Computer Systems Security Notes

Network Access Control Facts This lesson covers the following topics:    NAC overview NAC agent types NAC process NAC Overview Network access control (NAC) is a policy-driven control process that allows or denies network access to devices connecting to a network. For example, you may want to have policies that require connecting devices to meet certain criteria, such as having a particular version of Windows, the latest antivirus definitions, or Windows firewall enabled. NAC is often integrated with automatic remediation systems, which helps bring a computer into compliance when NAC discovers missing requirements. When such a system is used, a connecting device only has access to resources that can resolve or remediate the issues. After the issues have been remediated, the device is reevaluated and then allowed to access network resources, like the internet or databases. NAC is not a product but a process. However, several companies implement products that utilizes the NAC process. For example, Cisco has a solution called Identity Services Engine (ISE), and Microsoft has Network Access Protection (NAP). Each is a framework that provides protection against unauthorized access or rogue system access to a protected network. The distinction and implementation between products is vendorspecific. The NAC process is usually accomplished using a two-stage process of authentication and authorization. If the requirements for either of these stages is not met, the access request is denied. This if often referred to as zero-trust security, meaning nothing is trusted unless it can pass both the authentication and authorization stages.   Authentication defines all the prerequisites a device must meet in to access the network. This criteria is detailed for such things as anti-malware, OS, patch level, and so on. Authorization looks at the authentication information and applies the appropriate policies to provide the device with the access it’s defined to receive. NAC Agent Types Before a device can connect to the production network, it must go through a health check. This health check is performed by specific software designed solely for this purpose, often known as an agent. A NAC agent can be one of the following types: Type Description Permanent The agent resides on a device permanently. This is the most convenient agent since it does not have to be renewed and can always run on the device. It is also known as a persistent agent. Dissolvabl e The agent is downloaded, or a temporary connection is established. It is removed once the user is done with it. The user has to download or connect to the agent again if needed. Agentless The agent is on the domain controller. When the user logs into the domain, it authenticates with the network. Agentless NAC is often used when there is limited disk space, such as for Internet of Things (IoT) devices. NAC Process NAC is a complicated process that requires forethought. Use the following process when implementing NAC:     Plan - A committee should convene and make decisions that define how NAC should work. Define - The roles, identities, and permissions (policies) must be defined. Apply - Once defined, the polices must be applied. Review/Revise - As business needs change, the process must be reviewed to determine whether changes are required. Network Threats Facts This lesson covers the following topics:     Network segmentation Network attack types User education and training Threat focus points Network Segmentation The main component of secure network-architecture concepts is network segmentation. The idea behind proper network segmentation is that if a system or systems were compromised, the damage would be limited to that network segment. Network segmentation also makes it much easier to identify suspicious network traffic since the network traffic is broken into manageable chunks. For example, if your network has static systems, such as IoT devices, you probably want to have them on their own network segment. This minimizes the damage they can cause to a single network segment and makes identifying issues with them much easier. Likewise, you would probably need to segment the wireless network from the wired network since wireless networks are inherently less secure. Segmenting workstations from authentication servers, SQL servers, or DNS servers is also essential. The most common way to segment networks is to create multiple virtual local area networks (VLANs) for each network zone. These zones can also be separated by firewalls to ensure only specific traffic is allowed. When creating these zones, it is helpful to create different categories or purposes for each zone; for example, a no-trust zone, low-trust zone, medium-trust zone, high-trust zone, and highest-trust zone. The no-trust zone is the zone that you have no control over. It is where everything but your network resides—in other words, the internet. The low-trust zone is where publicly available information resides. You do have control over the security of this zone, but it is still exposed to the internet. For example, a web server might reside in this zone. This kind of zone is also referred to as a DMZ, or demilitarized zone. Network Attack Types Network attacks are classified as follows: Technique Active Description Active attacks are when perpetrators attempt to compromise or affect the operations of a system in some way. For example, trying to brute-force the root password on a web server is considered an active attack. A distributed denial-of-service (DDoS) attack is also an active attack. Passive Passive attacks occur when perpetrators