being run over by an office chair, crushed by a server box, etc.

While 10Base2 cable looks like TV cable, it is NOT the same physical media. If TV cable is used for a Thinnet network, it may appear to work (for a while at least), but your network will experience performance and packet error issues. In addition to issues with the cable itself, there could also be issues with connectors and terminators. A loose connection or missing terminator could cause erratic network performance, with reduced speed, high frame transmission error counts, or even a lack of network connectivity as the result. Similarly, with Thicknet, a malfunctioning transceiver could also cause excessive packet transmissions, frame transmission errors, etc. Since a fault anywhere along the cable is likely to affect the entire segment, coax-based networks don’t have the same level of fault tolerance as UTP/STP based networks. Usually time-consuming trial and error or an expensive diagnostic device like a TDR (Time Domain Reflectometer) is required to locate cable or connector errors on coax-based networks. Another security consideration for 10Base2 coax-based network segments is that it is possible for anyone with access to the cable, to “tap” into it and add an unauthorized device to the network. It’s easy to tap into a Thinnet-based segment (by adding another length of cable with a Tee connector, anywhere along the network), and also possible, though a bit more involved, to tap into Thicknet. Since the device connections on a bus network don’t occur in a centralized location (as with hub-based systems), but rather at any convenient point along the cable, it is more difficult to physically monitor for these unauthorized devices. To compensate for this, if your network includes coax segments, you might want to regularly scan those network segments with a network scanner program like nmap (mentioned in an earlier section) and flag any unknown devices. Success Owl!

Coax Security Issues Security issues with coax-based networks include reliability and the ease with which a coax network can be physically “tapped” to another device to the network.

3.2.2 UTP/STP In recent years, most workstation connectivity (and some server connectivity) has been accomplished with twisted pair cabling—either UTP (unshielded twisted pair) or STP (shielded twisted pair). It is easier to work with, generally less expensive today, and supports higher speeds (up to 1gbit/sec) than the coax Thicknet and Thinnet approaches. STP is typically used for Token Ring network cabling and UTP for twisted-pair Ethernet. In Ethernet networks, twisted pair cables with RJ-14 jacks (8-wire connectors that look like large RJ-11 telephone jacks) are used to connect computers with hubs or switches, which connect together into local area networks. Twisted pair can be used to wire 10BaseT (10mbit/sec), 100BaseTX (100mbit/sec) and 10000BaseT (1gbit/sec) networks. Common physical cable standards are Cat3 (up to 10mbit/sec), Cat5 (generally 10mbit/sec, sometimes up to 100mbit/sec), Cat5e and Cat7 (up to 100mbit/sec) In Token Ring networks typically found in organizations whose technology is IBM-based, Type 1 STP cables are normally used to connect computers to the network.

Security issues with UTP/STP With twisted pair networks, the main security concern is not so much direct tapping into existing cable, but adding devices to the network by plugging easily-available cables into unused ports on existing hubs, switches and routers. You can physically inspect the hubs, switches and routers on your network, to ensure that only the ports you expect are being used, are in use. You can also employ software-based network monitoring techniques to detect unauthorized nodes, as on coax-based network segments. Another security vulnerability of twisted pair (and coax-based) networks is that since they transmit information via electric pulses, they emit small amounts of electromagnetic radiation that could conceivably be eavesdropped on, by someone with the right equipment and sufficient interest. Networks built with twisted pair cable tend to have greater fault tolerance than those built with coax. Because devices are physically arranged in a “star” network configuration, a problem with the connection of one device to the network, or one port on a hub, typically does not interfere with the rest of the network. As with Thinnet coax, many kinds of twisted pair cables look alike, but do not work alike. Be sure that you are not using Cat3 cabling to wire a gigabit network, or that if you use UTP on your STP-based Token Ring, you install the appropriate media filters to compensate for the extra noise on a UTP cable. Success Owl!

Unshielded Twisted Pair (UTP) Issues The ease of adding devices to a UTP based network, and UTP’s vulnerability to being eavesdropped on by monitoring electromagnetic radiation emissions, are the key security issues for UTP based networks.

When buying twisted pair cabling, you need to take into account WHERE you are installing it. When running twisted pair cable in certain locations (such as in a suspended ceiling or within conduit), you need to use a more expensive version, called “plenum cable”, which has a different type of outer jacket to comply with building and fire codes.

3.2.3 Fiber Before scientists ratcheted up the speed of twisted pair technologies, the main option available to those who wanted faster networking, was fiber. Fiber-optic cabling uses light pulses instead of electrons, as in copper-based technologies, to transmit information. There are a variety of cable standards, supporting 100mbit/sec (100BaseFX) and 1gbit/sec (1000BaseSX, 1000BaseLX, 1000BaseLH, and 1000BaseZH) Ethernet. A number of connectors may be used as well, from the older SMA connector, to the newer, easier-to-use ST and SC connectors.[39] Today fiber is often the cabling of choice within data center environments used to connect systems into fault-tolerant clusters, attach storage area networks, etc. It is also in use where an excess of electrical “noise” in the environment makes twisted pair impractical, such as a factory floor. Fiber also has some additional data-security advantages over copper-based technologies. The cable itself is difficult to “tap” into by someone who wants to add an unauthorized node to the network, and since fiber does not radiate electromagnetic

energy, emissions cannot be intercepted.[40] It is also resistant to RF interference that might affect other types of cabling, causing transmission errors and dropped packets. Fiber-optic cable can be challenging to install and maintain, depending on the precise technologies in use. Because fiber-optics involves passing light around a network, it is important for the connections to be as perfect as possible, to minimize the loss of light, and thus signal, at the connection. In earlier days, fiber optic cable breaks meant major efforts to polish the ends of the broken cable and reattach them, but fortunately, technology has advanced and vendors have introduced easier ways to deal with fiber-optic cable breaks. Success Owl!

Fiber Positives and Less than Positive Security advantages of fiber-optic cable include the facts that it is difficult to tap and resistant to RF interference. Disadvantages include the fact that traditionally fiber has been more difficult to work with, than other technologies like UTP, although this situation has been improving over the years.

As with twisted pair, if you are running fiber in certain locations like suspended ceilings or conduit, be sure that you are using a plenum-certified variety of cable. Outside the data center, you may also see fiber-optic cable used instead of standard video cable in high-security theft or intrusion alarm systems.

3.2.4 Removable media Removable media refers to data storage media that is somewhat portable, that is, it is not permanently fixed to a server or workstation. Removable media is often used for data transfer between systems, software or database product distribution, and off-site backups. In this section, we discuss various types of removable media including tape, CDR, hard drives, diskettes, flash memory cards and smart cards.

Security issues with removable media Security considerations to keep in mind, in the area of removable media, include the following: •

•

•

It enables data to be transported outside your physical network, without being filtered through a device like an internet gateway, possibly allowing unauthorized removal of data from the site. It is used to store data securely, for disaster recovery backup and archival purposes, with the expectation that the data can be retrieved from the media at a later date, if needed, so you should consider the life of the media, and the ease with which data can be restored. Destruction of data on removable media, to ensure that no data can be retrieved off the media in the future, can be a challenge

•

Depending on your OS, the OS may “helpfully” decrypt data stored on an encrypted file system, when writing to removable media—without notifying you of the decryption

On the subject of data storage, depending on your security requirements, you may opt to encrypt data on removable media so that even if it is lost or stolen, unauthorized personnel still cannot read it. Success Owl!

Removable? Encrypt It! Removable media is portable—which means that the data on it is portable also. Generally anyone with access to the physical media can read the data on it. If the data is confidential, make sure it is encrypted on the media so that even if the media is lost or stolen, the data cannot be obtained. When using removable media for backup/archival, be sure that you are using media with a “life” long enough for your purposes, or that you have a plan to periodically restore archived data and re-write it on new removable media. Also, when dealing with backup/archival, make sure that you regularly test the “restore” process, to make sure that you can read the data off the removable media, back on to the system. Finally, it can be difficult to completely destroy data stored on removable media (or any media whatsoever), so care must be taken when disposing of it.

3.2.4.1 Tape Tape is the traditional high-volume backup media. It has historically had the advantage of providing the most storage for the least cost, at an acceptable (though not incredible) speed. Because of its ability to hold large amounts of material, it was also often used prior to the popularity of CD-ROM technology, for the distribution of software or data from one organization to another. When choosing a type of media and removable media drive, consider the duty cycle of the equipment (how many hours’ use it can take per month/year), the life of the media (some media will last a couple years, others will last decades) and your backup needs so that you neither over buy (going for an expensive solution that’s more than you need) or under buy (and end up replacing your drive every 3 months, and tending backups for hours each night). The drive and media manufacturers are the best source of this information. Note that different brands of media, for the same type of drive, often have different lifetimes. Geek Owl! The many formats of Tape Common capacities and form factors of tape include: 1. 4mm DAT (Digital Audio Tape, which is used for more than just audio), holding 4, 8 (DDS-2), 24 (DDS-3), or 20/40 (DDS-4) GB 2. DLT (Digital Linear Tape), holding 10/15/20/30 (DLT III) 40/80 (DLT

IV) GB, with the new Super DLT having 110/220GB capacities 3. 8mm (“Exabyte”), at many capacities from 2.5GB to 50GB 4. Travan (a standard for HP/Colorado tape drives), at many capacities up to 40GB 5. QIC (Quarter Inch Cartridge, an older standard), holding from 60MB to 2GB 6. 9-track (the large spools of “reel-to-reel” tape seen in all those Grade-B movies) A characteristic that tape shares with most other magnetic media is that it can be rewritten. When you no longer need the information on the tape, you just reuse the tape and the old information is written over by new. As with other magnetic media, if you don’t want to overwrite the tape, but do want to erase the data on it, a large magnet (sometimes called a bulk eraser or de-gasser) can be used to disrupt the magnetic storage mechanism, effectively “erasing” the tape.

Security issues with tape From a security standpoint, be aware of the difficulty of truly deleting information from magnetic media. Some types of disk and tape that are overwritten or bulk erased, such as a DAT or 8mm tape, may still be able to have data extracted through use of special hardware and software. Geek Owl! Magnetic Tao How can data be restored from an erased tape? It’s due to the magnetic properties of the media. When data is written to a specific location on magnetic media, the read/write heads do not always align with complete precision over the same exact spot, each time it is written to, and the strength of the magnetic field is not always completely uniform. According to Peter Gutmann, “The recovery of at least one or two layers of overwritten data isn’t too hard to perform by reading the signal from the analog head electronics with a high-quality digital sampling oscilloscope, downloading the sampled waveform to a PC, and analyzing it in software to recover the previously recorded signal”[41], and other methods will recover data from even longer ago. For that matter, evidence suggests that, over time, some media may become more difficult to erase. Because of the difficulty of assuring that “bulk erasing” truly does render the data nonretrievable, physical destruction of media or use of a “secure delete” program is recommended to maintain confidentiality. “Secure delete” programs work by performing multiple overwrite passes with disk caching disabled, among other techniques.[42] Some options are SDel, available include: Secure Delete[43] Windows Macintosh[44] Secure-delete UNIX/Linux[45] Sure Delete[46]

Magnetic media is also prone to damage by aging and extreme temperatures. Therefore, many organizations use temperature-controlled off-site data storage facilities (did you know that if you want to pony up the $$, you can store your data in Fort Knox?!), and have a policy of restoring and rewriting critical archival data before the useful life of the media is reached. If you need to read, write or store media in other than typical office conditions, check the removable media technology, and the specific brand of media you purchase, to make sure that it will function properly in your environment. Another thing to keep in mind when deciding where to store magnetic media such as tape or diskettes (or hard disks) is that the data on the media is vulnerable to corruption if it is stored near a device that can disrupt the magnetic properties of the media. For example, it is not a good idea to store backup tapes on top of your big, bad computer speakers (which contain big magnets—somewhat similar to those used for bulk erasing magnetic media!). Another concern regarding the use of tapes and diskettes as backup or archival media is that unlike hard disks, tapes and diskettes do not have self-contained read/write heads (the part of the drive that translates between magnetic impulses on the media, and the 0’s and 1’s understood by computers). This matters when considering restorability because it is possible, if the data was written on a drive whose heads are out of alignment, and then the restore is attempted on a drive with properly aligned heads that the data will not be readable, and in fact, will only be readable by the drive on which it was written. More than a few notebook owners, one of your authors included, know of at least one road warrior notebook whose floppy drive wrote diskettes readable only by it! The time to find this out, so that the drive can be replaced or repaired, is BEFORE you need to read the data off the media at another site. Therefore, if using magnetic media for backup/archival purposes, build into your operational schedule regular “restore” tests, and use a different system and different drive to perform the test. A final concern about all media used for archiving is that it’s no use to have media that lasts for 50 years, if 50 years from now, you don’t have a way to read the data off of it. For this reason, many companies also store a duplicate tape/disk/CD-ROM unit with the media itself—and sometimes an entire PC, if the device uses a non-standard interface like a special PCI card rather than SCSI, IDE, etc. Success Owl!

Magnetic Security Security issues with tape include: it can be difficult to completely remove all traces of data from a tape, the media may deteriorate over time due to age/humidity/temperature, data stored on magnetic media is vulnerable to corruption by interference with its magnetic properties, it is possible to write a tape on a misaligned drive and then find out it can’t be read on other drives, and you have access to the proper “restore” hardware to read data, if you want to access it in the future.

Figure 27: Sure Delete not only does a confirmed delete of files, it cleans up ‘empty space’ on drives and is free

3.2.4.2 CDR Recordable (CD-R, or Compact Disc Recordable) and Rewritable (CD-RW, or Compact Disk-Rewritable) CD-ROM technology has become popular for moderate-sized backups, due to the modest cost of drives and media. Other interesting uses have appeared as well[47].

Figure 28: If you look carefully you can see that the CD-RW (left) has less reflection than the CD-R (Right). This can cause some CD units to not ‘see’ a CD-RW CD-R allows for an area of the disc to be written once, although the entire disk does not have to be written all at the same time; CD-RW allows any area of the disc to be rewritten multiple times. Unlike tape and hard discs, CDR is based on optical technology with a laser used to create “pits” and “lands” in the media to store data. How do you choose between the different types of CDR media? CD-R media tends to be less expensive, but keep in mind that it cannot be re-used. Once you’ve filled up the disk, you can’t go back and delete data off it to free up space, and continue writing. However, this is not necessarily a bad thing from the point of view of archiving. You may specifically WANT to write data onto media permanently, so that it cannot be altered or deleted once it is written. With CD-RW on the other hand, you can use it almost like a hard disk, adding and deleting files as desired.

Geek Owl! CD Replacing Tape CD has largely replaced both tape and diskette as the software distribution media of choice, because of the “Orange Book” physical standards which help ensure compatibility, capacity (usually 650meg to 700meg, per disk), and adoption of standardized CD file system formats such as ISO and El Torito by vendors and the wide availability of CD-ROM drives. CD-R’s and CD-RWs are usually the size of a typical audio CD, however, some manufacturers make them in “interesting” formats such as business-card-sized CD’s, and “cd single” sized CD’s which have a lower capacity (150MB) than full-sized CD’s. A note to those buying media: CD-R’s and CD-RW’s are not quite created equal. There are “fast” discs (supporting fast write speeds like 24x) and “slow” discs (supporting slower write speeds like 4x), and varying levels of media quality. You generally get what you pay for here. Those bargain CD-R’s may only be burnable at low speed (which increases the time it takes to write the info to the disc), or may have a very short life. For one-off temporary-use copies, bargain media may be sufficient. For backups, it almost certainly is not. The composition of the media varies, depending on brand and quality. It consists of a reflective layer (either a silvery alloy, or 24K gold) and can include: 1. 2. 3. 4.

Cyanine dye (blue) phthalocyanine dye (aqua) Metallized azo dye (dark blue) Formazan dye (light green)

The type of reflective layer and dye may have a bearing on how long the media lasts (for example, phthalocyanine dye based CD’s are less sensitive to sunlight and UV radiation, while cyanine dye based CD’s are more forgiving of read/write power variations between drives). Additionally, some CD’s have an extra coating to help the CD resist scratches. Since scratching is one of the easiest ways to damage a CD-R or CD-RW, it is recommended that full-disc labels be used, to cover the top of the disc, to protect it from scratches and prolong its life.

Security issues with CDR How long will a CD-R or CD-RW last? This is a matter for some debate, since the claims now being made for some types of discs, such as 75 years for cyanine dye, 100 years for phthalocyanine dye on gold discs or even 200 years for phthalocyanine dye on “platinum” discs. Unrecorded (blank) discs are estimated to have a shelf life of 5-10 years. On the care and keeping of CD-R’s and CD-RWs, CD-R FAQ recommends, “keep them in a cool, dark, dry place and they will probably live longer than you do,” because aside from scratching, the main enemies of CD-R’s are heat, humidity and direct sunlight (CDs, not being magnetic media, are not sensitive to magnetic fields).[48] Along these lines, what if you have CD-Rs or CD-RWs containing proprietary data, which you want to render unreadable before disposing of? Again, the CD-R FAQ has suggestions, such as scraping off the reflective layer with something sharp (warning: this

may still leave data on the dye residue), running the disc through a sander, etc. Although not a mil-spec procedure for rendering all data on a CD unreadable, a combination of scratching the surface and breaking the CD into pieces seems to be popular. Since data is redundantly written to multiple locations on a CD, if you do this, make sure you’ve done more than make a few token scratches on the media. Success Owl!

CDR Security Security concerns related to CD-R media include its vulnerability to damage via scratching, heat, humidity and direct sunlight. Another concern is that, as with magnetic media, it is can be difficult to destroy the media in a way that ensures no data can be retrieved from it. To erase a CD-R, you can take actions like scraping the reflective layer off the media with a sharp object, scratching the media and breaking the CD into many pieces.

3.2.4.3 Hard drives Recently, with the dropping prices of high-capacity hard disks (100 GB and up), they’ve become a viable off-line as well as on-line (via RAID) backup option. Want to send data offsite? Many servers are already equipped with removable hard drive bays. You can often identify them by the row of disc-sized panels with handles, on the front of the server case. For under $100, you can acquire a removable-drive bay, and a caddy that fits inside it, to make your own hard disk-based removable media system. Buy a hard disk of the appropriate capacity, install it in the caddy, and you’re set. However, this “homebrew” approach may not give you all of the benefits of a server-removable drive system. For example, many servers feature “hot swappable” hard drive subsystems allowing drives to be removed and replaced on the system while it is running without affecting system operation.

Figure 29: The mechanical and magnetic nature of a hard drive requires careful handling Geek Owl! Hard Drive Types The most common types of hard drives today are IDE (used on most network workstations), and SCSI (used on most network servers), with IDE as the low-

cost leader and SCSI as the performance leader. Hard drives are available in a variety of form factors (from PCMCIA-card sized drives used in notebooks, to 3.5” drives often used in servers), capacities and speeds.

Security issues with hard drives In contrast with the other media solutions we’ve looked at so far, a hard drive contains both media and the read/write mechanism (tapes and CD-R’s are just media … the drive contains the read/write mechanism). Because of the mechanical nature of the read/write mechanism, with heads hovering just barely above the surface of the media platters within the drive, hard drives are very sensitive to shock. For instance, dropping a hard drive is very likely to result in a non-working drive (though some of the data may still be able to be recovered), but dropping a CD or tape is likely to be a non-event. Again, as with tape, hard drives are magnetic media, and are sensitive to magnetic fields, thus care should be taken to keep them away from large magnets, like those in your computer speakers! In general, the faster the drive, the more expensive, and the more heat it generates. The heat generated by a hard drive can be a concern because it can affect the reliability and lifetime of any part of the computer that is temperature-sensitive (that is, most of them). Therefore, many users who want fast hard drives opt for larger cases with better airflow, and may add extra fans to the computer case, to help cool the system. Unlike CD-R’s, which cannot be erased once written, and tapes and diskettes which have mechanical protection against accidental overwrite (if the user wishes to employ it), most hard disks cannot be “write-protected” in hardware, so there’s always a risk that a critical piece of data will be overwritten or erased with a “format c:” or “rm *”. Many hard drives have a MTBF (Mean Time Between Failure) rating, to allow you to compare the useful life of the drive with other similar drives since part of building a reliable system is simply choosing parts that are less likely to fail. The MTBF is usually measured in hours of operation. One interesting fact about this is that notebook drives often have a much lower MTBF than workstation or server drives. The manufacturers assume that a notebook drive will not be in use as much per day, as a typical desktop or server machine’s drive would be. Success Owl!

Hard Drive Security Security concerns with hard drives include their sensitivity to damage from physical shock, vulnerability to data corruption by disruption of magnetic media properties, the amount of heat some hard drives generate, a lack of “write protection” on most hard disks, and the varying estimated lifetime (MTBF, or Mean Time Between Failure) of different models and types of hard drives.

Because every day people lose data on hard drives that weren’t backed up recently (or at all), the data recovery industry is thriving. Did your disk stop working? Was there a “head crash”

in which the read/write heads of the disk contact the media surface with some force, damaging it? Got errant fingers “rm –r /”? There are plenty of “data recovery” companies, who specialize in getting the data off a disk, no matter what’s happened to it, that are ready to help you, for a price. Just search the Internet for “data recovery”. In many cases, they’ll have to totally take apart the drive, rendering it unusable, and you’ll have to replace it, but chances are that’s less important to you than getting your data back. For lesser accidents, you can purchase disk recovery software from companies such as OnTrack and Norton, which may help you do the job without enlisting expensive professionals and/or risking sending the disk two states away via a delivery service (ever see what those overnight delivery guys do with boxes when they think no one’s looking?).

3.2.4.4 Diskettes Diskettes are still sometimes used for small software/patch/configuration distribution, and emergency system boots, in some environments. Although not usually positioned as a backup solution in corporate environments, diskettes were at one time the personal backup solution of choice, since every computer was already equipped with a floppy drive and everything else was generally outside the price range of non-business users. The primary type of diskette in use today is the 3.5” 1.44meg diskette. The disc is covered by a hard, square, plastic shell. To protect the data on the disc, you can adjust the “write tab” on the disc. When inserted in a drive, the drive will detect the position of the write tab, and not allow the disk to be written to (or reformatted) if the user has set the tab appropriately. Older types of diskettes, such as 5.25” diskettes, were not covered with hard plastic. Instead, they were placed in a flexible plastic envelope. The flexible characteristic of these older diskettes explains why they were commonly called “floppy diskettes”.

Security issues with diskettes Truly “floppy” diskettes (5.25” or 8”) are vulnerable to damage by well-meaning users who aren’t familiar with the technology. For example, users have been known to fold them in half like a piece of paper, or staple them to notebooks for safekeeping. The hard covering on newer 3.5” diskettes makes them much more resistant to damage. Another issue is that since diskettes are magnetic media, devices and objects that disrupt the magnetic properties of the media can affect them. Success Owl!

Diskette Security Like tape and hard drives, diskettes are also magnetic media, and thus can be affected by EMF, so they should be stored appropriately.

3.2.4.5 Flashcards A media technology that has been rapidly gaining in popularity for electronic devices like PDA’s, MP3 players and digital cameras, as well as for data exchange among

computers, is the flash memory card, or “flashcard” (not to be confused with the very-lowcapacity media you might have used in 2nd grade to learn math).

Figure 30: The extremely small size of SmartMedia makes taking a huge amount of data very easy to transport without being noticed Flashcards offer “persistent” memory, sort of a cross between the no-moving-parts attribute of RAM and the ability to maintain data even without a continuous supply of power offered by magnetic and optical media. Geek Owl! Flash Card Types A number of different types of flashcards are in common use today, including: 1. 2. 3. 4. 5. 6.

Compact Flash (CF) Smart Media (SM) Memory Stick (MS) Multi-Media Card (MMC) Secure Digital (SD) XD-Picture Card

Flashcards are a convenient way to transport large amounts of data in a very small space, usually without worrying about format issues. For example, a CF card written by a digital camera can usually be popped into an adapter on a desktop, and read, as if it were a CD or floppy. Additionally, flash memory cards are more durable than most media, even diskettes, thus making them useful for transporting data. Since they are solid-state devices, there’s no mechanical wear and tear, and unlike optical media, no concern about scratching. The main disadvantage to this type of media is high cost (hundreds of dollars for a card which stores less than a CD-R, for example).

Geek Owl! Flash Card Storage Capacities offered by these cards are constantly growing. For example, CF cards are up to 1 GB. In terms of CF, be aware that there are both Type I and Type II cards. If you have an older device that accepts CF, you may not be able to use Type II devices such as the “micro-drive”, which is really a miniature hard drive in a CF form factor, not a true CF technology device. CF is very similar to PCMCIA, so a CF card can be used in a standard notebook PCMCIA slot with the simple addition of a 50-pin to 68-pin adapter. In contrast to CF, which contains both memory and the controller used to access it, the smaller Smart Media cards contain only the memory, laminated onto a plastic card. Because the controller used to access the memory sits outside the card itself, there are occasionally compatibility problems between newer SM cards and older SM devices like digital cameras. While for some time, CF and SD media sizes ran neck-to-neck currently CF cards provide larger storage capacities. This in combination with SM’s less durable construction (it is a very thin card) makes CF a more attractive option when using a device that supports both. It is anticipated that Smart Media is gradually being replaced by the new XD-Picture Card technology, which allows storage of up to 8 GB in a card the size of a postage stamp. This is interesting from a security point of view because of the sheer volume of information that can be carried around (or out of an environment) very unobtrusively. Memory Stick is a Sony technology. MS slots are built into many Sony cameras and desktop/notebook computers. This makes MS technology sometimes more convenient than other types since an adapter is often not required as long as you stay within the Sony brand family. Of course, any time you exchange with non-Sony technology, an adapter probably will be required. A newer version, called the Memory Stick Duo, is smaller than the original Memory Stick. While most Memory Sticks sold are of the generic type, there is also a hard-to-find copyrightprotected Memory Stick available, which protects the contents from illegal copying. Secure Digital and Multi Media Cards are closely related. Most devices that support one also support the other (although there are some devices which are compatible only with one or the other; check the device specs for the final word). SD, currently popular in Pocket PC’s, is an evolution of the original MMC. The word “Secure” conjures up images of built-in encryption, passwords and other great security features, but alas, it refers to compatibility with the Secure Digital Music Initiative specifications, which allows the copyright owner to specify if the data can be transferred, and if so, how many times. So, the primary security benefit available from these cards is that of creating software or data repositories that can be used anywhere, but not “pirated” for use in multiple locations at once.[49]

Security issues with flashcards The different physical formats of flashcards are not compatible with each other, so you must be certain when you purchase one, that the type you’re buying is supported by your device.

All of these types of cards (except the Memory Stick) usually require an inexpensive adapter when they’re used in a computer (whether it’s a PCMCIA adapter, or a USB or serial reader device), so when transferring data, make sure that you have an appropriate adapter that can be used to read the card, on the destination computer. Due to their very small size, flashcards are vulnerable to theft. Depending on the type of media, a gigabyte of data, or more, may be stored on a small device about the size of a large postage stamp or small key chain. Additionally, the USB version of these devices may be attached to any computer’s USB port, and provide a way to pull data off that computer and remove the data from the site, even if that PC has been carefully locked down by removing floppy drive and CD-R capability. Flashcards are most often used in combination with electronic devices such as digital cameras and MP3 player/recorders, which do not support reading or writing encrypted files. Because of this, you should be aware that data exchanged with these devices via flashcard will be stored unencrypted, and is thus available for access by anyone who obtains the card. If you are using a flash card as storage for a Palm or Pocket PC, there are numerous programs that will encrypt data, so that loss of the device or card does not necessarily mean that the data on it is accessible by unauthorized personnel. Along the same lines, some people have begun to use flashcards (and their cousins, solid-state USB “storage units) as portable storage media, copying data off one computer and then onto another. If you’re copying a file off a Windows 2000 system, and that file is encrypted using Windows 2000’s built-in encryption, be aware that when you copy it to the flashcard, whose file system does not support encryption, the portable copy of the file will not be encrypted. Flashcards tend to allow a more limited number of write/read cycles before failure, than hard disks and RAM. If you plan to use flash memory for frequent data transfer, it’s a good idea to estimate the useful life of the media, and make sure that you have spare cards on hand toward the end of its anticipated life so that operations are not interrupted due to bad media. Success Owl!

Flash Card Security Issues Security issues with flashcards include compatibility concerns, vulnerability to theft, lack of support for encryption in some devices that use flashcards for storage, and limited media life.

For more information about flash memory cards, see the Flash Memory Card Primer[50]

3.2.4.6 Smartcards A smartcard is “a small device, about the size of a credit card, which contains electronic memory and possibly an embedded integrated circuit (IC), which allows them to do a small amount of processing. Smartcards containing an IC (a.k.a. microprocessor) can cost 3-6 times more than non-IC cards, and are sometimes called Integrated Circuit Cards (ICC’s).”[51] Much like flash memory, to access the data on a smartcard, you insert the card into a device known as a smart card reader.

Figure 31: Smart Cards combined with Biometrics deliver a high degree of security. Photo courtesy of the good folks at nexwatch.com © 2002 netwatch.com Photo used with permission Geek Owl! Smart Cards In contrast to flash memory, smart card storage capacity is very small, generally ranging from 8K to 32K. No, this isn’t much at all! And this is complicated by the fact that if you have a programmable card, the available storage often must hold both your program code and the data you wish to store. Smartcards can be used for a variety of purposes, including storage of personal data like medical records, newer cell phone configuration information, management of passwords and digital certificate data, electronic “cash” (school dining credits, department store gift cards, etc), access control (the widely used “card key”) and generating network authentication information (using a one-time password instead of a fixed password every time you login). Success Owl!

Smartcard A smartcard is a small, credit card sized device that contains memory and sometimes an IC that allows the card to do some processing, like encryption or calculation of a password. Smartcards containing an IC (processor) cost more than smartcards containing only memory. Smartcards are often used for access control (“card keys”) and authentication (generating secure one-time passwords). They can also be used to store “electronic cash” (such as school dining credits) and digital certificate data.

It is estimated that as of the end of 1999, more than 1.5 billion smartcards were in use worldwide. They are managed by smartcard life cycle management software, which is generally obtained from a different source than the smart cards themselves, such as Bellid[52] or Litronic[53]. Because the capabilities of smartcards differ so substantially, you need to look at a variety of areas when evaluating smart cards, including security features, supported applications, storage capacity, and standards supported, data access controls, processor support, programming methods and algorithms supported.

Security features on smartcards, in addition to the embedded memory and possible IC, may include pictures, biometric data storage, bar codes, a magnetic stripe (as in credit cards) and even a very small antenna (for wireless communication that doesn’t require the card surface actually contact the reader). Additionally, the chip, by virtue of being embedded in the card, is tamper-resistant. Typically each card has its own serial number[54]. Geek Owl! One Smartcard, More than one Memory Type An interesting aspect of smartcards is that they may contain more than one type of memory, for security purposes. For example, memory is either read only, or read/write. And within each of these types, are other types: memory which can be accessed without providing credentials (“public”), memory that can be accessed without a PIN but with other access controls (“scratch pad”), memory that can only be accessed with a PIN (“private”), “emergency” memory that can be written to or read from even after the card’s preset expiration date. Most smartcards support at least one standard encryption algorithm, since without encryption, anyone who can read the card, can retrieve the data off it. Encryption algorithms that may be available on smartcards include DES, 3DES, Diffie-Hellman, MD5, SHA-1, the NISTapproved DSA, Rinjdael, KEA, RSA, and ECDSA. (Some of these are discussed in more detail in section 4 of this book.) It has been said that “the nice thing about standards is that there are so many to choose from,” and in the case of smartcards, that’s definitely true. There are at least 25 standards a smartcard can choose to comply with, including ISO/IEC, FIPS, ANSI, X.509 (certificate) and EMV standards, which define physical, electronic, algorithmic and formatting standards. Important from a security standpoint would be the FIPS-140, Level 3 standards level, an NIST security requirement for cryptographic modules. A de-facto standard for programmable cards that is gaining in popularity is that of Java support, with other options being Visual Basic or MULTOS. Most new smartcard applications are written in java, so using a Java-based smart card will allow you the greatest choice of applications, as well as comply with the GlobalPlatforms.org standards. Federal Government users choosing a Java-programmable smartcard should make sure that the one they select is FIPS certified, such as Schlumberger’s Java smartcard. The software running on the card itself is not the only area of compatibility to consider when selecting a smartcard. You should also make sure that the smartcard reader and smart card lifecycle management software you choose works with the operating systems and OS versions on which you plan to use them. If you are interested in implementing smartcards in your organization, check out the current offerings from ActivCard[55], Datakey[56], GemPlus[57], Oberthur[58] and Schlumberger[59]. A great resource to start with is Smart Cards From Scratch[60].

Security issues with smartcards

Smartcards are often used as part of an authentication process. Because it is possible for the smartcard to be lost or stolen, it is important that the authentication process depend on “something you know” (like a PIN) or “something you are” (like biometric data) as well as the smartcard (“something you have”), when access to sensitive data and resources is involved. The risk of someone else coming into possession of the smartcard means that any data stored on the card should be encrypted to protect against unauthorized access. Additionally, since there are many different formats of smartcards, you should be sure to have readers compatible with your chosen card available in all locations in which you might wish to retrieve data. (Without the proper reader device, you can’t get to the data.) Success Owl!

Smartcard Security Issues Security concerns with smartcards involve compatibility issues, vulnerability to theft, and the fact that sometimes a secondary method of identification should be used along with the smartcard to protect sensitive resources from access by unauthorized people.

Figure 32: Netwatch provides Smartcard with Biometric confirmation. Photo courtesy of Nexwatch ©2002 Nexwatch61 [39]

Houser, Tcat and O’Boyle, Helen Inside Scoop to Network+ Certification, Total Recall Press, 2002 ISBN 159095202-2

[40]

“Cable Construction,” NetOptics, http://www.netoptics.com/5.html.

[41]

Gutmann, Peter, “Secure Deletion of Data from Magnetic and Solid-State Memory”, Sixth Usenix Security Symposium Proceedings, San Jose, California, July 22-25, 1996. [42]

SDel product home page, JRTwine Software,

[43]

http://www.jrtwine.com/Products/SDEL/

[44]

http://www.aladdinsys.com

[45]

http://www.stokely.com/unix.sysadm.resources/disk.printing.html#disk.secdel.link

[46]

http://www.wizard-industries.com/sdel.html

[47]

www.m4postcard.co.uk

[48]

McFadden, Andy, CD-Recordable FAQ, http://www.cdfaq.org

[49]

Flash Memory Card Primer, http://www.onepc.net

[50]

http://www.onepc.net.

[51]

“Smart Card”, http://www.webopedia.com

[52]

http://www.bellid.com/

[53]

http://www.sspsolutions.com/solutions/government

[54]

“Smart Card Basics”, http://www.gemplus.com/basics/index.html

[55]

http://www.activcard.com

[56]

http://www.datakey.com

[57]

http://www.gemplus.com

[58]

http://www.oberthur.com

[59]

http://www.schlumberger.com

[60]

http://www.nexwatch.com/

3.3 Security Topologies Security topologies deal with the organization of devices on a network, from a security perspective. They can specify the way devices within different zones of your network communicate with each other, and which types of zones are used within the network.

3.3.1 Security Zones Security zones are areas of your network with specific security-related attributes and requirements. We will look at DMZs, intranets and extranets.

3.3.1.1 DMZ The DMZ, or Demilitarized Zone, on a network is “that portion of a company’s network which sits between the Internet and an internal network’s line of defense, usually some combination of firewalls and bastion hosts”[62]. Firewalls were described earlier in this section. Bastion hosts are gateways between inside and outside networks, designed to defend the internal network from attacks aimed at it from outside. Much like in the non-computerized world, a network DMZ, sometimes called a “perimeter network,” is a “neutral zone” that attempts to keep external users and the internal network apart. It is strongly advised that there be an external firewall (or at least a well-configured filtering router) between the DMZ and the Internet as well, for protection of the DMZ, although that is not required for that portion of the network to be considered a DMZ.

Figure 33: DMZ Allows public services such as Web and FTP servers to be available while not risking the private network Success Owl! DMZ A DMZ (Demilitarized Zone) is an area of the network that sits between the Internet and the organization’s internal network. It is a “neutral zone” that keeps external users and the internal network apart, reducing opportunities for unauthorized access. Usually a DMZ is a separate subnet from your internal network, to minimize opportunities for compromises due to traffic sniffing. While, logically speaking, a DMZ is an intermediate area “between” your internal network and the Internet, a network configuration supporting a DMZ is sometimes implemented by using a single router with three port connections (Internet, DMZ and internal network) and good filtering rules between them.

Figure 34: A router of sufficient recourses can handle multiple ports

What services should be run in the DMZ? The DMZ typically contains those devices running services which need Internet access (inbound, outbound or both), such as DNS, email (SMTP), FTP and Web (HTTP) servers. It lets an organization provide access, over the Internet, to a small portion of its network that offers services for external users, without making all hosts on the organization’s network similarly available to random Internet surfers. The hosts and other devices on the DMZ are more “exposed” to the Internet and are thus more vulnerable to attack. Therefore, care should be taken when planning which services and data will reside there, and on administering machines that reside there. A general guideline is to run only the most essential services on your DMZ hosts, because as with security in general, the more applications, ports, services and the like that are available, the greater the number of potentially-exploitable objects there are. Separating the services into ones which must accept connections from Internet hosts and those which need only accept connections from your DMZ host (for example, by having your DMZ-based web server access a database on an internal host) enables you to locate those services which only need to be accessed by DMZ hosts, on your internal network instead of in the DMZ. Success Owl!

DMZ Setup Generally, you would run in the DMZ any services which need to accept connections from the Internet, such as email servers that accept incoming mail from Internet users, web servers meant for use by Internet users and FTP servers.

What services should NOT be in the DMZ? For example, your company’s internal web server not intended for use by those who don’t have access to the internal network, should NOT be placed on the DMZ. Similarly, an internal mail server, like an Exchange Server, which stores individual mailboxes, should be located on the internal network, not in the DMZ. The idea is that if your DMZ is compromised, the information that is most likely to get corrupted or taken is that which is available on the DMZ—information on your internal network will remain private unless access to the DMZ

allows attackers to break into the internal network as well. (Hint: traffic filtering on the router between the DMZ and internal network can help minimize the potential for this.)

Using multiple DMZ’s While organizations usually implement only one DMZ, it is possible to separate your network into multiple DMZ’s, each with a particular purpose (for example, Web server, Database server accessed by Web server, etc.) to further isolate traffic and increase the security of your network. More information on advanced DMZ design can be found in the paper, “Three Tiered DMZs” by Chris Mahn[63]. Success Owl!

Advanced DMZ Setup A network can include multiple DMZ’s, each with its own function (and access rules), for further security.

Security and DMZ’s Because hosts in the DMZ tend to make good targets (not only are they relatively easily accessible, but also, they may be VERY visible, such as a Fortune 500 company’s main external web server), it’s a good idea to pay special attention to locking them down (to minimize security exposures), keeping up-to-date with updates and patches for the OS and application software used on those systems, and to formulate backup and recovery plans which will allow you to restore the system in the event of the almost-inevitable break-in to at least one of the hosts in your DMZ. A DMZ is not without costs, including the cost of additional hardware and software, (possibly) a second firewall, a slight decrease in performance since traffic will not go directly between the Internet and internal hosts and the cost of maintaining and administering the DMZ (including additional security auditing). Nevertheless, it is almost always well worth the expense, since a single break-in when a DMZ is not present can often result in data and staff time losses far in excess of the cost of setting up a DMZ.

3.3.1.2 Intranet An intranet is a logical (not physical) network that is specific to a single organization. It may reside wholly within the organization’s boundaries, and be contained within the company’s internal network, or span across public networks such as the Internet. The traffic that goes across the intranet includes proprietary data that should not be exposed to those outside the organization. Because of the security implications of sending private data across public network links, when planning an intranet that uses these public links, you should also plan to implement VPN technology to authorize users and encrypt the traffic that crosses outside your internal network’s boundaries.[64] Success Owl!

Intranet An intranet is a logical network for use by an organization’s internal personnel. Its network traffic typically includes proprietary data. If

implementing an intranet across public networks such as the Internet, the sensitive data should be protected by an encrypted channel such as a VPN or by the use of SSL for browser-based applications.

3.3.1.3 Extranet An extranet is another type of logical network, which allows a business to connect with suppliers, vendors, customers, stockholders or others related to its business. An extranet is usually run over the Internet, often using a VPN for security. Alternatively, some companies limit their extranet functionality to data exchange via SSL-protected web pages that can only be accessed by authorized parties, and do not implement a VPN. The extranet’s primary components are normally situated within the company’s internal network, allowing limited access to some corporate resources to those outside the organization on a need-to-know basis, and allowing corporate staff to access limited resources on other organizations’ networks as needed. If you are employing a VPN for your intranet, you may wish to employ a second VPN for your extranet, to best separate this “restricted public access” traffic from your completely internal traffic. Success Owl!

Extranet An extranet is an extension of some parts of a company’s network to its business partners, such as suppliers, vendors, customers and stockholders, on a need-to-know basis. Access to the extranet is normally provided over the Internet, using a VPN or SSL-based web pages.

3.3.2 VLANs A VLAN, or Virtual LAN, is a logical subnet created through configuration of networking switches. It may be part of a larger LAN or WAN. One benefit of VLAN is that you can get the benefits of a subnet without requiring hosts to be in physical proximity to each other, or connected to the network using the same physical technology (such as 100BaseT UTP vs. fiber). Switches and other network devices can be configured to pass data that would not normally be passed between subnets (such as broadcast packets) so that it is shared among multiple physical subnets, via a trunking protocol such as the emerging 802.1q standard, or the more secure 802.10 standard. Conversely, you can also use VLAN technology to break a single physical subnet into multiple logical subnets, reducing collisions and broadcast overhead. Success Owl!

VLAN A VLAN (virtual LAN) is a logical subnet created by configuring network switches. It provides the benefits of a subnet without requiring the devices on the VLAN be located near each other or connecting using the same physical technology.

An investigation into security vulnerabilities of VLANs reveals that it is not wise to assume that partitioning your network into VLANs provides the same level of protection

as sub-netting it or carefully designing a routed network the directs traffic appropriately. Researchers discovered through experimentation that it is possible to get the 802.1q trunking frames to hop into a switch’s non-trunk ports and be delivered to their destination, and that it is possible to get 802.1q frames to hop from one VLAN to another if the frames are sent through a switch port attached to the native LAN of the trunk port. While an attacker requires some network knowledge (such as the MAC address of the target machine, and VLAN trunk configuration data) and access (to a switch port on the same VLAN that the trunk port is assigned to) to pull this off, it’s often not impossible, depending on the configuration of the VLAN.[65] Success Owl!

VLAN is Good, not Perfect A VLAN does NOT provide the same level of security as a true subnet that is created by putting a network segment on its own router port.

3.3.3 NAT NAT, or Network Address Translation, allows devices on private networks to communicate with outside networks by “translating” between the network address conventions used by each. This enables you to hide your internal network from the Internet. Typically, NAT is used by an organization connecting its internal network, using a private IP address range, to the Internet. Recall that there is a private IP address range for each Class of TCP/IP network. Since these private IP address ranges cannot be used directly on the Internet, NAT was developed to act as a go-between, mapping internal host, port and connection information, to external connections. Success Owl!

NAT Network Address Translation (NAT) maps private network addresses to public network addresses, allowing devices on private networks to communicate with outside networks.

NAT is most commonly used in TCP/IP networks, and its operation is specified in RFC 1631[66]. It works at OSI layer 3 (the same layer as routers). When constructing packets to be sent out on the Internet, NAT should be applied to the packet before the IPSec encapsulation is performed. The reason for this is that IPSec relies on IP address information in each packet not changing between the time the IPSec encapsulation is applied, and the time the packet is received at the destination IPSec-enabled device. If NAT were applied after IPSec, it would change addresses in data headers and control packets, confusing IPSec. NAT can also be used for tunnel mode IPSec, with the ESP protocol (which does not guard against the address changes that NAT devices make in the IP datagram header). For more information on combining NAT with IPSec, see this Cisco article.[67] Success Owl!

NAT with IPSec To use NAT with IPSec, NAT should be applied to the packet before the

IPSec encapsulation is performed.

Types of NAT NAT can be static or dynamic. In static NAT, there is a one-to-one mapping between each private address and a public address. The NAT process consists of modifying the source IP address on outgoing packets to the public address, and modifying the destination IP address on incoming packets to the private address. In this situation, an organization is required to have as many public network addresses as private network addresses, which sometimes isn’t possible (for technical or political reasons). In dynamic NAT, there is a pool of public addresses, and internal hosts needing Internet connectivity will be mapped to the next available public address on an as-needed basis. When the connection is terminated, the public address is returned to the pool, to be used again. Because of this reuse, it is possible to have a smaller number of public addresses than you have machines with private addresses—as long as all of the internal machines aren’t using the Internet simultaneously. A variation on dynamic NAT is Port Address Translation (PAT). PAT, sometimes known as “single address NAT,” is a specific case of NAT in which there is one external address, and multiple internal computers connecting to Internet hosts through it. In this case, not only does the IP address in the packet change… so does the TCP/IP port number. (This is required because multiple internal connections are sharing the same public IP address simultaneously, and a connection using the same port number on the public address can’t be guaranteed, since someone else may already have it.) An alternate explanation of PAT is that it is used to redirect requests for access to a specific port number on the external address, to a specific internal machine, based on a table of address/port redirections set up by the administrator. For example, if you have one external address, you might redirect port 80 packets to a web server in your network, port 25 packets to a mail server, etc. In this case, the port number of the packet doesn’t change, but the address does. Success Owl!

Mapping Ports/PAT Static NAT involves a fixed one-to-one mapping of a private address to a public address, for each node in the private network. The port numbers in the packet do not change. Dynamic NAT involves as-needed mapping of a private address to the next available public address in a pool of possible addresses. PAT involves mapping multiple private addresses to a single public address. This is accomplished by also translating port numbers. PAT can be used so that requests to different port numbers at the same IP address are routed to different hosts.

Why use NAT? Sometimes organizations use NAT by choice, to improve security by limiting the direct connectivity that is possible between internal network hosts and the outside and make it

more difficult for outside attackers to “map” the target’s internal network. Sometimes, but not always, NAT is combined with a proxy service which ensures that any outside connection inbound to your network terminates at the machine providing the NAT, and is routed to the appropriate internal service with a second, separate connection—making sure that there is never a direct connection from an outside host to an internal server. This isolates your internal network from certain low-level attacks and exploits that might otherwise be possible. Additionally, NAT eases administration by insulating an organization from external IP address changes. Without NAT, if an organization switches providers and is assigned a new Class C address, they would have to change every hard-coded address used in their organization (including configuration information like DHCP servers, DNS servers, etc.). Some organizations and individuals use NAT by necessity. ARIN (the American Registry for Internet Numbers) has long since stopped giving out permanent Internet network addresses, even for small Class C networks, because they were getting close to the point of running out of them. Also, the Internet had expanded to such a point that routing became increasingly difficult with random network addresses scattered all over the Internet—and could be simplified considerably if things were set up so that certain super blocks of net addresses, consisting of multiple Class (n) addresses, were all assigned to the same ISP. So now, organizations are typically issued a small number of IP addresses, and must use this limited number of addresses for all of their organization’s connectivity needs. NAT is a good way to allow many hosts to access the Internet via a small number of gateway IP addresses. Success Owl!

NAT is Great For… Reasons that an organization might use NAT include increased security, simplified administration, and the need for more host IP addresses than provided for by the network address block assigned to them by their ISP.

For more information about NAT, see the Network Address Translation FAQ at http://www.vicomsoft.com/knowledge/reference/nat.html

3.3.4 Tunneling Tunneling is the process of encapsulating a protocol within packets carried by a lowerlevel network, to provide a virtual point-to-point connection. For example, many VPNs run over TCP/IP networks, embedding another TCP/IP network’s traffic, sometimes using a completely different host addressing scheme such as NAT, within the outer network’s packets. In many cases, the complete packet traveling on the “virtual network” is placed into the data area of the physical network’s packets, just as with any other application. The lower layers of the outer network are not even aware that another network’s traffic is piggybacking over them. Tunneling can provide an authenticated, encrypted, tamper-resistant channel of communication over the Internet, between two points, as we discussed in section 2.1 on Remote Access protocols and technologies.

Tunneling software takes care of encapsulating the packets for transmission, and then receiving and decoding them at the other end of the tunnel and placing them onto the local network as if they had originated there. It can exist at various network layers, such as OSI layers 2 and 3, or higher application layers. Success Owl!

Tunneling Tunneling involves encapsulating a protocol within packets carried by a lower-level network. It provides a virtual point-to-point connection. Tunneling can provide a “private” authenticated, encrypted, tamper-resistant connection between two points over the Internet.

Examples of tunneling For example, layer 2 tunneling is often used to carry PPP traffic between VPN endpoints. When dialing in to a corporate VPN, there are two options—originating the tunnel at the dialup user’s host (voluntary mode) or intercepting the user’s dial-in at the ISP and originating the tunnel to the corporate network from the ISP forward (compulsory mode). PPTP is an example of a layer 2 protocol that provides encrypted, authenticated tunneling. L2TP is a layer 2 protocol that provides authenticated tunnels, which can be encrypted using the layer 3 IPSec technology mentioned below. Layer 3 tunneling provides virtual IP connections at the network layer. It is often implemented via the IPSec protocol extensions and IKE (Internet Key Exchange, an authenticated key exchange protocol). It supports a wide variety of encryption options, such as DES, 3DES, MD5, SHA1 and is often used in “security gateway” products such as IPSecenabled routers, which provide dial-up or Internet users access to the internal network behind the gateway. Note that IPSec itself doesn’t provide for authentication, which is why it is often paired with other technologies like L2TP, or used in full site-to-site links where the organization considers individual authentication to be overkill. Higher level tunneling, when you wish to tunnel traffic related to some applications, but not all traffic on the network, is most often accomplished via Secure Shell (SSH), or Secure Sockets Layer (SSL). SSH seems to be the protocol of choice when tunneling login connections (providing a more secure remote connection than the Berkeley UNIX “r“commands it was developed to replace). And SSL is, of course, the protocol used to implement a secure version of HTTP communication used between web browsers and servers. Interestingly, the use of both of these originally special-purpose tunneling protocols has been expanded to other applications as well. For instance, many companies now use SSH as an inexpensive way to provide general-purpose security tunnels between remote clients and all sorts of applications, including web servers and POP3 or SMTP email connections. And SSL has evolved into the IETF-standard Transport Layer Security (TLS), which uses digital certificates for authentication and confidentiality.[68]

Pop Quiz 0011.00

Pop Quiz 0011.00 Questions 1. The technology used to detect anomalies is known as ____________________. 2. IDSs verify, itemize, and characterize threats from threats _________________ and/or ____________ the network. 3. A drawback of Network-based IDSs is they cannot ________________ ______________ ____________. 4. An extranet can be viewed as part of a company's intranet that is extended to users____________ _____ __________. 5. An ________________is a network that is mostly contained within a company Answers 1. The technology used to detect anomalies is known as IDS or Intrusion Detection System. Intrusion Detection is a quickly evolving domain of expertise. In the past year we have seen giant steps forward in this area. We are now seeing IDS engines that will detect anomalies, and that have some built-in intelligence. It is no longer a simple game of matching signatures in your network traffic. 2. IDSs verify, itemize, and characterize threats from outside and inside your organization's network. IDSs verify, itemize, and characterize the threat from both outside and inside your organization's network, assisting you in making sound decisions regarding your allocation of computer security resources. Using IDSs in this manner is important, as many people mistakenly deny that anyone (outsider or insider) would be interested in breaking into their networks. Furthermore, the information that IDSs give you regarding the source and nature of attacks allows you to make decisions regarding security strategy driven by demonstrated need, not guesswork or folklore. While an IDS can be deployed in one's DMZ to look only for Internet or outside network intrusions, it can also be used internal to a network as well. 3. A drawback of Network-based IDSs is they cannot analyze encrypted information. Network-based IDSs cannot analyze encrypted information. This problem is increasing as more organizations (and attackers) use virtual private networks. Most network-based IDSs cannot tell whether or not an attack was successful; they can only discern that an attack was initiated. This means that after a network-based IDS detects an attack, administrators must manually investigate each attacked host to determine whether it was indeed penetrated. 4. An extranet can be viewed as part of a company's intranet that is extended to users outside the company. An extranet is a private network that uses the Internet protocol and the public telecommunication system to securely share part of a business's information or operations with suppliers, vendors, partners, customers, or other businesses. An extranet can be viewed as part of a company's intranet that is extended to users outside the company. It has

also been described as a "state of mind" in which the Internet is perceived as a way to do business with other companies as well as to sell products to customers. The same benefits that HTML, Hypertext Transfer Protocol (HTTP), Simple Mail Transfer Protocol (SMTP), and other Internet technologies have brought to the Internet and to corporate intranets now seem designed to accelerate business between businesses. Typically the portion of a company's network inside the company is referred to as its intranet. Generally extranet users do not have administrator or root privileges. 5. An intranet is a network that is mostly contained within a company. An intranet is a private network that is contained within an enterprise. It may consist of many interlinked local area networks and also use leased lines in the wide area network. Typically, an intranet includes connections through one or more gateway computers to the outside Internet. The main purpose of an intranet is to share company information and computing resources among employees. An intranet can also be used to facilitate working in groups and for teleconferences. [62]

“DMZ”, http://www.webopedia.com

[63]

http://www.sans.org

[64]

Houser, Tcat, and O’Boyle, Helen Inside Scoop to CompTIA Network+ Certification, TotalRecallPress, 2002.

[65]

Taylor, David, “Are There Vulnerabilities in VLAN Implementations?”, http://www.sans.orghttp://searchnetworking.techtarget.com/originalContent/0,289142,sid7_gc i540868,00.html [66]

http://www.ietf.org/rfc/rfc1631.txt

[67]

Phifer, Lisa, “The Trouble with NAT,” http://www.cisco.com/warp/public/759/ipj_34/ipj_3-4_nat.html [68]

Phifer, Lisa, “VPNs: Virtually Anything?” http://searchnetworking.techtarget.com/originalContent/0,289142,sid7_gci540868,00.html, 2001.

3.4 Intrusion Detection Earlier in this section, we looked at the IDS as a component of a network. In an ideal world, every system would run flawless software (with no known or soon-to-be discovered bugs which can be exploited), administrators would never make careless mistakes and users…well…what can we say? Since this is the real world, not the ideal world, new security bugs are discovered daily, administrators do sometimes set permissions incorrectly and users load software from virus-infected diskettes. Thus, organizations need the capability to detect and respond appropriately to suspicious activity, and deploying IDS is one way to help automate this process.

IDS standards Standards that apply to IDS, which you might wish to investigate, include CIDF (Common Intrusion Detection Framework, by DARPA) and IDWG (ID Working Group by IETF). In this section we will delve into specific types and features of IDSs. There are two primary types of IDS, network based and host based. Some IDSs make use of only one or the other, and some make use of both. We’ll discuss each of these types of IDS in more detail below. Success Owl!

Intrusion Detection Systems Intrusion detection systems may be network-based or host-based.

3.4.1 Network Based Network-based intrusion detection systems (NIDS) monitor network traffic, looking for “interesting” events. When examining traffic, they can detect either patterns in individual packets that indicate suspicious traffic such as known attack signatures (data streams from popular exploit tools), or violations of algorithmic rules that indicate out-of-theordinary traffic (often referred to as “heuristics”, such as more than 100 incoming FTP connections to a single host within 10 seconds). More advanced systems rank different events according to the level of threat they represent, and are able to correlate a variety of suspicious activities in order to determine if a more significant threat is present. In addition to monitoring the network, some NIDS also monitor SNMP, syslog logging communications and other network-event-reporting mechanisms for interesting networkrelated events. Some, but not all, NIDSs allow the administrator to create custom rules and algorithms to search for traffic of local interest, which aren’t part of what the NIDS scans for “out of the box.” For example, one site has a custom rule that searches the network for SNMP traffic containing the default community strings of ‘public’ or ‘private’.[69] Success Owl!

NIDS A Network Intrusion Detection System (NIDS) monitors network traffic, looking for “interesting” events that indicate potential attacks. It decides what traffic is “interesting” based on pattern matching with traffic signatures of known attacks or with heuristics that reveal deviations from normal network traffic patterns.

NIDS architecture For smaller networks, an NIDS may be completely self-contained, running on a single machine and watching the network for activity. However, this is often not sufficient for medium-to-large environments because in order for a NIDS to monitor traffic, it must have access to it—which generally means having access to the traffic on any subnet of interest. NIDS for a medium-to-large environment often consists of several components: •

Agents deployed on hosts around the network to collect information and forward relevant information to the Director

• •

Director which combines information from agents and analyzes it to find potential threats Notifier which handles responding to threats identified by the Director[70]

NIDS considerations, pros and cons Because NIDSs generally run in real time (in other words, they notice events as they happen, not after the fact), they are likely to detect potential attacks more quickly than many host based IDSs. Additionally, NIDSs are not limited to looking at only the traffic to or from the host they are running on—they can inspect any packets traveling across the network. Another benefit of NIDSs over host based IDSs is that some attacks, such as a DoS or Teardrop attack, can only be detected by looking at the packet headers. When selecting and deploying a NIDS, be aware of a few key points: •

•

•

•

•

•

•

A NIDS can only monitor what it can see. If switches or routers prevent the NIDS from seeing traffic, it can’t review that traffic for potential problems, so use span ports on switches or place the NIDS agent on a machine off a hub on the uplink port of the switch. Then TEST your configuration to make sure that the NIDS really is seeing the traffic you want it to see If you use a VPN or other traffic encrypting technology, such as SSL for web transactions, on your network, the IDS may not be able to look inside those packets for potential threats, and will miss any attacks that occur through those channels. Most malicious attacks on a network occur on the internal network (given the increasing presence of third parties like vendor field engineers and consultants, on internal networks), and internal networks are full of well-meaning users who every so often open an email containing a virus, so consider using a NIDS to monitor the internal network as well as your DMZ Some NIDS do not process fast enough to examine all traffic on gigabit networks, and may let traffic through without scanning it, if overwhelmed, so if you have (or plan to soon have) a gigabit network installed, make sure that your vendor certifies that the software and hardware you select for your NIDS can keep up with it Make sure that the vendor regularly updates their rule database in response to new threats, and then make sure that someone in your organization is tasked with keeping the NIDS rule base up-to-date, by promptly installing vendor updates. If a signaturebased NIDS doesn’t know about a suspicious pattern, it can’t look for it and alert you to its presence NIDS which focus on detection of statistical behavioral anomalies (unusual patterns of network activity, as compared with normal network traffic) via “heuristics” can often detect attacks unanticipated by a simpler pattern-matching system that looks for known threat signatures. The downside to the statistical approach is that benign but unusual traffic patterns often trigger the NIDS into action, resulting in a higher degree of “false positives” than with the pattern-matching approach, and thus require more administrative attention in exchange for a (possible) increase in detection ability Tools such as “Stick”, popular in black hat circles for flooding a NIDS with traffic and causing it to drop packets, can also be used for NIDS evaluation, to stress-test an NIDS before purchasing it

•

Not all NIDSs reassemble fragmented packets before comparing packets with signatures; those that do not, may miss detecting attacks if the attackers obfuscate them via excessive fragmentation

Success Owl!

NDIS Limitations A NIDS can only monitor the traffic that it can see. If you use switches or routers to segment traffic, and wish to monitor network segments other than the one on which the NIDS is placed, make sure that you deploy NIDS agents, which report back to the main NIDS, on those other network segments. A NIDS reveals one of the downsides of VPN or SSL-protected Internet communications. A cracker can tunnel their attack through SSL or a VPN, and evade detection by a NIDS, which can’t decrypt the encrypted packets. (In the future, this is likely to change. The state of the art at the moment, though, is that it usually can’t.) Like some switches, some NIDS can be flooded with traffic and caused to stop examining packets, allowing an attack to take place without detection by the NIDS.

For more information on NIDS, check the “Barbarians at the Gate” article referenced earlier in this subsection.

3.4.1.1 Active Detection NIDS are increasingly focusing on active detection. This does not refer to how the NIDS detects potential problems, as you might expect. Instead it refers to how the NIDS responds to the situation once it is detected. (Sorry folks, this is the industry standard terminology. We didn’t create it.) With active detection, the NIDS takes some action to mitigate the detected threat. Such options can include: • • • •

Reconfigure a firewall or router to route traffic around a problem such as a DoS attack Break suspicious network connections Send a message to a host-based agent to shut down a vulnerable service on a particular host Attempt to collect more information about the intrusion

Success Owl!

Active NIDS With Active Detection, a NIDS actively attempts to perform “damage control” on a detected intrusion attempt. Actions taken as part of active detection can include reconfiguring a router to route around a network problem like a DoS attack, breaking suspicious network connections, shutting down services to minimize vulnerability, or collecting more information about the intrusion.

3.4.1.2 Passive Detection Most early NIDS focused on passive detection, which involves alerting someone to the detected threat so that they can take action, if desired. IDSs that use only passive detection do not take action against the threat themselves. Passive methods include: • • • • • • •

Logging the event (most IDSs use a standardized, documented log format such as Syslog, tcpdump, or Snort for ease of mining data from the logs) Emailing or instant messaging an administrator Paging an on-call administrator Displaying an on-screen alarm Sending an alert to a monitoring system Sending an SNMP trap to flag the event Interfacing with a local custom application to perform site-specific tasks like entering the data for the suspicious activity into a site trouble reporting system

Success Owl!

Passive NIDS With Passive Detection, when an attack is detected, the NIDS alerts someone so that appropriate action can be taken. The NIDS does not take any action against the perceived threat itself. Actions which may be taken by passive detection NIDS include alerting an on-call administrator via paging or email, sending an SNMP trap to flag the event to a management console, logging behavior to a file, displaying an onscreen alarm or sending an alert to another monitoring system.

3.4.2 Host Based In contrast to network based IDS, host based IDS focus on monitoring for unauthorized activities occurring on hosts themselves, including both incoming/outgoing network traffic involving the host running the IDS and other events on the host which do not involve the network. Host based IDS have been around for a long time (since the 1980’s, says ISS[71]). They range from simple accounting record auditing packages (which may or may not run in real time), to more advanced detection systems that not only check system, security and event logs, but also periodically verify system file checksums to ensure that critical configuration files and executables have not changed, and/or monitor certain ports for connection activity. Success Owl!

Host Based IDS (HIDS) A Host-based Intrusion Detection System (HIDS) monitors for unauthorized activities occurring on hosts, including network traffic in and out of the host and other events on the host that do not involve the network. It may watch the host’s network interfaces as well as monitor logs and the state of key system files.

HIDS architecture To secure your network using host based IDS technology, you would have to install a copy of the host based IDS on each system you want to monitor. Unlike NIDS, a single installation can only monitor a single machine—generally the one on which it has been installed.

HIDS considerations, pros and cons While host-based IDS typically do not address the variety of attacks that can be detected by NIDS, there are some benefits to host-based technology, such as: •

•

•

Ability to detect attacks which occur within a system, without traffic traveling across the network, such as someone sitting down at a serial-wired “dumb terminal” and replacing a key system file Fewer false positives (reporting something as a threat, which isn’t really a threat), since host-based IDS technology usually looks at logs of what has already happened as opposed to what it looks like someone might be trying to do Not affected by switched environments or network-based encryption, because the system must decrypt the network traffic destined for it in order to respond to it. For example, the actual contents of an SSL transaction are known on the web server to which it is sent, so a host-based IDS on the web server may be able to detect anomalies in that transaction which could not be detected by a NIDS

Success Owl!

Host IDS Advantages Advantages of HIDS include the ability to detect attacks occurring on a system without involving the network, fewer “false positive” reports than NIDS, and the fact that they’re not affected by network switches or networkbased encryption. Unlike a NIDS, a host-based IDS on a web server can often see SSL-protected transactions because they are decrypted upon receipt by the host (or a dedicated SSL processor box installing in front of the host, on the network).

3.4.2.1 Active Detection As with network based IDSs, host based IDS technology can feature either active or passive detection. Active methods used by host-based systems can include: • • • •

Terminating suspicious network connections; Shutting down services which are being attacked; Shutting off user accounts that are being used for suspicious activities. Attempt to collect more information about the intrusion.

Success Owl!

Active HIDS With Active Detection, when a potential attack is detected, a HIDS may take steps like terminating network connections involved in the attack, shutting down services, logging off and invalidating user accounts which may be involved in the attack, and collecting further information about the attack and attacker.

3.4.2.2 Passive Detection Passive methods used by host based systems mirror those available on NIDSs, including: • • • • • •

Logging the event Emailing or instant messaging an administrator Paging an on-call administrator Displaying an on-screen alarm Sending an alert to a monitoring system Sending an SNMP trap to flag the event Success Owl!

Passive HIDS With passive detection, a HIDS will take the same types of actions as would a passive detection NIDS, when an attack is detected, like logging the event, notifying an administrator, displaying an alarm/alert, or sending an SNMP trap to a monitoring console.

3.4.3 Honey pots “Mmmmmm, honey pot”…. The name is supposed to sound tempting… to potential attackers, that is. Honey pots are decoy systems or networks set up to look like interesting targets to attackers. The idea is that attackers will spend their time and resources on this (to you nonbusiness-critical) system rather than interfering with the operation of more important systems on your network. Alternately, the honey pot can be purely a research tool, to lure the 3133t (that’s “elite” in script kiddie speak) into attacking, so that those observing the honey pot can learn about their techniques. Honey pots typically mimic a real system or network (ideally one particularly attractive to hackers, such as one that purports to contain interesting data or runs a service that is a known “easy target” like (sorry Microsoft!) IIS). Each system can be set up to run one or more services that any other server on your network would run. The difference is that a honey pot is not normally in use (at least, not in use doing anything other than pretending to be a great target). It is merely a target lying in wait, and any amount of interaction with it can be interpreted as an attempt at intrusion, reconnaissance, or other type of abuse. Honey pots are normally well-isolated from the rest of the network (due to obvious concerns about traffic sniffing), and feature good logging, often sending their log results across the network to a different machine so that compromise of the honey pot doesn’t allow the attacker to “cover his tracks” by tampering with the logs. Success Owl!

Honey pots Honey pots are decoy systems or networks set up to look like interesting targets to attackers. They typically mimic a real system or network that is attractive to hackers, such as one containing interesting data or running known-vulnerable software. They may be used purely as a research tool or as an active defense used to

deflect intrusions, by giving crackers an attractive but non-business-critical target in an organization’s network. Entire Internet projects such as Lance Spitzner’s Honeynet Project[72] revolve around using honey pots to study black hats in their native habitat (out in what looks like “the wild”). For more information about the Honeynet Project, including recounts of some attacks staged against it and how the Honeynet team reacted to them, see Know Your Enemy[73], by The Honeynet Project. Real World Owl!

Honey Pot Thoughts In an email exchange between Tcat and Fred Cohen the chance came up to ask him about his honey pot, the Deception Took Kit (DTK). The following is re-printed with Mr. Cohen permission: “I will share some of mine… I am amazed that the bad guys have not come up with some DTK detector. There are thousands of folks using the same DTK that came out 3+ years ago - I included - and I am flabbergasted at how many things it catches considering how simple and basic it is. I cannot believe how many people end up trying things 5 or 6 times before moving along. I figured it would be a program I would have to update constantly, but it turns out that it's not necessary in order to do its present function. I am interested in what people think the next generation should be. I am working on several related things and am looking for any burning desires from the readership. FC”

While most honey pots, including those at the Honeynet Project, have traditionally been UNIX-based, there are also tools for setting up honey pots on Windows systems, which even include servers such as the free-for-personal-use BackOfficer Friendly from NFR[74]) which simulate popular Trojan servers like BackOrifice, but log, instead of act on, their requests.

Legal issues around honey pots “Luring? Deliberately going out of your way to create a target to attract ne’er-do-wells? What’s our legal department going to say?” The only answer we can give is: we don’t know. Some have claimed that honey pots are a form of entrapment. Others have pointed out that entrapment can only be committed by law enforcement, so random net administrators and security researchers aren’t affected by that regulation. Additionally, if your honey pot is compromised, and the attacker does make off with information you wish he hadn’t… what do you do then? Does the fact that you set the honey pot up specifically for use by such individuals imply that they might have been (in some

legally-defensible way) authorized users of that system and thus broke no privacy rules? It’s tough to say, since we’re still in the early stages of legal precedents in this area. There are enough questions here that, before you set up a honey pot of your own, you would be wise to confer with your legal counsel to determine potential legal ramifications.[75] For more information on honey pots, check the paper by Lance Spitzner mentioned in the footnotes, as well as the http://www.honeynet.org site.

3.4.4 Incident Response An intrusion has been detected… Now what? Unless you are restricting yourself to observation only, as an academic exercise, the next step is to respond to it. This activity is known in security circles as “incident response”, and it includes activities like stopping further damage, investigating what happened, and performing required cleanup. Success Owl!

Incident Response Incident response is the collective name for all of the activities performed in response to a perceived computer security related incident. It includes both “defensive” activities such as securing the network, and “offensive” activities like investigating the incident and possibly reporting details to law enforcement.

Role of IDS in Incident Response As seen above, sometimes part of that response is accomplished FOR you, by the IDS doing what it can to stop the attack, determine the extent of the damage, and safeguard the system or your network from further attacks by taking actions like shutting down services. At other times, it’s up to you to get the email, page, or alert on your computer screen, and race into action. Do you immediately shut the attacker off? Or do you let them continue for a while, and try to determine the source of the attack so that you might have a better lead on who could be prosecuted later? (Take note: few prosecutions of this sort are successful.) Do you yank your site’s Internet connection? All of these are potentially valid actions that the authors have seen network administrators take more than once.

Six-step Incident Response process The NSWC Dahlgren Computer Security Incident Handling Guidelines[76] describe incident response as a six-step process: 1. Preparation (setting up systems to detect threats and policies for dealing with them, including identifying roles staff will play in incident response, and creating emergency contact lists); 2. Identification (identifying what the threat is, and/or the effects it is having on your systems/networks, including keeping records of the time/systems involved/what was observed, and making a full system backup as soon after the intrusion was observed, as possible, to preserve as much information about the attack as you can);

3. Containment (limiting the effects of an incident by confining the problem to as few systems as possible, freezing the scene so that nothing further happens to the compromised system(s) by disconnecting its network connections and possibly console keyboard) 4. Eradication (getting rid of whatever the attacker might have compromised by deleting files or doing a complete system reinstall—we cannot stress enough that you should err on the side of deleting MORE rather than less in order to restore a system to production, since the intruder may have left very-well-disguised Trojan Horse binaries around the system, to be activated once the system is reconnected to the Internet); 5. Recovery (getting back into business, by putting the system back into normal operations, reconnecting it to the network, restoring from backups if necessary, etc.); 6. Follow up (if possible tightening security so that the intrusion cannot happen again, determining the “cost” of the intrusion based on staff time/lost data/lost user work time (don’t skip this! It may help justify security expenditures in the future), considering which, if any, additional tools might have helped handle the incident better than it may have been handled, reflecting on “lessons learned” from both the intrusion and the organization’s response to it and tweaking policies as required). SANS offers an incident response publication dealing with these 6 major phases, in detail[77]. The very first thing to do is to secure access to the involved devices, to protect against further damage and to assist with preservation of evidence. The critical theme is to not destroy evidence by changing anything! Legal cases have been hampered, and even destroyed, by well-meaning system administrators “doing the wrong thing” in the name of “preservation of evidence.” Report any suspicious incidents to upper management. Success Owl!

Incident Response: Step-by-Step The six steps to incident response are preparation, threat identification, containment, eradication, recovery, and follow-up. When an incident is detected, the first thing to do is secure access to the involved devices through actions like unplugging them from the network, locking any involved terminals or systems, etc. Be careful not to destroy evidence by changing anything, in case the incident is eventually taken to the courtroom.

Also be sure to report any suspicious incidents to upper management. They need to know when intrusions have occurred, particularly if financial aspects of the business may be affected. Real World Owl! Incident Response Planning Does your organization have a computer security incident response policy? If so, do you know what it is? If not, consider sketching one out and seeking approval for it so that you know in advance what to do, if you need to react on short notice someday. As noted above, a helpful guide to incident response, to help get you started in planning for it, can be found at SANS. Again, we can’t stress enough that you should think about this in advance, in order to be best prepared to respond in ways that help get things back to “business as usual” as quickly as possible in a way that

doesn’t destroy important evidence, and which enables you to understand the threat you faced, so that you can better protect yourself against similar threats in the future.

Reporting incidents to third parties Additionally, you may wish to take advantage of some third-party channels. For example, if you seem to have a new vulnerability on your hands, you might want to contact your application, OS or security product (firewall, IDS, etc.) vendors to see what information you might be able to share with them, to help them protect against (or respond to) this vulnerability. You might want to contact CERT[78] or the BUGTRAQ mailing list, to report the flaw so that other white hats find out about it and can take appropriate action (if it’s been aimed at you, at least one black hat’s already got the exploit). Depending on the type and severity of the incident, you may also want to alert law enforcement personnel. Additionally, these channels often have information about how to respond to certain threats, such as explanations of software bugs you might have missed and information as to which versions of the software have had the bug fixed, and where to get them. As far as viruses are concerned, you can also check with the primary anti-virus sites, which often make available (even to non-customers) information on how to recover from common virus infections. A debate has raged recently on the issue of “disclosure”. If you find a bug, who should you inform, when should you inform them, and how much should you say? Again, this is one of those issues where many people have opinions, but there is not necessarily one blanket answer appropriate for all situations. If you inform everyone at the same time, and crackers who might not have known about the hole beforehand find out about it and create an exploit, you could potentially be liable under the Digital Millenium Copyright Act for an activity affecting cybersecurity. On the other hand, if you inform the vendor, months go by, and the vendor has not informed you of plans to fix the hole you found, you have reason to believe an exploit is likely to show up before a fix is. Let your organization’s policies, your conscience and perhaps your management be your guide. Real World Owl!

Incident Response—Where To Start To get you started, here are some resources: SANS, at http://www.sans.org, offers instructional documents, vulnerability alerts and the SANS Digest, a mailing list focused on computer security-related news and vulnerability reports. BUGTRAQ at http://www.securityfocus.com offers a variety of security information as well as the full-disclosure mailing list BUGTRAQ and archives of the list. NTBUGTRAQ, at http://www.ntbugtraq.com offers the NTBUGTRAQ mailing list about Windows vulnerabilities, archives of the list, and editorials about issues significant to security administrators. CERT, at http://www.cert.org offers a vulnerability database, informational documents and the CERT Advisory Mailing List. (Note

that CERT is sometimes criticized for delaying the publication of vulnerability alerts; if you’re seeking the timeliest information, you may want to check the other sources first). If you’re running UNIX or Linux, and would like a reference on “what to do if we’re compromised,” check out Bob Toxen’s Real World Linux Security[79]. [69]

Saoutine, Greg, et. al., “Barbarians at the Gate”, http://mcpmag.com/Features/article.asp?EditorialsID=294

[70]

Memon, Nasir, “CS 392 Network Security – Module 5 Intrusion Detection”, http://isis.poly.edu/courses/cs393/lectures/module-5.pdf [71]

“Network- vs. Host-based Intrusion Detection”, Internet Security Systems, http://documents.ids.net/whitepapers/nvh_ids/

[72]

http://www.honeynet.org

[73]

The Honeynet Project, Know Your Enemy, Addison-Wesley, September, 2001, http://www.nerdbooks.com/item.html?id=0201746131 [74]

http://www.nfr.net/products/bof

[75]

Spitzner, Lance, “Honeypots: Definitions and Value of Honeypots”, http://www.enteract.com/~lspitz/honeypot.html

[76]

“NSWC Dahlgren Computer Security Incident Handling Guidelines”, http://www.nswc.navy.mil/ISSEC/Docs/Ref/GeneralInfo/incident.handle.html, February, 2002.

[77]

http://www.sans.org/newlook/publications/incident_handling.htm

[78]

http://www.cert.org

[79]

Toxen, Bob and Seth Fogie, Real World Linux Security, Prentice-Hall, November, 2000, http://www.nerdbooks.com/item.html?id=0130281875

3.5 Security Baselines Security Baselines are standards that specify a minimum (that is, “baseline”) set of security controls that are suitable for most organizations under normal circumstances. They typically address both technical issues (such as software configuration) and operational issues (such as keeping applications up to date with vendor patches). The idea of security baselines is that for any particular platform (hardware, OS, network, application), there is a minimum set of security recommendations which, if followed, will significantly decrease its vulnerability to security threats, and that it shouldn’t take an expensive consultant doing an extensive risk analysis of your environment to determine a reasonable set of security controls for you to implement. In this way, even a small mom-andpop business without access to a major IT consulting firm can have some assurance that they are taking at least some worthwhile steps to computer security.

There are multiple schools of thought on the use of security baselines. Some think adopting a common set of security baselines across the industry is the way to go—a kind of set it and forget it approach that ignores the risk analysis step. Others think that baselines are just a starting point for the bare minimum acceptable level of security and those organizations that can, should expand upon them to further increase the security of their system as time, knowledge and budget permits and their particular risk situation requires. When establishing Security Baselines, you may consider: • •

• •

•

Any existing security baseline documents for the hardware and software you use Any “best practices” guides that exist for hardening the hardware/software you use, which may exceed the recommendations in any proposed baselines for that hardware/software Specific issues you may have run into the past which deserve extra attention (suppose your web server has historically been a favorite target of hackers) What other administrators are saying and doing (do you really want to run the easiest FTP server for “warez” folks to take over, on the whole Internet? If not, take the same step other administrators customarily take to secure their servers) Unique characteristics of your environment (in terms of security risks faced, how much collaboration takes place, management’s views on the security requirements vs. ease of use tradeoff, etc.)

Success Owl!

Security Baselines Security baselines are minimum standards that set appropriate security controls that are suitable for most organizations in normal circumstances. They may include both technical and operational standards. The idea is that application of the baseline standards is sufficient to substantially decrease an organization’s risk of being attacked. When establishing security baselines, consider vendor recommendations, “best practices” guides by third parties, what other system administrators are currently doing to harden their networks, and specific issues appropriate to your organization such as industry requirements (HIPAA, etc.).

Automatic enforcement of baselines Some security auditing products take the idea of baselines one step further by allowing you to specify rules for your desired system configurations (and other security controls) within the auditing product, so that the tools can automatically scan for deviations from those baselines and report them to you.

Implementing baseline recommendations One idea, which can’t be repeated often enough, to those who are in the process of “tightening the screws” is the importance of testing and re-testing new configurations to make sure that you haven’t “broken” any critical network/system functionality as you’ve worked to increase security. It’s somewhat sad to report this, but the software world

is replete with packages (not named, to protect the guilty) that contain functions that just won’t work if file system security is tightened, ordinary users aren’t assigned rights normally reserved for administrative users, etc. This is the kind of situation you want to discover on a Saturday morning, with a crew of volunteer users and a nice brunch delivery expected at 11am (so that the users can take a break, and your team can frantically work to adjust small things that didn’t work properly during the first few hours of testing), not on the day that the company is trying to close the month. If you discover that you seem to be running one of these packages that just don’t play nicely with a locked-down system, contact the vendor to see if they have any solutions or workarounds to the issue you find. If not, management needs to know about it, because a choice needs to be made, balancing security exposure with the importance of that package to the organization. Success Owl!

Test BEFORE Deploying When hardening network components, be sure to test your changes carefully before putting them into production, as security improvements often conflict with the way applications expect things to be configured.

In the following sections, we look at the process of “hardening” (making resistant to attack) various types of server functionality typically available within an organization’s network. Starting with the underlying OS/NOS level, since an application server won’t be secure if the OS on which it runs is not secure, we continue by looking at common services often made available over the Internet such as web, email and ftp, and services generally used internally such as DHCP and directory services.

3.5.1 OS/NOS Hardening OS hardening deals with the actions that can be taken to secure an OS. In this section, we look at resources for hardening Windows and UNIX systems, and then we look at particular areas of consideration. Note that specific practical measures for any specific OS are beyond the domain of the Security+ exam, so we present these as “geek tips”. Nevertheless, if you’re going to be working in Security, you really do need to know the practical details of securing your organization’s operating systems of choice. Here are some hints on where to look for this information. Geek Owl! Tip Windows Resources In the Windows world, there are both written guidelines such as the SANS “Gold Standard” and automated tools like the Microsoft Baseline Security Analyzer which attempt to automate some baseline security measures. The following are two resources in which the US government was involved. The “Gold Standard” is a recent development by the Center for Internet Security, DISA, NSA, NIST, SANS and GSA. The US National Security Agency, after review of successful system compromises of Windows 2000 during the past eighteen months, found that more than 85% of them would have been blocked had the owners been using the Gold Standard. Heard enough? Go get it[80].Similarly, the FBI/SANS duo has updated its list of the Top 10 Windows vulnerabilities, as of October, 2002. This list, and a similar list for UNIX

systems, is available at http://www.sans.org/top20/. Also available at this site is a list of vendors supplying scanners that check for the presence of these vulnerabilities, some free. The Microsoft Baseline Security Analyzer supplied by Microsoft itself, helps check for new security patches and insecure OS and Microsoft application configurations. While its results were somewhat inconsistent at the beginning, it has matured nicely and we feel it is a valuable tool to run, because it is likely to alert you to one or two more things you could do to secure your systems even if you think you’ve already taken care of it all. A third-party alternative to this is HardenNT, a security script generator, available at many locations on the net.[81] In addition to these guidelines, many excellent books on the subject of securing Windows exist. These discuss not only OS details, but also networking in the context of Windows systems. For example, a good overview of Windows File Sharing considerations may be found in Windows NT/2000 Network Security[82] by E. Schultz. Another interesting book with Windows “checklist” ideas, registry configuration details, etc. is Have You Locked the Castle Gate[83] by Brian Shea. Geek Owl! UNIX/Linux Resources In the UNIX world there are many tools that set and help check for compliance with organizationally set baselines. The original UNIX hardening script, written originally for Solaris, is Titan (http://www.fish.com/titan), which also runs on FreeBSD and Linux. Bastille-Linux (http://www.bastille-linux.org) helps administrators lock down a Linux system. JASS (http://www.sun.com/blueprints/tools) and YASSP (http://www.yassp.org) can be used to harden a Solaris system. As noted above, you can find the FBI/SANS list of the Top 10 UNIX vulnerabilities at http://www.sans.org/top20/ as well.

Some areas to look at when hardening an OS In addition to file systems and OS updates (covered in upcoming sections), some areas to look at when hardening an OS installation include user accounts, installed OS options, available services and OS configuration.

User accounts Multi-user systems such as Linux and Windows 2000 support the concept of user accounts, so that each person accessing a system does so with a unique identifier. This makes it easy to log interesting events, define privileges for special users, etc. Along with user accounts, most (if not all) OS’s have some concept of a supervisor level account with additional privileges. In Windows, the user ID is Administrator. In UNIX, this user is “root”, a.k.a. the “super user” account, by default. Both Windows and UNIX let you rename the account, which is not a bad practice, since it complicates the life of passwordguessers (if they mindlessly attack Administrator, and your administrative account is named

SiteManager, they’ll be at it all day, to no effect). This is possible because in both OS’s, security is actually based on a value underlying the user ID name—the UID on UNIX and the SID (Security ID) on Windows. The UNIX UID is a numeric value, whereas the SID is a rather long string. Additionally, both Windows and UNIX allow users to be categorized into “groups” which can be used when setting permissions (this is particularly valuable on Windows systems due to its flexibility in assigning permissions to multiple groups). As with user ID’s, groups are named, but are really referenced by underlying GID or SID. It’s a good idea to regularly audit your user databases, looking for accounts which are no longer used, or which have no password (even if you didn’t create an account without a password, a software package installation routine may have), and to disable any such accounts that are found. Similarly, as we’ve discussed elsewhere in this book, enforce a policy in which passwords are changed regularly, and meet some minimum criteria for strength (such as minimum 6 characters, not appearing in a dictionary, etc.). Real World Owl!

Action Steps Some action steps you can (and probably should) take in the area of user accounts include: Remove unused accounts Enforce password security Enforce lockout of accounts on unsuccessful passwords

Be careful when assigning administrative permissions to users (sometimes people do this as the “easy way out” when other security settings, such as file permissions, were set, possibly inadvertently to deny users’ access; you’re much better off spending the time to resolve the underlying issue)

Installed options Operating systems typically don’t come in just one configuration. Rather, at installation time, you can select from a wide variety of installation options to customize the OS to your particular needs. The more components that are installed on an OS, the more possible targets there are for intruders to exploit. In the past, most OS’s defaulted to installing any option a user might possibly want, to make it easy for naïve users who “just took the defaults” to access these OS features. In recent years, the pendulum has swung back the other way, favoring security over ease of installation and variety of features, and vendors are now thinking carefully about security implications before installing an option by default. The next version of Windows, .NET Server, includes a limited set of features in its default installation. And some Linux distributions don’t even include an FTP server by default—quite a surprise to those who consider UNIX to be the quintessential “Internet OS”.

Real World Owl!

Gotcha! Do you just “take the defaults” when installing an OS? If so… Do you know what those defaults install and what they don’t? If you don’t know, consider finding a spare machine and performing an install of an OS used in your environment, and review the list of options it installs, with an eye toward discovering ones you can eliminate.

Available services System processes, known as services on Windows machines and daemons on UNIX machines, run in the background, often with higher-than-normal-user system privileges such as administrative access to files and high priority. In Windows 2000, you can list and control most services via the SC.EXE command line tool or the Computer Management MMC console. On UNIX systems, you might have to dig a bit, as daemons are commonly started in a variety of ways. Check the /etc/inittab file and /etc/inetd.conf, as well as your system startup files (files whose names begin /etc/rc, or which are contained in the /etc/rc* directories, depending on which version of UNIX or Linux you run.) Some guidelines on how to determine which services are running and listening for network connections on UNIX machines, as well as a list of known-to-be-insecure services which should be turned off no matter how “neat” you might think they are, can be found in Real World Linux Security[84] by Bob Toxen. Be aware that it’s not usually a good idea to turn off a service unless you know approximately what it does. Of course, finding this out can be a challenge. Check your system documentation or a third-party source, such as Maximum Windows 2000 Security[85] by Anonymous, which also includes security recommendations for when certain services should and should not be running, for descriptions of common OS services. And be warned the OS vendor did not supply all the services running on your machines. Application software packages may also install services they require for proper functionality, so just because a service you see on your machine doesn’t make the list, doesn’t mean that your system doesn’t need to be running it. Real World Owl!

Where is the Service? Sometimes the only way to identify a service might be to find its executable in the list of running processes, and search for it in the file system—hopefully discovering the directory in which it lives will provide some information as to where it came from, and give you an idea of who to call for more information. You can find out what sockets are open on your system with the “netstat – a” command. But how do you get from there, to finding out the process that has a network connection open? The “lsof” command on UNIX or utilities like “tcpview”[86] from sysinternals.com on Windows will let you find out which process is associated with each open socket.

OS configuration OS configuration involves any settings that you can specify to customize the behavior of the OS. (Technically it includes the ideas of installed options and available services. But it also continues to include general OS settings such as those specified in the Windows registry.) In the Windows world, many OS configuration details can be accomplished by applying what are known as Policies, on users, groups, the entire network, and other objects. The Security Configuration Tool Set for Windows 2000[87] is a suite of MMC snap-ins related to security administration, which is well described in Hack-proofing Windows 2000 Server[88] by Todd and Johnson. Using this toolset, you can manage account policies, machine policies, system event log settings, registry permissions, services, IPSec policies, public key policies, and more. One specific decision in the area of OS configuration, which can have a substantial impact on network security, is choice of an authentication mechanism. In UNIX, your choices are typically the traditional /etc/password based login, NIS+ from Sun, or Kerberos. In Windows, your choices include Anonymous, Basic, and Message Digest, NTLM, Kerberos and PKI authentication. The pros and cons of these options are explained in the Windows 2000 Security Handbook[89] by Cox and Sheldon.

3.5.1.1 File System File system issues are important to consider when hardening an OS. These relate to both the type of file system chosen, and the access controls on information stored in them. In most modern operating systems, an administrator can choose to format a disk in any number of standardized formats, called file systems. For example, in the Windows world, there is NTFS, FAT-32, FAT-16, etc. In the UNIX world, there are MS-DOS compatible file systems, JFS, extfs, ReiserFS, etc. The best way to make sense of these is to study your documentation, as complete coverage of the attributes of these file systems is beyond the scope of this document. Several security-related aspects of file systems are important to consider when choosing a file system: • • •

What kind of access controls does the file system provide? (Some, like the FAT32, provide none); What kind of encryption/data privacy features does the file system provide? (Again, some may provide none, requiring you to use application-level encryption); How resistant is the file system to loss of data as a result of a system crash? (Some, like compressed file systems sometimes used in days of old to conserve disk space, were notoriously bad; others, like the journaling file system for UNIX, are generally good).

Real World Owl!

O/S Configuration If you’re OS allows you to choose the disk file system you use, consider the types of access control, encryption and other data privacy features, and fault tolerance of each file system option when making your choice.

As noted above, some file systems are notorious for losing data when the system crashes. Other file systems are noteworthy for being robust, such as the JFS (journaling file system)[90] available for Linux. When thinking about file system security, it’s tempting to focus primarily on access controls. But it’s important to also take into account the reliability of the file system—if your data disappears when there are system problems, it can cause as much business disruption as a cracker intrusion. Of course, one should also visit the topic of proper file access control configuration. File access permissions provided by an OS depend on the file system involved. As mentioned above, some file systems like the Windows FAT-32 file system and its ancestors provide no file access control permissions (giving everyone locally accessing the machine full permissions to all files and instead leaving it up to network share permissions to control access granted to remote users).

Windows/NTFS Windows NTFS-based file systems typically provide the following permissions, accessed by right clicking to open a file’s Properties menu and then selecting the Security tab: • • • • • •

Read—Read files, list the names of files in directories, read attributes and permissions, synchronize Write—Create and write files, create folders, write attributes, read permissions, synchronize Modify—Same as “Read and Execute”, plus create and write files, create folders, write attributes, delete Read and Execute—Same as “Read” permissions, plus allow users to run program files and travel through directories to reach lower level files List Folder Contents—Same as “Read and Execute” Full Control—allows all of the above, plus delete subfolders and files, change permissions, and take ownership

Each of these permissions can be granted to a user or group that the OS knows about. Be cautious about granting Full Control, since that gives the user “the keys to the kingdom” as far as that file is concerned. In reality, these permissions are just a convenient way of specifying useful groups of finer-grained permissions. The full list of permissions can be accessed via the “Advanced” tab.

UNIX/Linux UNIX/Linux file systems typically provide the following permissions, which you can specify separately for the owner of the file, users who are in the “group” that is assigned to the file, and everyone else (a.k.a. “other” in UNIX speak): • • •

Read—allow users to read files, and list the names of files in directories Write—allow users to write and rewrite files, and create and delete files in directories Execute—allow users to run program (script and binary) files, and travel through directories to reach lower level files

Geek Owl! NIX Also Offers

Additional attributes that can be assigned to UNIX files along with those basic permissions include: 1. Sticky—on a directory set with write permission, keeps the user from deleting files owned by users other than themselves (other users’ files are “sticky” to the directory… get it?) 2. Set user ID / Set group ID—allows the process to take on the user ID or group ID assigned to the file, when it is run (this can be a major security issue… files with these permissions are often security vulnerabilities waiting to happen) As you can see, the UNIX permissions model is considerably less complex than the Windows model, at the cost of some feature richness, such as being able to assign different permissions to different groups of users. Real World Owl!

Putting *NIX Power to Practice Example file-system-related policies you could (and probably should) enforce include: 1. Don’t allow users write privilege into system directories, or shared data directories they don’t need to update (be warned that some software still insists on writing into C:\WINDOWS\SYSTEM32 no matter how annoying this is, and that because of this, some organizations may not be able to completely lock down all directories) 2. Provide each user with their own home directory, whose file access control settings fit your organization (for some organizations, this might mean the directory is unreadable by all users except the directory’s owner; for others, it might mean everyone can read it but only the owner can write to it); 3. Make sure that sensitive shared data directories are unreadable by everyone except those authorized to use them

3.5.1.2 Updates As if we haven’t mentioned this enough already, you need to watch for them and install them. Vendors produce updates for all sorts of reasons—not just for fixing security issues. Because of the propensity for vendor-supplied patches to “break things”, many organizations have developed a policy of a “wait and see” approach, letting a patch (program fix) “age” for a bit out in the community to shake out any bugs that didn’t show up during its beta testing, or of performing tests using production applications on a test server prior to rolling the patch out to production users. A wise person would perform update tests on a test platform before installing on a live network to be sure the update does not break any line of business applications or processes.

Where to find updates

You can usually find updates of all sorts for a product (OS or application) in that product’s area of your vendor’s web site. Additionally, vendors typically make security patches available in a special area of their web site, for easy access. For example, both Sun and Microsoft offer security bulletin and patch collections. Microsoft’s may be found at http://www.microsoft.com/security, and Sun Microsystems’ may be reached in the Security section of http://sunsolve.sun.com.

Types of updates It is partially due to vendors’ awareness of end users’ hesitance to test and install an endless parade of patches to do things like add support for new devices, tweak an obscure system function rarely used by end users, optimize RAS communications, etc. that vendors often issue security updates which include only vital security patches. These patches are often called “critical updates” or “hotfixes”. They’re sometimes rushed out the door somewhat, to get a fix for a critical issue onto vulnerable systems as quickly as possible. This means that quality might not be up to the standards of a service pack, and it comes down to the administrator’s judgment call, on whether it’s worth the risk to install it. On the positive side, since a hotfix is targeted to a specific issue, the amount of testing needed at an end user site is typically smaller than what is required to test a service pack. Other, generally better-tested, updates might be termed “service packs” or “update packs”. These are sets of patches that have generally gone through both internal vendor testing and a field test process, to help ensure that they will not negatively affect systems. Even then, undesirable side effects are not unheard of, when the service pack makes its way onto a system with a configuration it had not been tested on before release. Success Owl!

Patch, Hotfix, Service Pak A patch is a fix to a problem found in software or data. A patch may also add features, but generally, it is thought of as a repair, as a patch to a tire would be. A hotfix is a small patch file, generally targeted to one or two specific issues. Hotfixes are usually developed and released in a short timeframe, with less testing than service packs. A service pack (or update pack) is a collection of patches. Often service packs undergo a significant testing process for quality control reasons.

3.5.2 Network Hardening Network hardening involves the steps taken to secure a network and the devices on it. It includes both securing devices which have options set “out of the box” which are generally regarded as insecure, as well as customizing the configuration of the devices to meet the specific security requirements of the organization.

3.5.2.1 Updates (Firmware) OS/NOS products, being software-based with their code stored on server hard disks, are typically updated via software updates on CD or downloaded from the web. Installing an OS update is much like installing any other program or OS component. The install program copies the code into the proper locations on disk, perhaps makes some configuration changes, and the updated server is ready for use. With network devices, the program code and data controlling the device is often stored in a form called “firmware”, which is a combination of “software” and “hardware”. Like OS updates, network device updates are often distributed over the web. However, rather than being stored on a hard disk, code for network devices is usually written into ROM (read only memory) chips with a special firmware update program. As always, stay on top of the latest versions of firmware available for your networking products. These often address security-related vulnerabilities. To locate updates for your network devices, check the vendors’ websites. And remember to perform tests before applying to a live environment. Success Owl!

Firmware Firmware is a combination of hardware and software, in which network device program code and data is stored.

3.5.2.2 Configuration Configuration deals with setting options on the devices. One key issue to address would be device passwords used to access administrative features of switches, routers, etc. Devices typically ship with a default password used for initial device configuration. Please make sure you change it ASAP. As mentioned earlier in this book, entire web pages are dedicated to lists of default passwords for common network devices, so that intruders can walk right in your front door after turning the key. Success Owl!

Setup Configuration Be sure to change any default or blank passwords on the device at configuration time.

When configuring networking equipment, follow along with the standards already set for your network if possible. For example, if your organization has standardized on a particular vendor and model of network switch, the configuration process for one is likely to be very similar to the configuration process for the next. In these situations, it’s best not to reinvent the wheel. Create a written document outlining the steps to take when configuring a device of that type, and then follow it each time a similar device needs to be installed. If the device allows you to print out its configuration information, do this, and file it in a safe place (even consider storing a copy offsite). It will be useful to have a record of configuration information should the device fail and need to be replaced in the future.

Real World Owl!

Don’t Forget… Other items to remember when configuring a new piece of networking equipment include: I. II. III.

IV.

V.

If you don’t specifically need SNMP access to the device, disable it If you do need SNMP access to the device, change the community name If installing a router, make sure that you have set it up to not allow inbound packets whose source address is on an internal network, or outbound packets whose source address is NOT on an internal network (these package are at best badly damaged, and at worst, forged) Check the manufacturer’s site to see if they have specific securityrelated recommendations for their devices. For instance, Cisco provides some hints at http://www.cisco.com/univercd/cc/td/doc/cisintwk/ics/cs003.htm Does the device offer a handy-dandy web-browser based configuration interface, as many today do? If so, consider implementing a firewall rule to disallow connections to that device on port 80 (or 443) from all but trusted sources

3.5.2.2.1 Enabling and Disabling Services and Protocols As stated above when discussing OS hardening, TURN OFF anything you’re not using. This can take the form of turning off services at the server (as discussed in the previous section), or establishing filtering rules (on your routers or the servers themselves) to completely allow or disallow inbound or outbound connections to certain ports. IE, in effect, this “turns the port off.” We’ve said it a few times already and we’ll say it again: if you don’t absolutely require SNMP access to a network device, disable it. SNMP has a variety of security issues. If you absolutely must have it, SNMP v3 includes enhancements to authentication that make it a better network resident, so look for support for it on your devices and servers, and use it rather than v1 or v2, if possible. Do you have a whiz-bang multi-protocol router? And do you have a network that only uses TCP/IP (as many do, these days)? If you don’t need to pass IPX and AppleTalk packets through a router, turn off its ability to do so. Not using the IMAP protocol outside your internal network? Don’t allow traffic on port 143 through your firewalls and routers. Someone installed a UNIX IRC server “just for test purposes” to see if it enhanced internal communication, and left it running, forgotten, after the test was complete? Get rid of it. Don’t need the ability for outside machines to “ping” your inside machines? Disable ICMP protocol packets inbound from the Internet to your internal network.

Success Owl!

Network/Hardware Hardening One step to take when hardening network devices is to turn off any services and protocols you’re not using.

The next step in hardening a network device is to exert a finer-grained degree of control over what traffic you allow through the router. Instead of just allowing or disallowing based on type of network-layer protocol or service, you can examine a packet’s specific origins. That is discussed in the next section on Access Control Lists.

3.5.2.2.2 Access control lists Access control lists (ACLs), sometimes called filters, are used to determine which traffic is permitted to pass through a network interface, in which direction, between which addresses. Routers typically manage access control via a text file of access control rules; OSes and home networking devices including this functionality generally wrap access control lists in a GUI for ease of use. The network device examines the information in each packet, comparing it to the ACLs, and either lets the packet through or stops it depending on the ACL instructions. Typical attributes that may be examined by rules in access control lists include a packet’s: • • • • • •

Source IP address Destination IP address Source port number Destination port number IP protocol number (this is not the same thing as the application port number) Direction of travel (incoming to or outgoing from the interface)

The above is just a sample list of common parameters that can be included in an access control list—the features supported by your equipment may vary (unlike Internet protocols, access lists are not standardized, since they are not required to be “interoperable” between different vendors’ devices). Typically an overall default policy is set on each device, specifying whether inbound traffic will be permitted by default, or denied by default. A similar default policy is set for outbound traffic. Often it is appropriate to “deny all” inbound traffic by default and “permit all” outbound traffic by default, but that depends on your organization. Success Owl!

Access Control List (ACL) An access control list is a set of rules that specify which traffic will be permitted to pass through the network device, and which will be stopped. Common packet attributes evaluated by access control lists include source and destination IP addresses and port numbers, IP protocol number and direction of the packet’s travel. A device may permit all outbound traffic (from your network to the Internet) by default, and contain access lists specifying when to deny it, or deny all

outbound traffic by default, and contain access lists specifying when to allow it. Similar rules can be configured for inbound traffic (from the Internet to your network). It is common to deny all inbound traffic, and permit all outbound traffic. You should set up access control lists to enforce your security policies, such as those which specify which Internet services are, and are not, made available from your network to the Internet. As pointed out in section 3.5.2.2, two “no-brainer” access control list rules to implement are: •

•

Do not allow into your network, any traffic from the outside whose Source IP address is set to an address inside your network (it’s a red flag that the incoming traffic was spoofed—to keep the attacker out, don’t let the traffic in); Do not allow out of your network, any traffic from the inside whose Source IP address is set to an address outside your network (another red flag that the traffic is spoofed— although this time, you’ve got more problems, because the spoofer is somewhere on your network, at least you’re not aiding and abetting him in attacking someone on another network). Geek Owl! Vendors Vary in Implementation The syntax for access lists varies among vendors. Here’s an example of a Cisco IOS “standard” access list, which allows packets from host 128.172.1.2 into the network: # access-list 50 permit 128.172.1.2 0.0.255.255 The official syntax for a standard access list looks like: # access-list [1-99] [permit|deny] [ip address] [mask] [log] You may notice that this is fairly bare bones, and you might be wondering, “Surely Cisco provides better control over network connections than these… don’t they?” Yes, they do. Part 2 of the story is the idea of an extended IP access list, which incorporates features that have become standard for access lists in the industry, plus others as well. An example of a Cisco IOS extended access list might be: # access-list 70 permit tcp any host 199.97.31.1 eq 80 … which lets anyone connect to port 80 on machine 199.97.31.1. The official syntax for an extended access list looks like: # access-list [1-1199] [permit|deny] [protocol|protocol keyword] [source source-wildcard|any] [source port] [destination destination-wildcard|any] [destination port] [precedence precedence#] [options] Depending on the protocol (such as a routing protocol, or TCP, or IP,

etc.), many different options may be available. If you want more information on how to work with Cisco IOS access lists, check out the Cisco Access Lists Field Guide by Held and Hundley,[91] which shows how to work with access lists, use contentbased access control to dynamically open ports for applications requiring multiple connections, set up NAT, configure IPSec on Cisco routers, etc.

3.5.3 Application Hardening Application hardening is the process of securing applications in use on a network. It can be a major issue simply because there are so many different applications in use on the average network. It’s simply difficult to keep track of what’s installed where, let alone what the latest security baseline recommendations are for each product. Nevertheless, it’s a task that needs to be performed. The difficulty of keeping up with all applications, as well as the OS’s used in an organization, is part of the reason that applications were prominently featured in the SANS/FBI Top 20 Vulnerability lists for both Windows (IIS, SQL Server) and UNIX (Apache, sendmail, SSH). The Security+ objectives primarily concern the hardening of network applications rather than those which work on a standalone system without communicating over the network, so that is what we will focus on in this section.

Network applications Before looking in detail at different categories of network applications, let’s establish what a network application is (at least as far as Security+ is concerned). A network application is one that communicates with another program across the network. Network applications can be peer to peer (in which two computers share resources, as in many popular file-sharing services not relevant to corporate environments) or client/server (where a “client” program, usually on a smaller computer, accesses the functionality of a “service” program, usually on a more powerful computer called a server). In the TCP/IP world, most network applications use at least one TCP/IP port for communication with the other computer taking part in the conversation. The port may exist in the well-known range 0-1023 or above 1023 all the way up to 65,535. In the “old days” of the Internet, programmers developing a new service that they wanted to become a standard service would apply for one of the low “reserved” port numbers (which were originally somewhat more protected against spoofing than the other ports). Geek Owl! Well Known Ports In the world of multi-user systems in which the Internet was developed, only users with administrative privileges could start server applications that accepted requests on those low-numbered “well known” port numbers. This provided a primitive form of access control over who could start services, reducing the ability of users to spoof server programs and violate security. Today, using a

low-numbered port doesn’t really have any security advantages, since most users have administrative control over their own machines and can start such services at will. This is just as well, because so many low-numbered ports have already been spoken for. Most new network services today use higher port numbers, so that they don’t conflict with port numbers already assigned to other services. Success Owl! Well Known Ports A network application communicates with another program across the network. TCP/IP applications may use a well-known port in the reserved range 0-1023, or may use a higher-numbered port, up to 65,535.

3.5.3.1 Updates As with OS software and networks, it’s important to keep up to date with the latest fixes and patches for the applications used on your network. And test them before installing in a live environment.

3.5.3.2 Web Servers Web servers are often a company’s primary interface with the outside world, since a company’s web site is generally accessible to anyone, with no authorization required. Success Owl!

Web servers Web Servers are frequently a critical component to customers

Web servers accept HTTP requests on port 80, and HTTPS requests on port 443. You can change these port numbers, if you wish, but understand that unless your site visitors know the alternate port number at which your site lives, they won’t find it. Success Owl!

Critical Ports for Web Servers Web servers use TCP port 80 for HTTP requests and port 443 for HTTPS (SSL) requests.

When looking at hardening your web server, you actually need to look at a variety of tasks (in addition to hardening the machine on which the server software is running). In the early 1990’s, a web server consisted of just the server software itself and a bunch of static pages displayed upon request. Time marched on, and now web servers typically include some sort of application server to process pages whose content is dynamically created, such as JSP or ASP pages. So, hardening a web server includes: • • •

Hardening the web server software Hardening any “third party” server-side applications it uses Hardening any applications you’ve written for it

Hardening web server software

The first thing to do is to make sure you’re running with the latest security patches. Check your vendor site and the popular security sites for details. It almost seems like the popular web servers have regularly scheduled “bugs of the week”, including buffer overflows, privilege issues, etc. Second, configure the web server securely. Geek Owl! IIS/Apache Web Hardening For the Windows platform, MS provides two tools specifically aimed at increasing IIS security. IIS Lockdown Wizard, provides templates for the major IIS-dependant Microsoft products—turning off unnecessary features. The URLScan tool scans all incoming requests to the server and filters them based on rules set by the Administrator.[92] This can help you avoid known attacks which have been reported but for which a patch may not yet be available. An interesting summary of some common IIS vulnerabilities can be found in Hacking Exposed: Windows 2000[93] by Scambray and McClure. For Apache, check out Maximum Apache Security[94] by Anonymous, which includes coverage of using OpenSSL with Apache, setting up access control, URL mapping, log management, configuration parameters relevant to security, etc. This book looks at the recently released Apache 2.0 as well as Apache 1.3. More information about securing the Apache web server (was well as some amusing tales about grey-hatting Berkeley UNIX back in the day when it was actively under development) can be found in Real World Linux Security by Bob Toxen[95]. Information about using the mod_ssl extension to Apache can be found in Maximum Linux Security, mentioned above. Setting up restrictions based on user authentication, as well as, more about SSL and Apache can be found in Linux Apache Web Server Administration[96] by Aulds. Some general guidelines for securing web servers include: • • • • • • • • • •

don’t use the web server for anything but web serving don’t run the web server as System, root or any admin user remove any demo or “cute” applications… these tend to only provide places for latent bugs to hide, and when found, they will be exploited by attackers watch for client packages like front page that install scripts on the server (see: third party apps, below) disable (or don’t install) any server features you don’t need disable automatic listing of files in directories which do not contain a default HTML page (these can reveal other files on your system and might be a security risk) check file permissions of items in the web servers’ directories regularly avoid making system directories such as \WINDOWS or /etc accessible via the web server (or FTP server or …) don’t let your users install random CGI scripts or programs—it might be possible to abuse them to do unintended malicious things along the same lines, inspect any scripts from the net carefully before installing them

Success Owl!

Reducing Web Exposure To reduce the vulnerability of your web server to attacks, make sure that the OS and web server software is updated with the latest security patches, do not run any additional services on the web server, remove any scripts and pages that you are not actively using, and make sure you have locked down directory permissions to not allow updates or retrieval of unauthorized files.

Hardening third-party server applications In order to harden the applications on your web server, you need to find out what third party applications and tools are on your web server. These may be a mix of end-user applications such as CRM applications and programming environments like Java or Perl. If your developers were given free reign over the server in order to roll out an application in a timely fashion, ask them what they installed in addition to their own code. Otherwise, you probably have some idea of what run-time environments like a java application server were installed on your web server. After you have made that list, take a long, hard look at that list of third party applications on your server. Do you REALLY need ALL of them? Each additional application is another potential point of vulnerability. Particularly, if you’re running a database and storing sensitive data on your web server (or anywhere on the same side of your firewall as your web server), strongly consider moving the database to another machine. Your web server is a security compromise waiting to happen. You want to take all possible steps to minimize not just the chances of a break-in, but also the loss the company incurs, if one occurs. It’s bad enough for a web server to get “rooted”. It’s worse for the attacker to make off with a list of 20,000 credit card numbers because he had access to the database stored on the same server. Once you know the applications you MUST have on the server, check the vendor’s web site and security sites for information about current vulnerabilities and take the recommended steps. Also double-check any configurations with security in mind. Geek Owl! Third Party Hardening Information about securely programming and configuring these third-party applications is not quite as easy to find as is information about web servers themselves—in part because the audience for these is smaller than is the audience for the major web servers. However, here are some sources that might help get you started (be warned, they’re mostly programmers’ books): 1. More Servlets and Java Server Pages[97] by Hall, which covers the use of different kinds of authentication, role-based security and the configuration of the Tomcat open source JSP server 2. BEA WebLogic Server Bible[98] by Zuffoletto, which covers programming for security in that environment, logging, setting up clustering for redundancy, and an intro to security concepts interesting to someone maintaining a web server. 3. Other books are available which include coverage of security topics for platforms like ColdFusion and other commonly used web application

environments.

Hardening custom applications The area of hardening applications, such as ASP pages, that your own organization’s developers wrote (or that a long-gone dot-com-heyday web consultancy created for you) is a tricky one. Unlike for web server and application platform software, there’s no web site you can go search to look for bugs in “ourinternalapp” “version 2.4”. Rather than merely keeping your eyes and ears open for the latest flaws, you must proactively look for and prevent flaws in local, homegrown applications. Geek Owl! Secure Coding Secure coding is a topic that has been in the spotlight more and more, recently, with the two leading texts in this regard being: 1. Writing Secure Code[99] by Howard and LeBlanc 2. Building Secure Software: How to Avoid Security Problems the Right Way[100] by Viega and McGraw, which deals with the subject at a high level not specific to Windows Word of advice: Software architects familiar with UNIX tend to like the Viega and McGraw book, and Windows developers tend to prefer the Howard and LeBlanc volume.

So, you think you’ve got it locked down? After you think your web server and server applications are secure, consider running a web security scanner on a regular basis, to make sure that you have made all necessary security improvements (as far as the scanner knows, at least), and to make sure that periodic web site and system maintenance doesn’t undo your work on securing the server. For example, the Stealth HTTP Scanner will check for thousands of known vulnerabilities, and allow you to add your own tests, should you run into an issue it is not yet aware of.[101] Another CGI scanner to consider is whisker, available at http://www.wiretrip.net/whisker, which runs on Perl on Windows or UNIX. If the scanner finds any additional vulnerability, correct them, and re-run the scanner.

3.5.3.3 Email Servers Email servers actually run two different types of protocols. The first type is SMTP (Simple Mail Transfer Protocol), which is used to transfer mail from server to server on the Internet, or to send mail from a client program like Outlook to a server that can deliver the message to its destination. Clients use the second type of protocol to pick up their mail from an email server. These protocols include mailbox-access protocols like POP3 (Post Office Protocol version 3) and IMAP (Internet Message Application Protocol). POP3 is more popular (and better supported by client programs) than IMAP, but IMAP includes additional features like the ability to organize email into folders on the server, and search server mailboxes without downloading their contents to the client.

Success Owl!

Email Ports. To send email from server to server, or from client to server, TCP port 25 (SMTP) is used. For a client to retrieve email from a server, use TCP port 110 for POP3 connections, and TCP port 143 for IMAP connections. For a client behind a firewall to retrieve email from a server out on the Internet, open port 110 or 143 in the outbound direction, since the traffic is outbound from your network to the Internet. To allow Internet clients to retrieve mail from a server on your internal network, open port 110 or 143 inbound, since the traffic is coming into your network from outside.

Hardening email servers Email server software is, like web server software, a fertile ground for software bugs—some of which can be exploited to gain administrative access to the email server. Therefore, it is very important to keep up with your email server of choice, and monitor the vendor’s site and security mailing lists for bug reports. Geek Owl! Hardening is an Ongoing Process For example, years ago, there was a running joke about the “Sendmail bug of the week,” because Sendmail is a complex application and new vulnerabilities were being identified in the program with such great frequency. Today many Microsoft applications seem to have comments like that applied to them, and it’s easy for Linux/UNIX users to look down upon them for that—not having been around when administrators were shaking their heads, wondering when the stream of Sendmail reports would end. Additionally, some email servers provide a great deal of functionality beyond simple mail delivery, such as interactive conferencing, instant messaging and groupware. As with any server, disable any functionality you do not need, because it is an additional point of vulnerability in the server. Real World Owl!

SMTP Hole One interesting issue with the SMTP protocol is the ability of an attacker to use an SMTP server to find user ID’s of users on your system via the SMTP VRFY command. Most mail servers have this disabled today (in fact, most servers can detect telnet connections and deny them), but some don’t. To find out if yours still allows VRFY, use the command “telnet yourmailservername 25”, then type the line “HELO test” and press enter, then after the server tells you it’s pleased to make your acquaintance (a social lot, mail server programmers ;-), type “VRFY yourloginID” and enter. You’re safe if you receive a reply saying that the VRFY command is not known or not allowed. You need to check with your vendor on how to disable it, if the VRFY came back with information. The SMTP command “EXPN yourloginID” has similar issues, but it’s somewhat worse—because if the SMTP server handles group alias expansion, a

command of the form “EXPN aliasname” could potentially dump out to the requesting user, a list of all users in that alias. Open Source Email Security[102], by Richard Blum, contains many details on security for common email server programs; including SMTP, POP3 and IMAP servers, as well as details on blocking spam, open relays, etc. If you’re implementing a UNIX or Linux-based email system, it’s worth taking a look here to learn more about the many available alternatives. (Sendmail is the most popular SMTP server… not the only one.)

3.5.3.4 FTP Servers The third most common service, after web and email that a company may provide to Internet users is FTP, the File Transfer Protocol. FTP servers make available files for download over the Internet (or your intranet). They can also be used to accept uploads from business partners, customers, employees, etc. FTP needs ports TCP 20 and 21 open in a firewall to function across the firewall. Port 20 is used for the “data” connection, which transfers the actual file contents from one system to the other. Port 21 is used for the “control” connection, over which FTP commands and responses are sent. Success Owl!

FTP FTP is the File Transfer Protocol, used to upload and download files across the network. FTP uses TCP port 20 for its data connection and port 21 for its control connection.

Security-related aspects of FTP There are two primary aspects of an FTP server to consider when hardening it (other than various “features” of the FTP protocol which are interesting to hackers): user authentication and file access permissions. FTP servers accept connections in either authenticated mode or unauthenticated mode. Authenticated mode connections send the user and password across the network, and assume no one’s running a sniffer on your network. Because sending authentication information across the network like this is a bad idea, newer FTP servers feature a Secure/FTP protocol that handles authentication in a more secure manner, using techniques like challenge/response. Unauthenticated FTP connections, commonly referred to as “anonymous FTP,” are another barrel of laughs. Presumably you’ve heard of the concept of “warez”—pirated software. Well, warez “traders” need lots of disk space and bandwidth to store and distribute their software… and they often find it on random anonymous FTP sites around the net that have at least one directory write able by the anonymous FTP user. If all of a sudden, your Internet connection seems very slow, and your FTP logs very large, you might have accumulated some warez on your FTP server.

If you have to allow anonymous FTP access for one reason or another, OK—but make sure that you don’t offer anonymous users a writeable directory if possible. Geek Owl! Of course you know, this means WAR! Note that if a warez geek does find and use your server, and then you shut off his/her access, you’ve just dramatically upped your network’s chances of being attacked by a group of software “traders” annoyed at losing “their” site and trying to re-own it. (Author Helen has experienced this phenomenon first-hand, and oh boy, they can have you on their “preferred target” list for years!) File access permissions refer to which FTP users have access (and what type of access— read, write, delete, etc.) to which resources on the server. Some FTP servers rely strictly on OS security to set up these permissions. If the OS would allow that user to have access to that file/directory normally, the FTP server lets them have it. Other FTP servers start with that level of security and then add onto it an additional file access control configuration file that further restricts those permissions when files are accessed in the context of an FTP server. A potential issue you can face on an FTP server is that of a denial of service, caused by uploaded files filling up the FTP file system or disk. Once this has happened, no other users can upload files, until the disk full condition is remedied. This problem is exacerbated if the file system or disk used for FTP uploads is the same one that contains the OS and the logs, since it may cause the FTP server to stop logging transfers (when it is still allowing downloads) or crash altogether. To help guard against this, set disk quotas on users who access the system via FTP (including whichever user ID is used for anonymous logins).[103] Also, FTP is susceptible to man-in-the-middle attacks, because of the unencrypted nature of the FTP protocol.

Securing your FTP server The details of securing your FTP server are of course application-specific. For information on the version of FTP supplied with Windows .NET Server, check the Windows .NET Server Security Handbook[104]. For information on FTP in Linux, see Hacking Linux Exposed[105] by Hatch et. al. In addition to making sure that your FTP server software is up to date, we recommend that only those users requiring FTP be given access to it (avoid anonymous FTP if possible), and that you carefully monitor the directories available through FTP. Also, make sure that you log FTP logins and file uploads and downloads. Due to the potential for the FTP server being compromised, it is best if the logs are kept on a separate system (so that an attacker can’t easily delete evidence).

3.5.3.5 DNS Many sites configure their web server and FTP server on the same system (at least in part because certain vendors’ software, like IIS, encourages this by including an FTP server as part of the web server). If you really want to run both on the same machine, make sure that your FTP server can’t be used to upload files into a directory also accessible via your web server—

if an attacker can upload a file to a location accessible by the web server, he can upload a malicious script using FTP and then execute it by invoking it via a web browser. Success Owl!

DNS DNS, the Domain Name Service, maps hostnames to IP addresses. DNS uses TCP port 53 and UDP port 53.

DNS Servers DNS, or the Domain Name Service, is used to map hostnames to IP addresses. In the UNIX world, the most common DNS server is BIND—and unpatched BIND servers were recently named by SANS as the #1 security problem on the Internet. DNS uses TCP port 53 and UDP port 53, so if you are passing DNS information through a firewall, you need to make sure those ports are open.

DNS security issues There are a number of historical flaws in DNS that have begun to be addressed by new protocols such as DNSSEC (DNS Secure), which provides for more authentication than the original DNS protocol, and is implemented in BIND 9. One of these issues, present in BIND 8 and other versions, is the availability of unauthenticated zone transfers. Zone transfers are used to update secondary DNS servers with the changes made to a zone’s DNS information on the primary DNS server. Hosts involved in the zone transfers do not authenticate themselves in any way. Most DNS servers allow administrators to restrict zone transfer operations to specific hosts. The way that this should be used is that you should restrict zone transfers from your primary name server to only your secondary name servers. No other servers need to perform this action. Since too many zone transfer requests can also cause a DoS condition, it is in your best interests to not allow any other machines to perform zone transfers. Success Owl!

DNS Security To improve DNS security, restrict zone transfers from your primary name server to only your secondary name servers. Since attackers can use repeated zone transfers to cause a DoS condition on your name server, restricting the use of zone transfers this way minimizes your vulnerability to DoS attacks.

Another issue is that of spoofing, through which you can feed bogus DNS data to other servers (or, it can be fed to you!). Fortunately, the more recent versions of BIND, the DNS server commonly run by UNIX machines, are not susceptible to this. (So, if you’re running a version of BIND less than 8, upgrade now!). If you’re running a server that does not yet incorporate anti-spoofing enhancements, you’ll have to take other measures such as placing your DNS server behind your firewall or turning off recursive DNS queries (which leads to its own problems).[106]

Related to spoofing is indirect DNS cache poisoning, in which an attacker takes some action that causes your name server, to query a name server under his control, for DNS information. If the information his name server provides to your server is bogus, he has managed to get your server to load bogus information into its cache. Since a DNS server, if attacked in these or other ways, can be used to provide false mapping data (possibly causing sensitive data to be redirected to unintended locations, like an attacker’s personal machine) or cause a denial of service to your network, it is important to safeguard it by making sure that the OS and DNS software is securely configured and that you are running with the latest updates. To allow for continued name service in the event of the failure of one server, you should carefully consider your DNS architecture. DNS should be configured redundantly, with both primary and secondary name servers (for example, with your own organization’s DNS server as primary, and your ISP’s as secondary). That way, you have created some redundancy to minimize the effects of DNS server downtime. Similarly, a large company should have multiple internal DNS servers, on separate subnets, to avoid the single point of failure that locating all of them on the same subnet can create. On this subject, a survey conducted by Men & Mice in June, 2002, revealed that 27% of Fortune 1000 companies have all their DNS servers on the same subnet.[107] Since attackers have been able to crash various name servers by overwhelming them with data in various ways, it is safest to run the name server with the minimum necessary permissions. Should a buffer overflow exploit be found in your DNS server of choice, and should an attacker get to your machine before a patch is available, you’d be better off if the user compromised is a relatively unprivileged user with limited system access rather than an administrative user. This litany of issues is why the Internet wizards are hard at work at developing a more secure DNS protocol. Until then, we take the precautions that we can and watch for vulnerability reports and patches. Geek Owl! DNS Security Testing Curious about your DNS setup’s security? Commercial tools are available at http://www.menandmice.com, to query your name servers and report vulnerabilities and configuration errors that might exist.

3.5.3.6 NNTP Servers NNTP servers handle the distribution of Usenet News. The NNTP (or Net News Transfer Protocol) uses port 119, so if you need to provide NNTP access to clients outside your network, make sure you allow incoming connections to port 119 on your NNTP server. Success Owl!

NNTP NNTP uses TCP port 119.

Through an NNTP server, users can read and post news “articles” which are then made available to other sites participating in Usenet through bulk transfers of batches of articles among cooperating sites. (Yes, you read that right; there WAS peer-to-peer before Napster!)

NNTP Server security issues NNTP software tends to be fairly complex, and security holes are discovered in various implementations from time to time, with results including an attacker obtaining system administrator access to the news server, creating a denial of service situation, reconfiguration of the news server, etc., so do keep up with patches. NNTP originally controlled access based on the host from which users connected (or they allowed everyone, anywhere, access). When most users read news from multi-user UNIX machines, this model worked well enough, but with the advent of single-user workstations and dynamically assigned IP addresses, became difficult to manage. Add the problem of users making inappropriate posts, and even “forging” news articles (making it look like someone else posted an article they created), and news server suppliers began to place more emphasis on authenticating those who connect to them. Some require users to authenticate themselves before access is provided, and some don’t. If possible, run a news server that requires authentication and takes steps to ensure that articles are not submitted with forged identity information. Based on the provided authentication information, users can be authorized to read news, post or bulk transfer news (which allows the user to upload/download entire sets of multiple articles, a capability which is usually only needed for servers). Most commonly, you would only allow the first two privileges, unless a peer server with whom you exchange news used the user ID in question. Success Owl!

NNTP Issues As with email messages headers, NNTP article headers listing the poster’s identity and other information can be forged. Additionally, NNTP client connections can consume a lot of bandwidth. Therefore, it is best if you can run a news server that requires authentication and takes steps to ensure that forged articles are not accepted.

3.5.3.7 File/Print Servers In most cases, the file and print server software you’re running was supplied as part of the OS, so there’s usually no need to update it separately from the OS. Generally, if there’s a security (or other) issue with file and/or print services, the patch will appear as an OS update. In the UNIX world, common network file server applications are NFS, the traditional UNIX Network File System originally from Sun, and Samba, a Windows File Sharing-compatible application. The BSD “lpd” subsystem is often used for printing. RPC (the underlying technology used by NFS) and lpd both appear in the SANS/FBI Top 20 list of UNIX vulnerabilities.

In the Microsoft world, the overwhelming choice for file and print services are the Windows File and Printer Sharing features supplied with the OS. You can also run NFS client and server software, and Novell-Netware-compatible software (plus numerous other less-wellknown packages). The technologies underlying various Windows File Sharing features appear on the SANS/FBI Top 20 list of Windows vulnerabilities. The most important point here, in addition to watching for vulnerabilities and patches, is to pay attention to configuration details. Make sure you haven’t made any directories or devices available to the world that you didn’t want to be available to the world.

How “share” permissions are applied When determining what access a client has to files in a shared directory, the operating system starts with the permissions that client would have if accessing the file locally on that machine. It then overlays the permissions on the share, and the “most restricted” level of permission wins. For example, if the OS would allow the user to read and write the file, but the directory is shared read-only, the user could only write to it. If the OS allowed the user to only read the file, and the directory is shared read/write, the user could still only read the file. Some file systems allow for the server to validate specific client user credentials, so that each user accessing a file could potentially have different permissions to access information on that remote system. Others map all remote accesses to a single user with minimal privileges, similar to the way that anonymous FTP works. Geek Owl! Samba If you run Samba on a UNIX machine, for ease of sharing files with Windows machines check out the section on Samba security-related configuration in Real World Linux Security.[108]

3.5.3.8 DHCP Servers Dynamic Host Configuration Protocol (DHCP) servers are used to assign and distribute host configuration information to clients who request it. Each DHCP server is configured by the organization with data including ranges of addresses it can hand out (possibly including some “static” IP addresses that are always assigned when a host with a particular MAC address makes a request), and configuration information such as the gateway out of the network, the DNS server, etc. Success Owl!

DHCP Dynamic Host Configuration Protocol (DHCP) servers assign and distribute host configuration information to clients who request it. Information assigned can include IP address, network gateway, and other configuration information.

DHCP security issues Since DHCP servers don’t require authentication of either client or server, they are vulnerable to exploits by attackers. For example, any client can request a network address—if enough

spurious requests are aimed at a DHCP server, its pool of available addresses can be exhausted, depriving legitimate users of access to the network. Therefore, it is recommended that your DHCP server be configured to hand out addresses only to those hosts that are “known” to you (for example, those hosts whose MAC addresses appear in a file on your DHCP server). On the other side, anyone can run their own DHCP server on a network, and if that server is faster at responding to DHCP queries than the “real”, authorized server, clients will accept the data from the rogue DHCP server. Among the problems this can lead to is the rogue DHCP server providing incorrect DNS nameserver addresses, which might allow the attacker to redirect traffic originating at that client, and destined for legitimate sites, to other sites, by “faking” bogus DNS information for the legitimate site. Therefore, it is recommended that DNS information be configured statically on each client rather than provided by the DHCP server. Success Owl!

DHCP Vulnerabilities Possible attacks on DHCP servers include DoS and spoofing. Spoofing can enable an attacker to provide bogus DNS server information to clients, causing more trouble by directing clients to bogus sites that masquerade as common sites such as amazon.com (possibly leading to identity theft or credit card fraud, etc).

Because of the DNS risk, it is recommended that you not hand out DNS information via DHCP, but instead configure static DNS information on each client. Geek Owl! DHCP Issues The industry has somewhat addressed the problem of rogue DHCP servers, but alas, the solutions provide a bit of a false sense of security. For example, when using the DHCP server capability provided by Microsoft Windows 2000, a DHCP server must be “authorized” by an administrative user before it can accept requests for IP addresses. This helps keep Joe newbie admin from installing a machine and setting it up as a DHCP server, without realizing the impact it might have on network connectivity to do so. However, understand that it does nothing to prevent someone from obtaining a freeware DHCP server from another source and installing it on a Windows Server, in order to run an “unauthorized” DHCP server handing out whatever information he or she wishes. On the bright side, attacks against DHCP servers tend to be limited to the local network, because DHCP requests are made as network “broadcasts” which typically do not get passed out of a subnet. If your DHCP server is on a different subnet from the hosts, you must configure your router to use the “BOOTP relay” protocol[109] (via UDP port 67) to allow the DHCP requests to cross the subnet boundary. When doing this, exercise care so that you do not allow more clients access to the DHCP server, than is absolutely required. Success Owl! BOOTP When using BOOTP relay functionality to distribute DHCP information across a router boundary, the router should allow communication via UDP

port 67.

3.5.3.9 Data Repositories Data Repositories are locations that hold information—about your network or about its business. For obvious reasons, you should care about protecting repositories from unauthorized reading and modification. An additional concern is protecting the repository servers from a denial of service attack that could result in clients who need information from the repository being unable to obtain it in a timely fashion. Success Owl!

Data Repositories Data Repositories hold information about your network or your organization’s business. They are important from a security standpoint because you need to protect this important data from unauthorized reading and modification.

3.5.3.9.1 Directory Services A directory service is the full-featured electronic version of the white-pages. It allows clients to perform property-based retrieval of information stored in the directory. For example, the directory might store information about users, network services and printers. Types of information about, or “properties of” users that are maintained in the directory might include their name, department, position, telephone extension, and email address—and can include anything else of interest to those who manage the directory (as long as the directory software allows for it). Directories are used for far more than simple information lookup by the curious. For example, they can be used to distribute public-key information (public keys will be discussed in the next chapter), locate the “closest” server providing a specific network service like electronic mail, and control access to resources. Directory servers can also be set up to communicate among themselves and exchange information so that they know about information managed by other directory servers.[110] Directories can be used for simple information lookup, like an electronic “white pages”. Success Owl!

Directory Services They can also be used to make public key information for available, find the “closest” server providing a specific network service, and control access to resources.

Lightweight Directory Access Protocol (LDAP)

The most common protocol in use today for retrieval of information from directory services is the Lightweight Directory Access Protocol (LDAP), discussed in a prior section. LDAP requires port 389 to be open on your firewall if you want to allow LDAP-based Directory Service traffic between your internal LDAP server and other hosts on the Internet. To enable your internal hosts to query an LDAP server which sits outside your

firewall, open port 389 in the outbound direction. To enable clients on the Internet to query an LDAP server on your internal network, open port 389 in the inbound direction. Most common directory services, such as Microsoft Active Directory (which stores the security policy information for the network and its users, among other things), Novell eDirectory (the service formerly known as NDS), Netscape iPlanet and OpenLDAP (an opensource project) communicate via LDAP. As you probably guessed by now, the usual caveats apply about running with the most up-to-date security patches and secure configuration settings. Since configuration settings are vendor-specific, see your vendor for details. For nice overviews of Active Directory and NDS, including security tips for NDS, see Directory Services—Design, Implementation, and Management[111] by Nancy Cox. Success Owl!

LDAP Port LDAP, the Lightweight Directory Access Protocol, uses port 389 for communication between your internal LDAP server and other hosts on the Internet. Open port 389 outbound on your firewall to allow clients on your network to query a directory server on an outside network. Open port 389 inbound to allow clients on the Internet to query a directory server on your internal network. LDAP is the protocol used by most common directory services such as Microsoft Active Directory, OpenLDAP and Novell eDirectory.

Directory Services security issues

Some directory services allow anyone to query the directory for any available information about network resources and users. Still other directory services support multiple forms of authentication—allowing the administrator to choose the most appropriate mechanism (hint: challenge/response or PKI based authentication schemes, discussed further in the following chapter, are more secure than those which transmit a password in encrypted or clear text forms). With authentication, different levels of users can be granted different levels of access, helping enforce the security principle of providing information on a “need to know” basis only. Geek Owl! Tip Directory Services Security Issues Much has been said about security flaws in Active Directory (replication latency). Robert Williams claims this is not a technical issue but an administration issue. His answer is to be aware of the design of Active Directory and only make changes to a single Domain Controller at one time[112]. Other issues such as the “Mixed Object Access” were discovered as well[113]. A patch was released less than a week after discovery. Once again, this only reinforces the point of keeping on top of updates and applying patches. Information provided by directory services can include sensitive details about the enterprise and its network configuration—types of data that you wouldn’t want an attacker with a network packet sniffer to have. Therefore, many directory services can make use of encryption when sending data back and forth between directory service client and server. If

your directory service supports an encrypted communication path, use it. If you’re using vanilla LDAP, consider moving to LDAP over TLS, which provides such encryption. Success Owl!

LDAP Security and TLS If your LDAP directory service distributes information that you consider to be sensitive, consider moving to LDAP with TLS (for encryption) to protect that information.

A last subtle point to consider when hardening a directory server is verifying that the directory contains correct data. Has the data been obtained through appropriate, verified channels? If you don’t have established, verifiable sources for data, someone might very well be able to insert bogus information into your directory without any sort of technical access to it at all (in yet another case of social engineering).

3.5.3.9.2 Databases A database is a collection of information—about a company’s products, its customers, its financial records, etc. Databases are quite useful tools from a hacker’s perspective. For one thing, they contain data that the company considers valuable enough to retain for some reason or another. Database security issues

As with hardening a web server, hardening a database server tends to be a multi-step process, in which you harden the database server software itself, and then any custom applications/databases your organization’s staff has set up. Don’t overlook the step of checking for security updates for your database server software. While database servers are not as visible on the Internet as web servers are, they’re often not completely invisible either (particularly if a cracker has broken into your web server), and the potential value of their contents makes them an interesting target. The most straightforward issue with databases is simply configuration of the database for appropriate levels of data privacy and integrity. Your database administrator should be responsible for maintaining the necessary security on the sets of data stored in the database. Each data table can often be assigned its own permissions, which may for example allow web users to just read, or just add to a table. If you need to apply different rules to different users, many databases can be configured to accept individual user logins as well as general connections without authentication, and then match the user login with access rules for the data in the database, to determine what kind of access (delete records, add new records, change records, read only) the user has to each type of data in the database. Not only can databases contain valuable data, but also they’re often a handy portal into command line access to the OS—sometimes with system administrator privileges—due to programming errors in the database software itself, or in applications written by others, attached to the database server. Some databases feature the concept of a “stored procedure”—small programs stored within the database server to do a series of things (like, often, run certain command line commands) when they are invoked by database users.

The stored procedures often take user-provided data as parameters, to determine exactly what the stored procedure will do. As with CGI script exploits and buffer overflows, it’s sometimes possible to creatively manipulate this data to do something other than what you might expect. In addition to considering the server itself, you should also consider how the database talks to the rest of the world. Does it, like SQL Server, listen on a well-known port for incoming connection requests? If so, does your firewall allow traffic in-bound from the Internet to that port on that machine? There’s almost no good reason to do so. In fact, ideally, there are rules in place on your network to allow your web server and perhaps some internal workstations to connect to the database server port—and disallow access to it by everyone else. Geek Owl! ”Select” Issues Many web applications are written to build database commands (in the SQL language used by most databases) from certain keywords like “SELECT” and input that is provided by a user via a web form. Often the provided input is simply copied into the database command as it is being built, without checking to see that the web form data would actually be valid, and then submitted to the database to be run. As with stored procedures, it is possible to creatively construct web form data so that it actually embeds additional attacker-specified database commands into the original command. The database sees the additional database commands and not knowing they’re not legitimate requests, executes them—and gives the hacker a map of the database, deletes your customer records, changes item prices, etc. This particular attack is known as SQL injection. Even in late 2002, SQL injection is still possible on many commercial sites. While it’s beyond the scope of this book (we’re not writing a programming book, after all) to describe exactly how these flaws are taken advantage of, or how to write code that guards against them, other sources for this information exist, such as Writing Secure Code[114] by Howard and LeBlanc. Real World Owl! Databases and Ports Research the TCP/IP port(s) used by your database server software, and set up appropriate ACLs to restrict access to those ports on the database server, to only those systems that require access. For example, if SQL Server is your database, only allow inbound access to the database server machine TCP ports 1433 and 1434 from your web server and a minimal number of trusted internal hosts. If your tables are well protected and your database software is patched with the latest security fixes, why care about this? It’s all about providing concentric rings of security—defense in depth. For example, locking down your tables and keeping up to date with patches does not necessarily protect you from a zero-day exploit that misuses vulnerability in the database server software. Once there, an attacker can attempt to brute force the DBA’s database password, look at other databases on the server which might not be as well-protected as the one accessed from the web, etc.

One final note: Remember default passwords? Some databases have them, too. Make sure you change the password of any account installed with your database installation (or use a method of authentication that verifies identity other than by password). EVERYONE knows the default account and password for older versions of SQL Server (no, we won’t add to the problem by repeating it here); surprisingly few people change it. Combine this with a network configuration that allows the database server to be accessed from the Internet, and a tool such as sqlpoke that allows a cracker to search for SQL Servers out on the Internet that use the default account and password,[115] and it’s not a pretty sight. (As Scambray and McClure say about this, “sleep tight!”) Success Owl!

Database Lockdown Make sure that you change all default passwords for your database installation. If possible, select a user authentication mechanism that does not rely on passwords. If that is not possible, take care to assign strong passwords that are as invulnerable as possible to cracking attempts.

And now that we’ve wrapped up our discussion of infrastructure security, it’s on to the next chapter, which fittingly (now that we’ve just talked about passwords for databases) concerns the topic of Cryptography. [80]

http://csrc.nist.gov/itsec/guidance_W2Kpro.html#NSA_W2K

[81]

http://www.securiteam.com/tools/5FP0D2K2KA.html.

[82]

Schultz, E. Eugene, Windows NT/2000 Network Security, Macmillan Technical, September, 2000, http://www.nerdbooks.com/item.html?id=1578702534 [83]

Shea, Brian, Have You Locked the Castle Gate, Addison-Wesley, April, 2002, http://www.nerdbooks.com/item.html?id=020171955X. [84]

Toxen, Bob, Real World Linux Security, Prentice-Hall, November, 2002, http://www.nerdbooks.com/item.html?id=0130281875

[85]

Anonymous, Maximum Windows 2000 Security, Sams, December, 2001, http://www.nerdbooks.com/item.html?id=0672319659

[86]

http://www.sysinternals.com

[87]

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows 2000serv/deploy/confeat/securcon.asp [88]

Todd, Chad and Norris L. Johnson, Hack-proofing Windows 2000 Server, Syngress, November, 2001, http://www.nerdbooks.com/item.html?id=1931836493

[89]

Cox, Philip and Tom Sheldon, Windows 2000 Security Handbook, Osborne, November, 2000, http://www.nerdbooks.com/item.html?id=0072124334

[90]

http://www-124.ibm.com/developerworks/oss/jfs/

[91]

Held, Gilbert and Kent Hundley, Cisco Access Lists Field Guide, McGraw-Hill, April, 2000, http://www.nerdbooks.com/item.html?id=0072123354 [92]

Peikari, Cyrus and Seth Fogie, Windows .NET Server Security Handbook, Prentice-Hall, April, 2002, http://www.nerdbooks.com/item.html?id=0130477265 [93]

Scambray, Joel and Stuart McClure, Hacking Exposed: Windows 2000, McGraw-Hill, September, 2001, http://www.nerdbooks.com/item.html?id=0072192623 [94]

Anonymous, Maximum Apache Security, Sams, May, 2002, http://www.nerdbooks.com/item.html?id=067232380X

[95]

Toxen, Bob, Real World Linux Security, Prentice-Hall, November, 2000, http://www.nerdbooks.com/item.html?id=0130281875

[96]

Aulds, Charles, Linux Apache Web Server Administration, Sybex, September, 2002, http://www.nerdbooks.com/item.html?id=0782141374

[97]

Hall, Marty, More Servlets and Java Server Pages, Prentice-Hall, December, 2001, http://www.nerdbooks.com/item.html?id=0130676144 [98]

Zuffoletto, Joe, BEA WebLogic Server Bible, Hungry Minds, February, 2002, http://www.nerdbooks.com/item.html?id=0764548549

[99]

Howard, Michael and David LeBlanc, Writing Secure Code, Microsoft Press, November, 2001, http://www.nerdbooks.com/item.html?id=0735615888

[100]

Viega, John and Gary McGraw, Building Secure Software: How to Avoid Security Problems the Right Way, Addison-Wesley, September, 2001, http://www.nerdbooks.com/item.html?id=020172152X [101]

Scambray, Joel and Stuart McClure, Hacking Exposed – Windows 2000 Network Security Secrets and Solutions, McGraw-Hill, September, 2001, http://www.nerdbooks.com/item.html?id=0072192623 [102]

Blum, Richard, Open Source Email Security, Sams, October, 2001, http://www.nerdbooks.com/item.html?id=0672322374

[103]

Crothers, Tim, Internet Lockdown, Hungry Minds, October, 2001, http://www.nerdbooks.com/item.html?id=0764548611

[104]

Peikari, Cyrus, and Seth Fogie, Windows .NET Server Security Handbook, Prentice-Hall, April, 2002, http://www.nerdbooks.com/item.html?id=0130477265

[105]

Hatch, Brian, James Lee and George Kurtz, Hacking Linux Exposed, Osborne, April, 2001, http://www.nerdbooks.com/item.html?id=0072127732

[106]

Crothers, Tim, Internet Lockdown, Hungry Minds, October, 2001, http://www.nerdbooks.com/item.html?id=0764548611

[107]

http://www.nwfusion.com/news/2002/133721_07-01-2002.html

[108]

Toxen, Bob, Real World Linux Security, Prentice-Hall, November, 2000, http://www.nerdbooks.com/item.html?id=0130281875 [109]

http://www.ietf.org/rfc/rfc1542.txt

[110]

Greenblatt, Bruce, Internet Directories: How to Build and Manage Applications for LDAP, DNS, and Other Directories, Prentice-Hall, August, 2000, http://www.nerdbooks.com/item.html?id=0139744525 [111]

Cox, Nancy, Directory Services – Design, Implementation and Management, Digital Press, December, 2001, http://www.nerdbooks.com/item.html?id=1555582621 [112]

http://www.windowsadvantage.com/tech_edge/04-16-01_alleged_flaw.asp

[113]

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/Security/Bulletin/ms 00-026.asp [114]

Howard, Michael and David LeBlanc, Writing Secure Code, Microsoft Press, November, 2001, http://www.nerdbooks.com/item.html?id=0735615888

[115]

Scambray, Joel and Stuart McClure, Hacking Exposed – Windows 2000 Network Security Secrets and Solutions, McGraw-Hill, September, 2001, http://www.nerdbooks.com/item.html?id=0072192623

3.6 Summary In this chapter, we looked at the topics in the third domain of the Security+ exam, Infrastructure Security. The chapter covers everything from physical components to applications—all the components that are likely to be part of your network infrastructure. Devices you learned about include: • •

•

•

Firewalls (which protect an internal network from the outside world; more about these later in this summary) Routers (the traffic directors of the Internet at the Network Layer, which connect networks, forwarding packets between them; you can limit sniffing by using routers to send to a subnet only the traffic required to be on it, and use Access Lists to control traffic passing through routers based on source IP address, destination IP address, port number, direction and other characteristics) Switches (which direct traffic at the Data Link, or MAC, Layer, forwarding to subnets only required traffic in order to minimize opportunities for sniffing; unlike hubs, they do not automatically make a packet appearing at one switch port, available to the connections on all other switch ports) Wireless (which implements network connectivity without the need for physical connections; due to the current state of the most common 802.11-based wireless

•

•

•

•

•

•

•

•

protocols, access control and the sniffing of unencrypted wireless network traffic are security concerns) Modems (which allow users to connect to your network from outside it, may allow users to bypass security if dial-ins are not restricted by a firewall or VPN as with connections to your network from outside on the Internet; you can limit access to your modem pool by using call-back technology, but attackers can sometimes defeat this by using call-forwarding) RAS (which stands for Remote Access Services, discussed in Section 2, that authenticates users connecting to the network from a remote location and allows them network resource access; it can use many authentication mechanisms, including CHAP and MS-CHAP (considered more secure), and PAP and SPAP (considered less secure); RAS attempts should be logged so that you have a record of successful and unsuccessful connections) Telecom/PBX (which is becoming more of an issue as more organizations combine computers and telephony, possibly even integrating them with IP telephony; phone networks have similar security concerns as data networks, and in some cases, less security; you should change all default passwords on your PBX, limit administrative access permissions to locations requiring physical access to the administrative console, and be on guard for social engineering attempts) VPN’s (Virtual Private Networks, which allow you to simulate a private network over a public network through secure authentication and data encryption; VPN’s are a cost effective alternative to dedicated private networks, and may be used to protect services used by both internal and external users; VPN’s can be used internally to provide an extra level of security for sensitive transactions such as payroll; VPN security vulnerabilities include susceptibility to Internet traffic interruptions and flakiness, lack of encryption of some packet fields such as source/destination address under some VPN’s, susceptibility to DoS attacks, and configuration challenges) IDS (Intrusion Detection Systems, which detect attempts to break into or misuse a system or network; attacks they can detect include network scans, packet-spoofing, DoS and other common script-kiddie attacks, unauthorized service connection attempts, malformed packets, changed system files and improper activities; an IDS should be placed on your network anywhere you want to monitor for suspicious activities) Network monitoring/Diagnostic tools (which include tools working at low layers such as TDR’s and SNMP-enabled devices like switches, as well as higher-level tools that monitor packet traffic, capture network configuration information, and scan a network or system for open ports; SNMP is the Simple Network Management protocol, used to query devices for information and sometimes alter parameters; because SNMP traffic is very vulnerable to sniffing, and its “community name” authentication is insecure, we recommend that you disable it unless you can configure your devices to use the more secure SNMPv2) Workstations (which are the machines your network’s users employ to get their work done, and often the source of troubles like viruses spread by users opening email attachments, staff installing and running unauthorized applications, not adequately securing their machines when away from them, using insecure passwords, or hooking a modem up to their PC for access from home; other issues include the ability to “boot” the workstation into an OS that allows direct access to disk contents, the ability to change BIOS information, and theft) Servers (which usually run services used by many client users, are a security priority; they’re also a hacker target because of the importance of the data they hold, or

•

functionality they offer the network; placing a server in your internal network is no guarantee against attack, since some attacks originate internally; if uptime is a concern, consider adding a UPS or generators, or even implementing a “clustered” system with multiple redundant high-availability hardware components such as RAID arrays and hot-swappable devices) Mobile Devices (which span from Pocket PC and Palm handhelds, to RF scanners and notebooks, are those items on your network which typically aren’t restricted to just one location; because of their portability, you are advised to set a password on the device if possible, encrypt data stored on the device, and consider encryption for any wireless networking to minimize the potential for loss of confidential data; because these devices move around a lot, they are also vulnerable to loss of the units themselves and data corruption, so upload collected data from the mobile device to your network as soon after collection as possible)

You discovered more details about firewalls, which come in two types, application-level and network level. Application-level firewalls, or proxy servers, act as middlemen between client and server sides of a connection, keeping two separate physical connections open for each single logical conversation, and passing packets as permitted. Pro’s include finer-grained control over permissions due to proxy’s detailed knowledge of each protocol allowed to pass through the firewall, and the fact that internal systems are usually protected from most lowlevel TCP/IP attacks, because the proxy never allows an external system to connect directly to the internal system. Con’s include that client configuration is usually required, and they are less efficient than other types of firewalls due to overhead in setting up multiple connections for each incoming request. Network-level firewalls inspect packets as they travel through the firewall, from one side (the outside network) to the other (the inside network). Pro’s include transparency to network clients and faster speed/more efficiency compared to applicationlevel firewalls. Con’s include no isolation from low-level TCP/IP attacks since direct connections from outside devices to inside devices are allowed, and less protocol specific filtering functionality than many application firewalls. Two types of network-level firewalls are packet filters and stateful packet inspection firewalls. Packet filters are the simplest, lowest-overhead firewall; they base all decisions as to allow or disallow a packet based on the contents of that packet, not taking into account the context of the conversation. Stateful packet inspection firewalls build on packet filter technology by looking at packets in the context of the conversation in which they occur, giving them more information to evaluate when deciding whether or not to allow a packet through. You also looked at the various types of media likely to be found on (or near, or involved in some way with…) your network, including: •

•

Coax (early Ethernet cabling, usually either 10Base5, a thick cable up to 300 feet in length, or 10Base2, a thin cable-TV-like cable up to 183 feet in length; security issues include a lack of reliability and the ease with which coax can be tapped and conversations eavesdropped upon) UTP/STP (unshielded and shielded twisted pair cabling, used for Ethernet and Token Ring communications at speeds from 4mb/sec to 1gb/sec or more; security issues with UTP include the ease of adding devices to a UTP network by plugging a cable into any spare hub or switch port, and vulnerability to eavesdropping by monitoring electromagnetic emissions; if running cable in certain locations like dropped ceilings, you need to use specially-approved cable that meets fire codes, such as plenum cable)

•

•

Fiber (fiber-optic cabling which transmits data via light pulses rather than electrons, whose advantages include being difficult to tap and immune to RF-based interference or snooping; the main disadvantage is that fiber can be fragile and difficult to work with, a situation which has been improving in recent years) Removable media (all types of data-storage media which can be written to and then removed from the machine and taken to another location; we look at these in detail below; the primary vulnerabilities of removable media center around the lifetimes of media for archival data storage as well as the potential for loss of confidential data when the media gets into the wrong hands; to minimize data privacy issues, you may want to encrypt data stored on removable media)

You reviewed the different types of removable media, which include: •

•

•

•

•

•

Tape (one of the oldest media, and also one of the slowest; tape is often used for system backups; it is prone to becoming unreadable due to age/humidity/temperature and even tape stretch, just like your favorite audio cassettes (if you’re old enough to remember such things!), and like all magnetic media is vulnerable to data corruption from magnetic fields such as those from your computer speakers, and may be difficult to FULLY erase) CDR (which encompasses the original CD-R technology as well as the later rewritable CD-RW technology; different types of CD-R and CD-RW media have vastly differing expected lifetimes, so do your research carefully; security vulnerabilities of CDR include corruption via scratching the media, heat, humidity and direct sunlight; it can also be difficult to fully erase data on a CDR, and some users resort to scratching, breaking and even microwaving CD’s to make them unreadable) Hard drives (which are available in two common types, IDE and SCSI today; IDE is the low-cost leader, although SCSI is the performance leader; hard drives may be either semi-permanently installed inside a machine, or installed in removable carriers that can easily be transported from machine to machine; hard drive security issues include sensitivity to shock from being hit or dropped, corruption due to magnetic fields, the amount of heat generated by the drive, lack of hardware “write” protection for data written to drives; like different kinds of CDR media, different manufacturers and brands of hard drives have vastly differing MTBF, or mean time before failure, ratings) Diskettes (which are relatively low-capacity media, so the risk of loss of substantial amounts of data via diskette is minimal; older “floppy” diskettes were more vulnerable to physical damage than today’s hard-shelled diskettes; like other magnetic media, they are vulnerable to corruption via EMF) Flashcards (which are more properly called “flash memory cards”, use non-volatile memory which doesn’t require a constant power source, to store data; many PDA’s and digital cameras employ flash cards; since flashcards are available in many different formats such as Compact Flash, Smart Media, Memory Stick, MMC and Secure Digital, one concern is compatibility; other security issues include vulnerability of theft of large amounts of data in a small device, lack of support for encryption in some devices that read/write data on flashcards, and limited media life) Smartcards (which are small credit-card devices containing memory and possibly an IC for computations and data encryption, with those that contain an IC costing more than the ones just containing memory; smartcards typically store a small amount of data such as 32K; they may be used for access control (card keys), authentication (generating one time passwords) or storing e-cash (such as some schools’ student ID

cards; smartcard security issues include compatibility, vulnerability to theft, the frequent need for multi-factor authentication, to augment smartcard authentication with another type, for security purposes) You also explored network security topologies, which describe the organization of devices on a network from a security perspective. You first looked at how a network can be partitioned into multiple zones of security including: •

•

•

DMZ (or De-Militarized Zone, a no-man’s-land between external networks like the Internet and your protected internal network, usually sitting outside the firewall separating the wild world from your internal network; it is a neutral zone which keeps internal and external users apart, and minimizes opportunities for unauthorized actions by each, such as break-ins by external users or uses of Internet music-sharing services by internal users; in the DMZ you generally run services which need to accept connections from outside, such as email and web services; non-essential services should be minimized since they increase vulnerabilities, and internal-only services should not be run in the DMZ) Intranet (the internal network used by the organization’s insiders; proprietary data is generally stored and transported around a company’s intranet; if implementing a logical intranet connection via the Internet, protect that connection with an encrypted channel like a VPN or SSL-encrypted web connection; the intranet contains your network’s crown jewels—its most valuable data—and while threat of access by outsiders may be lower, there is still possibility of compromise by insiders, so suitable security should be deployed) Extranet (the extension of parts of an organizations network to its business partners such as suppliers and customers on a need-to-know basis; access is normally provided via VPN or SSL-encrypted web connections; because more people have access to these areas of your network than to your intranet, extra monitoring may be advisable)

You discovered that a VLAN (Virtual LAN) is a logical LAN created through configuration of switches; it provides the benefits of a subnet without requiring that the devices be on the same physical network, or connected with the same physical technology. Because some VLAN partitioning can be compromised, VLAN’s do not provide the same level of security as true physical subnets behind separate router ports. You learned that NAT (or Network Address Translation) is used to connect a private network to a public network, using one or more externally-visible public network IP addresses. It allows devices on private networks to communicate with the Internet and other public networks. When combining NAT and IPSec, the NAT address translation should be applied BEFORE the IPSec encapsulation is performed. (If you are using ESP in tunnel mode, you MAY be able to get away with doing NAT translation after IPSec encapsulation since that configuration doesn’t protect the header’s addresses from modification.) Static NAT involves a permanent mapping of a private address to a public address, generally one private to one public address. Dynamic NAT maps private addresses to public addresses as needed, which means that you can get away with fewer public addresses. PAT, or Port Address Translation, directs requests to a particular port on a public internet address, to the machine designated at the PAT box, as the machine that handles that service; for example, you might designate one machine as your web server port destination and one as your email server port destination. NAT is used for increased security, simplified administration, and the need for more internal addresses than permitted by the organization’s Internet connection.

You discovered that tunneling, the encapsulation of packets to create a virtual point-to-point connection can provide an authenticated, encrypted, tamper-resistant channel between two points, over the Internet. It can exist at Layer 2 (PPTP, L2TP, L2F), Layer 3 (IPSec) or higher layers (via ssh or SSL). You explored the topic of Intrusion Detection, learning that the two types of IDS are: • •

Host-based (HIDS) Network-based (NIDS)

Most IDS work by pattern-matching traffic with known attack signatures and taking action when it finds a match. Network-based IDS (NIDS) watches all packets it has access to on the network, which excludes packets that may be isolated away from the NIDS’ location by switches or routers, so you may have to deploy NIDS on multiple subnets to cover all segments of interest on your network. Disadvantages include that it is possible for a cracker to avoid detection by a NIDS by doing their communication via a VPN or SSL, since the NIDS cannot decrypt the traffic and analyze it, and that some NIDS can be forced into ignoring traffic through flooding. A NIDS can use either Active Detection (reconfiguring a router, breaking suspicious network connections, shutting down services) or Passive Detection (Logging the event, notifying the administrator, sending an SMTP alert, displaying an onscreen message) when an intrusion is detected. Host-based IDS (HIDS) watches for events on the hosts on which it is installed, including network traffic in and out of the host, changes to system files, etc. Host-based IDS can also use Active Detection or Passive Detection. An advantage of hostbased IDS is that unlike NIDS, it can potentially see the contents of SSL and VPN conversations involving that host, because the traffic is decrypted at some point on the host. You discovered that honey pots are decoy systems (or networks) set up to look interesting to crackers, typically mimicking a real system that would interest them; honey pots may be used purely as a research tool or an active defense against intrusions into systems that your organization really cares about. You explored incident response, the group of activities performed in response to a perceived computer security incident; activities may be defensive (such as securing the network) or offensive (such as investigating the incident and alerting law enforcement). The six key steps in incident response are: • • • • • •

Preparation Threat identification Containment Eradication Recovery Follow-up

When a threat is detected, the first thing to do is to secure the area; DO NOT power down any computers involved, but do make sure that they are not touched by random system administrators by unplugging network connections, locking keyboards, terminals, etc. Be careful not to change any evidence as that can affect a legal case. After securing the area,

report the incident to upper management; they need to know when intrusions have occurred, particularly if financial aspects of the business may have been affected. You next explored security baselines, which are minimum standards that set appropriate security controls, suitable for most organizations in normal circumstances. (You may use preestablished baselines such as the SANS Gold Standard, or define your own, specific to your organization, if its needs are unique.) Baselines may include both technical and operational standards, with the idea that application of these guidelines will substantially decrease the risk of the organization being attacked. When establishing baselines, consider vendor-provided standards, what others in the industry are doing to harden their networks, and specific issues related to your organization. Test before deploying, since tightening security often breaks applications that expect looser security settings, and you want to know about, and address, those situations in advance. When hardening an OS, some steps you may wish to take include: •

•

•

•

•

•

•

•

Research common guidelines that include a set of specific activities for hardening each specific OS you use, and start with these as a base of potential improvements; build on it from there, adding and subtracting items as needed Improved user/password management (remove unused accounts, enforce password guidelines such as length and ageing, log logins/logouts/attempts/account changes, consider putting users into groups to ease administration and enforce lockout of accounts after a number of unsuccessful attempts) Analyze where you’ve just “taken the defaults” during an OS installation and decide whether it was appropriate; some defaults may install unnecessary services which lead to vulnerabilities; in general, you should make sure that only required components are installed, and only required services are enabled Tighten “polices” in use (if your OS supports it (such as Windows), you can use system and network policies to lock down entire groups of machines and users at a time) Select a secure file system (on Windows machines, file systems like FAT are not secure, because permission-based access is not used; a better Windows choice is FAT; also consider an encrypting file system so that if an attacker steals the disk and tries to read it directly on another machine, he will not be able to get the data; you might also consider the “robustness” of the file system and its resistance to data corruption… some file systems are better than others) Select secure authentication mechanisms (choose something like Kerberos rather than a mechanism that transmits the password in cleartext; in Windows 2000 and higher, this has already been done for you courtesy of the Kerberos functionality built into the OS) Set appropriate permissions on files and directories (do not allow users to write into system directories; follow guidelines appropriate to your organization for restricting users’ access to other users’ files) Keep on top of updates, such as patches (a fix to a software problem; sometimes patches add new features, but usually just fix bugs), hotfixes (interim fixes issued for critical bugs that are often security-related; they are generally developed more quickly and are less tested than service packs) and service packs (or update pack, which is a collection of patches; service packs are often heavily tested to minimize the potential for trouble after installation); be aware that ANY update you install to your system

may break something, so you should test any update during non-production hours to ensure compatibility with your existing system configurations When hardening a network, some steps you may wish to take include: •

•

•

•

Update firmware (the updateable programming that determines how a device operates; it is important to watch for vendor updates and update firmware on a regular basis, since it can correct security bugs in hardware devices just as OS updates correct OS vulnerabilities) Carefully configure each device (changing any default or blank passwords on the device will remove lots of “low hanging fruit” from attackers; make any configuration changes recommended by the vendor to improve security) Disable any non-required services on the device, as unnecessary services running on the device increase vulnerability without adding any functionality your organization needs Use access control lists to specify traffic that will and will not be allowed to pass through the device (it is common to deny all inbound traffic, and list exceptions that will be permitted such as traffic inbound on port 80 to the web server, inbound on port 25 to the mail server, etc., and often common to permit all outbound traffic; “permit all outbound traffic” is becoming less popular as employers crack down on employee use of peer-to-peer Internet services, and workday Internet browsing; you should also use access control lists to specify that inbound traffic with a source address equal to your inside network should not be allowed, and outbound traffic with a source address not inside your network should not be allowed, to help foil TCP/IP spoofing)

When hardening network applications, you should ensure that the platform on which they are deployed (the OS) is secure by following the guidelines listed above for hardening an OS. Since these machines tend to be more attractive targets to attackers, special attention should be paid to keeping them up to date with patches and secured. Most network applications in common use involve services running on well-known TCP/IP ports (that is, on ports numbered 0-1023), although TCP/IP ports up to 65535 are possible. In general, you should make sure that only required services and applications are installed on each server; a common guideline is to require that each server do only one thing (be a web server, be an email server, be a database server, etc.). Web servers are frequently business-critical for both internal use, and for allowing customers and business partners access to some company resources (to allow them to order, check status, share information, etc.) They generally use port 80 (for HTTP) and port 443 (for SSL, or HTTP/S). No matter whose web server software, and what version of it, you use, you are likely vulnerable now, or will be vulnerable in the future, to a web-server-based exploit, so stay on top of updates to the web server software. Some steps you may want to take when hardening a web server include: •

• •

Ensure that the web server is not running any additional services it does not require, such as FTP (if you don’t use it), databases (which should be on a different machine), etc. Follow vendor-provided and user-community provided guidelines for securely configuring the web server (specific to each type of server) Remove any sample scripts and pages provided by the vendor that you are not using, and for that matter, any other scripts and pages you might have installed that you are

•

•

•

no longer using (each is a potential vulnerability, and vendor-provided scripts have OFTEN been the source of exploits) Harden any third-party products you’re using like java server engines, Cold Fusion engines, etc., by referring to vendor-provided and user-community-provided guidelines for securing those products Follow secure coding principles for software developed in-house or by consultants, to reduce vulnerability to attacks like buffer overflows and SQL injection (users embedding malicious code into form data used to update or query databases) Consider employing a web-server-specific scanner to probe your server for known exploits, to help ensure that you have locked it down as well as possible

Email servers are another tool critical for internal and external communication. For sending and receiving email between other servers, and receiving email from clients, they employ TCP port 25 (SMTP). For allowing clients to check their email boxes and retrieve email for reading on their PC’s, email servers use either port 110 (POP3) or port 143 (IMAP), or both. For a client behind your firewall to retrieve email from an Internet-based mail server, you must open outbound port 110 or 143 on your firewall. For a client outside your firewall to retrieve email from an internal server on your network, you must open inbound port 110 or 143 on your firewall. Like web servers and other common servers, email server software is a known source of many vulnerabilities; few email servers have never fallen victim to a security bug, so keep up to date on vulnerability notices and patches. Make sure that you have closed any “open relays” in your organization. FTP servers are used to exchange data internally and between internal and external sources. FTP uses ports 20 and 21 for its data and control connections, so those ports must be open in your firewall to allow transmission of data between external and internal sites. As with other application servers, keep up to date with patches and consult vendor-specific and user community documents describing secure configuration of your particular software. When securing an FTP server, consider: •

• •

• •

User authentication (limit access to only those users who really need it; avoid “Anonymous” access if you can, and use a secure FTP variant such as S/FTP to avoid transmitting passwords across the network in cleartext; when the original FTP protocol is used, you are susceptible to password and data sniffing and man-in-the-middle attacks) File permissions (carefully set file permissions on your server to ensure that users have access to only those files you wish them to have access to) Restricting uploads (restrict upload permission to only those users who need it; this reduces the number of accounts which if compromised can upload unauthorized files to your server) Disk quotas (setting a disk quota for users allowed to upload reduces the likelihood that they can DoS your FTP server by filling up its disk space) If you run your FTP server and web server on the same machine (bad idea), do not allow the FTP server access to web-server-related directories (scripts, HTML pages, etc.

DNS servers provide domain name service information to clients who need to map hostnames to IP addresses. DNS uses TCP and UDP port 53 for communication with clients and other nameservers on internal and external networks. The most widely used UNIX DNS software, BIND, has historically had many security issues (as have most other DNS servers), so keep up

with software updates to your DNS server. Some actions to consider taking when hardening a DNS server, in addition to the obvious actions of securing the underlying OS, include: •

• •

• •

Follow vendor and community-provided guidelines for secure configuration; this can help guard against spoofing and DNS cache poisoning (the insertion of invalid information in the DNS cache, which can be used to redirect traffic to non-legitimate sites) Run the DNS server as an unprivileged user, so that if it is compromised via a buffer overflow, the attacker cannot run code with administrative privileges Restrict zone transfers (batched DNS info updates) from your primary name server to your secondary name servers, to minimize DoS vulnerability and risks of other exploits Configure redundant DNS servers, so that an outage on one machine doesn’t remove access to DNS information for your entire network Locate a secondary DNS server in a distant area (both in terms of wire topology, and in terms of geography) for fault tolerance

NNTP, the Network News Transfer Protocol, handles the distribution of Usenet News, over port 119. As with email messages, News article headers can be forged, and news server clients can consume lots of bandwidth, so if possible, run a News server that requires authentication and takes steps to disallow the posting of forged articles. The next area you looked into was hardening file and print servers. In addition to making sure your OS software is up to date, and important action to take is to pay attention to configuration details, as one slip can place a random user into, for example, the Windows Local Administrators group, allowing them access to many sensitive files. When determining whether to grant a remote request for access to a file, the file server will typically start with the OS-level file permissions set on that object, and then further restrict those permissions if the “share” permissions are set to deny certain types of access like write, or access to certain individuals or groups. You then explored hardening DHCP servers, which are used to assign and distribute host configuration information to clients who request it; information assigned may include IP address, gateway and other configuration details. DHCP-related risks include denial of service to legitimate network hosts if rogue clients unnecessarily request IP addresses, and use up the pool of available addresses, and the risk of a “rogue” DNS server on the network being run to hand out an illegitimate DNS server address which contains invalid data an attacker could use to redirect legitimate traffic to illegitimate sites. Because of this DNS vulnerability, it is suggested that DHCP be configured to NOT hand out DNS server addresses, and that that be hand-configured at each client machine. Normally, DHCP communicates via broadcast and is thus restricted to communication within a subnet only; if you wish DHCP requests to cross subnet boundaries, you must enable DHCP forwarding on your routers and allow UDP port 67 traffic. You also looked at hardening different types of data repositories, which are locations holding information about your network or your organization’s business. Some of these include: •

Directory services (often using LDAP over port 389, it is frequently a good idea to run LDAP over TLS to provide encrypted communication so that information about your network setup or individuals within the organization is not sent across the network in

•

cleartext; you might also restrict access to certain types of directory information by user or group if your directory server allows it; another step to take is to verify that the directory server contains good data to begin with, so that it is not serving up bogus information to clients) Databases (which are collections of information, generally about the company’s products, customers, suppliers, etc. which are generally very sensitive; they are known for having security issues regularly, so keep on top of updates offered by your vendors, and investigate vendor-provided and user community developed recommendations for hardening your databases of choice; watch out for applications which are vulnerable to SQL injection attacks; work with your DBA to restrict access to individual data elements so that they are available only to those with a “need to know”; make sure that your routers and firewalls are configured to only allow connections to your database server’s ports (TCP ports 1433 and 1434 for SQL Server) from those trusted machines which require access and deny access to the database server from other hosts; finally, remove any default passwords your database server may have installed, and if possible select an authentication mechanism that does not rely on passwords, particularly if it requires that the passwords be passed over the net in clear text; if not possible to avoid passwords entirely, make sure you assign strong passwords and change them regularly)

3.7 Success Questions 1. IDSs can be described in terms of what fundamental functional components? A. B. C. D.

Information Sources Analysis Response No Answer is Correct

2. The majority of commercial intrusion detection systems are: A. B. C. D.

network-based host-based identity-based signature-based

3. Which of the following is a drawback of Network-based IDSs? A. B. C. D.

It cannot analyze encrypted information. It is very costly to set up. It is very costly to manage. It is not effective

4. Host-based IDSs normally utilize information from which of the following sources? A. operating system audit trails and system logs B. operating system audit trails and network packets C. network packets and system logs

D. operating system alarms and system logs 5. What is known as decoy system designed to lure a potential attacker away from critical systems? A. B. C. D.

Vulnerability Analysis Systems Honey Pots Padded Cells File Integrity Checker

6. Which of the following attacks can force a browser to come to your WWW server instead of the real site? A. B. C. D.

DNS spoofing Hijacking Man in the middle Land attack

7. A PBX with a maintained modem attached should A. B. C. D.

Be turned off except during actual maintenance periods Have strong authentication for use Be left on for high priority updates to the PBX software PBX's don't use modems

8. When backing up using tape the administrator needs to A. B. C. D. E.

periodically confirm the tape is still valid clean the tape drive store the tape off-site in a secured area all of these choices are correct no choices are correct

9. Choose the technology that enables the use of one-time passwords or pass phrases. A. B. C. D. E.

Biometrics Smartcards Genius cards USB hub no choice is correct

10. Classic ON/NOS hardening includes A. B. C. D. E.

Disabling unneeded protocols and services applying patches monitoring email and web sites for new issues all choices are correct Apply BIOS changes

Answers 1. *A. Information Sources *B. Analysis *C. Response Many IDSs can be described in terms of three fundamental functional components: Information Sources - the different sources of event information used to determine whether an intrusion has taken place. These sources can be drawn from different levels of the system, with network, host, and application monitoring most common. Analysis - the part of intrusion detection systems that actually organizes and makes sense of the events derived from the information sources, deciding when those events indicate that intrusions are occurring or have already taken place. The most common analysis approaches are misuse detection and anomaly detection. Response - the set of actions that the system takes once it detects intrusions. These are typically grouped into active and passive measures, with active measures involving some automated intervention on the part of the system, and passive measures involving reporting IDS findings to humans, who are then expected to take action based on those reports. 2. *A. network-based The majority of commercial intrusion detection systems are network-based. These IDSs detect attacks by capturing and analyzing network packets. Listening on a network segment or switch, one network-based IDS can monitor the network traffic affecting multiple hosts that are connected to the network segment, thereby protecting those hosts. Historically, IDS started out as host-based, which is the other major type of IDS. Identitybased and signature-based are not types of IDS. 3. *A. It cannot analyze encrypted information. Network-based IDSs cannot analyze encrypted information. This problem is increasing as more organizations (and attackers) use virtual private networks. Most network-based IDSs cannot tell whether or not an attack was successful; they can only discern that an attack was initiated. This means that after a network-based IDS detects an attack, administrators must manually investigate each attacked host to determine whether it was indeed penetrated. 4. *A. operating system audit trails and system logs Host-based IDSs normally utilize information sources of two types, operating system audit trails, and system logs. Operating system audit trails are usually generated at the innermost (kernel) level of the operating system, and are therefore more detailed and better protected than system logs. However, system logs are much less obtuse and much smaller than audit trails, and are furthermore far easier to comprehend. Some host-based IDSs are designed to support a centralized IDS management and reporting infrastructure that can allow a single management console to track many hosts. Others generate

messages in formats that are compatible with network management systems. Host-based systems do not generally use network packets (although some may inspect all packets destined for the particular host in question). Similarly, they traditionally rely on logs rather than on real-time alarms. 5. *B. Honey Pots Honey pots are decoy systems that are designed to lure a potential attacker away from critical systems. Honey pots are designed to: Divert an attacker from accessing critical systems, Collect information about the attacker's activity, and encourage the attacker to stay on the system long enough for administrators to respond. Vulnerability analysis systems measure a system or network's vulnerability to attack, not whether or not an attack has occurred. File Integrity Checkers are used to see if system files have been altered by an attacker. 6. *A. DNS spoofing There are vulnerabilities in the Netscape and Internet Explorer browsers. Using DNS spoofing to force a browser to come to your WWW server instead of the real site can demonstrate the ability to attack web clients. Hijacking can be used behind the scenes to accomplish the same results in some circumstances but requires more work on the attacker's part and does not necessarily involve redirection to a separate site. MITM attacks generally do not involve browser redirection. Land attacks are network-level attacks. 7. *A. Be turned off except during actual maintenance periods *B. Have strong authentication for use All but the smallest PBX systems can be updated by a modem. It is very easy to get default passwords and syntax for most PBX systems. Leaving the maintenance modem on is like leaving the key to the front door in the lock when going home at night. 8. *D. all of these choices are correct More than one company has found that storing tape in a high security area off site still needs to check the tapes. In one case a freezer running in an adjoining security area erased the tapes. The motor running the compressor created enough EMI to erase the tapes in the adjoining area. 9. *B. Smartcards Smart cards and other access tokens rely on one-time-only passwords, challenge-response phrases or public-key security to dramatically increase authentication strength. Biometrics involves unique physical characteristics, not passwords or tokens. USB hubs do not require passwords.

10. *D. all choices are correct This one is pretty self-explanatory. Some good web links for different operating systems include: Free BSD hardening concepts http://geodsoft.com/howto/harden/hardintro.htm Firewalls with VPN http://www.ntsecurity.net/Articles/Index.cfm?ArticleID=19686 Basic Steps to Hardening a Standalone Windows 2000 Installation http://www.astalavista.com/library/hardening/windows2000/win2kexchange.shtml

Chapter 0100: Domain 04: Basics of Cryptography (15%) "The job is never done. Just because you've wiped out the top N holes in your systems doesn't mean that it's Miller time. Expand the scope of your sweeps to include more obscure vulnerabilities -- after all, you never hear or see the one that gets you." --"Senior Analyst,” InfoWorld Test Center

Getting Ready—Questions 1. _______ are used in security system to ensure that transmitted messages have not been tampered with. 2. Two widely used applications of cryptography are for _________ and ___________. 3. The main role of a cryptographic hash function is in the provision of: ______________ and _________________. 4. A digital digest can/cannot be made public without revealing the contents of the original document? 5. A _______________ is used to allow verification of the claim that a specific public key does in fact belong to a specific individual. Answers 1. Hashes are used in security system to ensure that transmitted messages have not been tampered with. Hashes play a role in security systems where they're used to ensure that transmitted messages have not been tampered with. The sender generates a hash of the message, encrypts it, and sends it with the message itself. The recipient then decrypts both the message and the hash, produces another hash from the received message, and compares the two hashes. If they're the same, there is a very high probability that the message was transmitted intact.

2. Two widely used applications of cryptography are for identification and authentication. Identification and authentication are two widely used applications of cryptography. Identification is the process of verifying someone's or some thing's identity. For example, when withdrawing money from a bank, a teller asks to see identification (e.g. a driver's license) to verify the identity of the owner of the account. This same process can be done electronically using cryptography. Every automatic teller machine (ATM) card is associated with a "secret" personal identification number (PIN), which binds the owner to the card and thus to the account. When the card is inserted into the ATM, the machine prompts the cardholder for the PIN. If the correct PIN is entered, the machine identifies that person as the rightful owner and grants access. 3. The main role of a cryptographic hash function is in the provision of: message integrity checks and digital signatures. The main role of a cryptographic hash function is in the provision of message integrity checks and digital signatures. Since hash functions are generally faster than encryption or digital signature algorithms, it is typical to compute the digital signature or integrity check to some document by applying cryptographic processing to the document's hash value, which is small compared to the document itself. 4. A digital digest can be made public without revealing the contents of the original document? A digest can be made public without revealing the contents of the document from which it is derived. This is important in digital time stamping where, using hash functions, one can get a document time stamped without revealing its contents to the time stamping service. 5. A certificate is used to allow verification of the claim that a specific public key does in fact belong to a specific individual. Certificates are issued by the certificate authority. Certificates are digital documents attesting to the binding of a public key to an individual or other entity. They allow verification of the claim that a specific public key does in fact belong to a specific individual. Certificates help prevent someone from using a phony key to impersonate someone else. In some cases it may be necessary to create a chain of certificates, each one certifying the previous one until the parties involved are confident in the identity in question.

4.0 Basics of Cryptography The Security+ exam expects you to have a moderate grounding in both the theory and practice of cryptography and its applications on today’s networks. While we won’t make you an expert in this subject in a single chapter, we can shed some light on this esoteric subject which should enable you to make better decisions regarding when to employ cryptography, what type to use in specific circumstances, and what is involved in administering crypto-based systems. Cryptography involves creating and using systems to encode (or “encrypt”) data, allowing it to be read (“decrypted”) only by those who have certain knowledge (like the type of encryption used, and the specific “key” used).

Success Owl!

Cryptography Is… Cryptography involves creating and using systems to encode and decode data.

Cryptography has a long history. To cite the example mentioned in the Cryptography FAQ[1], legend has it that Julius Caesar had to send messages to his trusted compatriots via messengers he didn’t trust. In order to protect the contents of the messages, he used a substitution code, replacing each letter by the one 3 positions after it—‘A’ by ‘D’, ‘B’ by ‘E’, ‘C’ by ‘F’ and so on—and only those who knew the substitution rule were able to decipher the messages. Despite this history, advances in cryptography are still being made today. The Security+ exam expects you to know about both traditional symmetric cryptography techniques as well as the newer asymmetric techniques that are only now becoming widely used. Geek Owl! Deep Study on Cryptography If you want to read more about cryptography, the reigning book on the subject is Applied Cryptography: Protocols, Algorithms and Source Code in C[2] by Bruce Schneier. It contains detailed descriptions of cryptographic algorithms and for some, implementations of them in the C programming language. Another good resource is Network Security: Private Communication in a Public World[3] by Kaufman, Perlman and Speciner. This book, which contains less math than Schneier’s includes lots of info on cryptography including PKI, and coverage of current applications of cryptography such as email security (mostly related to privacy, non-repudiation, integrity) and how authentication works in NDSv4, Win2K, Kerberos, Lotus Notes, Clipper. [1]

http://www.faqs.org/faqs/cryptography-faq/

[2]

Schneier, Bruce, Applied Cryptography: Protocols, Algorithms and Source Code in C, 2nd Edition, John Wiley, November, 1995, http://www.nerdbooks.com/item.html?id=0471117099 [3]

Kaufman, Charlie, Radia Perlman and Mike Speciner, Network Security: Private Communication in a Public World, 2nd Edition, Prentice-Hall, April, 2002, http://www.nerdbooks.com/item.html?id=0130460192

4.1 Algorithms An algorithm is a sequence of steps that specify in detail how to perform an action. For example, an algorithm for starting a car might include steps to approach the driver’s side of the car, unlock the front door, open the front door, get in the car, close the front door, put the key in the ignition, and turn the key. The term “algorithm” derives from the name of a 9th century Persian mathematician. A computerized algorithm is a sequence of operations and inputs. The inputs provided to the algorithm determine exactly which steps of the algorithm are performed. In the car example above, the algorithm’s sequence of operations would include the sub-steps involved in opening the door. The inputs would include the type of handle on the door. Using the provided inputs (based on car make, model and year), the algorithm would select the correct

steps to perform (pull the handle toward you for a Mercedes, click the latch behind the handle for a vintage VW). When discussing encryption, cryptographers will often use the terms “plaintext,” “cipher text” and “message.” A message, in the context of cryptography, is the data that will be safeguarded by encryption, in either its plaintext or encrypted state. To you, a message might usually be an email or an IM or SMS message. To a cryptographer, a message might be those items, or a PDF sent via FTP from a secure download site, or a Web form containing sensitive data, or some keystrokes from an encrypted terminal session via SSH, or anything else whose contents will be (or have been) subject to cryptography. Plaintext is the “before” state of whatever you’re encrypting. It may be text, or it may be an MP3 of your garage band’s newest song that you’re sending to friends a week before it is available for sale at local record stores, or it may be anything else you want to protect from others. Cipher text is the “after” state—the message in its encrypted form. An encryption algorithm typically uses a series of mathematical or “bit-twiddling” formulas and a user-provided key to transform a “plaintext” message into an encrypted message, usually also employing a user-provided “key” which determines the output cipher text produced. For example, in the Julius Caesar example above, the algorithm involves taking the position of the original letter in the alphabet, adding 3 to it, and replacing the original letter with the one at that new position in the alphabet. Success Owl!

Algorithm An algorithm is a sequence of steps describing how to perform a specific action. A message is the data that will be safeguarded by encryption. It can be anything from an IM message to a PDF sent via FTP, a web form transaction, etc. Plaintext is the “before” state of the message, before encryption. Cipher text is the “after” state of the message, in its encrypted form.

The three types of cryptographic algorithms we will look at in this section are hashing, symmetric and asymmetric algorithms.

4.1.1 Hashing Hashing is the process of creating a long alphanumeric string, called a hash value or “message digest”, which functions as a relatively unique identifier of that file. The idea behind hashing is to run a large set of data, like a document, through an algorithm, and get a result -- a small piece of data that somewhat-uniquely identifies the contents of the original document. This hash value, or sum, can then be used as a smaller, easier to handle unique identifier of the document. Anyone with a copy of a document whose author computed a hash value for it can use the same algorithm to compute a hash value on their copy, to ensure that they have the same version of the document as the author. Changing even one character of the document will change the resulting hash value in an unpredictable way, so if

someone computes a hash value for a document and gets a different result than the originator did, they’ll know the document has been tampered with. The most popular type of hashing is the MD5 “message digest” (another term for “hashing”) function developed by Ronald Rivest, so named because it creates a 128-bit “digest” (smaller or summarized) version of a message. The footnote takes you to a freeware version know as MD5Sums[4]. Another popular hashing algorithm is SHA-1, the Secure Hash Algorithm (revision 1), which was developed by NIST and later standardized by ANSI. SHA-1 produces a 160-bit “digest” of a message. Success Owl!

Hashing is… Hashing is the process of creating a long string of characters, called a hash value or message digest, which serves as a relatively unique identifier or fingerprint of a file. MD5 (Message Digest 5), a hashing function that creates a 128-bit message digest, was developed by Rivest. It is the most popular hashing function in use today. SHA-1 (Secure Hash Algorithm rev. 1), a function that creates a 160-bit message digest, was developed by NIST.

Message Digest as a message fingerprint Statistically speaking, it is possible for there to be multiple documents whose hashes are the same, since you are identifying a potentially large item (a document) by a smaller key value. Fortunately, it is also unlikely that two documents with the same hash value both make sense—one is likely to be a series of random characters that just happens to result in the same hash value, or “sum”. It would be obvious to the user upon seeing the document, that something is wrong with it. It is considered computationally infeasible to modify the content of a message or program while retaining the same sum, and have the modified content be a reasonable replacement for the original, rather than obviously invalid gibberish. It’s not necessarily impossible to do this, but with most hashing algorithms, it would take a prohibitively large amount of time to find another plausible document with the same hash value. For some information on duplicate hash value related issues in MD5, see this informational page on MD5.[5] Often, but not universally, the longer the hash value produced by the hashing algorithm (assuming it is a mathematically-good algorithm from a crypto standpoint), the less susceptible it is to this sort of attack. This is one of the reasons that the SHA-1 hashing algorithm is considered by some to be stronger than MD5. As we mentioned earlier, the SHA1 algorithm produces a 160-bit message digest, while the MD5 algorithm’s message digest is only 128-bits. To account for increased computer processing speeds, even stronger versions of the SHA, which produce message digests of 256 or more bits, have recently been standardized.[6] Another hashing algorithm you may encounter in your digital travels is RIPEMD-160, considered to be on a par with SHA-1.

Figure 35: There is not enough data in a hash to determine what the original data contained Because of the potential for collisions (duplicate hash values for different documents), designers of hashing functions take extra care to ensure an even distribution of hash values. That is, they want to make sure that if there are 16 possible hash value results that approximately as many documents hash to a value of ‘9’ as to ‘13’. If 99% of documents hash to ‘15’ using a particular hashing algorithm, that algorithm doesn’t have an even distribution and is thus weaker than those that do. Because of the requirement for an even distribution of hash values, good hashing algorithms tend to be computationally complex, taking a relatively significant amount of CPU time to perform. The evenness of distribution doesn’t have to be perfect, but the more well distributed potential hash values are, the more difficult it is to attack the problem of finding a plausible duplicate document. It is impossible to ascertain the contents of a program or message from the hash value alone. That is, the hashing algorithm is one way. You can put a document through a hashing algorithm and get back a hash value as a result. However, you cannot put a hash value through a hashing algorithm and get back the original document as a result. Why is this? For the same reason that a bitmap compressed into a JPEG file can’t be turned back into the original bitmap with complete accuracy—the hash is only a “summary” of the original document, and some information is lost during the summarization process. Success Owl!

Odds Are?

It is possible (but not necessarily likely) for different documents to have the same hash value. However, it is considered computationally infeasible to modify a message and have it hash to the same sum as the original message, in a way that is not obviously detectable. Most likely, other messages hashing to the same sum would appear to be gibberish. It is impossible to determine the contents of a message from the hash value alone. This means that the hashing algorithms in common use are “one-way”.

4.1.2 Symmetric Symmetric cryptography algorithms use a “shared secret” key known to the sender and authorized recipient of an encrypted message. The key same key is used whether you are encrypting or decrypting the document (thus the name, symmetric). The key must be protected so that unauthorized personnel can’t use it to decrypt the document. Success Owl!

Symmetric Symmetric encryption uses a “shared secret” key and (usually) a non-secret algorithm to perform the encryption and decryption. The same key is used to encrypt and decrypt the message. Because anyone possessing the key can decrypt the message, it is important to protect the key from access by unauthorized personnel.

Types of Symmetric algorithms There are two primary types of symmetric algorithms: block and stream ciphers (coding methods). In a block cipher, data is broken into blocks of a certain size and encrypted (and later decrypted) block-by-block, with the same key. Stream ciphers work the same way but work on a bit-by-bit basis. A combination of the two, cipher-block-chaining, encrypts block by block, but the encryption of any block is dependent on the results from encrypting the prior block. DES, Triple DES, IDEA, RC2 and AES are examples of symmetric cryptography. While DES is the most well known, it is also an older algorithm and not as strong as the others. For example, the Electronic Frontier Foundation has broken DES encryption with a brute force attack in less than a day (to read about it, see Cracking DES: Secrets of Encryption Research, Wiretap Politics and Chip Design[7] by the Electronic Frontier Foundation), so this is clearly not an encryption technology we’d want our most sensitive government or commercial traffic to use.

Figure 36: The point of symmetric encryption is the same key is used to cipher and decode the data Success Owl! Block & Stream Cipher Block cipher and stream cipher are the two types of symmetric algorithms. Block ciphers encrypt an entire block of data at a time, independent from other message data; stream ciphers encrypt bit-by-bit. A combination of the two, cipher-block-chaining, encrypts block by block, but the encryption of any block is dependent on the results from encrypting the prior block. Block ciphers are best suited for large sets of data, stream ciphers for bit-oriented traffic like streaming audio or video. Some well-known symmetric algorithms include: DES, Triple DES, RC2, IDEA and AES. DES, which uses a 56-bit key, is considered breakable, and weaker than many other symmetric algorithms.

Security issues with symmetric cryptography One of the issues with symmetric cryptography is that you need a secure way to transport the key from one user to another. This is generally simple if the users are located in the same building, because you can just walk over to the other person’s office and whisper it to them. However, it’s a bit more complex if one user is in a different physical location. If you communicate the key via an insecure channel, such as an unencrypted email message, the confidentiality of any information encrypted with that key is at risk; because it’s possible someone eavesdropped on the key communication. Another issue is that everyone who has the key must take care not to disclose it to others who are not authorized to have it—

for example, they shouldn’t write it down in an obvious place where unauthorized people might see it. Encryption tends to be even more computationally expensive than hashing. This is deliberate for a number of reasons, one of which is resistance to brute-force attacks. As mentioned earlier in the book, one way to discover a password is simply through brute force -- try many possible passwords, running each through the appropriate encryption algorithm, and comparing the results with the encrypted version. The longer it takes to compute the encrypted version, the fewer attempts can be made per second, or hour, or month. One reason that encryption algorithms become outdated is that technology catches up with them. Algorithms which used to take hundreds of years to “brute force” on the original 4.77mhz IBM PC can be attacked in much shorter period of time on the latest 2.4ghz Pentium 4. The less time it takes, the weaker the algorithm is considered to be. Success Owl!

Symmetric Issues When using symmetric cryptography, you need a secure way to transport the key from one user to another, and to store the key. Since encryption algorithms depend partly on being computationally expensive to break, algorithms can become weaker over time, as computer speeds increase and the time to do the computations necessarily to break them decreases.

4.1.3 Asymmetric Asymmetric algorithms use a pair of keys -- one key to encrypt data and a different key to decrypt the data. This type of cryptographic system is known as a public/private key system, because it involves the use of a public key that is distributed to others, and a private key whose confidentiality is guarded carefully by the owner of the key pair. Typically at least one public/private key pair is issued to each user, and a user will have access to only one private key (their own), and potentially many dozens, hundreds or even thousands of public keys (belonging to others, which they use when communicating with those other users). An asymmetric algorithm makes use of what cryptographers call a “trapdoor one-way function”. That is, like a hash, the function that computes the encrypted output is not reversible using the same key. Unlike a hash, there is another key which, when applied to the data, will decrypt it. So, unlike with hashing, it is possible to recover the original document’s contents. Success Owl!

Asymmetric uses… Asymmetric algorithms use a pair of keys—one key to encrypt the data, and another to decrypt it. It is known as public/private key encryption, or sometimes just public key encryption, because it involves a public key that is distributed to others and a private key known only to the owner of the key pair.

Asymmetric cryptography algorithms Diffie and Hellman originally discussed asymmetric cryptography, in their 1976 paper about a new, secure way to exchange secret keys between users.[8] The Diffie-Hellman key exchange protocol solved the problem of securely communicating symmetric algorithm key information to those users who need it by using a new type of cryptography. Perhaps the most widely used asymmetric commercial algorithm at this time is RSA (developed by Rivest, Shamir, and Adleman in 1977), by RSA Data Security, Inc. Others include DSA (used by the government) Popular examples of Public/Private key cryptography include PGP (Pretty Good Privacy, with versions using RSA and Diffie-Hellman keys), S/MIME, SSH (the secure alternative to telnet) and SSL (used for encryption of data between a web browser and server).[9] Success Owl!

Asymmetric Sezs Thanks to: Asymmetric cryptography was pioneered by Diffie and Hellman in 1976, in their paper on the Diffie-Hellman Key Exchange Algorithm, which described the use of public/private key cryptography to securely pass a secret key between authorized parties. RSA, developed by Rivest, Shamir and Adleman in 1977, is the most widely used commercial asymmetric algorithm. PGP, S/MIME, SSH and SSL usually use public/private key encryption.

How is asymmetric cryptography used? Each entity that needs to encrypt messages is assigned a key pair—one public key and one private key. As noted above, when using asymmetric cryptography, a message can be encrypted with either key, and once encrypted; it can only be decrypted by the OTHER key, not the original key that was used to encrypt it. Which of the two keys you choose to encrypt a message with, is determined by what you’re trying to achieve with the encryption. For example, encrypting the message with the private key known only to you means that it can be decrypted by anyone with the public key (translation: anyone). This doesn’t do much to maintain message confidentiality, but it does provide strong proof that the message is from you, since the message couldn’t be decrypted with your public key if it wasn’t from you. On the other hand, if you have someone’s public key, you can encrypt a message to him or her with his or her public key, so that only that person can decrypt it (with their private key). This means that once the message has been encrypted, it will remain confidential except to its intended recipient. However, since anyone with the public key can encrypt the message, this use of asymmetric cryptography doesn’t provide proof of the sender’s identity.

More will be said about this later in the chapter, when we discuss applications of public key cryptography. In addition to its use in public/private key systems, asymmetric cryptography is also used for the exchange of secret symmetric keys used for encrypting files, so that the symmetric key information can be communicated securely between authorized parties. This gets around one of the problems with symmetric key systems—how to securely exchange key information. One asymmetric algorithm used for the secure exchange of a secret key is the Diffie-Hellman Key Agreement protocol. Why not send the entire file encrypted with asymmetric cryptography? One answer is that symmetric algorithms take less (often much less) CPU time/power to encrypt and decrypt. Because of the use of different keys to encrypt and decrypt, asymmetric cryptography has interesting uses in applications such as digital signatures, which will be discussed later. Success Owl!

Asymmetric Offers To be able to prove that a message came from a certain sender and was not modified before receipt, encrypt the message with the sender’s private key, and decrypt it with the sender’s public key. Asymmetric cryptography can be used to encrypt a secret key that will be used to encrypt and decrypt a file being transferred across the Internet.

Figure 37: The beauty of Asymmetric encryption is the public key does not compromise the private key

[4]

http://www.pc-tools.net/win32/freeware/console/

[5]

http://home.pacbell.net/tpanero/crypto/md5.html

[6]

http://csrc.nist.gov/encryption/tkhash.html

[7]

Electronic Frontier Foundation, Cracking DES: Secrets of Encryption Research, Wiretap Politics and Chip Design, O’Reilly and Associates, August, 1998, http://www.nerdbooks.com/item.html?id=1565925203 [8]

W. Diffie and M.E. Hellman, New directions in cryptography, IEEE Transactions on Information Theory 22 (1976), 644-654.

[9]

Prakash, Vipul Ved and Benjamin Trott, “Asymmetric Cryptography in Perl”, http://www.perl.com/pub/a/2001/09/26/crypto1.html?page=1

4.2 Concepts of using cryptography “Crypto” is the catchall term for cryptography, crypto-analysis and cryptology. If you’re looking for a break, and you are into creative avoidance, several folks have suggested the book Cryptonomicon[10] as a nice fiction book to study this art. The term is based in the Greek language that translates to secret writing. If you’re looking to become a serious crypto geek, Bruce Schneier’s Applied Cryptography book is one to read from cover to cover. In this section, we explore various possible benefits of using cryptography, including assuring confidentiality, assuring data integrity, secure authentication, assuring non-repudiation, and providing access control.

4.2.1 Confidentiality Confidentiality involves passing a message among authorized parties without any unauthorized parties who obtain it, through eavesdropping or other techniques, being able to understand it.[11] Cryptography provides confidentiality by scrambling the message before it is passed, so that even if unauthorized individuals get a copy of the scrambled message, it isn’t feasible for them to figure out its original contents. Only the intended receiver of a message can decrypt it. This works provided the key is not detected or broken. As we mentioned earlier, keys come in two flavors, secret key (symmetric encryption) or public/private key (asymmetric encryption), and either type can be used to enforce confidentiality. To enforce confidentiality with asymmetric encryption, you would obtain the recipient’s public key and encrypt the message with the public key of its recipient before sending it; the recipient would decrypt it with his private key upon receipt. Since you can only encrypt a message with a single public key at a time, this allows you to send a specific confidential message to only one person at a time. If you want to communicate confidentially with multiple people using asymmetric cryptography, you have to send a separate message to each recipient, each encrypted with the receiver’s public key.

To enforce confidentiality with symmetric encryption, you would encrypt the message with the shared secret key, and the intended receivers would decrypt it using the same shared-secret key. Because anyone who possesses the shared secret key can decrypt the message, messages encrypted with symmetric encryption can be sent to multiple people at a time, rather than requiring a separate message per recipient, as with asymmetric methods. Success Owl!

Confidentially means… Confidentiality involves passing a message among authorized parties without any unauthorized parties who intercept it, being able to understand it. To send a confidential message using asymmetric encryption, encrypt the message with the recipient’s public key, and decrypt it with the recipient’s private key.

4.2.2 Integrity Integrity is the assurance that data has not been tampered with—i.e., that it has been unchanged during some period of time since it was created. Both public/private keys and symmetrical (secret) keys are acceptable for providing confidentiality. Other methods must be employed to ensure full data integrity. Why? Anyone with access to both the key used to decrypt the message (so that they can decrypt it) and the original key used to encrypt the message (so that they can encrypt a substitute message after changing it) can tamper with a message. In a symmetric key system, this means that anyone with access to the shared secret key can tamper with the message, and change it without being detected. In an asymmetric key system, because one of the keys needed to encrypt or decrypt is held by only one person (unless someone’s managed to compromise it), it is more difficult to tamper with a message. Usually, if you’re able to decrypt it, because it was encrypted with a public key you have access to, you can’t encrypt it again because you don’t have access to the private key that was used to encrypt it. However, it’s possible to decrypt the message and then use a different public/private key pair to distribute it, misrepresenting that new key pair as the original sender’s key pair. This misrepresentation might involve social engineering, or replacing a user’s public key posted to their web site with the new public key, etc.

Figure 38: Notice that a public key can be used to encrypt a message that can only be open with a private key Success Owl! Integrity is… Integrity is the assurance that the message date has not been altered since the encrypted version of the message was created.

4.2.2.1 Digital Signatures A Digital Signature is an electronic signature of a document, created by using asymmetric encryption. A digital signature is different from a handwritten signature, because a handwritten signature tends to be the same over time, but a digital signature differs depending on the data being signed. A digital signature is used by a document’s receiver to verify that: the message has not been tampered with since it was signed (data integrity) the person who supposedly sent the message really did Typically this is accomplished by encryption with a private key known only by the message sender, and decryption with the public key. Keep in mind that it is computationally more expensive to encrypt a message than to apply a hashing algorithm to it, that messages sent between parties can be very large (such as file transfers), and the time taken to encrypt data increases the larger the amount of data is. This

led researchers to combine the ideas of hashing (with an algorithm like MD5) and encryption, to create a digital signature by encrypting only the document’s message digest hash value, rather than the entire contents of the message. Success Owl!

Digital Signature A Digital Signature is an electronic signature of a document, created using asymmetric encryption. Digital Signatures can be used to verify message integrity and sender identity.

Using Digital Signatures To create a digital signature, you would: • • •

Compute the hash value of the message, generally using a standardized algorithm like MD5 or SHA-1 Encrypt the hash value of the message, using the sender’s private key, with an algorithm like RSA Associate or attach the encrypted hash value to the message in some way

To verify that a message has not been tampered with and was indeed sent by the specified sender, the receiver would: • • •

Decrypt the encrypted hash value, using the sender’s public key and the same asymmetric algorithm used by the sender Compute the hash value of the message using the same algorithm used by its sender Compare the hash value of the received message, with the hash value associated with the message by the sender

Success Owl!

A Digital Signature is created by Typically, a digital signature is created by computing a hash value (using an algorithm like MD5) for a document. Then, the hash value is encrypted using sender’s private key, using an asymmetric algorithm like RSA. This signature value is sent along with the message, to the intended recipients. To verify that the message has not been tampered with, and was sent by the specified sender, the receiver would decrypt the signature value using the sender’s public key, compute the hash value for the received message (using the same algorithm the sender used), and verify that both the received hash value and the computed hash value are identical.

Figure 39: A digitally signed message receives a Message Digest to prove it has not been changed. It may be encrypted as in this example Note the difference between using asymmetric encryption for confidentiality and data integrity differ: • •

When using asymmetric encryption to ensure confidentiality, the message contents are encrypted with the receiver’s public key and decrypted with their private key When using asymmetric encryption to ensure data integrity, a digest of the message contents, not the message itself, is encrypted with the sender’s public key and decrypted with their public key

Signatures and non-confidential messages You are not required to encrypt a message before digitally signing it. You can digitally sign an unencrypted message, thus providing a data integrity check without data confidentiality. If you look at the above steps to create and verify a digital signature, you see nothing about encrypting contents—the only data encrypted is the message’s hash value. Why would you want to do this? You might be sending out a security bulletin whose contents are meant to be public, and want receivers to be able to verify that the message came from a recognized authority and has not been changed since it was written. Again, note that the potential issues with hashing functions still exist—it is theoretically possible, though considered computationally infeasible, to come up with an alternate document which hashes to the same message digest value. You can also combine both techniques to provide both confidentiality and data integrity.

4.2.3 Authentication Authentication is the process of verifying that a specific person sent a message. This can be accomplished with secret or public key encryption systems.

A secret key system can verify that one of the individuals who know the secret key sent the message, although it cannot necessarily identify which one of those individuals sent the message. With an asymmetric key system and a digital signature, you know that only the people possessing the key used to create the signature could have sent the message. Since digital signatures are usually created with the sender’s private key, this tells you that that person was the sender of the message. Success Owl!

Authentication is… Authentication is the process of verifying that a specific person sent a message.

4.2.4 Non-Repudiation Non-Repudiation is a stronger variation on authentication which allows the sender’s identity to be verified by a third party, and is used to prove that a message was not forged—that the person who supposedly sent the message really did. This also means that the sender cannot deny he sent a particular message. In the paper world this is accomplished via a Notary Public who verifies the signer’s identity, witnesses the signing and puts their seal on the document, indicating that they witnessed the signing. In the digital world, it is accomplished with a verified digital signature. Non-Repudiation cannot be achieved with a symmetrical, secret-key algorithm. Why? By definition, more than one person knows the shared secret key, so while it’s possible to narrow down the list of possible senders, it’s not possible to reliably determine which one of the individuals possessing the key, sent the message. If you think about how public/private key encryption works, it might occur to you that you can prove the origin of a message by encrypting the entire message with the sender’s private key, and allowing it to be decrypted by the sender’s public key. If the sender’s public key decrypts the message, then you know that the sender’s private key (known only to that individual) was used to encrypt it. The down side to this is that if the message contents need confidentiality as well as non-repudiation, the message contents are encrypted twice— with both the sender’s private key and the receiver’s public key—which is computationally expensive. Success Owl!

Non-Repudiation Non-repudiation is a stronger variation on authentication. It allows the sender’s identity to be verified by a third party, to prove that the message was not forged. Because proof of sender comes from a third party, the sender cannot deny he/she sent the message. You can prove the origin of a message by encrypting the entire message or its hash value with the sender’s private key, and decrypting it with the sender’s public key.

Figure 40: As long as the private key remains private, non-repudiation is achieved

4.2.4.1 Digital Signatures A more efficient way to prove message origin is, as with data integrity, to use a digital signature. Remember that a digital signature is a message digest encrypted with the sender’s private key, which is used by a document’s receiver to verify that: • •

the message has not been tampered with since it was signed (data integrity) the person who supposedly sent the message really did (this is non-repudiation)

A receiver may wish the verification of a public key, to make sure that the public key they have really is assigned to the person claiming to have sent the message. This is done through the Public Key Infrastructure, using certificates, described in the next major section.

4.2.5 Access Control When using a shared secret key (symmetric key) all parties need to ensure the key is secured. This can be impractical when working with a large group. In a public/private key arrangement, the private key must remain private. Should a compromise of the private key occur, it must be destroyed. (Refer to 4.3.2) [10]

http://www.cryptonomicon.com/beginning.html

[11]

Schlaff, Robert, “Confidentiality Using Authentication”, http://www.acm.org/crossroads/xrds5-2/confide.html

4.3 PKI A Public Key Infrastructure (PKI) is the combination of software, encryption technologies and services that enables enterprises to protect the security of their communications and business transactions[12] and proprietary data. As you might imagine PKI’s focus on the implementation of public/private key systems, using key pairs to encrypt and decrypt messages. They also make use of digital certificates and certificate authorities, discussed below. According to Netscape Communications, PKI protects your information assets in a variety of ways: •

• • • • •

Authenticate identity. Individual users, organizations and their web sites use digital certificates, issued as part of your PKI, to validate the identity of the parties to a transaction. Verify integrity. Ensure that the signed message has not changed since being signed. Ensure privacy. Ensure that unauthorized individuals cannot make use of confidential data. Authorize access. Digital certificates can replace user ID’s and passwords for login security, reducing IT overhead. Authorize transactions. The enterprise can control access privileges for specified transactions. Support non-repudiation. Protects against forging, and users’ later challenging transactions.

Adoption of PKI technology has been slow due to the complexity and relatively high cost of PKI solutions. However, the growing use of public-key based technologies such as SSL, and improved awareness of security issues in the enterprise, are causing PKI to be increasingly implemented in organizations today. PKI is discussed in substantial depth in the X.509 standard. Success Owl!

PKI A Public Key Infrastructure (PKI) is the combination of software, encryption technologies and services that enables enterprises to protect their communications and data. PKI’s are implemented with public/private key systems that use key pairs to encrypt and decrypt messages. PKI’s use digital certificates and certification authorities for authentication.

4.3.1.1 Certificates A Digital Certificate is a digital ID card of sorts, much like a driver’s license. It binds a public key to a specific person, business, document, software etc, much like a driver’s license attaches your license number to the human being who is you. A digital certificate, signed with the Certificate Authority’s private key, includes:

• • • • • • •

X.509 certificate version (currently v1, v2 or v3) Unique serial number for this certificate Signature algorithm ID Period of validity, including expiration date (after this date, the certificate will need to be renewed or replaced in order to continue to be used) Certificate Authority which issued the certificate Name/identify of subscriber whose key is indicated by the certificate Subscriber’s public key

A certificate is also considered to “contain” all documents referenced in it, even if those documents are not actually included in the certificate data itself. Success Owl!

Digital Certificate A Digital Certificate is a digital “ID card” which binds a public key to the individual or item identified by the certificate.

Information included in a Digital Certificate includes the X.509 version, the unique serial number, period of certificate validity (including expiration date), name of issuing Certificate Authority, name of individual to whom the certificate belongs, and that individual’s public key. Additionally, certificates aren’t limited to identifying humans. They can also be used for identifying systems and organizations. Some common types of digital certificates include: • • •

Personal certificate—identifies a person Server certificate—identifies a server, enabling a user to verify that server’s identity, and engage in SSL or TLS-based communication with it Object-signing certificate—allows you to sign ActiveX controls, java applets, Microsoft .CAB files, etc. to securely identify the source of those files

Many Certificate Authorities offer different levels of digital certificates, which offer varying degrees of authentication. For example, a certificate user may have a higher degree of trust in a certificate when the certificate authority has received and verified business license information, credit card data, etc., but this extra effort is not performed in all cases. The certificate buyer chooses the level of the certificate they obtain. Why not always opt for the most trusted one, with the highest guarantee of authenticity? Because the more validation the Certificate Authority (see below) has to do when issuing the certificate, the more the certificate costs to obtain.

Certificate Authorities (CA’s) A Certificate Authority is the digital world’s version of a notary public. A Certificate Authority (or CA) is a trusted third party (hopefully a responsible one) that verifies the legitimacy of the public/private key pair as really belonging to the individual in question. They use a variety of techniques, such as verifying one’s email address, You can request a digital certificate from a prominent CA such as VeriSign or Thawte, or (if you only need one for internal testing and don’t need strong validity for production use) generate one yourself using a variety of development tools.

A huge list of CA’s can be found athttp://www.pki-page.org. Be aware that the cost for obtaining a digital certificate varies greatly on the source CA you choose, and the use to which you intend to put the certificate (certificates by use for those who engage in high-value transactions normally undergo a more rigorous identity-verification process, and thus cost more). Success Owl!

Certificate Authority A Certificate Authority is a trusted third party that verifies the legitimacy of the public/private key pair as belonging to the individual named in the certificate. A Certificate Authority is a digital version of a notary public.

Some public Certificate Authorities (CA’s) are specifically authorized or approved by governmental entities, such as the Utah and California state governments. Not all Certificate Authorities are public. Some organizations may opt to create an internal Certificate Authority for purposes of issuing internal digital certificates to staff. A Certificate Authority: • • • • • • •

Creates and distributes Public/Private keys. Publishes public keys in open directories. Secures private keys. Provides revocation in the event a private key is compromised. Verifies to users that a subscriber’s certificate is currently valid (has not expired or been revoked) Acts as a digital notary for the holders of public/private keys. Has a Registration Authority that is typically publicly available (subject to DoS attacks).

4.3.1.2 Certificate Policies The certificate policy is a set of rules issued by a Certificate Authority indicating the applicability of a certificate to a class of application(s) with common security requirements. It sets forth rules governing the issuance, management and use of certificates issued by a particular certificate authority. For example, the certificate policy may include: •

•

The agreement between the subscriber and the CA (the subscriber agrees to take all reasonable precautions to secure the private key, the subscriber will review the information on the digital certificate soon after issuance and verify that it is correct, the subscriber agrees to accept any documents signed by their digital signature as originating from them, etc.) A statement of the legal liability and financial responsibility of the CA

This information can be used to determine the applicability of a certificate as verification of the parties to a particular type of transaction.

Success Owl!

Certificate Policy A Certificate Policy, issued by a Certificate Authority, describes the rules governing the issuance, management and use of certificates that CA issues. Among its contents is a description of the applicability of each type of certificate offered by the CA, for different applications.

4.3.1.3 Certificate Practice Statements The Certificate Practice Statement[13] (CPS) is a detailed statement of the procedures and practices used by the certificate authority in managing the certificates it issues. It describes how the certificate policies are interpreted in the context of operating procedures and system architecture within the organization.[14] Kinds of information that may be found in a Certificate Practice Statement include: • • • • • •

Action steps to be taken by the subscriber and the CA to establish a digital certificate for the subscriber Details of how the subscriber’s identity is validated, for each type of certificate offered by the CA Length of time for which the certificate is valid How to request a certificate revocation CA’s archival policies CA’s physical, technical and human security controls

Success Owl!

Certificate Practice Statement A Certificate Practice Statement (CPS) is a detailed statement of the procedures and practices used by the CA in managing the certificates it issues. A CPS includes operational procedures and a description of the organization’s certificate management system. A CPS tends to be much more detailed than a certificate policy.

4.3.2 Revocation Revocation refers to the irreversible invalidation of a certificate. A certificate may be revoked for any reasons deemed acceptable by the CA, each of whom sets their own policies for certificate revocation. Typical permissible reasons for key revocation include: • • •

The subscriber has requested that it be revoked The subscriber informs the CA that the public/private key has been compromised The subscriber has not accepted the certificate within the required acceptance period after it has been issued

Once revoked, a certificate’s information is no longer considered a valid.

Success Owl!

Reasons to Revoke Revocation is the irreversible invalidation of a digital certificate. A reason that a certificate might be revoked is that the subscriber has informed the CA that their public/private key has been compromised.

4.3.3 Trust Models Trust is the concept of confident reliance on an entity (person or organization). In the PKI world, it usually refers to the relationship between the user of a certificate, and the CA that issued that certificate. It revolves around the question, “Does the user believe that certificates issued by the CA are valid?” If so, normally the user will accept any certificates generated by that CA. If not, normally the user will not accept any certificates generated by that CA. Initiatives are under way today to set up a model for additional certification of CA’s as “trustworthy” through participation in an association such as tScheme, which functions as a sort of Better Business Bureau for CA’s, approving CA’s, handling complaints, etc. Different trust models exist to create a “chain of trust[15]”, which indicate how trust in one entity may affect one’s trust in another entity. For example, if you have a lot of faith in the judgment of a business associate, you may opt to trust anyone he trusts, even if you don’t have firsthand knowledge of those people. Conversely, if you don’t have much faith in his judgment, you may prefer NOT to automatically trust anyone he puts his “stamp of approval” on. Trust models describe these trust relationships. A Web-of-Trust is the simplest model. Each user creates and signs certificates for the people they know. There is no central authority. Trust decisions are made independently for each certificate user. (This is the model used by PGP). In the Single CA Model each person (or document, software, business or computer) is given a public key out-of-band (this means, the key is not sent the same way a message is). A single point of contact is used to check for revocation of a certificate. Generally, the single CA is trusted (it is often internal to the organization), and all certificates issued by it are trusted. The Hierarchical Model involves Multiple CA’s with a Root CA at the top, using lower level CAs whose public key certificates are signed by the Root CA, for improved scalability. (The Root CA’s certificate is signed by itself). The hierarchical model provides higher overall assurance than other models, however it may not work in a peer-to-peer role due to its reliance on a single root authority. It performs well in a large hierarchical environment like the military. The Browser Trust-List Model is sometimes called the CA list. Each user has a list of the public keys for all the CAs the user trusts. The good news is a different CA can be used for each application. The less than stellar news is there is no way to discern the strength of the PKI class—the granularity is on the level of the CA only, not on the types of certificates it may issue. As we mentioned earlier, you can often opt for different levels of identity verification, and thus different levels of authentication, when purchasing a certificate. For example, VeriSign has 4 different classes, with different levels of identity verification. Not all certificates by the same CA are created equal.

Geek Owl! Policy Trust List Model The Policy Trust List Model restricts access based on the policy under which the certificate is issued. This was recommended in X.509 V3 Certificate RFC, but has not been adapted, to date. The Policy Trust List Model with OU is similar to Policy Trust but using Organizational Units for policy. In the Cross-Certificate Model, each CA creates a certificate for the CA that has been confirmed to have an equivalent strength. There is only one root public key, however, the key is the local CA not the Root CA. The idea behind this is that each CA is in charge of determining who it trusts. The Bridge CA is a trust bridge that is built with cross-certificate pairs; it is an emerging concept.

Pop Quiz 0100.00

Pop Quiz 0100.00 Questions 1. Hashes are slower than digital signature algorithms. True/False 2. DES is considered to be________________. 3. A ____________ is used to allow verification of the claim that a specific public key does in fact belong to a specific individual. 4. A typical certificate contain a number of data entries. One entry NOT included in a typical certificate is ________ _______. 5. Digital Certificates can provide A. B. C. D. E.

Authentication Integrity Encryption Token verification E No choice is correct

Answers 1. Hashes are slower than digital signature algorithms. False Since hash functions are generally faster than encryption or digital signature algorithms, it is typical to compute the digital signature or integrity check to some document by applying cryptographic processing to the document's hash value, which is small compared to the document itself. Hash functions do not require 128bit computing. Also, they are not typically more secure than the public key encryption used for digital signatures, although digital signatures may use an encrypted hash value. Has functions are standardized, rather than proprietary. Common hash functions include MD-5 and SHA-1.

2. DES is considered to be insufficient. While the 56-bit key in DES now only offers a few hours of protection against exhaustive search by a modern dedicated machine [Wie94], the current rate of increase in computing power is such that an 80-bit key as used by Skipjack can be expected to offer the same level of protection against exhaustive key search in 18 years time as DES does today [BDK93]. Typically, as computer power increases, encryption algorithms once considered secure become insecure due to the reduced amount of time and resources necessary to break them. 3. A certificate is used to allow verification of the claim that a specific public key does in fact belong to a specific individual. Certificates are issued by the certificate authority. Certificates are digital documents attesting to the binding of a public key to an individual or other entity. They allow verification of the claim that a specific public key does in fact belong to a specific individual. Certificates help prevent someone from using a phony key to impersonate someone else. In some cases it may be necessary to create a chain of certificates, each one certifying the previous one until the parties involved are confident in the identity in question. 4. A typical certificate contain a number of data entries. One entry NOT included in a typical certificate is (the) type of server In their simplest form, certificates contain a public key and a name. As commonly used, a certificate also contains an expiration date, the name of the certifying authority that issued the certificate, a serial number, and perhaps other information. Most importantly, it contains the digital signature of the certificate issuer. The most widely accepted format for certificates is defined by the ITU-T X.509 international standard. 5. Digital Certificates can provide *A. Authentication *B. Integrity *C. Encryption *D. Token verification "Authentication: This is digital verification of who you are, much in the same way your driver's license proves your identity. It is very easy to send spoofed email. I can email anyone in the world pretending I am the President of the United States. Using standard email, there is no way to verify who the sender is, i.e. if it is actually the President. With digital signatures and certificates, you digitally encode verifiable proof of your identity into the email. Integrity: This is the verification that the data you sent has not been altered. When email or other data travels across the Internet, it routes through various gateways (way stations). It is possible for people to capture, alter, and then resend the message. Example, your boss emails the company president stating that you should be fired. It is possible for you to intercept that email and change it saying you deserve a $10,000 raise. With digital

certificates, your email cannot be altered without the recipient knowing. Encryption: This ensures that your data was unable to be read or utilized by any party while in transit. Your message is encrypted into incomprehensible gibberish before it leaves your computer. It maintains it encrypted (gibberish) state during its travel through the Internet. It is not de-crypt until the recipient receives it. Because of the public-key cryptography used (discussed later) only the recipient can decipher the received message, no one else can. Token verification: Digital tokens replace your password that can be easily guessed. Tokens offer a more secure way of access to sensitive data. The most common way to secure data or a web site is with passwords. Before anyone accesses the data, they are prompted with their user login id and password. However, this is easily cracked using various types of security software (such as Crack 5.0, etc.). Also, passwords can be found with other means, such as social engineering. Passwords are not secure. Token verification is more secure. Your digital certificate is an encrypted file that sits on your hard drive. When you need access to a system, that system asks you for your digital certificate instead of a password. Your computer would then send the certificate, in encrypted format, through the Internet, authorizing you for access. For this to be compromised, someone would have to copy this file from your computer, AND know your password to de-crypt the file." -http://www.enteract.com/~lspitz/digcerts.html [12]

“Understanding PKI”, http://verisign.netscape.com/security/pki/understanding.html

[13]

http://www.entrust.com/resources/pdf/cps.pdf

[14]

http://www.quovadis.bm/support/glossary.asp

[15]

http://www.e-government.govt.nz/docs/see-pki-paper-4/chapter3.html

4.4 Standards and Protocols To be a workable technology for public use, cryptographic systems generally need to be interoperable. That is, messages encrypted with one vendor’s cryptography product should be able to be decrypted by another vendor’s cryptography product. In order for this to happen, the community needs to agree on the cryptographic and hashing algorithms used. A number of organizations have been involved with formal cryptography-related standards, including the IEEE, ANSI, IETF, RSA Data Security, Inc. and FIPS.

IEEE The IEEE has a working group for Public-Key Cryptography[16], P1363, whose goal is the creation of assorted standards documents, including those for traditional public-key cryptography, including digital signatures and key establishment algorithms (RSA, DSA, Diffie-Hellman, and the newest, elliptical curve).

ANSI The ANSI X.509 digital certificate standard grew out of discussions in the late 1980’s. Augmented by further work on the Privacy Enhanced Mail (PEM) standard in the early 1990’s, X.509v3 is the current industry standard for digital certificate formats. The second version of X.509 added serial numbers to uniquely certificate authority and the subscriber. The latest version of this standard, X.509 version 3, adds extended attribute fields so that certificates can convey additional information such as security clearance level. X.509 also includes standards for certificate revocation, with the current version of the CRL standard being X.509v2. Version 2 of the CRL standard allows for extensions (like the V3 certificate), standard extensions such as reason code/suspension/etc., CRL distribution points (improves scalability for large CRL’s by allowing multiple sites to distribute portions of the list), and a “Delta CRL” containing only the incremental changes in the CRL. Success Owl!

X.509v3 X.509v3 is the current industry standard for Digital Certificates. It is similar to the X.509v2 certificate standard, but allows for extension of the contents of the certificate.

The current ANSI standard for the format of a Certificate Revocation List (CRL) is X.509v2. Geek Owl! X9F1 ANSI’s X9F1 project includes work on other cryptography-related standards for the Financial Services Industry, including algorithms such as DSA, SHA, RSA, 3DES, Diffie-Hellman, certificate management, etc. An earlier ANSI standard, X.500, specifies the hierarchical format for Distinguished Names, which are often used on digital certificates.

IETF IETF, the Internet Engineering Task Force, is responsible for the Internet protocol standards, which include cryptography as used on the Internet. The IETF PKIX (public key infrastructure X.509) committee is involved in the issues of public key management and public key systems. PKIX defines standards for the format of a certificate and the protocols needed to authenticate and issue certificates to entities. Certificates, as defined by PKIX, can be used by the TLS and IPSEC protocols. There are also IETF committees working on secure email—S/MIME (using PKIX keys) and PGP/MIME (using its own key management scheme). While many standards are still under development, the IETF has already issued a number of RFC’s relevant to public-key cryptography, including the MD5 message digest algorithm, key exchange algorithms, certificate revocation list profile, online certificate status protocol, etc.

Success Owl!

PKIX The IETF PKIX (Public Key Infrastructure X.509) committee is involved in public key management and public key systems. Standards they are working on include the format of a certificate and the protocols needed to authenticate and issue certificates to entities.

RSA Data Security, Inc. Many of the ANSI X9 standards first appeared in standards documents published by a cryptographic systems vendor, and are known as the RSA Data Security, Inc. Public-Key Cryptography Standards (PKCS) series. The first of these were published before public-key cryptography was a mainstream technology, and the series is still under development—RSA invites comments and submissions from others. When vendors refer to products that meet the “PKCS #3” or “PKCS #10” standards, they are referring to these documents, which can be obtained from RSA’s web site.[17] Geek Owl! PKCS/RSA The current standards in the PKCS series are, with explanations from RSA[18], are: PKCS #1—RSA Cryptography Standard Describes the RSA encryption algorithm, syntax for public and private keys used by it, and signature algorithms combining MD2, MD4 and MD5 hashes with RSA encryption. PKCS #2—(incorporated into #1) PKCS #3—Diffie-Hellman Key Agreement Standard Describes the Diffie-Hellman key agreement protocol, with which two parties, without any prior arrangement, can agree on a secret key for message encryption and decryption. The Diffie-Hellman Key Agreement Standard is useful because it enables agreement on the secret key without that key being transmitted from one user to the other in plaintext and thus being subject to eavesdropping. PKCS #4—(incorporated into #1) PKCS #5—Password-Based Cryptography Standard Describes a method for encrypting octet strings with a secret key derived from a password. It was developed as a means of encrypting private keys for secure transfer from one system to another, using a combination of the DES symmetric algorithm, and MD2 or MD5 hashes. PKCS #6—Extended-Certificate Syntax Standard

Describes the syntax for an extended digital certificate consisting of an X.509 standard public-key certificate and a set of extended attributes, which is encrypted in a single encryption operation. The extended attributes may include data like the user’s email address. PKCS #7—Cryptographic Message Syntax Standard Describes syntax for data which may have encryption applied to it, such as digital signatures. It allows for encryption of data that has already been encrypted, allowing for signing of pre-encrypted messages. This is the standard which specifies what a digitally signed message consists of. PKCS #8—Private-Key Information Syntax Standard Describes syntax for private key information, a set of associated attributes (such as a Certificate Authority’s name) and encrypted (possibly via PKCS #5) private keys. PKCS #9—Selected Attribute Types Defines some attribute types that may be used in PKCS #6, #7 and #8. PKCS #10—Certification Request Syntax Standard Describes the syntax for requesting a digital certificate, including data such as a distinguished name, public key, etc. which is sent to a CA, who then transforms the provided data into an X.509 public-key certificate or PKCS #6 extended certificate for the requester. PKCS #11—Cryptographic Token Interface Standard Describes an API, Cryptoki, used to access devices such as smart cards that hold key information and/or perform cryptographic functions. PKCS #12—Personal Information Exchange Syntax Standard Describes a portable format for storing or transporting a user’s private keys, certificates, miscellaneous secrets, etc. PKCS #13—Elliptical Curve Cryptography Standard Describes elliptical curve cryptography (still under development), which is intended to improve on current public-key cryptographic methods by providing a similar degree of security with reduced key sizes. PKCS #15—Cryptographic Token Information Format Standard Describes a standard for using cryptographic tokens to identify oneself to multiple standards-aware applications, regardless of the application’s specific token interface provider, such as Cryptoki.

In practice as an IT professional, you probably won’t need to know the details of the contents of these standards to get your work done. Still, it’s useful to be able to recognize some of the more popular ones like PKCS #1, PKCS #3 and PKCS #10 when they appear in vendor literature, and know that that means the products employing those standards are interoperable with others that also employ the same standards.

FIPS The National Institute of Standards and Technology (NIST) is the developer for Federal Information Processing Standards (FIPS) documents. FIPS publications are developed when NIST feels that no existing standards adequate address an area of technology that is useful to the government. Among the FIPS standards related to cryptography are ones for secure hashing, digital signature and the AES (Advanced Encryption Standard) algorithm. [16]

http://grouper.ieee.org/groups/1363/

[17]

http://www.rsasecurity.com/rsalabs/pkcs/

[18]

ftp://ftp.rsasecurity.com/pub/pkcs/ascii/overview.asc

4.5 Key Management/Certificate Lifecycle Key pairs and their associated certificates have a defined life cycle. They are initially requested by the individuals or entities requiring them. Typically, this request is made to a Certificate Authority (CA), which is responsible for verifying the requester’s identity and generating a key pair and certificate for them. The CA then sends those items to the requester. The certificate is then valid for use by the requester until its expiration date, at which point the certificate is automatically revoked. Private keys are typically stored in a secure location, possibly including hardware designed expressly for this purpose. If a key is lost, your PKI may allow for its retrieval via a process known as key recovery. It is possible to revoke a certificate prior to its expiration, for reasons including compromise of the private key, using a process known as certificate revocation, which permanently invalidates the certificate. You can also temporarily disable a certificate through certificate suspension; you might do this if you suspect key compromise but don’t know for sure yet whether it occurred. Revoked, suspended and expired certificates are placed into one or more certificate revocation notice systems such as a Certificate Revocation List (or CRL). More information on these and other related topics is included below.

4.5.1 Centralized vs. Decentralized When implementing a PKI scheme, you need to look at whether you require a centralized key management mechanism, in which a central authority manages keys, or whether a decentralized model, in which each individual user manages his/her own key pair, is sufficient. A model such as the one used by PGP is decentralized, and therefore would not scale well at the enterprise level. The more users you have, the more individual sources of keys (and points

of potential vulnerability) you’d have—in addition to being a high-overhead model that makes certain functions like key distribution difficult, it’s just asking for a private key compromise sooner rather than later (as an inexperienced clerk allows a tech-savvy poweruser in the department unrestricted access to the file containing his private key). Without a central authority verifying user identity, you’d need to investigate each provider of a public key and satisfy yourself that they are legitimate before accepting it. What if an individual’s key has been compromised and then revoked? Using decentralized key management, you might not know about the revocation unless the user happened to email you and let you know. Centralized key management is performed by a firm, such as VeriSign, or within the organization itself. The managing organization controls functions like the generation, escrow and status checking of keys it issues, freeing individual users from these tasks. Typically centralized key management involves the use of a Certificate Authority to issue and manage certificates (and thus keys). Success Owl!

PKI Key Management Key management can be either centralized or decentralized. In the centralized approach, a central authority manages keys. In the decentralized approach, individual users (or groups of them) manage their own key pairs. When a Certificate Authority is used to issue and manage certificates (and thus, keys), you are dealing with centralized key management.

4.5.2 Storage As private keys are in the digital sense, the “keys to the city”, improper protection of private keys would prove a major disruption of business and costly in terms of revenue. This does not even begin to address the security aspects between compromising of private keys and the time when the compromise was discovered. It’s not uncommon to hear of organizations keeping copies of private keys in vaults, or even off-site, in case needed for disaster recovery.

4.5.2.1 Hardware vs. Software Keys can be stored using hardware and software protection mechanisms. A software device might be something as simple as a text file maintained by a user, which contains his private keys, decrypted as needed to obtain the appropriate private key. Or it might be a key management database specifically intended for the centralized storage and retrieval of keys. A hardware device for key storage might either: • •

Store the key itself (for instance, a smart card which can be read by an appropriate reader when a PIN is provided) Not store the key at all (just an algorithm for generating a key based on the input of a user-provided pass phrase or PIN number).

One example of a device used for storing keys is nShield by nCipher[19]. In addition to providing secure storage and management of keys, it also provides for hardware-based cryptography, freeing servers from having to do those computations on the main CPU.

4.5.2.2 Private Key Protection A private key holder is responsible for taking all adequate precautions to secure their primary key and ensure that no one has access to it. This is important because anyone who obtains a user’s private key can forge a message and claim it was sent by that user, and can decrypt any sensitive communications encrypted by that user’s public key. This includes all the common precautions you might expect, like: • • •

Not including the private key in email Not leaving it in a world-readable location on disk in plaintext Not writing one’s PIN on the back of the smartcard holding the key.

… and also involves educating users about the potential for social engineering attempts to acquire their private key, much as they are educated (we hope) not to give out their network passwords.

4.5.3 Escrow Key Escrow[20] is the procedure of keeping a copy of a user’s private key in a centralized location that is only accessible to security administrators, or of implementing a mechanism whereby the private key can be recovered without having to be physically stored. Escrow allows for the future recovery of the key, should it be lost due to disaster or by its owner, or needed by someone authorized to view the information encrypted by it, such as in certain regulatory environments or situations in which law enforcement is involved. It’s the PKI equivalent of giving a trusted friend a copy of your car and house keys, perhaps in a sealed envelope or maybe in a combination-lock box if you are especially protective of them, just in case something happens to your original set of keys. The concerns and types of precautions you might take in that situation apply equally to safeguarding escrowed keys. Depending on how (if) the organization controls private keys, and the conscientiousness of users, this recovery ability may be needed more or less routinely. It may be accomplished by encrypting the central database in which private keys are stored, or by safeguarding hardware used to automatically regenerate the private key given the appropriate information. Key escrow can be performed either after the key has been generated or by pre-compiling public/private keys before assignment (depending on what your key escrow system supports, and your policies allow). In systems that use separate key pairs for signing and encrypting data, both the signing and encryption keys may be archived, with either key recoverable independently, to preserve nonrepudiation even if an encryption/decryption key is recovered. That is, the key used for decrypting private messages sent to a particular user can be recovered, without also obtaining the key used to sign messages with the identity of that user.

Different organizations and industries (such as the securities industry, which requires that transaction-related data be stored for 7 years) have different requirements for archiving business-related information. If that information is stored in an encrypted state for security purposes, encryption keys must be held for that period as well.

4.5.4 Expiration At the time a digital certificate is created it is assigned an expiration date, which appears in the certificate itself. A new certificate must be created by the time the previous certificate expires. Expiration is different from revocation; because the expiration date is known in advance, and no notification of the CA is required (expiration occurs automatically at the end of the period of validity). The expiration date is usually assigned by the CA, according to its policies on the length of time a certificate is considered valid. Normally this period does not exceed a year or two.

4.5.5 Revocation As discussed before, a digital certificate can be revoked under circumstances specified by the issuing CA, and once revoked, that digital certificate is permanently “gone.” Should the user want another digital certificate, they will have to obtain a new one. VeriSign states the following reasons permitting revocation: “There has been a loss, theft, modification, unauthorized disclosure, or other compromise of the private key of the certificate's subject. The certificate's subject (whether an IA or a subscriber) has breached a material obligation under this CPS (Certification Practice Statement), or The performance of a person's obligations under this CPS is delayed or prevented by an act God; natural disaster; computer or communications failure; change in statute, regulation, or other law; official government action, including but not limited to acts by agencies responsible for export control administration; or other cause beyond the person's reasonable control, and as a result another person's information is materially threatened or compromised.”

Certificate revocation techniques Several methods for certificate revocation by managing entities are currently in place. The older method employs a list of keys that cannot be trusted being held in a CRL (Certificate Revocation List), which is a time-stamped list of no-longer-valid certificates signed by the CA’s private key. One of the issues with this is that the CA may generate a new CRL only once a day, so revocations do not happen immediately. If an e-commerce site’s private key has been compromised, the amount of time it takes for the key to appear in the CRL could be an issue. Another issue with CRL’s is that they are distributed with a specific lifetime, and often cached on intermediate systems. If a system cannot reach the CA, it will attempt to use the existing, cached CRL, and it may find that it is out of date.

Although many CA’s still make use of the CRL method, the newer method is the OCSP[21] (Online Certificate Status Protocol). OCSP allows for on-line checking of certificate validity, by sending a request to a web site containing information on valid certificates. Thus, it tends to use more up-to-date data than the CRL approach uses. The drawback is that the client must be on-line to the network containing the CA, in order to contact the site furnishing validity data via OCSP. This may not be an issue in corporate environments using an internal CA, since network connectivity is assumed.

4.5.5.1 Status Checking In general, before trusting a party’s certificate for an important transaction, you should check to make sure that it is still valid, and has not been revoked. This is called checking its status. If the certificate does not come back as valid, proceed with the transaction at your own risk. The process, and the potential consequences for not doing it, is similar to the common practice of a merchant authorizing your credit card before accepting it as payment. Normally status checking would be performed by referring to information from the certificate’s issuing CA, which may be in the form of a published CRL, or perhaps in the form of an OCSP site. Additionally, as pointed out in a Microsoft paper on certificate status checking in closed PKI environments[22] (rather than public environments with external CA’s), other protocols can be used to perform similar validity checks, depending on how the CA wishes to set it up. Be aware that many email clients are notoriously bad at checking for revoked certificates, so when sending or receiving signed email, you may wish to check certificate validity independently. A certificate status check may tell you the certificate status (valid, suspended, revoked, and expired) as well as list a reason code explaining the current status (such as “requested by user”, “compromise suspected”, etc.) Success Owl!

Checking Digital Certificates Before trusting a party based on their digital certificate, you should check the status of the certificate to make sure that it is still valid and has not been revoked or expired. Often, if the status is anything other than valid, the status check response will list a reason for the current status, such as “compromise suspected.”

4.5.6 Suspension Suspension of a certificate places a temporary hold on the validity of a digital certificate without causing irreversible revocation. If it later turns out that the certificate should still be considered valid after all, the suspension can be removed, and the certificate will once again be valid. Suspension can be accomplished by placing a digital certificate into a CRL with a suspended status and a reason code for that suspension. Why suspend a certificate rather than permanently revoke it? You may want to temporarily suspend a certificate’s validity because the subscriber has not paid their annual service fee, or perhaps because some behavior related to the certificate is under investigation.

Success Owl!

Suspension Vs. Revocation You would suspend a certificate, rather than revoke it, if there is a temporary problem (such as a delinquent account) or if there might have been a compromise of the key, but it’s still being investigated. Suspension does not permanently invalidate the key, whereas revocation does.

4.5.6.1 Status Checking Just as it’s generally unwise to trust the data in a revoked certificate, because it may or may not be valid, it’s unwise to trust the data in a suspended certificate. This is another reason that a potential user should verify a certificate’s validity by status checking. As mentioned previously, this entails checking against the CRL or OCSP (or any other mechanism used by the CA to validate its digital certificates). If it is temporarily impossible to check the validity, the user must make an informed choice about whether to accept the risk of using a certificate whose authenticity cannot be verified.

4.5.7 Recovery Recovery is the process of reacquiring a private key of your own that has been lost (due to disaster, hardware failure, a personal mistake, etc.), or someone else’s private key that you are authorized to possess (perhaps because it is required for a business function or law enforcement investigation). Certificate authorities usually have policies around when a key can be recovered, the procedure required (such as the presentation of proper ID by the requester), and the procedure for requesting the key recovery. Recovery is related to the concept of Key Escrow, discussed in Section 4.5.3, which allows for the safeguarding of keys in case recovery is needed at a later date. Success Owl!

Recovery Recovery involves reacquiring a private key. An individual might want to recover his or her own key if it has been lost due to hardware failure or user error. An organization might want to recover an employee’s private key if it is required for a business function or law enforcement investigation.

Who can perform key recovery? Another issue around key recovery involves who is authorized to do it. Giving someone key recovery privileges implies that they are being given the ability to obtain ANYONE’s keys, and can decrypt any private messages and perhaps even digitally sign messages with others’ identity. Therefore, personnel given this privilege should be highly trusted, and appropriate record-keeping methods should be in effect to help ensure that this privilege is not abused. Because of the significant exposure presented by a single person having key recovery privileges, organizations have come up with a variety of ways to see that the cooperation

of multiple staffers is required to recover a key. This is implemented differently depending on the key escrow system used, but usually involves some degree of “M of N” control, which is described in the next section.

4.5.7.1 M of N Control M of N control is a policy of dividing up a task among multiple entities so that no one person acting alone can perform the entire task. As stated above, it is used to help minimize an organization’s exposure to the risk of one person misusing a privilege, and performing a sensitive action like key recovery without authorization. One simple approach to M of N control might be to double-encrypt the database of keys, such that two staffers, each assigned one of the keys to the database, are required in order to obtain someone’s private key. M of N control is also provided by some hardware-based key recovery systems, such as the smart-card based KEON KRM (Key Recovery Module) by RSA to control the private key used for key recovery. Each entity is issued some percentage of the entire private key used for recovery, in the form of a token. In order to perform a key recovery, some number of these entities (M) out of the (N) to whom a portion of the recovery key was distributed, must come together and combine their key fragments. This adds additional security to the key recovery process and minimizes opportunities for abuse of Key Recovery Operator privileges.[23] M of N Control involves dividing a task among multiple entities so that no one person acting alone can perform the entire task. It is often used to minimize the risk of someone misusing a privilege, such as key recovery. Success Owl!

M of N Policy The policy of M of N Control can be enforced only by written policy or by technological means if your PKI supports it. For example, a PKI supporting M of N Control on the key recovery function might require some number of authorized individuals (M) out of the (N) to whom a portion of the recovery key was distributed, to combine their key fragments, before key recovery can occur.

4.5.8 Renewal Renewal is the process of revalidating a certificate that has neared or passed its expiration date. There are two variations on certificate renewal, according to VeriSign[24]: • •

Use your current public key from your public/private key pair from the existing certificate Create and use a new public key that you provide from a newly created public/private key pair. This is essentially a new certificate. (This is VeriSign’s suggested option).

If a certificate is not renewed before its expiration date, then it is considered to be expired and can no longer be relied upon. Success Owl!

Renewal of a Digital Certificate Renewal is the process of re-validating or replacing a certificate that has neared or passed its expiration date.

4.5.9 Destruction Destruction refers to the permanent removal of a key or certificate that you no longer need. This is accomplished by destroying the private key and any certificates. In the case of public keys, they tend to be difficult to destroy since they are sometimes passed around indiscriminately (Google’s Usenet archives are probably full of them). However, if the private key is destroyed, it is not necessary to destroy all copies of the public key, since, due to the way asymmetric cryptography works, no compromise of information will be possible without the other half of the key pair. Success Owl!

Destruction Destruction is the process of permanently removing a key or certificate that is no longer needed.

4.5.10 Key Usage Throughout this chapter, we’ve discussed how to use public and private keys to accomplish certain goals. These are summarized below.

4.5.10.1 Multiple Key Pairs (Single, Dual) Conventional hierarchical PKI uses a single key pair—one public key and one private key. According to VeriSign, “Key Pairs are used for one or more of three basic purposes: encryption, authentication and non-repudiation.” A single key used for multiple purposes violates non-repudiation[25]. Up until now, we’ve primarily been discussing situations in which each individual has only one key pair. RSA recommends that you assign two key pairs per person -- one key pair for signing messages, providing authentication and non-repudiation, and a second key pair for encryption. This allows someone to recover the encryption key and decrypt documents that were encrypted using it, without their gaining the ability to sign documents with that user’s private key as well (which could lead to forgery and violation of non-repudiation).[26] Success Owl!

PKI Goals Use the receiver’s public key to encrypt a confidential message which will be able to be decrypted only by them (using their private key) To send a confidential encrypted message to multiple users, send a separate message to each user, each encrypted with that user’s public key

Use your own private key to encrypt a message which anyone can decrypt, to prove that you are the sender of the message (non-repudiation) and that the message has not changed during transport (integrity) as long as they trust your public/private key pair (A variation on the above) You can use a private key issued by a trusted CA, and a public key embedded in a digital certificate signed by that CA, to encrypt a message which anyone can decrypt, to prove that you are the sender of the message (non-repudiation) and that the message has not changed during transport (integrity) (And a variation on THAT…) Because it can be processor-time-consuming to encrypt an entire message for data integrity, you can take a shortcut and compute a digest of the message, then encrypt that digest with your own private key. Anyone who decrypts the digest with your public key and compares it to the original digest you published for the message will know that it was not tampered with if the two digest values are the same. With a single key pair, this protection is not available. When a single key pair is used, key recovery gives the individual recovering the key the ability to masquerade as the user whose key was recovered, if desired, in addition to allowing them to encrypt/decrypt communications from and to that user. Since an organization already has to have infrastructure in place to manage a single set of keys, it’s generally not that much more difficult, from an administrative point of view, to add a second set of keys for each user (as long as any key management software/hardware used supports this). Because of the low incremental cost and the potential value of implementing a PKI with dual key pairs, it’s something to consider. Note that when using dual key pairs, you may wish to treat the archiving and escrow of signing keys different than encryption keys. The reason for this is that if a signing private key is lost, it’s no big deal—just generate another key pair for future messages (the public half of the old signing key will still be “good” for reading messages signed with the old private key). Additionally, if the employee were no longer with the company, although you might have a need to go back and decrypt messages encrypted with his or her private key, you wouldn’t need to digitally sign a message with his or her identity. Contrast this with the loss of an encryption private key—which means that any outstanding messages to the recipient, created with the recipient’s public key, cannot be read.[27] Success Owl!

Single/Multiple Keys Multiple key pairs, the idea of assigning more than one public/private key pair to each user, are an idea that resulted from problems identified in the use of recovered keys. Key recovery not only allows the holder of the recovered private key to decrypt communications encrypted using the associated public key; it also allows the holder of the recovered key to encrypt messages using that private key. This means that anyone recovering the user’s private key can

masquerade as that user, which is a security issue. The answer to this is to use two key pairs—one for signing messages to provide authentication and non-repudiation, and one for sending confidential messages. When the private key needed to decrypt messages is recovered, that still does not give the holder the ability to sign messages as that user. [19]

http://www.ncipher.com

[20]

http://www.networkmagazine.com/article/NMG20001004S0015/2

[21]

http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci784421,00.html

[22]

http://www.farcaster.com/papers/fc99/fc99.htm

[23]

http://216.239.53.100/search?q=cache:aUqGdG9fQIcC:www.rsasecurity.com/products/keo n/datasheets/dskeonkrm.html+%22m+of+n%22+certificate&hl=en&ie=UTF-8 [24]

http://support.aventail.com/akb/article00626.html

[25]

http://www.verisign.com/resources/wp/enterprise/management/management.pdf

[26]

http://216.239.53.100/search?q=cache:aUqGdG9fQIcC:www.rsasecurity.com/products/keo n/datasheets/dskeonkrm.html+%22m+of+n%22+certificate&hl=en&ie=UTF-8 [27]

Kaufman, Charlie, Radia Perlman and Mike Speciner, Network Security – Private Communication in a Public World, Prentice-Hall, April, 2002, http://www.nerdbooks.com/item.html?id=0130460192

4.6 Summary In this chapter, we looked at the topics in the fourth domain of the Security+ exam, Basics of Cryptography. You learned that cryptography involves creating and using systems to encode and decode data, to improve data privacy and data integrity. Cryptographic techniques are often expressed as algorithms, or sequences of steps describing a detailed action (often mathematical). Some basic terms are: • • •

Message (data that will be safeguarded by encryption) Plaintext (“before” state of the data, prior to encryption) Cipher text (“after” state of the data, after encryption)

You explored three types of cryptographic algorithms including: • • •

Hashing Symmetric encryption Asymmetric encryption

You discovered that hashing is the process of creating a long alphanumeric string or number, called a “hash value”or“message digest, which functions as a relatively unique identifier of the message or file that, was hashed. The most popular hashing algorithm is MD5 (Message Digest 5, developed by Rivest) which creates a 128-bit message digest. A stronger algorithm is SHA-1 (Secure Hash Algorithm rev. 1, developed by NIST), which creates a longer 160-bit message digest. It is possible but not likely for different documents to compute to the same hash value; a potential attacker can take advantage of this to try to find a duplicate document that has the same hash value, but it is unlikely he’d find another with the same value that is not gibberish. It is not possible to derive the full original document contents from the hash value alone, much like it is impossible to derive the original bitmap from a compressed JPG file, due to information loss. Next, you looked at symmetric cryptography, which is the oldest type. It uses a shared secret key known by the sending and receiving parties, and (usually) a non-secret encryption algorithm, in which the same key is used for encrypting and decrypting the message. Because anyone possessing the key can decrypt the message, you need to make sure only authorized individuals have access to it. DES, Triple DES, IDEA, RC2 and AES are examples of symmetric algorithms; DES is well-known but considered insecure today because of its short 56-bit key length. You discovered that symmetric ciphers come in several types: • • •

Block ciphers (encrypting an entire block of data at a time, generally independent from other blocks; well-suited for large sets of data) Stream ciphers (encrypting data bit by bit; well-suited for bit-oriented traffic like streaming media) Cipher-block chaining (a combination of the two in which the encryption of any block of data is dependent on the results of encrypting the prior block)

A primary security issue with symmetric crypto is that if the message sender and receiver are in different places, you need a secure way to transmit the key from one person to another. Also, since crypto algorithms depend on being computationally expensive to break (reducing success of brute force attacks), they become weaker as computers become faster, and, like DES, eventually need to be replaced by more complex algorithms. You also learned about asymmetric cryptography, a newer technique which uses a pair of keys—one to encrypt the data and one to decrypt it. It is sometimes known as public/private key encryption, or just public key encryption, because it involves a public key distributed to others and a private key known only to the owner of the key pair. The earliest use of asymmetric crypto was in a 1977 paper on the Diffie-Hellman Key Exchange Protocol, describing how symmetric keys could be securely transmitted to users who needed them. One of the most widely used asymmetric crypto algoriths today is RSA (developed by Rivest, Shamir and Adleman in 1977); another is DSA, used primarily by the government. Applications using asymmetric cryptography include the PGP mail facility which uses DiffieHellman and RSA algorithms, the S/MIME mail facility, SSH (Secure Shell) and SSL. Messages can be encrypted with either the public or private key, and are decrypted by whichever key was NOT used for the original encryption. Encrypt with the receiver’s public key if you want to create a confidential, private message readable only to that receiver, who’ll decrypt with his private key. Encrypt with the sender’s (your) private key if you want to create a message decryptable by everyone with the sender’s public key, that allows each recipient to verify that it was definitely you who sent the message and that that message was

not altered during transmission. Per Diffie-Hellman, asymmetric crypto can also be used to encrypt a conventional symmetric crypto “secret key” which will be used to decrypt a file being transferred across the Internet; you might do this to minimize encryption/decryption time for a large file, since symmetric encryption takes less time than asymmetric encryption. You learned about several concepts important to cryptography, including: •

•

• •

•

•

Confidentiality (ability to pass a message without unauthorized people who intercept it, understanding it, accomplished by encrypting with receiver’s private key; in symmetric crypto, confidentiality is limited because of the use of a shared key and the challenges of distributing it securely) Integrity (assurance that data has not been tampered with since it was encrypted, usually accomplished by encrypting with the sender’s private key; with symmetric crypto, anyone possessing the key can recreate and re-encrypt the message, destroying integrity) Authentication (verifying that a specific person sent a message) Non-repudiation (a stronger variation on authentication, where the sender’s identity is verified by a third party, to prove that the message was not forged and make it impossible for the sender to deny sending it; you can prove message origin by encrypting the message or its hash value with the sender’s private key and decrypting with the sender’s public key) Digital signature (electronic signature of a document, created by calculating a document hash value with MD5 or SHA-1 that is encrypted with asymmetric crypto using the sender’s private key and an algorithm such as RSA; can be used to get data integrity and non-repudiation by having receiver decrypt signature using sender’s public key, compute the message hash value and verify that the has value and decrypted value are equal; you can digitally sign a message to get data integrity and non-repudiation WITHOUT encrypting the entire message to get confidentiality, or encrypt the message to get confidentiality as well) Access control (for symmetric cryptography, all parties need to make sure the key is kept secure, which can be challenging; for asymmetric cryptography, the private key must be kept secure and if it is compromised, the key pair should be destroyed/revoked)

You explored PKI (Public Key Infrastructure), which is the combination of software, encryption technologies and services allowing organizations to protect the security of their communications and data. PKI’s are generally implemented with public/private key systems, and use digital certificates issued and validated by certificate authorities for authentication. You discovered important elements of a PKI including: •

•

Digital certificates (a digital ID card binding a public key to the individual or item such as a server identified by the certificate; most certificates are based on the X.509 certificate standard and include information like the X.509 version, expiration date, serial number, name of issuing certificate authority, name of individual to whom certificate belongs and their public key; versions in common use include X.509v2 and X.509v3 which adds custom extensions to X.509v2) Certificate Authority (or CA, the digital equivalent of a notary public, which is a trusted third party that can verify the legitimacy of a public/private key pair as belonging to the individual in question; they create key pairs, publish public keys in

•

•

•

directories, provide services such as revocation and expiration for keys, verify certificate status in response to queries, etc.) Certificate Policy (the set of rules issued by a CA indicating the applicability of a certificate to a class of applications with common security requirements; describes rules for the issuance, management and use of certificates issued by that CA) Certificate Practice Statement (or CPS, a more detailed statement of the procedures and policies used by the CA in managing the certificates it issues; includes operational procedures and a description of the organization’s certificate management system; tends to be much more detailed than a Certificate Policy) Certificate Revocation List (or CRL, a list of all revoked, expired or suspended certificates which is a time-stamped list digitally signed with the CA’s private key; one problem with CRL’s is that they are typically updated once a day or so, rather than in real time, so there can be a delay between the time revocation is requested and the time a certificate appears in the CRL)

In taking a more in-depth look at certificates, you learned that certificate authorities may be arranged in various ways; there may be a single certificate authority, or a combination of several, used in managing a PKI. “Trust” is the confident reliance on an entity or organization; in the PKI world it often describes the relationship between the certificate holder and the issuing CA, or viewer of a certificate and the issuing CA. “Trust models” are used to describe the “chain of trust”, that indicates how trust in an entity affects trust in other entities, similar to the way trusts work in Windows 2000 domain environments. Some common CA trust models include: • •

•

•

Web of Trust (no central authority; each user creates and signs certificates for people they know; PGP uses this model) Single CA (each entity is issued a public key, over a secure channel, which is generally issued by a single CA; there is a single point of contact to check certificate status and to request certificate actions such as revocation) Hierarchical (a tree-structured model involving multiple CA’s with a Root CA at the top, using lower-level CA’s whose certificates are signed by the Root CA, for improved scalability; better for large hierarchical organizations like the military than for distributed, non-centralized peer-to-peer uses) Browser Trust List (or CA list, in which each user has a list of public keys for all the CA’s the user trusts

You learned that cryptography is standardized by a variety of organizations including: • •

•

•

IEEE ANSI (responsible for the X.509 certificate standard, currently at X.509v3 and the X.509v2 Certificate Revocation List, or CRL, standard; also sponsors X9F1 committee for financial industry cryptography standards) IETF (whose PKIX, or PKI X.509, committee is involved in issues around public key management; PKIX defines certificate formats and protocols for issuing and authenticating certificates) RSA Data Security (a market leader in asymmetric crypto, many ANSI X9 standards were first developed by RSA in their series of PKCS standards, including PKCS #3 dealing with Diffie-Hellman Key Agreement, PKCS #10 for requesting certificates and PKCS #11 which details an interface for accessing data from smartcards)

•

FIPS (a series of standards developed by NIST and used by the government; they include secure hashing, digital signatures and AES encryption standards)

You also learned about the certificate life cycle, including events like: •

• • •

•

•

•

•

Issuance (certificates are requested by the individual or supervising organization; the CA verifies the requester’s identity, generates a key pair and certificate, and sends these items to the requester) Suspension (temporary invalidation of a certificate, often used if you suspect compromise of the private key but don’t know for sure if it has occurred) Expiration (when the certificate reaches the expiration date listed in the certificate, it is no longer valid; the normal valid period for a certificate is a year or two) Status Checking (users of a certificate can AND SHOULD check the status of a certificate to ensure it is still valid before relying on it for anything; practically speaking, client software such as an email client program is notorious for NOT doing this, and thus accepting certificates which may not be valid, so users are encouraged to check certificates independently) Revocation (irreversible invalidation of a certificate; once revoked, a certificate is no longer considered valid; this can happen if the subscriber informs the CA that the private key for that certificate has been compromised; certificates can be revoked by being placed on a CRL, or by inclusion in an OCSP, or online certificate status protocol, database, which is a newer revocation list management system that enables more up-to-date status tracking) Recovery (the process of reacquiring a private key that has been lost due to hardware failure, user error, etc.; an organization might also want to recover a private key for an ex-employee if required for a business function or law enforcement investigation; relies on key escrow and secure storage) Renewal (process of re-validating or replacing a certificate that is near or at its expiration date; some CA’s recommend totally replacing a certificate with a new key pair; others think just issuing an updated one with the current key pair is sufficient) Destruction (permanent removal of a key pair you no longer need)

You discovered various things about the key management process, such as: •

•

• •

Keys can be managed by either a central authority or via a distributed system in which each individual (or small groups of individuals, headed by a designated manager) manages their own key; when you use a CA to issue and manage certificates, you are using a centralized model Private keys must be securely stored (it is not unheard-of for companies to keep copies of private keys in vaults or off-site, in case needed for recovery; private keys may be stored in software or in hardware devices specifically designed for secure key storage) Each private key owner is responsible for safeguarding his/her private key so that it does not fall into anyone else’s hands Key escrow, which is the process of keeping a copy of the user’s private key in a centralized location accessible to security administrators, or implementing a mechanism whereby the private key can be recovered without being stored; this allows for future recovery of a key, should it be lost due to hardware issues on the user’s machine, etc.

You learned that there are some interesting issues in key recovery. Since private keys are very sensitive items, and anyone possessing the private key can sign documents claiming to be the person to whom the private key belongs, care must be taken during key recovery. Persons given this privilege should be highly trusted, and careful logs kept to ensure that this privilege is not abused. Because of the significant exposure of single-person key recovery, organizations have come up with a way to use the concept of M-of-N control to require multiple participants in any key recovery operation, reducing risk. M-of-N control involves dividing up a task among multiple people so it cannot be performed by one person acting alone. One key recovery technique using M-of-N control involves issuing each potential key recovery agent a percentage of the private key used for the recovery system, in the form of a token; in order to perform a key recovery, some M of the N authorized people entrusted with these tokens must come together and combine their tokens, to be allowed access to key recovery functions. You discovered that multiple key pairs can be employed for added security, since a single key pair violates non-repudiation, because of the potential for someone other than the key owner to obtain someone’s private key used to sign documents. With multiple key pairs, each entity is assigned TWO key pairs, a “signing key pair” and an “encryption key pair”. This ensures that if you need to perform key recovery in order to obtain the entity’s private key to decrypt messages sent to them, you can obtain that key without also obtaining the private key that could be used to masquerade as that user’s identity.

4.7 Success Questions 1. The main role of a cryptographic hash function is in the provision of: A. B. C. D.

message integrity checks and digital signatures message integrity checks only digital signatures only signature algorithm computations

2. What is used to allow verification of the claim that a specific public key does in fact belong to a specific individual? A. B. C. D.

Certificate Key ring SA Ticket

3. To protect the data while in transit on a network, what is used to identify errors and omissions in the information? A. B. C. D.

Record sequence checking Transmission error correction Retransmission controls Hash total

4. A digital certificate contains what data? (choose all that apply) A. A subject name, which identifies the person or object that the certificate

B. C. D. E.

represents. The public key belonging to the subject. The identity of a Certificate Authority (CA) that has signed the certificate to certify that the public key and the identity both belong to the subject. The digital signature of the named CA. An expiration date for the Certificate

5. From the list, select the symmetric algorithms A. B. C. D. E.

DES RC4 IPSec PGP IDEA

6. A digitally signed message offers A. B. C. D.

Authentication of Origin Integrity of Data Non-Repudiation Confidentiality

7. The definition of a Certificate Policy is A. B. C. D.

Found in US Title Code (Federal law) determined by the CA both choices are correct no choice is correct

8. What does CPS mean? A. B. C. D. E.

Acronym for Cycles Per Second Certificate Practice Statements Certificate Policy Statements Certificate Procedure Statements No choice is correct

9. Certificate Revoking is based on A. B. C. D. E.

Policy Expiration date Administrator action No choice is correct Some choices are correct

10. Select the protocol that is utilized for management and negotiation of SA's. A. MD5 B. RC3

C. ISAKMP D. IDEL Answers 1. *A. message integrity checks and digital signatures The main role of a cryptographic hash function is in the provision of message integrity checks and digital signatures. Since hash functions are generally faster than encryption or digital signature algorithms, it is typical to compute the digital signature or integrity check to some document by applying cryptographic processing to the document's hash value, which is small compared to the document itself. 2. *A. Certificate Certificates are issued by the certificate authority. Certificates are digital documents attesting to the binding of a public key to an individual or other entity. They allow verification of the claim that a specific public key does in fact belong to a specific individual. Certificates help prevent someone from using a phony key to impersonate someone else. In some cases it may be necessary to create a chain of certificates, each one certifying the previous one until the parties involved are confident in the identity in question. A key ring may be used to hold an individual's collection of keys. SA's and tickets are used in distributed cryptosystems but are not specifically involved in authentication. 3. *D. Hash total Hash totals - these identify errors and omissions in the information, A has algorithm provides a hexadecimal checksum of the data. This is stored in a record prior to transmission, and then sent to the remote computer with the data. The remote system can then compute the checksum, and if it agrees with the value that was calculated before transmission, the information arrived intact. Record sequence checking would verify that records were received in the correct order, but not verify record contents. TCP-level techniques do not protect against alteration of data during transmission, since packets could potentially be inserted with altered information. 4. *A. A subject name, which identifies the person or object that the certificate represents. *B. The public key belonging to the subject. *C. The identity of a Certificate Authority (CA) that has signed the certificate to certify that the public key and the identity both belong to the subject. *D. The digital signature of the named CA. *E. An expiration date for the Certificate

A subject name, which identifies the person or object that the certificate represents. The public key belonging to the subject. The identity of a Certificate Authority (CA) that has signed the certificate to certify that the public key and the identity both belong to the subject. The digital signature of the named CA. An expiration date for the Certificate 5. *A. DES *B. RC4 *E. IDEA RC4, IDEA and DES are symmetric. PGP and IPSec are Asymmetric. Symmetric Algorithms: AES, Blowfish, CAST5, CAST128, DES, DESede, GOST, IDEA, LOKI91, Mars, RC2, RC4, RC5, RC6, SAFER, Skipjack, SPEED, Square, TEA and Twofish 6. *A. Authentication of Origin *B. Integrity of Data *C. Non-Repudiation Signing a message does not mean the message IS encrypted. It is possible, but not MANDATORY. Without encryption, confidentiality is not offered. Diffie-Helman -"The Diffie-Hellman variant described requires the recipient to have a certificate, but the originator may have a static key pair (with the public key placed in a certificate) or an ephemeral key pair. -- RFC 2631 7. *B. determined by the CA "Certificate Policy is defined and maintained in conjunction with related policies in the organization." Entrust White Paper. These policies are not specifically determined by law. 8. *B. Certificate Practice Statements While Cycles Per Second would be accurate in an electronics certification test, this is about Security+. "A Certification Practice Statement (CPS) is a statement of the practices that a CA employs in managing the certificates that it issues." -- Entrust White Paper 9. *A. Policy *B. Expiration date

*C. Administrator action Expiration date is one part of policy that is standardized. The real issue addressed here is the policy of compromised keys. "The certificate revocation policies of your organization include policies for revoking certificates and policies for certificate revocation lists (CRLs). Policies for Revoking Certificates Your certificate revocation policy specifies the circumstances that justify revoking a certificate. For example, you can specify that certificates must be revoked when employees are terminated or transferred to other business units. You can also specify that certificates must be revoked if users misuse their security privileges or the private keys are compromised (a lost smart card, for instance). For computer certificates, you can specify that certificates must be revoked if the computer is replaced or permanently removed from service, or if the key is compromised. Policies for Certificate Revocation Lists Your CRL policies specify where you will distribute CRLs and the publishing schedule for CRLs. For example, you can specify that certain CRLs will be distributed to commonly used public folders and Web pages, as well as to Active Directory. You can also specify that certain CRLs be published daily instead of using the default weekly publication." -- Microsoft Resource Kit, Planning Your Public Key Infrastructure. 10. *C. ISAKMP "The Internet Security Association and Key Management Protocol (ISAKMP) defines procedures and packet formats to establish, negotiate, modify and delete Security Associations (SA)." -- RFC 2048

Chapter 0101: Domain 5.0: Operational/Organizational Security (15%) "This is not an abstract problem. The vast majority of users don’t read security mailing lists and don't read postings about product vulnerabilities. Hackers do." --Scott Culp, Manager of Microsoft's Security Response Center

Getting Ready—Questions 1. Separation of duties is valuable in deterring________. 2. Enforcing minimum privileges for general system users can be easily achieved through the use of _______. 3. All logs are kept on archive for a period of time. It is ____________ __________ which determines this period of time. 4. How often should logging be performed?

5. Which of the following are potential firewall problems that should be logged? A. B. C. D.

Reboot Proxies restarted Changes to the configuration file. No Answer is Correct

Answers 1. Separation of duties is valuable in deterring fraud. Separation of duties is considered valuable in deterring fraud since fraud can occur if an opportunity exists, due to combinations of various jobs related capabilities being performed by one person. Separation of duty requires that for particular sets of transactions, no single individual be allowed to execute all transactions within the set. The most commonly used examples are the separate transactions needed to initiate a payment and to authorize a payment. No single individual should be capable of executing both transactions. In order for fraud to occur, multiple people would have to collaborate in pulling it off -- difficult, because while one person can generally keep a secret, with two people, secrets typically don't stay secret for long. 2. Enforcing minimum privileges for general system users can be easily achieved through the use of RBAC. Ensuring least privilege requires identifying what the user's job is, determining the minimum set of privileges required to perform that job, and restricting the user to a domain with those privileges and nothing more. By denying to subjects transactions that are not necessary for the performance of their duties, those denied privileges couldn't be used to circumvent the organizational security policy. Although the concept of least privilege currently exists within the context of the TCSEC, requirements restrict those privileges of the system administrator. Through the use of RBAC (role based access control), enforced minimum privileges for general system users can be easily achieved. 3. All logs are kept on archive for a period of time. It is retention policies which determines this period of time. All logs collected are used in the active and passive monitoring process. All logs are kept on archive for a period of time, called a retention period. This period of time will be determined by your company policies. This allows the use of logs for regular audits, and annual audits if retention is longer then a year. Logs must be secured to prevent modification, deletion, and destruction. Administrator preference is often used to determine certain things like how long logs are retained. But since these decisions can affect the ability of the company to go back and research potential security issues, it is a corporate issue that should be governed by a deliberate policy statement. 4. How often should logging be performed? Always. Usually logging is done 24 hours per day, 7 days per week, on all available systems and services except during the maintenance window where some of the systems and services

may not be available while maintenance is being performed. If you only perform logging at certain times, then any activities taking place at other times won't be logged, and can't be used for auditing or forensic activities at a later date. This makes your network more vulnerable to undetected intrusions and thus a more attractive target for attackers. 5. *A. Reboot *B. Proxies restarted *C. Changes to the configuration file. The following firewall problems should be logged logged: Reboot of the firewall. Proxies that cannot start (e.g. Within the firewall). Proxies or other important services that have died or restarted. Changes to firewall configuration file. A configuration or system error while firewall is running. A reboot or proxy restart signals a potential reliability issue, or a cracker restarting the firewall after configuration changes or an attempted attack. Changes to the configuration file may be made under legitimate circumstances (by the network administrator) or might indicate an intrusion by unauthorized individuals. Similarly, system and configuration errors might indicate intrusion attempts, or reliability problems.

5.0 Operational/Organizational Security This chapter discusses security from the point of the view of the physical organization and the people within it. As you might guess from earlier chapters, the people aspect figures in prominently, whether we’re discussing physical or organizational security. Additionally, this chapter looks at computer security-related policy-making. What rules should your organization have in place to govern business continuity, handling improper use of the organization’s computing resources, the specification of the privacy/sensitivity level of data, what computer-related administrative activities occur at employee hiring and termination, etc.? These subjects are addressed in greater depth in this chapter. Because all the security efforts in the world won’t necessarily keep you from ever experiencing a break-in, we look at computer forensics—the process of investigating an attack, often with the goal that evidence will be presented to law enforcement personnel, for prosecution of the attacker. It also looks at the business issues of threat and risk identification and assessment—a critical step in the business justification of computer security measures. Before you know how much (people, dollars, etc.) you can dedicate to computer security, you need to know the risks you

face, and their values. This chapter covers the last official domain in Security+. Your authors have put forth every effort to adhere to RFC 1925[1] throughout this work, and particularly so in this chapter as we are forced to interact with the non-technically inclined. [1]

http://www.faqs.org/rfcs/rfc1925.html

5.1 Physical Security Physical security involves the safety and security of the actual hardware, cables and other physical components of your network. In one documented case, precautions were taken, and the server was placed in a locked, windowless room. The security aspects seemed satisfied. The hapless firm discovered otherwise when the intruder simply pushed the ceiling tiles aside outside the server room, and went over the wall, which did not go all the way to the ceiling. Once inside, the intruder unplugged the server, opened the door from the inside of the server room, and walked out with the server containing the data. Consider: • • •

Physical barriers from 6 sides Alarm System Camera free to long term videotape (via time-lapse)

5.1.1 Access Control As discussed in previous sections, access control involves the process by which you restrict access to resources—in this case, physical resources. Some measures to consider: • •

Sign in/out logs to provide an audit trail Video surveillance for investigation and evidence

5.1.1.1 Physical Barriers Good defense employs concentric rings of security. This term involves two thoughts in one term. The first is the process of effective physical security creating layered perimeters in circles that get tighter with each circle. In addition to tighter rings, as the core is approached, certain (mind & emotion) principles are applied. Once again, three points are to be considered when applying physical security to a sensitive area. For security zones they are: 1. The outermost ring or perimeter should be the first line of defense and should contain the public activities. Continuing inward, more security measures should be incorporated as one approaches the private or high-risk areas. 2. Prominent use of signage (symbolic language), architectural elements and natural and man-made barriers should be utilized to signify the transition from public to semiprivate, and finally, private space. 3. Clear border definition should be provided for the controlled space. Further, there are territorial behavior strategies that contribute to physical security. There are guidelines for this aspect as well. These include:

• • •

Create elements to reinforce the feeling of proprietorship within an area. Use signage, reflecting the purpose of the area. The physical area should support legitimate users. Architectural amenities should not attract undesirable behavior or provide concealment points. Provide natural barriers for controlling activities that conflict with the purpose of the area

5.1.1.2 Biometrics Biometrics, as discussed in earlier domains, adds an additional layer of security. Passwords coupled with biometrics involve authentication with something you are. Biometrics should not be used as the single means for authentication. Tsutomu Matsumoto of Yokohama National University has demonstrated two different techniques for circumventing biometrics with an 80 percent accuracy rate[2]. Biometrics such as a fingerprint scan can be included in a smartcard[3]. While other biometric options are possible, such as facial or iris scanning, fingerprint scanning is currently the most popular biometric because it is the lowest cost option with the highest accuracy rate.

5.1.2 Social Engineering Operational Security + Social Engineering = User Awareness Training[4]. There are two considerations that come into play. The first is competitive intelligence[5]. Employees have access to the data in order to do work. An unhappy worker could sell valuable data to a competitor[6]. Honest employees need to keep aware of the fact somebody wants your data. If the data is valuable to your company, it is valuable to your competitors. Secondly, setting aside data, consider other assets, such as the phone system. A hacked phone system can be used for: • • •

Long distance phone calls being billed to the company Voice mail compromised Phone numbers for customers and prospects

Geek Owl! Scam The scammer calls pretending to be a telephone service technician performing a test on the line. He asks that you transfer him to an operator by pushing 9, 0, # and then hang up. On some business systems, this can give the caller an outside line that can be used to make long distance calls. Toll charges will then be billed to the owner of the PBX as directly dialed calls. Success Owl! Identify Contractors A more direct attack is for the scammer to come in with a tool case and say they are there to work on the PBX. It is possible to be friendly and still challenge the guest for solid proof of identification.

5.1.3 Environment The environment refers to the physical surroundings in which your network operates. Policies regarding protection of corporate assets and employee safety need to be established by senior management. Success Owl!

Involve All Departments Committees involving stakeholders, from all departments need to create recommendations so intelligent choices can be made balancing issues of implementation costs, and security.

Not involving all departments would result in a flawed disaster recovery plan, which could be worse than no plan at all

5.1.3.1 Wireless Cells While not as ‘cool’ as the relative high-speed nature of 802.11x, other wireless technologies have been around for upwards of 10 years. Generically, we refer to these as cellular phones. While voice is the major use of cellular, data cable adapters have been available for cellular phones for a long time. Today, only very rural areas do not have cellular phone coverage. Before jumping to the table of the speeds available, consider how much damage could be done if email from select accounts was secretly transmitted. Note that email text does not consume a great deal of bandwidth, so it doesn’t take a tremendously high speed connection to move a significant amount of email data. Now consider the following table. 1G

Mobitex, Moitent

9.6Kbps

2G

CDMA, CDPD, TDMA-IDEN

19.6 Kbps

2.5G

GPRS

128+/- Kbps

3G

CDMA2001x

384Kbps

The table illustrates the total bandwidth, and like Ethernet, about ½ of this speed is the real throughput. Now even with 1st generation wireless, which means over 400 characters per second of email that could be leaked without anyone knowing. Then think about the 2.5 G PCS phone plans that offer unlimited data usage for about $100 a month. Given an AC adapter to a PCS phone on one of these plans and 16,000 characters per second of email could be sent to virtually any location in the world. Nextel uses IDEN (Integrated Digital Enhanced Network) that is based in TDMA, and offers private 2-way radio. Nextel is specifically mentioned because we know that setting an IP address on a Nextel phone is very easy.

5.1.3.2 Location Location involves the area in which your network operates, including its specific placement in your building. Network device location decisions that are not well-thought-out can leave network components excessively vulnerable to harm (locating an unprotected PC keyboard in a restaurant kitchen, or a network client on a factory floor). When considering location issues, a prime area of concern is wireless networking, because too little attention paid to wireless network positioning can increase the likelihood that your network is available to unauthorized individuals. When considering wireless network components, minimizing transmission power reduces the changes your data will leak out of the intended area. Careful antenna placement will also have an effect[7]. Success Owl!

Antenna Placement Attempt to place antennas as far from exterior walls as possible. Consider the RF pattern options with different types of antennas.

Typically the interface between the wired network and the transceiver is placed in a corner in an effort to hide the electronics. If that corner is along the outside of your building, that places the network signal outside and easy to intercept. In effect, you have put an Ethernet jack for your network in the parking lot.

Figure 41: Depending on building layout wireless networking may be controlled by mounting an outdoor antenna high outside and angled down toward the building. Or an external antenna (when combined with other security) may make a wireless bridge. Photo of External Hg2426p Courtesy of Sharon Cantor and Hyperlink Technologies © 2002 Http://www.hyperlinktech.com . Used with permission

Beyond controlling power output and antenna placement and configuration, consider shielding, the next topic.

5.1.3.3 Shielding Shielding reduces the distance that radio and other electronic waves can travel. For example, the building in which the network is operating can be used as a shield for itself. Success Owl!

Metal shielding Paint with metal and Mylar window covering can attenuate the RF signals from wireless and other networks, decreasing the chance someone can get to your network.

The downside could be a negative impact on pagers and cellular phones. An additional plus is this reduces your risk of a wireless denial of service attack. Keep in mind that 802.11b operates at the same frequency of a microwave oven. Something as simple as disabling the safety interlock of a consumer microwave oven creates a DoS weapon with up to 1000 watts of 802.11b interference. A more determined black hat may invest in a ‘heavy duty’ antenna, capable of handling up to a 300W[8] input from the inner workings of a microwave antenna.

5.1.3.4 Fire Suppression Computers do not mix well with water. Fire suppression for computers used to be setup with Halon 1211 gas. Due to the nature of Halon 1211 being destructive to the ozone layer, it has been replaced with FE-36 in both portable and fixed system fire extinguishers. FE-36 is “much safer” from inhalation point of view, according to the manufacturer, DuPont. FE-13 can be used to prevent explosions. The inert concentration for FE-13 Dupont states the inertia point for methane/air is 20.5%. While safer than Halon 12111, the Dupont FAQ states the following regarding human safety: “Where possible, evacuate before discharge. Cardio toxicity is what usually LIMITS the quantity of halocarbon agent to which humans can be exposed. This level is determined by challenging dogs with epinephrine in the presence of an air/agent mixture. No cardiac sensitization was observed at 30% FE-13™ in air. DuPont has established a fire emergency exposure limit (FEEL) for FE-13™ of 20% by volume for up to 15 minutes with a 1 minute not-to-exceed ceiling of 23%” The manufacturers’ requirements indicate that a fixed fire suppression system brings the contained area up to 16% concentration within 10 seconds with this heavier than air fire suppression gas. Beyond fire suppression equipment, consider logistical planning as well. The theory goes that nobody should be in the building when the fire alarm goes off. And, how many movies have you seen where someone sets off a fire alarm to get everyone out of the building while the actor/actress goes for a quick data mining trip? I guess the movie would have to take a different turn if the computers shut down when there was an alarm.

Success Owl!

Shut down servers as part of a fire plan All Network Operating Systems have some sort of batch function that can be invoked to shut systems down automatically. Make that part of your fire planning.

[2]

http://www.itu.int/itudoc/itu-t/workshop/security/present/s5p4.pdf

[3]

http://www.didya.com/SmartCardBioKit.asp

[4]

http://rr.sans.org/securitybasics/awareness.php

[5]

http://security1.gartner.com/story.php.id.12.s.1.jsp

[6]

http://www.cio.com/archive/060102/doom.html

[7]

http://www.80211-planet.com/tutorials/article/0,4000,10724_1116311,00.html Article on running a Site survey by Jim Geier [8]

http://www.hyperlinktech.com/web/hg2415p.html

5.2 Disaster Recovery This topic within security is extremely broad; the full scope involves many departments within a large firm. For the purposes of the Information Technology department, five areas should be addressed. They are: • • • • •

A ‘battle plan’ Hot sites Backup Vital records Planning

Justifying the cost of disaster recovery can quickly be ascertained by: • •

How much revenue is lost for each minute of downtime? How many dollars in salaries are being lost per minute due to lack of system availability?

Do the math, and be prepared for a scary surprise.

5.2.1 Backups Backups are archival copies of files, electronic and otherwise. A keystone in disaster planning is, have recent backups, and keep them off site. Smaller sites can do this by utilizing a key person taking backups home. This action step should be firmly planted in your thought process as a job. This opening statement is covered directly in the next sub-domain. For this sub-domain, the only time I haven’t seen a test for knowledge on particular topics of backups was the first A+ core hardware test (when you had the option of the second test being Windows 3.x or Macintosh). Every other test, from Network+, i-Net+, Server+, etc. has made

sure you knew about backups. So it should not be any surprise if you see them in Security+. If this is just a review for you, great. Otherwise, pay very close attention. Success Owl!

Permissions & Security for Backups Encrypting backups makes life more difficult for someone who walked away with your data

Backup/Restore All of the files we create everyday need to be managed. Part of that management includes backing up (saving) our files. There are different types of backups and methods.

Method to the Madness One of the simplest ways is to save the file to another disk such as a floppy disk. We call this removable media. Today with the ease of CD-R/RW burning, we can backup this way. Another method is to backup the files on another drive or across a network to another drive. One of the most common methods is to backup the files to a tape drive. Have you heard the phrase “restore from tape?” If we lose a drive or a file then we have a copy of the information to restore from. We back up in the first place because we lose files, corrupt files and drives die. As our data is important, the method we employ to protect that data should be carefully considered. We can specify where, when and how the files will be backed up. If we are on a network the system administrator makes those decisions and uses a backup (program) agent. There is also scheduling done to determine what type of Backup will occur.

Archive Bit Now that we’ve heard more about backup, we can talk more about the archive bit. What is the archive bit? This is an attribute that indicates a file status regarding the backup attribute applied to the file. It can be set to either ON or OFF. Each time a program or file is used or opened, the network operating system (NOS) checks to see if the information in the file has changed, and if so, sets this bit, if it is not already set. When the backup program runs, it checks each file’s archive bit and includes the file or program in the backup if the archive bit is set, thus saving the changes. The archive bit is turned off when a full or incremental backup is performed.

Types of Backups All backups are not created equal. The following is a description of the types of backups you can do, and how to restore them.

Full Backup This choice means: Everything selected is fully backed up. The entire drive will be recoverable in the event of a failure. Be sure all the hidden files are checked. Typically this is done weekly. The archive bit for each file is then reset to “OFF”.

Restoring Full Backups This method is the slowest, but most complete and reliable backup possible. To restore from a full backup set simply use the full set (complete) of tapes or other media and begin the restoration process.

Differential Backup This choice means: All files that have changed since the last full (complete) backup are saved in this backup method. Typically, this is done every day, concluding with a full backup of the week (separate process) and then when the next week starts, the cycle (schedule) of backups of all files that have changed since this most recent full backup begins again. The maximum number of backup sessions that occur in a week for this method is five, assuming that users work on the system five days a week. The archive bit for each file is not touched (reset) during each backup.

Restoring Differential Backups This method is slower than, but not as slow as, a full backup. This method is safer than an incremental backup, but not as easy as a full backup, to restore. When you need to restore you must use a full set (all of them!) of the full (complete) backup tapes, and the most current differential backup tape.

Incremental Backup This choice means: A partial backup of files that have changed, since the last full or incremental backup. Typically, this method is used as a daily backup. This means that only the files that have changed are backed up each day and since the amount of data or information is less, it is a faster method. The each file’s archive bit is cleared to “OFF” each backup.

Restoring Incremental Backups To restore from tape using this backup method, you must use the full backup (complete) set of tapes AND each daily tape, going all the way back to the last full backup.

Tape Rotation Tape backup is wonderful when it comes to cheap storage. Furthermore… Wait! There is nothing else good to say about tape backup. It is fraught with magnetic bits falling off the plastic, stretching, heads going out of alignment, accidental erasure, and the list goes on. The challenge then becomes how to preserve the maximum amount of information for the longest time possible, with the minimum number of tapes. Two popular backup strategies are: • •

Towers of Hanoi Grandfather-Father-Son

Towers of Hanoi[9] is based on a puzzle where you start out with all the rings on one pole and must move all the rings to another pole. You can never have a ring on top of one that is smaller than itself. The idea is that you must move them in a certain order to accomplish the task. The order of movement of rings is: A-B-A-C-A-B-A-D-A-B-A-C-A-B-A-E-A-B-A-C-A-B-A-D-A-B-A-C-A-B-A-FA-B-A-C-A-B-A-D-A-B-A-C-A-B-A-E-A-B-A-C-A-B-A-D-A-B-A-C-A-B-A-GA-B-A-C-A-B-A-D-A-B-A-C-A-B-A-E-A-B-A-C-A-B-A-D-A-B-A-C-A-B-A-FA-B-A-C-A-B-A-D-A-B-A-C-A-B-A-E-A-B-A-C-A-B-A-D-A-B-A-C-A-B-A-H In the case of tape backup, label the tapes A-H and use the same order to rotate tapes through a tape drive, each day putting a complete backup on the tape. The Towers of Hanoi backup strategy is often used because it creates the longest possible data retention period (the length of time archived data is kept around) with the minimum number of tapes. For example, using the Towers of Hanoi backup strategy with a set of 10 tapes allows for retrieval of data up to 1023 days old. In the Grandfather- Father- Son method, you label tapes by the day of the week with a different tape for each Friday in the month and a different tape for each month of the year. Using a tape for Saturday and Sunday is optional depending on whether you have files updated over the weekend. This would look like the following: MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY1 MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY2 MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY3 MONDAY

TUESDAY

WEDNESDAY

THURSDAY

MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAYI MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY2

MONTH1

MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY3 MONDAY

TUESDAY

WEDNESDAY

THURSDAY

MONTH2

MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY1 MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY2 MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY3 MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY4 MONDAY

TUESDAY

WEDNESDAY

THURSDAY

MONTH1

Because, some months have more than four weeks, it will take over 20 tapes for regular backups. Now that you have a backup, the question becomes where to put it? That is tackled next.

5.2.1.1 Off-Site Storage Off-site storage is important, to protect the organization’s data from disasters that affect the immediate are of the network operations center. The purpose of off-site storage is to put a backup of your data in a location that is not likely to be affected by an event in the area in which the servers are located. This way, even if your operations center is rendered inaccessible due to flood, etc., you can still get to a copy of your data and business can continue. Off-site storage can be found in a number of different forms. A trusted backup operator can take home CD-RW or tape. There are a number of firms that offer backup via remote access by either direct dial with a modem or over the Internet[10]. Companies that want media picked up for safe storage can enlist the services of firms specializing in off-site storage[11]. Success Owl!

Test Those Backups Most experienced IT people have their own story about the backup that wasn’t a real backup. Test your backups regularly from your off-site storage. As mentioned in domain 3 when discussing network devices, test your backups on a different device than the one on which they were made, to make sure that an out-of-alignment tape drive is not writing backups that no other tape drive can read. Also, ensure that you have a matching backup device offsite, so that you can read those backups. Repeat after me: backups are not any good if you can’t restore from them.

5.2.2 Secure Recovery Integrity is required to have a security guarantee. Typically, this is not found as part of the design of a computer system’s architecture. The University of Pennsylvania has developed a

system they call AEGIS or Automated Recovery in a Secure Bootstrap Process.[12] In brief, AEGIS assumes: • • • • • • • • • •

The system board has not been compromised. A certificate authority is being used. A trusted host exists for recovery purposes. With these assumptions, there are six goals for AEGIS. They are: Allow the AEGIS client and the trusted repository to mutually authenticate their identities with limited or no prior contact. Prevent man in the middle attacks. Prevent replay attacks. Mitigate certain classes of denial of service attacks. Allow the participating parties to agree upon a shared secret and secure manner in order to optimize future message authentication. Be as simple as possible: Complexity breeds design in an application.

5.2.2.1 Alternate Sites If the firm is small enough, a cold site may suffice. A cold site may be rented storage in a hotel, containing minimal equipment. When a major system crash occurs (for whatever reason), renting a room in the hotel can provide an alternate site with minimal downtime. A hot site is fully equipped, with technology including the phone lines, chairs, etc. The site does not have to be sitting idle. Consider using a branch office, or if the firm is too small, to have other locations, create a reciprocal relationship with another company. Ideally, the site is of some geographical distance from the original site. Consider how the damage area in a flood, earthquake or another natural occurrence would impact when planning an alternate site. Vital records should be part of a site, hot or cold. This data should include how to reach employees, contact information for water, power, and telecommunication companies that provide logistical support to your firm. Success Owl!

Hot Site Cold Site A hot site is fully equipped, with technology including the phone lines, chairs, etc. A cold site may be rented storage in a hotel, containing minimal equipment.

5.2.3 Disaster Recovery Plan Once a solid backup procedure is in place, a strategy for what to do when Old Man Murphy jumps from his hiding place and really messes with your company is the next step. When detailing a plan, a good set of guidelines is to pretend you are a cub reporter for a news agency. The outline for the cub reporter asks the questions, Who? What? When? Where? Why? Loosely that translates into something like: • • • •

(Who) is responsible for X? (What) does Who need to accomplish X? In what sequence (When) will Who perform the What steps. (Where) will Who find the parts to accomplish X?

•

The (Why) typically comes in the form of cost justification.

[9]

http://www.studyworksonline.com/cda/content/applet/0,,NAV3-15_SAP48,00.shtml

[10]

http://www.networkbuyersguide.com/search/105582.htm

[11]

http://www.fedsysgrp.com/mediastorage/About%20Datasafe.pdf

[12]

http://www.cs.columbia.edu/~angelos/Papers/reco.pdf

5.3 Business Continuity Continuing business as usual, in the face of unusual conditions requires forethought. The reality is that there is a mountain of work in putting together a plan of response. The question is where to start? The answer is ISO 17799. The Industry Standards Association is the same international Organization who brought us the OSI (Open Standards Interconnect) model that we use in networking. Specifically ISO 17799 is a comprehensive set of controls created with best practices for information security in mind. The first version of it did not live long, however, with version two published in May 1999, this standard is at least being used as a guideline. Note that ISO 17799 has several sub sections including: • • •

Security Risk Analysis Compliance Management Auditing

As stated above, even using ISO 17799 as a guideline is not a small effort. A sample of what is involved is available as a PDF found in the footnote[13].

5.3.1 Utilities Utilities such as electricity in many countries have an amazing 'uptime'. So much so that we tend to take it for granted that it is there. As part of an overall security plan, the assumption must be made that it may not be there. Phone companies use large batteries that are backed up by generators. Larger ISPs follow the same technique. In your firm, make sure you check the manufacturer’s rating for battery life of your UPS systems. PDA's lose all data if they completely discharge. Sealed lead acid batteries that need to be swapped out according to the makers’ recommendations usually run security alarms. Do your ISP’s have backup servers (and even backup sites)? If you depend on an ISP for external web-hosting of an e-commerce site, you should know the answer to this question.

5.3.2 High Availability / Fault Tolerance High Availability in computers generally refers to another computer that is capable of continuing should one fail. More modern fail over designs is capable of load sharing when both systems are functioning normally and pick up the load on 'fail-over'. If it is important…

Consider Fail over computer clusters and computers designed for hot swapping components. @X@ End success owl Fault Tolerance is the generally accepted term for disk sub-systems. For example, RAID 1, also known as disk mirroring because it has a complete byte-for-byte copy of the other disk. Disk Duplexing adds to the idea of a second disk controller preventing the violent failure of a single disk controller from trashing both copies.

5.3.3 Backups While it was covered in 5.2 we are going to say it again here in 5.3.3 Success Owl!

Backup means… Test backups for integrity Have multiple copies Store in an off-site secure location Replace backup media often Reformat tapes often (Tape stretches)

[13]

http://www.iso17799software.com/policies.exe

5.4 Policy and Procedures Security policy (or collection of policies) can be regarded as the strategy and practices concerning confidentiality, integrity and availability of data[14]. A policy or set of policies cannot be created or purchased until the company philosophy has been clearly defined. Policies define what is to be protected. Once policies are defined procedures are created to ensure the policies that have been decided upon are implemented. Procedures determine how that protection happens. Procedures should also be in place for step-by-step instructions for abnormal events. Just as virtually every public place has an EXIT sign as a guide in the event of an emergency, a procedure should be written in a step-by-step manner for “what to do & how to do it” in the event of negative occurrences. This work continues with some brief thoughts. All readers are strongly advised to refer to RFC 2196[15]. Readers of this document who do or are considering employment in the computer industry should consider studying carefully RFC 2196 mandatory. When developing policies and procedures, it’s useful to have some familiarity with the current laws related to computer and network security and data privacy. An overview of key US Federal privacy laws as of 2002 can be found in Protect Your Digital Privacy: Survival Skills for the Information Age[16] by Cady and McGregor. There are more than you might think, and worth a look—though since Security+ is not a US-specific exam, exactly what laws apply in the US are outside the scope of the exam.

5.4.1 Security Policy When creating Security Policy, the first order of business is determining who needs access. The principle of least privilege, in which each user is given the minimum access and network privileges needed to do their job, is the commonly accepted practice. Management has concerns about data protection. Legal cares about keeping the company out of court. The technical folks have to implement the policies, and users fear policies will impact their ability to get work done. In addition to our coverage of the topic, some management-level information on the types of information you might want in your corporate security policy can be found in the Enterprise Directory and Security Implementation Guide[17] by Carrington et-al.

5.4.1.1 Acceptable Use There is no single template that applies to all for Acceptable Use Policy. The Electronic Freedom Foundation has a large repository that serves as a guideline by individual industries[18], as noted in the general FAQ from the site. General guidelines include: As much as possible use existing legislation and law enforcement mechanisms rather than creating your own. • • • • • • •

Cite statutes or ordinances based upon which the authority to make this policy is based. Make policies reasonable and narrow Have legal counsel check policy “Common sense, reason and sensitivity should be used to resolve issues in a constructive and positive manner without escalation.” Train staff. Include empathy training. Consider any policy that the limits access carefully Provide a clear description of the behavior that is prohibited so that a reasonably intelligent person will have fair warning

Policies should be clear on a number of specific topics. Examples include: • • • • • • • • •

Responsibility of users to protect the data they are using Modifying database entries Providing passwords or sharing user accounts with other workers Copying software Installing software or hardware Policies regarding email and web access Password requirements including how often they must be changed Remote access capabilities Auditing of computer accounts

Success Owl!

AUP should be signed by all employees As with any legal document or contract, each employee should sign a copy of

the AUP, signifying that he has read the document and agrees to the terms outlined in it. This makes it more difficult for the employee to claim ignorance of the policy at a later date.

5.4.1.2 Due Care As with much of this domain of Security+, common sense comes into play. This is key term for saying “after considering the situation, has a balance been struck between protecting assets and the privacy of both workers and customers?” In other words, have you taken the care due the situation, to protect those items within your responsibility, be they customer databases, servers, network hubs, user accounts, etc.? Failure of anyone within a company to perform “due care” could result in liability for the company, which could be grounds for termination of an employee.

5.4.1.3 Privacy Privacy laws exist in most countries. Legal infractions can be found in a variety of forms. For example, without policies in place that state the company has a duty to inspect the companies' computers for unapproved software or to examine systems for Trojan Horses, an employee can make a case against the company for invasion of privacy. Success Owl!

AUP = CYA A well-prepared Acceptable Use Policy is an important part of operational security. More and more organizations are monitoring one or more aspects of network use. Some experts feel that unless an acceptable use policy states otherwise, employees have a reasonable expectation of privacy of their electronic mail, files and network communications. This “reasonable expectation” could result in a challenge for you if you ever needed to present electronic evidence to back up an action such as a staff dismissal. Therefore, we strongly recommend that you put a policy in place stating what you are monitoring.

Additionally, clients of the company have a legal right to expect that their business with a firm is kept private. Some sectors such as the medical industry have additional demands placed on them, such as those described by the HIPAA regulations for the health care industry.

5.4.1.4 Separation of duties Separation of duties involves the use of multiple personnel to perform the different steps involved in a job activity. Sensitive operations operate with what is called dual control. This means two people are tasked to a job, often with one given the responsibility of doing something, and the other given the responsibility of signing off on it. For example, a bank teller informs a supervisor of a transaction, and the supervisor initials that they reviewed the transaction. The assumption is that with an additional person involved, collusion is required to engage in an inappropriate activity. It was Ben Franklin who said, “Two people can keep a secret if one of them is dead.”

Specific separation of duties is part of a security policy. A typical procedure would be to have different employees for accounts payable and accounts receivables. For specific examples click on the footnote[19]. Success Owl!

Separation of Duties Job tasks are split between employees, limiting full control of sensitive information.

5.4.1.5 Need to Know Need-to-know is a fundamental security principle which involves workers having just enough information to do their jobs. Knowing more than the minimum amount required can create a security risk due to sensitive data being known to more people than those who absolutely require it. It’s simply a “numbers” game—with each additional person having the information, the probability that it will be exploited increases. Information requests must be backed by a genuine need-to-know. If the need-to-know is not there, the request should not necessarily be granted. Be prepared to justify your requests for information. Success Owl!

Need to Know Involves making sure a worker has just enough data to do their job.

5.4.1.6 Password Management Policies for changing passwords, frequency and length, all need to be part of the Acceptable Use Policy. Success Owl!

Large sites When managing a large user community, it can be a good idea to provide an automated password recovery or password change process in case the user forgets their password.

When doing this, you should make sure of the user’s identity before allowing the recovery or change in password. This is often done by collecting answers to “secret questions” like “What was your favorite pet’s name?” at time of original registration, and then asking the user to answer the question to prove their identity at a later date, if they need help with their password. Geek Owl! Some of these systems make more assumptions than others. For example, some systems watch you try to log in with a certain user ID (which is not necessarily the user’s email address), then, if you’re unsuccessful, they offer to email (in clear text—ARGH!) your password to your email address on record. Author Helen’s user ID on a private Microsoft partner site was “Helen”; since she was one of the first to register it allowed her the user ID of her first name. From a time shortly after that, until the time that the system was decommissioned, she’d periodically get notes from Microsoft telling her what her password was—and awkwardly splattering a favorite password convention across

the net and all over disks, in clear text. These weren’t being generated automatically—rather, other users who THOUGHT their user ID on the system was “Helen”, were clicking the site’s “I can’t login -- remind me of my password” link, and the system was dutifully looking up “Helen’s” email address and sending that “helpful” email to the owner of the “Helen” user ID, me. (If you implement a password recovery system, please don’t email the existing password in clear text. Ideally send the user to a link that lets them set a new password; second best is to email them a new password. You just don’t know the true sensitivity of the information you’re giving out, when you email someone’s password in cleartext.)

5.4.1.7 SLA Service Level Agreements (SLA’s) delineate services on which On-Line Administrative Systems users can depend. They spell out agreements between your organization and the vendors of services you use, or consumers of services you provide. An SLA would typically: • • • •

Describe responsibilities of On-Line Administrative System users. Identify roles and specify responsibilities of service providers who support users. Detail problem resolution paths for users and service providers. Describe service levels users should experience when problems or questions arise

When contracting with utility providers such as IP telephony providers and ISP’s, make sure that you have a service level agreement (SLA) in place with each, which specifies the minimum uptime percentage, maximum per-incident down time, maximum technician response time in the event of difficulties, etc. that you can expect from that company, and that it details appropriate compensation (and perhaps alternative arrangements, such as fallback to a backup lower-speed circuit) due you if the provider does not meet the terms of the agreement.

5.4.1.8 Disposal / Destruction The term used for finding discarded information is called dumpster diving. Silicon Valley dumpsters were famous for what surfaced in the trash. One of your authors, who shall remain nameless, recovered a CPU—hard drive data, still intact—one morning, after seeing an overflowing dumpster in a public parking lot along Stevens Creek Boulevard. More dangerous to organizations than the loss of equipment (which they’ve thrown out and presumably don’t want anyway) is the disclosure of confidential information that could occur if the wrong person gets hold of the discarded data. For tape and floppies, use degausses on magnetic media to help get rid of data. Erasing individual files, and even formatting a drive, does not necessarily result in the destruction of data on the drive. Success Owl!

Bye Bye, for sure Send hard copy through a shredder, to protect against “dumpster diving” for customer credit card data, employee lists, network address lists, and other current information about your network an attacker might use to gain access

or impersonate an authorized person who has access. For magnetic media, the DoD requires an overwrite of at least 6 times with random patterns for destruction of non-classified data. Secure erasing is a procedure of writing random byte patterns to change the magnetic information to prevent “un-erasing” of data. It is possible to recover data unless this is done. The command FDISK destroys the index of file structures. Think of a library with a manual card file for locating books. Destroying the card file does not make the library go away, just more difficult to find things. The only way to be really sure that a hard drive can no longer reveal data is to use a file on the surface of the platters.

5.4.1.9 HR Policy To the typical IT person, the human resource department does not make a great deal of sense. In brief, the Human Resource department has a wide range of duties, and one area includes legal issues. There are so many governing bodies that must be complied with. To get an idea of the complexity go to the footnote[20] and while at the web site, enter the word security in the search box and look at how many hundreds of different papers return from the system library. The HR department creates the handbook that each employee gets with the policies defined. They must also insure that paperwork is in place acknowledging that the employee has read the book, and understands the provisions. It may be part of your duties to help Human Resources understand the different technical issues. For example, Senior Management is encouraging the use of Instant Messaging. In this example a balancing act may need to be spelled out with you installing security software[21] to protect against worm or viruses while the HR department includes polices instructing staff not to reveal sensitive information via Instant Messaging because data is sent in clear text (human readable form).

5.4.1.9.1 Termination While the web site http://www.cio.com has some great reading on the overall topic termination, in this work we are concerned with your job as an IT person. And it wouldn’t hurt you any to follow the footnote to a specific article[22]. Since we are talking about Security+, it would be a reasonable bet to take certain computer security related precautions when someone’s employment is terminated. Going back to the concepts of “need to know” and “least privilege”, once someone is no longer employed by the organization, they no longer require access to internal systems, and are no longer subject to internal policies regarding the use of those systems. Much of security involves reducing the risks by thinking “What if…?” and taking actions to reduce the probability of that result. In the case of terminations, if the decision originates with the organization rather than the employee, many policies recommend that the employee’s computer access be disabled before the employee is notified.

The idea is that if the employee no longer has computer access, he or she cannot go back in and steal confidential data, install “logic bombs” to trigger a few weeks from today, etc. There is some debate about this in professional circles, with other experts chiming in to say that if no “cause” is involved (for example, if the termination is due to a financially-motivated layoff rather than an employee misdeed), you can cause more potential harm than good with this policy, by engendering ill will on the part of the terminated employee. Remember, that systems administrator you just RIF’d, who wanted a copy of his current login script, probably knows at least one vulnerability in your network for which vendors have not yet provided a fix. Legally speaking, you’re probably on safer ground locking employees out of the system prior to termination. Practically speaking, we’re not sure that that doesn’t increase, rather than decrease, your actual risk. Success Owl!

Termination Disable the user’s account before informing them of termination (or immediately after they’ve informed you of their resignation) Change other passwords to affected systems that the user may have known (just like it says in the article at CIO.com)

5.4.1.9.2 Hiring It is the duty of the IT department to work with HR to add/revoke passwords, privileges, etc. for both temporary and permanent staff. This is not being handled properly according to NetworkWorld[23]. For example, just as it is not at all uncommon to browse through a company’s user account list and see accounts tied to users who have not been associated with the organization for several years, it is not uncommon to see more than a handful of users with administrative privileges—many of whom do not work as network administrators. When adding accounts, it is too easy to just give an employee access to everything he or she might possibly ever need, rather than paying attention to what his or her job duties are, and assigning privileges accordingly, as required by the principle of least privilege. Success Owl!

Adding accounts Be sure to remember the principle of least privilege when adding accounts. You do not have to give administrator privileges to every user, or even every developer, in your organization.

5.4.1.9.3 Code of Ethics While there is no industry-wide code of ethics to which all computer security professionals must subscribe, several associations have created their own codes of ethics for members, with the aim of promoting certain standards of behavior. The Information System Security Association[24] is a non-profit organization for security professionals. The association has a code of ethics for its members and looks like good guidelines for anyone working in the computer industry. The code of ethics from ISSA follows.

• • • • •

•

Perform all professional activities and duties in accordance with the law and the highest ethical principles; Promote good information security concepts and practices; Maintain the confidentiality of all proprietary or otherwise sensitive information encountered in the course of professional activities; Discharge professional responsibilities with diligence and honesty; Refrain from any activities which might constitute a conflict of interest or otherwise damage the reputation of employers, the information security profession, or the Association; and Not intentionally injure or impugn the professional reputation or practice of colleagues, clients, or employers.

The International Information Systems Security Certification Consortium (ISC)2 also sets forth a more involved Code of Ethics[25] to be followed by computer security professionals.

5.4.2 Incident Response Policy Incident Response Policy will vary with the particular needs of an organization. For example, while it may be acceptable to disconnect the router that connects to the Internet in one firm, this could lead to serious liability in another firm, such as an ISP. It is beyond this work to detail all forms of policy regarding Incident Response. The footnote[26] will take you to a page supported by Fred Cohen who has more than a half dozen links to specific policies from the Naval Research Lab to generic templates to be filled in. One of the most important things to say about incident response policies is, have one before you need it. Decide before you’re faced with a computer security incident, how you are going to handle it, who will be involved, what their duties will be, etc. This enables you not to waste valuable time deciding these things during an actual incident.

Pop Quiz 0101.000

Pop Quiz 0101.00 Questions 1. What should you do to the user accounts as soon as employment is terminated? 2. A type of attack that could be the most successful when the security technology is properly implemented and configured is ______ _____________. 3. In order to avoid mishandling of media or information, you should consider using _________. 4. A counter measure to data aggregation is ____________ ___ _________. 5. A high-level statement belief, goals and objectives and the general means for their attainment for a specific subject area is called a ________. Answers 1. What should you do to the user accounts as soon as employment is terminated? A:Disable the user accounts and have the data kept for a specified period of time. A record of user logins with time and date stamps must be kept to ensure that any unauthorized access that occurs can be detected (although possibly after the fact). User

accounts shall be disabled and data kept for a specified period of time as soon as employment is terminated. 2. A type of attack that could be the most successful when the security technology is properly implemented and configured is social engineering. Social Engineering attacks - In computer security systems, this type of attack is usually the most successful, especially when the security technology is properly implemented and configured. Usually, these attacks rely on the faults in human beings. An example of a social engineering attack has a hacker impersonating a network service technician. The serviceman approaches a low-level employee and requests their password for network servicing purposes. 3. In order to avoid mishandling of media or information, you should consider using labelling. In order to avoid mishandling of media or information, proper labelling must be used. All tape, floppy disks, and other computer storage media containing sensitive information must be externally marked with the appropriate sensitivity classification. All tape, floppy disks, and other computer storage media containing unrestricted information must be externally marked as such. All printed copies, printouts, etc., from a computer system must be clearly labelled with the proper classification. Labelling is a physical measure which can prevent accidental misuse of media which could occur if the media does not contain specific indications of its nature. 4. A counter measure to data aggregation is separation of duties. Data Aggregation occurs when smaller pieces of information are assembled together to provide the "big picture". The risk is that through data collection techniques, a person who is authorized to have some of much of the information may be able to discern more than what they should from the information. A good countermeasure is to maintain strong separation of duties and a "need to know" approach. Job rotation can be beneficial. 5. A high-level statement belief, goals and objectives and the general means for their attainment for a specific subject area is called a policy. A Policy is a high-level statement belief, goal and objective with the general means for the attainment of a specific subject area. A Procedure spells out the specific steps of how the policy and supporting standards and how guidelines will be implemented. A procedure is a description of tasks that must be executed in a specific order. A Standard is a mandatory activity, action, rule or regulation designed to provide policies with the support structure and specific direction they require to be effective. They are often expensive to administer and therefore should be used judiciously. A Guideline is a more general statement of how to achieve the policies objectives by providing a framework within which to implement procedures. Where standards are mandatory, guidelines are recommendations. [14]

http://online.securityfocus.com/infocus/1193

[15]

http://www.faqs.org/rfcs/rfc2196.html

[16]

Cady, Glee Harrah and Pat McGregor, Protect Your Digital Privacy: Survival Skills for the Information Age, Que, December, 2001, http://www.nerdbooks.com/item.html?id=0789726041 [17]

Carrington, Charles, Timothy Speed, Juanita Ellis and Steffano Korper, Enterprise Directory and Security Implementation Guide, Academic Press, August, 2002, http://www.nerdbooks.com/item.html?id=0121604527 [18]

http://www.eff.org/CAF/faq/policy

[19]

http://www.uh.edu/infotech/pnp/security/rotation.html

[20]

http://www.hrnext.com/tools/subs.cfm?tools_id=5

[21]

http://www.instantmessagingplanet.com/security/article/0,,10818_1379731,00.html

[22]

http://www.cio.com/archive/060102/doom.html

[23]

http://www.nwfusion.com/archive/2001/124370_08-27-2001.html

[24]

http://www.issa.org/codeofethics.html

[25]

http://www.isc2.org/content.cgi?category=12

[26]

http://www.all.net/books/ir/

5.5 Privilege Management Policies are defined for persons, groups of persons or objects such as data files or hardware such as printers. The policies provide for what is and is not allowed. Privileges are then defined in accordance with these policies, so that the system can automatically enforce many of the agreed-upon policies. The terms rights management, access control, and authorization are frequently used interchangeably. Two terms used are sometimes confused: Authorization and Authentication. Authorization allows a user, Alice, to access a resource. It does not prove Alice's identity. Authentication proves that Alice is really Alice. At least that is how it is suppose to work.

5.5.1 User/Group/Role Management A central task in privilege management is the management of users, group membership and role membership. Each of these categories can be used for authorization. For example, you can assign a privilege to a single user, to a group or to a role.

Both groups and roles are collections of users. In fact, a role can be considered a special type of group, defined by job duties, whereas a group can categorize users, using any criteria (such as “friends of the admins” and “non friends of the admin”). Roles may be implemented on some systems using groups at the operating system level, or they might be implemented apart from the OS concept of groups, using a separate database of role membership information. With both groups and roles, a single user can belong to more than one group/role. Similarly, a group/role can contain multiple users. Database administrators would call the relationships between users and groups, and users and roles, “many to many” in database jargon. Success Owl!

Roles are job descriptions Role-based management is based on job assignments Some roles an organization might define include “customer service rep”, “accounts payable data entry clerk”, “operations supervisor”, etc.

5.5.2 Single Sign-on Network Operating Systems were designed to behave independently of other systems. For example, in the Windows world, if a user wanted a resource in a domain that was different than the domain they are held in, the administrator had to tell the second domain to be trusting of the fact that the first domain provided proper security, so that the user did not have to have separate sets of user ID’s and passwords, one per domain. The alternative was to have that user also have user and group membership on the second domain, this increased administration overhead. The situation grows more complex when today’s multi-vendor networks and complex applications are taken into account. A user might require access to the organization’s UNIX machine, NT file servers, and several database applications. Maintaining different accounts for the user on each platform is a headache for network administrators, and keeping track of an entire handful of user ID/password combinations a headache for users. With Single Sign-on, instead of using a password to verify a user when accessing data protected by an Access Control List (ACL), the client’s identity is often verified using a certificate. The idea behind single sign-on is to require the client to authenticate just once (presenting credentials like a smart card or even a user ID and password, if certificates are not used), and have this identity automatically relayed to each server/application the client accesses, when authorization is required, without the user having to perform extra steps.

5.5.3 Centralized vs. Decentralized In a centralized single sign-on, data is held at a certain location where authorization takes place. Today, Microsoft Passport is the most talked about centralized single sign-on service. The Liberty Alliance approach is that a company implements its own account service, conforming to the Liberty Alliance specifications for interoperability with other companies. Note:VeriSign supports both Passport and Liberty.

In addition to Single sign-on being centralized or decentralized, privilege management can be centralized or decentralized. For example, all privilege management can be controlled by a central group of administrators. Alternately, privilege assignment can be delegated to the group specifically responsible for each server. For example, the Accounting Applications team might manage user privileges on the servers used for accounting functions. The SQL Server team might manage user privileges on the servers used to run the SQL Server database. Etc.

5.5.4 Auditing Auditing is a basic tenet for security, which we discussed in detail in chapter 1. To accomplish auditing, a unique identifier must be applied to each entity, so that conclusive information can be provided by the audit, as to “who did what”. Success Owl!

UserID User ID is a great unique identifier for auditing.

5.5.5 MAC/DAC/RBAC As with Auditing, this section revisits a topic we covered in greater detail, earlier in this book. We will briefly revisit it now.

Role Based Access Control The National Institute of Standards and Technology (NIST) states: “With role-based access control, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as doctor, nurse, teller, and manager). The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization. Access rights are grouped by role name, and the use of resources is restricted to individuals authorized to assume the associated role. For example, within a hospital system the role of doctor can include operations to perform diagnosis, prescribe medication, and order laboratory tests; and the role of researcher can be limited to gathering anonymous clinical information for studies”. The NIST has a draft standard with a 51 page PDF that is available to study[27]. RBAC is policy-oriented, yet policy neutral. (It doesn’t dictate policies you must apply.) Examples of RBAC can be found in Microsoft's Active Directory and Novels Directory Services. Highlights of RBAC include: • •

Least Privilege Separation of Duties

• •

Abstract Permissions Separation of administration and access

Discretionary Access Controls DAC uses an access policy that restricts access based on the identity of users and/or groups. DAC is identity-based. Strict DAC does not allow ownership transfer. For example, Bob can create an object (say a spreadsheet). Bob grants access to Ted. Ted cannot grant access to Carol. Being discretionary means you can choose to implement access control, or not IE. Assign permissions and level of access (Read-Write-Execute) to someone else. Contrast this with Mandatory Access Control.

Mandatory Access Controls MAC is the most stringent of the security controls. Unlike DAC, you don't have a choice about whether or not to allow copying of information. In a MAC, 'everything' and everybody gets a label. This label is called a sensitivity or classification label. This allows for multi-level security policies. That is the ability to handle different clearance levels on a single system. Labels can be created for levels of trust such as: Administrator Power User User Guest And, another set of labels such as: Accounting R&D Sales These labels can be combined. For example a User and Sales may be allowed to access another label set such as specifications. While higher authority exists with Accounting and Power User, these labels could be combined to only allow this Labeled Person with an Accounting Label to print to the Labeled Printer Secure Printer from the Labeled File Accounts Receivable. For more information refer to DOD 5200.28-STD[28] (Orange Book) [27]

http://csrc.nist.gov/rbac/rbacSTD-ACM.pdf

[28]

http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html

5.6 Computer Forensics Computer forensics involves the application of investigation and analysis techniques that comply with a legal system. The U.S. Department of Justice working in conjunction with a

number of groups including the Technical Working Group for Electronic Crime Scene Investigation has created a 93 page PDF that appears to be accepted internationally[29]. A large percentage of the PDF is resources, which are handy. It will not take you a great deal of time to read what to do in the first moments of responding without destroying evidence. Geek Owl! Computer Forensics = Deep Specialty This particular sub-topic has been one that piqued my (Tcat’s) curiosity. Enough so, to have made the trek to a conference to hear what the top college computer science departments and experts from around the world had to say. The bottom line is it is a challenging career. For more overall data, or if you are in law enforcement, consider Scene of the Cybercrime by Debra Shinder a must read. www.sceneofthecybercrime.com The Cyber crime scene is no different than a physical crime scene in the sense that from a legal standpoint the protection of evidence is critical[30]. In fact, evidence figures prominently in the “three A’s” of computer forensics, which are: • • •

Acquire the evidence without altering or damaging the original data (covered in section 4.5.1) Authenticate that your recorded evidence is the same as the original seized data (covered in section 4.5.2) Analyze the data without modifying the recovered data (covered in section 4.5.3)

As with many computing topics, once you get started with descriptive models, you can run into a nearly endless variety of them. To illustrate this point, the International Association of Computer Investigative Specialists (IACIS), a computer forensics group made up entirely of law enforcement professionals (who have a great domain name[31]), puts it a bit differently, with the following essential requirements for a computer forensic examination: • • •

Forensically sterile examination media must be used (“Acquire”, above) The examination must maintain the integrity of the original media (“Authenticate” and “Analyze”) Printouts, copies of data and other exhibits must be properly marked, controlled and transmitted (an addition)

Elements to keep in mind when performing a forensic examination include the following: • • • • • • •

Insure that no possible evidence is destroyed, tampered with, damaged or compromised in any way by the procedures during the investigation. Insure that all possibly relevant evidence is properly handled and protected from electromagnetic or mechanical damage. Insure interruption to the normal process of business as minimal as possible Insure that information acquired with respect to a client-attorney relationship is not divulged. Take care to not violate provisions of law, i.e. Electronic Communications Privacy Act. Contact senior management. A continuing chain of custody is established and maintained.

The chain of custody will be discussed in the next heading. At the first sign of an issue: Begin a journal with accurate notes, including date and times. • • • •

Contact management. Take pictures including: Scene Computer Screen

Local laws may require Polaroid as valid evidence. Geek Owl! Further Study “Macro” level coverage of this field is in “Computer Forensics—Computer Crime Scene Investigation,”[32], by Vacca. More technical is Computer Forensics[33] by Kruse and Heiser, providing an introduction to forensics on Windows and UNIX. Various aspects of computer/network surveillance, initial response and evidence location on Cisco routers, Windows and UNIX are covered in Incident Response [34] by Mandia and Prosise, a great book with sheriff’s badge tips on how to make the best case, etc. Sometimes computer forensics involves getting down to nearly the lowest possible levels of hardware. For details about disk drive hardware and formats of interest to those performing a forensic analysis of a disk drive’s contents, see Forensic Computing—A Practitioner’s Guide[35] by Sammes and Jenkinson. This book also includes a small amount of coverage on forensics applied to handhelds. Want to get an idea of how you’d do in a real incident response situation? If you want to try your hand at investigating/solving some incident scenarios before one happens on YOUR network, check out the innovative Hacker’s Challenge: Test Your Incident Response Skills Using 20 Scenarios[36], by Mike Schiffman, which features descriptions of events observed, some log and other investigative info and then challenges the reader via questions as to what’s going on and how they know. Future Owl! Firewall Forensics Both system administrators and home users wrestling with personal firewalls will find a wealth of information at http://www.robertgraham.com/pubs/firewall-seen.html#1.1 Covering both *nix and Windows systems.

5.6.1 Chain of Custody The Chain of Custody refers to the record of who had possession of each piece of evidence, for how long, and under what security conditions (ie, what precautions were in place to prevent tampering with the evidence.) Our research suggests that evidence is frequently not legally valid due to improper handling of evidence. Findings will be examined both for content and breakdowns in the chain of custody. In short, documentation is everything -- and you cannot be too careful. Successful legal defense will look under every rock for a hole where evidence tampering could have occurred. The basic tenet for a criminal court case in many countries is, “beyond reasonable doubt.” Civil law is less restrictive going by “based on the preponderance of evidence. And if it appears that evidence was not properly documented, there is no evidence to ponder.” To give you an idea of what we mean: Locking hard drives involved in an incident in a lockbox in a safe, and requiring the presence of two different people to both remove the lockbox from the safe and open the lockbox, is not necessarily overkill. You want to remove as much doubt as you can that anything could have happened to the evidence between the time it was involved in the incident and the time it is presented in court.

5.6.2 Preservation of evidence This sub domain follows very closely to the previous domain, 5.6.1 Chain of Custody. For detailed guidelines follow the footnote to Army Regulation 195.5, Evidence Procedures[37] Preserving evidence in a legally defensible manner requires that: • • • • • • •

The handling, labeling and storage of evidence are critical. “Everything” must be 'bagged and tagged'. Stored in an evidence room that has: Low traffic Restricted Access Camera monitoring with the output captured on long play video recorders. Sign In & Sign Out for Chain of Custody

5.6.3 Collection of evidence You are encouraged to follow the footnote to Electronic Crime Scene Investigation: A Guide for First Responders. Keep in mind the following points: • • • • • • • •

Do not power down or reboot the system. Do not open files Do unplug the system from the network Do capture running processes and open files If possible, do document current memory and swap files. Do capture mail, DNS and other network service logs supporting hosts. Do a complete port scan of external TCP and UDP port scans of the host. Do contact senior management.

• • • • • • • • • • • •

Where it is practical to make byte for byte copies of the physical disk without a reboot, do so. If you are making byte for byte (bit stream) copies, it is preferable to use new drives. If you must use existing drives “sanitize” the drives first (low-level format) to eliminate the possibility of a virus. Take pictures of internal components. Document make/model/serial numbers, cable configuration and type. Label evidence “bag and tag”. Repeat photographic process with labels on evidence. Document who, what, when (with precise time), how, and why. Have evidence custodian initial each item at the scene, along with initials of worker. Photograph/videotape above procedures through process to the evidence room. Include hardware for specialized media, i.e., zip disks. Be extra careful with battery powered devices i.e., laptops.

[29]

http://www.iwar.org.uk/ecoespionage/resources/cybercrime/ecrime-scene-investigation.pdf Electronic Crime Scene Investigation: A Guide for First Responders

[30]

Kruse, Warren G. and Jay G. Heiser, Computer Forensics Incident Response Essentials, Addison-Wesley, September, 2001, http://www.nerdbooks.com/item.html?id=0201707195

[31]

http://www.cops.org (Yes, this truly is the web site of IACIS!)

[32]

Vacca, John R., Computer Forensics: Computer Crime Scene Investigation, Charles River Media, June, 2002, http://www.nerdbooks.com/item.html?id=1584500182

[33]

Kruse, Warren G. and Jay G. Heiser, Computer Forensics, Addison-Wesley, September 2001, http://www.nerdbooks.com/item.html?id=0201707195

[34]

Mandia, Kevin and Chris Prosise, Incident Response: Investigating Computer Crime, Osborne, July, 2001, http://www.nerdbooks.com/item.html?id=0072131829

[35]

Sammes, Tony and Brian Jenkinson, Forensic Computing: A Practitioner’s Guide, Springer-Verlag, October, 2000, http://www.nerdbooks.com/item.html?id=1852332999 [36]

Schiffman, Mike, Hacker’s Challenge: Test Your Incident Response Skills Using 20 Scenarios, Osborne, October, 2001, http://www.nerdbooks.com/item.html?id=0072193840 [37]

http://www.usapa.army.mil/pdffiles/r195_5.pdf

5.7 Risk Identification Identification of risks comes in several forms[38]. • • • • •

Natural disasters Flood Fire Power Failure Equipment Failure

External Threats • •

DOS/DDOS attacks Other outside attacks (Man in the Middle, SMURF, etc.)

Internal Threats • •

Embezzlement Theft of data/equipment

Loss of Credibility •

Lost revenue due to lack of confidence

5.7.1 Asset Identification Before you can analyze risks, you need to know what you have to lose. In order to know that, you have to identify your organization’s assets. Assets can be physical (or tangible) or intangible. In the physical world, Asset Identificationcan involve tagging each physical asset with a physical label (frequently with a bar code) or a tag with RFID (Radio Frequency IDentification) that derives its power from the reader, therefore not requiring a power source at the tag (which is how the exits work at some retail stores). It is useful for inventory purposes to tag each asset with a unique number. The unique ID number makes it easy to maintain a database listing each asset, purchase information, description and location. Particularly when bar-code or electronic tags are used, asset tagging simplifies the process of conducting a periodic inventory of assets, where teams of asset control personnel manually go through an office recording the assets located there. Generally the value of physical assets can be estimated, often by starting with the item’s purchase price and then applying depreciation rules. Intangible assets include information (such as the contents of databases), company goodwill and reputation (which might be damaged by an extended web site outage or defacement), etc. It may be difficult or impossible to accurately identify the value of intangible assets. An important thing to note about assets of an “information age” company filled with knowledge workers is that the intangible information stored on a server may have a value far exceeding the value of the physical server itself. This is almost certainly the case in any software company and many e-commerce companies as well.

5.7.2 Risk Assessment Risk assessment is concerned with discovering the potential losses due to risks, so that the organization can take steps to see that they are sufficiently protected. This may take the form of insurance policies, or perhaps self-insurance. Think your organization uses neither approach? If your organization is not insured against certain types of loss, then it is (by

default) self-insuring against those losses. In other words, the organization has decided it is willing to take the financial “hit” of that loss occurring, based on the probability of that loss. Risk is generally defined as vulnerabilities (see 5.7.4) X threats (see 5.7.3) X costs. Two factors are computed when considering Risk Assessment: • •

The cost of an event, should it occur The probability of it occurring.(a combination of vulnerabilities and threats)

Let’s look at an example. If a firm has 100 employees who use email, this activity has a bottom line cost to the firm (salary+taxes+benefits) of $25 dollars an hour times 100 employees, or $2500 per hour. Now, select a threat, such as viruses. Select a probability that a virus is likely to occur that affects email. In this example we will say 90%. Further let’s say it will take you 3 hours to repair the damage. Given this: (3 * $2500) = $7500. * .9 = $6750. That is your cost of the risk Use this figure against the cost of purchasing a site license for Anti-Virus software. Be careful to make an apple-to-apple comparison. If you estimate that without anti-virus software you would be repairing once a month for a year then it is $6750 * 12 = $81000 versus the annual fee for the site license of the anti-virus software. (Who says you cannot estimate risk? Insurance companies live by formulas like this (only more complex) for determining rates. The example used for anti-virus is known as quantitative risk analysis. A more accurate model may be the qualitative risk analysis. Both are described in more detail at the web site mentioned in the footnote[39]. A great article for software developers can be found in footnote[40]. It isn’t clear if it’s the long winters of Moscow and Idaho, or the very close physical proximity of Wazzu (the eastern Washington college campus) or both that contributes to the incredible work that flows out of the Center for Secure and Dependable Software at the University of Idaho. Among other gems, when publishing a paper titled Cost-Benefit Analysis for Network Intrusion Detection Systems[41] the team came up with a generic math model for risk assessment. It goes like this: (R - E) + T = ALE, R - ALE = ROSI "R" is the yearly cost of recovering from an intrusion; "E" is the savings gained from stopping an intrusion; "T" is the cost of an intrusion prevention or security system; "ALE" stands for annual loss expectancy; and "ROSI" is the return on security investment. All this and more can be found in the PDF available by the footnote.

5.7.3 Threat Identification A threat is a probability of causing harm. It is a combination of the capability to do harm, the opportunity to do harm, and intent. As we’ve discussed throughout this book, threats to network security are almost endless. A very partial list of sources of threats could include: • • • • • • •

the random cracker looking for a server on which to host warez or “to see if he can break in to a system” the newbie system administrator who “thought he knew how to use that UNIX command” the deliberate cyber-spy looking to accumulate competitive information on your company that he can use to improve his own company’s positioning the ex-employee who desires revenge the political activist who wishes to deface the web sites of companies whose policies he disagrees with the random technical person who resorts to extortion (“give me $20,000 or I’ll release the credit card number list I got off your web site”) to finance their new BMW the employee who doesn’t know that email attachments ending in “.exe” should not be opened without the system administrator’s permission

Areas of special attention when looking for activities indicating the presence of new threats include: • • • • • •

New user accounts or accounts with unusual activity IE. logins at O’Dark:30 when the account is a daytime user Changes in file lengths or dates Shrinking log files New files especially ones that have strange file names or extensions System crashes Unusual activity that just doesn’t ‘feel right’

5.7.4 Vulnerabilities NIST states, “Vulnerability analysis is an assessment to determine whether vulnerabilities identified during the evaluation of the construction and anticipated operation of the TOE (Target Of Evaluation) or by other methods (e.g. by flaw hypotheses) could allow users to violate the TSP (TOE Security Policy)”[42]. Vulnerabilities are weaknesses in the computer/network hardware or software used on the network, which can be taken advantage of. These would include things like systems relying on inadequate or non-existent passwords, software bugs allowing for buffer overflow exploits, networks that can be “sniffed” for confidential data, etc. The previous chapters have gone into great detail as to types of vulnerabilities that exist, and why they exist, so we don’t have to repeat that information here. Success Owl!

Risks, Threats and Vulnerabilities

A risk = threat X vulnerability X cost of the event occurring A threat is a probability of causing harm. It is a combination of capability, opportunity and intent. A vulnerability is a weakness in computer hardware and software. [38]

http://www.ustreas.gov/tigta/fy99-strategic_plans/att1-threats-example.html

[39]

http://www.security-risk-analysis.com/introduction.htm

[40]

http://www.processimpact.com/articles/risk_mgmt.html

[41]

http://www.csds.uidaho.edu/director/costbenefit.pdf

[42]

http://www.niap.nist.gov/tools/CCTB60f-Documentation/CCManual/CCCOVER.HTM

5.8 Education To be successful, several aspects must be considered in user training. The one of paramount importance is getting users to 'buy into' the fact that the need for security is critical. This requires overcoming the mindset of “this is not my concern". This is accomplished by demonstrating to the end users that only through the continued health and safety of the company will they continue to be employed. Even if an employee is unconcerned because she/he plans to quit anyway, a new prospective employer, in some cases, cannot contact this present firm regarding his/her performance, due to legal issues. Users must be educated on the fact that corporate data is the most valuable asset the corporate entity has. This step is the groundwork which training builds upon. Without this policy concept firmly in place, there's no foundation to create structure. It is the administrator's task to convince (and ensure) users, that steps must be taken on an ongoing basis, such as changing passwords. A password taped to a monitor or under a desk blotter renders the password useless. A would-be intruder simply gets a job in maintenance and cleans the office of passwords at night. Some firms put into place rigorous policies, ranging from no copying of work (files) to diskettes, or only allowing new work to be created outside of the office and then brought into work. Often all disks transported by employees in a particularly diligent company, will have those disks leaving the premises scanned. Security policies require being flexible enough to allow employees to get their job done. Reasonable security combined with convincing employees that protection of the corporate assets is in their best interests is the best possible approach.

5.8.1 Communication The organization’s management, systems staff and users should communicate, sharing information about security concerns, and about users’ views of them. Sometimes systems administrators have been known to implement ambitious security policies without regard as to whether or not they were practical in their environment, and if they didn’t listen to feedback

from users, they might never know that almost every user resorted to writing down that 12character, mixed case, consonants-only password that the system automatically assigned them. Similarly, sometimes CEO’s are unaware of the risks their businesses face due to computer security issues. Remember that no one, CEO or lower-level end user, can act on security recommendations unless they’re aware of them, and that that takes communication. Similarly, regular communication goes a long way toward overcoming that “network support doesn’t care how hard they make it for us to get our work done” opinion that can be prevalent among end users. One school of thought is the carrot and stick approach. The carrot is motivational slogans such as “SEC_RITY is not complete without U”

5.8.2 User Awareness “Ghosts of millions of former workers populate the databases of corporate America. The workers have moved on, but their ghosts linger, awaiting the hacker intent on using the ghost’s identity to damage the company’s network systems.” Says Brian Hook in his Tech Republic article[43]. The outdated access account can either be used by a black hat or by an employee whose layoff was handled with less than excellence. From a user awareness viewpoint: • • •

Educate users on the value of strong passwords that are not written down. Educate users on the value in mandatory frequent changing of passwords. This will disable forgotten accounts. Give personnel that are being laid off a specific amount of time to download personal data. Failure to do so only creates a hostile former worker.

Create and enforce non-disclosure policies. Non-disclosure is not the same as non-compete clauses. The former employee has a right to work, making non-compete clauses impractical. It is reasonable to expect them to not take with them sensitive supplier or customer data.

5.8.3 Education Education can come from in-house training based on data from groups such as those at http://www.sans.org and the reading room.

5.8.4 Online Resources http://softwaredev.earthweb.com is a great place to start for software developers. Another source is http://www.processimpact.com NIST (National Institute of Standards and Technology) has developed a great deal of material and since we already paid for it with our tax dollars, it is free. Specifically in education, NIST has many hosted programs listed in the footnote[44]. [43]

http://www.techrepublic.com/article.jhtml?id=r00620020717hoo01.htm&fromtm=e1064&_requestid=22643 [44]

http://www.nist.gov/public_affairs/edguide.htm

5.9 Documentation As you have already seen in Forensics, document every move and why you did it. Document your infrastructure and keep these documents secured. Obsolete data should be shredded before disposal.

5.9.1 Standards and Guidelines This is a very broad sub-domain when it comes to details. For the purposes of Security+, you need to know that you have to create standards and guidelines. Typically we would like to give you more than a ‘pass the test’ book and want to be your handy reference guide. The challenge with this sub-domain is the sheer volume of data would exceed this entire book. Fear not however! Thanks to the U.S. taxpayer, whatever you need to work out the details can be found from NIST (National Institute of Standards and Technology) CSRC (Computer Security Resource Center) with the soon to be famous 800 series. The index for the 800 series is listed in the footnotes[45]. One paper specifically created for Risk Management is 800-30[46] Risk Management Guide for Information Technology Systems.

5.9.2 Systems Architecture Hardware and software combine to become a system. Both maintaining and securing a system requires detailing how a system was designed with sub-components detailing hardware and software, so this information should be carefully documented. MIT has a white paper titled “A fractal Representation for Systems”[47]. A template for software project management is listed in the footnote[48] Include in this documentation items like: • • • • • •

maps of the company’s networks, showing physical connectivity and network addresses descriptions of what each computer is used for information about the hardware installed in each machine information about other devices used on the network a list of the software installed on each machine (including versions) a list of the computers each application depends on (such as “database server 1 with customer data”, “database server 30 containing geographical data”, “application server PAR12 containing the FINS application”)

5.9.3 Change Documentation Change documentation is a decision memorandum specifying the changes and justification with the accompanying IT spreadsheet reflecting the changes. The memorandum will also state that the changes to the program are approved and should be reflected in a control log. This type of documentation presents an audit trail of management approval of system changes before they were made.

5.9.4 Logs and Inventories Logs and inventory document the maintenance of the institution's computer systems and is used to insure compliance with any warranties or service contracts, schedule regular maintenance and diagnose system or component problems, and document system backups. Records may include: computer equipment inventories; hardware performance reports; component maintenance records (invoices, warranties, maintenance logs, correspondence, maintenance reports, and related records); system backup reports; and backup tape inventories. Access to secured areas, for example, a server room or router should be entered into a logging system that is tamper proof. Success Owl!

Why Keep Logs? There are many reasons that you, as a network administrator, should be glad to keep logs. Logs provide a record of your activities. Should you ever need to know exactly when you did something, such as installing a tape drive, you can refer to the log to find out the dates and times involved. Also, logs enable you to easily keep a record of changes to the network configuration, equipment maintenance/breakdown histories, etc.

5.9.5 Classification Classification can follow a military classification system such as confidential, secret, and top secret. Categories may be further divided such as “eyes only” which prohibits copies being made. Businesses may be broken down into items such as public (marketing), confidential, (sales volume), private (payroll data) and trade secret (formula for Coke).

5.9.5.1 Notification Notification can be the policies for an unexpected event such as an Intrusion Detection System revealing a possible attack or a planned change such as an upgrade to a piece of equipment which is critical to operations.

5.9.6 Retention/Storage Procedures for the securing of records both physical and electronic must be spelled out for proper retention, accessibility and security. It is difficult to expect an employee to “do the right thing” when they haven't been told what that is. Depending on the industry, different legal requirement come into play

5.9.7 Destruction Destruction of obsolete information may involve shredding of paper-based data. Higher security may require burning. For electronic media, formatting with a secure erase (overwriting with a random pattern of zeros and ones) may be acceptable. Other security

measures may involve using a strong electromagnet such as a bulk tape eraser. Higher security (for example some DOD requirements) may demand the opening of a hard drive and filing the metal on the platters. [45]

http://csrc.nist.gov/publications/nistpubs/

[46]

http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf

[47]

http://axiom.mit.edu/Publications/Papers/cirp99.pdf

[48]

http://cs.wwc.edu/~aabyan/435/Forms/SPMP.html

5.10 Summary In this chapter, we looked at the topics in the fifth domain of the Security+ exam, Operational/Organizational Security. You discovered that Physical Security involves the safety and security of physical components of your network. In the area of physical security, you learned about various facets of access control (the process by which you restrict access to physical resources), including: •

•

•

Physical Barriers (implementation of concentric rings of security by creating layered physical perimeters; can include warning signage, use of cardkeys for access, mantraps to limit passage into secured areas and reduce piggybacking, and the use of guards and/or video monitoring) Biometrics (which add an additional layer of security through authentication based on “something you are” or “something you do” but which should not be relied on as a sole method of authentication) The role of social engineering in circumventing access control (when an unauthorized person could gain access to secured areas by pretending to be a repairman, relative of a key executive, contractor, etc.)

You also looked at the environment in which your network operates. Be aware of wireless cells (areas in which wireless transmissions can occur) and take steps to ensure that unauthorized individuals cannot hop onto or snoop traffic on those networks. Carefully look at the location of your facilities, because improper location of resources can leave your network unnecessarily vulnerable to harm (like locating a machine room directly under a washroom). Additionally, careful placement of wireless antennas will help minimize vulnerability to unauthorized access. Similarly, shielding (of both equipment, to protect surrounding areas from RF, and buildings/rooms, to prevent leakage of RF from wireless communications) is often advised or even required to maintain confidentiality of data or network traffic. For example, metal paint and Mylar window covering can minimize wireless signal leakage and reduce your organization’s vulnerability to war-driving (in which users cruise around outside buildings looking for open wireless access points). Another area you reviewed in physical security is fire suppression. Computers and water don’t mix well, so historically computer room fire suppression used Halon 1211 gas; recently due to ozone layer concerns, this was replaced with FE-36. In addition to arranging for suitable fire suppression technology for equipment rooms, also consider logistics. You should set your servers up with a batch function which can be invoked to shut them down in the

event of an emergency; when a fire alarm occurs, invoke this function as you leave, so that no one can come along behind you (after setting the false alarm) and access the now-unguarded systems. You explored the subject of disaster recovery, which is the process of planning and implementing policies to enable your business to continue after experiencing some critical event. A key component of disaster recovery planning involves implementing a backup policy, including regular backups and off-site storage of backup media (which protects your backups from disasters affecting the immediate area of your network operations center). You might also consider encrypting backups, since that way, someone who can access your backup media still wouldn’t be able to access the data on it. You learned about different backup techniques, which include: • • •

Full backup (everything on the system is backed up) Differential backup (all files changed since the last full backup are backed up) Incremental backup (all files changed since the last backup of any type, are backed up)

Two popular strategies for organizing which tapes are used for which day’s backups are the Towers of Hanoi and the Grandfather-Father-Son methods. When planning the disaster recovery process, it can be useful to arrange for alternate facilities to be used in the event that the disaster affects your network operations center. A copy of all information needed for business continuation, or access to copies of this information, such as vital employee records and backups, should be available at the alternate site. Types of alternate sites include: • •

•

Cold site (equipped with power, air conditioning and space in which equipment can be delivered and installed for operations if required) Warm site (has the facilities of a cold site, plus possibly some pre-configured hardware and additional facilities like network connectivity arrangements and telephone service) Hot site (fully equipped with utilities and equipment sufficient to run required processing; this could be a branch office or perhaps even a site at another company with whom you have a reciprocal agreement; it could also be a site at a shared disaster recovery facility managed by a third party; generally copies of your applications and possibly backups are “ready to go” on site, should they be needed)

When using alternate sites, you would typically deploy the most business critical functionality first, and work toward getting other functionality up and running on an as-needed, prioritized basis. Similarly, when you can return to your main facility, you should focus on moving functionality back to your main site based on the cost of continuing operations at the alternate site, moving the applications most costly to maintain at the alternate site first. You learned about disaster recovery plans, which specify who is responsible for each activity, what is needed to accomplish each activity, the order in which disaster recovery steps are performed, where additional resources (such as duplicate systems) can be obtained and how quickly this can happen, as well as estimated costs and financial justification for the plan.

You discovered that when planning for business continuity (allowing critical business functions to continue without interruption or major change), you need to consider several areas: • •

•

Utilities (do you have backup power via UPS’s or even generators? What about backup telephone lines and data connections?) High availability / fault tolerance (systems that support high availability or provide fault tolerance can cost more than their less-resiliant siblings, but in calculating whether the risk is worth it, consider the dollar amount it will cost your organization to do without that functionality for a certain amount of time) Backups (things happen; having good backups, and testing those backups regularly to ensure that your backup procedure still works as intended, will eventually be a lifesaver)

You also explored the area of policy (defines what is to be protected) and procedures (define how it is protected), including the different types of security-related policies often found in organizations, including: •

•

•

•

•

•

•

•

Acceptable Use Policy (or AUP, which describes in detail permissible use of corporate systems, applicable laws and company policies which back up the network use policies; should be reviewed by legal counsel to ensure enforceability, and signed by all staff in order to demonstrate staff knowledge of policy contents and agreement with the policy) Due Care (a requirement that each person takes “due care” to protect those items within their responsibility; failure to exercise due care could result in liability for the organization) Privacy (specifies the extent of expectation of privacy by employees, which can frequently be summarized as “none”; may also specify privacy of data provided by and collected about customers and business partners; may also specify compliance with governmental or industry regulations regarding privacy, such as the HIPAA guidelines for privacy of health-related information) Separation of Duties (splitting job tasks among multiple employees, so that no one individual can perform all steps of an activity involving sensitive information; for example, you might have one employee enter a transaction, and another verify and approve it) Need to Know (involves making sure that each employee has just as much information as is required to do their job, and no more; the idea is that additional knowledge creates additional sources of risk) Password Management (including frequency of password change, requirements for password length/quality, procedures for resetting passwords which have been forgotten, and distributing reset and new passwords to employees; at a large site, an automated password recovery/change process can reduce administrative staff time dedicated to this routine chore) Service Level Agreements (SLA’s, which spell out agreements between your organization and suppliers, and your organization and its customers, specifying what each can expect from the entity providing a service, in the area of minimum up-time, maximum down-time, problem/support response times, alternate arrangements, etc.) Disposal/Destruction (specifies how your organization gets rid of data, whether stored on paper, magnetic media, etc.; disposing of sensitive data by just tossing it in the trash enables unauthorized individuals to obtain it by dumpster diving; you should

•

•

• •

shred paper materials and destroy data storage media, rendering it unreadable, before disposing of it; proprietary/sensitive data that you would not want unauthorized individuals to have includes customer credit card data, employee lists, network maps, and other current information about your network such as currently valid passwords) HR Policy (human resources policies which specify how and when employees are granted or denied computer access, and may also mandate certain procedures to be followed when enforcing policies like an AUP) Termination (specifies how termination of an individual’s computer access is handled upon termination of employment; generally their access to the network is disabled prior to informing them of termination, and other passwords they may have known are changed) Hiring (when an employee is hired, follow the principle of least privilege, and given them only the amount of access and system privileges they require to do their job) Code of Ethics (often adapted from an industry-accepted code of ethics which specifies expected standards of professional behavior)

You also learned that you need to be aware of your organization’s incident response policy, which governs what happens when a computer security incident is detected. Make sure you have an incident response policy in place, and rehearse mock incidents, before you need to put the policy into action “for real”. You also explored facets of privilege management, which controls how privileges are assigned, managed and enforced on your network. One area you looked at was user/group/role management, in which you are concerned with grouping user accounts into collections in order to make it easier to manage privileges granted to each; many times, users are grouped by role (job assignment, such as HR clerk, Comptroller, A/R data entry clerk, etc.). You also learned about single sign-on, a technical feature that enables a user to authenticate themselves to the network only once, and as long as that session is open, authorization for access to any related system or application is performed based on the original credentials that have already been provided. Privilege management may occur in a centralized (the data center handles all of it) or decentralized (responsibility is delegated) manner. Auditing is used to track user activities and verify proper security policies and procedures are in place and being followed; a user ID is a useful unique identifier for auditing. You revisited MAC/DAC/RBAC access control models. You then explored computer forensics, the application of investigation and analysis techniques which comply with a legal system. When performing computer forensics, be careful to not interfere with the chain of custody, which is the record of who had possession of each piece of evidence, for how long and under what security conditions (important because lack of chain of custody proof can result in evidence being declared inadmissible). Also, take care to ensure the preservation of evidence (do not alter evidence in any way, as tampering could also render it inadmissible). Lastly, you looked at guidelines for evidence collection, which specify types of evidence to gather such as logs, lists of running processes and logged-on users, pictures of the scene, etc.) Next, you learned about Risk Identification. Before analyzing risk, you need to know what assets you have to lose (including both physical assets like expensive servers and intangible assets like company reputation). Risk assessment involves discovering the potential losses due to risks, so the organization can take steps to ensure they are adequately protected. You need to be aware of threats (combination of capability, opportunity and intent to do harm) and

vulnerabilities (weaknesses in computer hardware/software which can be taken advantage of) when computing risk, as explained in the following formula: Risk = vulnerabilities X threats X costs When determining risk, you look at the cost of a particular event, and the probability of it occurring, to determine risk faced You were also made aware of the important role played by education. In order for users to follow policy, you need to communicate to them how their interests are served by those policies, and interact with them to determine how some policies may make their lives more difficult, and work with them to improve those policies. User awareness is critical, since employees need to be aware of policies and significant vulnerabilities (such as viruses and social engineering attempts) in order to best exercise “due care” in the performance of their job duties. Finally, you learned the importance of complete, up-to-date documentation, including: • • •

• • • •

•

Standards and Guidelines (specifying the standards and guidelines your organization/department adhere to) Systems Architecture (including network maps, lists of software installed on systems, configuration printouts, etc.) Change Documentation (which tracks changes to system and network configuration over time; not only is this a valuable history, but it may also be useful if the most recent change “broke something” and the administrator who made the change isn’t around to explain what he did) Logs and inventories (documenting equipment maintenance, backups, etc.; inventories may include asset lists, inventories of spare parts, available backup media, etc.) Classification (specifying the sensitivity of particular types of data and/or systems) Notification (who must be notified in the event of certain events like intrusion detection, theft, disaster, etc.) Retention/Storage (policies and procedures for securely storing physical and electronic records, specifying where they are stored and how long they are kept; this may be partly determined by industry regulations followed by your organization) Destruction (how and when documentation and other items such as media are destroyed; for high-security installations, the procedures involved may be complex)

5.11 Success Questions 1. What principle requires that a user be given no more privilege than necessary to perform a job? A. B. C. D.

Principle of aggregate privilege Principle of effective privilege Principle] of most privilege Principle of least privilege

2. Which of the following are potential firewall problems that should be logged? A. Reboot

B. Proxies restarted C. Changes to the configuration file. D. No Answer is Correct 3. Logs must be secured to prevent: A. B. C. D.

creation modification, and destruction modification, deletion, and destruction modification, deletion, and initialization modification, deletion, and inspection

4. If the computer system being used contains confidential information, users must not: A. B. C. D.

share their desks encrypt their passwords leave their computer without first logging off All choices are correct

5. Which of the following user items can be shared? A. B. C. D.

home directory ID card password No Answer is Correct

6. With RBAC, each user can be assigned: A. B. C. D.

a token role only one role a security token one or more roles

7. The Lattice Based Access Control model was developed MAINLY to deal with: A. B. C. D.

integrity confidentiality affinity No Answer is Correct

8. Under MAC, who can change the category of a resource? A. B. C. D.

All users All managers Administrator only No Answer is Correct

9. A method for a user to identify and present credentials only once to a system is

known as: A. B. C. D.

SEC IPSec SSL SSO

10. Prosecution of illegal break-ins to computer systems fails most often because of a failure of A. B. C. D.

Chain of Supported Facts Chain of Custody Chain of Electrons Chain of Witnesses

Answers 1. *D. Principle of least privilege As described at http://hissa.nist.gov/rbac/paper/node5.html, the principle of least privilege has been described as important for meeting integrity objectives. The principle of least privilege requires that a user be given no more privilege than necessary to perform a job (ie, that they be given the "least privilege" required). When people are given more privileges than absolutely required, you have needlessly increased the risk that they could violate security policy in additional ways, without receiving any business benefit from those additional privileges. The other terms are not typically used in the context of computer security. 2. *A. Reboot *B. Proxies restarted *C. Changes to the configuration file. The following firewall problems should be logged logged: Reboot of the firewall. Proxies that cannot start (e.g. Within the firewall). Proxies or other important services that have died or restarted. Changes to firewall configuration file. A configuration or system error while firewall is running. A reboot or proxy restart signals a potential reliability issue, or a cracker restarting the firewall after configuration changes or an attempted attack. Changes to the configuration

file may be made under legitimate circumstances (by the network administrator) or might indicate an intrusion by unauthorized individuals. Similarly, system and configuration errors might indicate intrusion attempts, or reliability problems. 3. *B. modification, deletion, and destruction All logs collected are used in the active and passive monitoring process. All logs are kept on archive for a period of time. This period of time will be determined by your company policies. This allows the use of logs for regular and annual audits if retention is longer then a year. Logs must be secured to prevent modification, deletion, and destruction. 4. *C. leave their computer without first logging off If the computer system being used or to which a user is connected contains sensitive or confidential information, users must not leave their computer, terminal, or workstation without first logging off. Users should be reminded frequently to follow this rule. Sharing their desk is not necessarily a security risk unless those with access to the desk also have access to information in or near that desk (such as an unlocked computer terminal, open drawers, etc.) Any passwords used should definitely be encrypted (and ideally verified with challenge/response technologies rather than by sending the encrypted password across the network). Working with confidential data does not mean that the user cannot communicate with the network, as long as the network is designed in a way to prevent disclosure of the information, such as through the use of a Virtual Private Network. 5. *D. No Answer is Correct Each user assigned directory (home directory) should not to be shared with others. Similarly, an ID card and password should not be shared, as these items are used for authentication, and it is important that only one user possess these. Therefore, "No Answer is Correct" is correct. You should not share the user of your user ID/user account with others, although it is usually fine to share the NAME of your user account with others, so that they can perform activities like sending you electronic mail, or contacting you with net conferencing software. 6. *D. one or more roles With RBAC (Role-based access control), security is managed at a level that corresponds closely to the organization's structure. Each user is assigned one or more roles, and each role is assigned one or more privileges that are permitted to users in that role. Roles can be hierarchical -- such that an Accounts Payable supervisor may have the rights of both AP data entry clerks and AP customer service agents (who work for the AP supervisor) as well as certain other rights granted only to the AP supervisor. Some users MAY be assigned only one role, but the point of RBAC is that a user can easily be given the privileges associated with all of their roles in the organization. Authentication may be performed through the use of a physical security token, but this is not unique to RBAC. Tokens are not generally associated with roles; they are associated with individual users.

7. *B. confidentiality The Lattice Based Access Control model was developed to deal mainly with information flow in computer systems. Information flow is clearly central to confidentiality but to some extent it also applies to integrity. The basic work in this area was done around 1970 and was driven mostly by the defense sector. Information flow in computer systems is concerned with flow from one security class (also called security label) to another. These controls are applied to objects. An object is a container of information, and an object can be a directory or file. In summary, this is a model that deals with confidentiality and to limited extent integrity. Integrity based access control is related to mandatory access control, but it is not the primary use of the Lattice Based Access Control model. Affinity is not primarily related to the Lattice Based Access Control model, and access control is not as concerned with integrity as it is with confidentiality. 8. *C. Administrator only MAC (Mandatory Access Control) is defined as follows in the Handbook of Information Security Management: With mandatory controls, only administrators and not owners of resources may make decisions that bear on or derive from policy. Only an administrator may change the category of a resource, and no one may grant a right of access that is explicitly forbidden in the access control policy. If All users or All managers, could change the category of a resource, then the access control would not be mandatory. 9. *D. SSO Single Sign-On (SSO) - This is a method for a users to identify and present credentials only once to a system. Information needed for future system access to resources is forwarded by the initial System. BENEFITS More efficient user log-on process Users select stronger passwords Inactivity timeout and attempt thresholds applied uniformly closer to user point of entry Improved timely disabling of all network/computer accounts for terminated users With SSL, each site typically requires a separate SSL transaction. IPSec provides for presenting credentials once per session, but individual applications accessed by that connection may require additional credentials. 10. *B. Chain of Custody Chain of custody refers to the audit trail describing when/where/how the evidence was acquired, and how it has been maintained since then. Most countries have strict rules to insure evidence could not have been tampered with.

Evidence Procedures http://www.usapa.army.mil/pdffiles/r195_5.pdf