attempt to gather information without affecting the flow of that information from the targeted network. For example, sniffing network packets or performing a port scan are both types of passive attacks. The goal isn't to immediately compromise a system, but to learn about that system. External External attacks are when unauthorized individuals try to breach a network from off-site. It is key to remember that with external attacks, the perpetrator is unauthorized for any level of access to the network. Inside Inside attacks are initiated by authorized individuals inside the network's security perimeter who attempt to access systems or resources to which they're not authorized. For example, an inside attack is a disgruntled employee accessing unauthorized company documents and leaking them to the public. User Education and Training User education and training is a very important aspect of maintaining a secure network environment. Attackers often send phishing emails to organizations in an attempt to compromise an employee workstation. The workstation is used as a pivot point to gain access to more sensitive systems. Another attack strategy is to compromise an employee's personal device that connects to the company's Wi-Fi. The personal device is then used as a pivot point. Because of this threat, it's imperative to educate users to be security-aware. Threat Focus Points As a security professional, you need to understand your network on multiple levels. You should focus on the following: Areas of Focus Entry points Inherent vulnerabilities Documentation Description Recognize all vulnerabilities and entry points for possible attacks. This includes public-facing servers, workstations, Wi-Fi networks, and personal devices. You must account for anything that connects to the network as a possible entry point. Identify inherent vulnerabilities or systems that lack proper security controls. For example, if your organization needs to use an older version of Windows for a particular application, you need to identify that system as a vulnerability. Internet of Things (IoT) and Supervisory Control and Data Acquisition (SCADA) devices are both systems that lack proper security controls and therefore must be dealt with appropriately. Document all network assets in your organization and create a suitable network diagram that you can use as a reference. This is probably one of the most important components of knowing your system. If you don't know the underlying infrastructure of your network, then you can't adequately secure it. Proper network documentation and diagrams not only help you identify a weak network architecture or design, but protect against system sprawl and unknown systems. Network baseline Identify a network baseline. This means that you need to know your systems' normal activity, such as regular traffic patterns, data usage, network activity, server load, and anything systemrelated. Mainly, you need to know what your network looks like in normal day-to-day usage. Knowing this allows you to identify unusual or atypical activity that can indicate an attack in progress or a compromised network. To identify a network baseline, you can use network tools that monitor network traffic and create a graphical representation of the collected data. Device Vulnerability Facts This lesson covers network device vulnerabilities. Network Device Vulnerabilities A knowledgeable attacker can exploit network device vulnerabilities to gain access to network resources. Network device vulnerabilities include: Vulnerability Description Default accounts and passwords Default accounts and passwords are factory defaults that already exist when a new network device is configured at installation. Default account names and passwords should be changed immediately when hardware or software is turned on for the first time. Weak passwords Privilege escalation Weak passwords are passwords that are blank, too short, dictionary words, or simple. In other words, they are passwords that can be quickly identified using password cracking tools. Password cracking is the process of recovering secret passwords from data that has been stored in, or transmitted by, a computer system. Enforce complex passwords to reduce the risks of weak passwords. Complex passwords require passwords of a certain length (typically over 8 characters) and a mix of character types (numbers and symbols) along with requirements that the passwords are not words, variations of words, or derivatives of the username. Privilege escalation allows a user to take advantage of a software bug or design flaw in an application to gain access to system resources or additional privileges that aren't typically available to that user. Examples of privilege escalation include:    A user accessing a system with a regular user account that is able to access functions reserved for higher-level user accounts (such as administrative features). A user who is able to access content that should only be accessible to a different user. A user who should only have administrative access that can access content that should only be available to a regular user. Privilege escalation does not occur when a user is able to steal or hack administrator credentials and is therefore able to access administrative functions. Privilege escalation refers to accessing features with an account that normally should not have access to those features. A backdoor is an unprotected access method or pathway. Backdoors:    Backdoors   Include hard-coded passwords and hidden service accounts Are often added during development as a shortcut to circumvent security. If they are not removed, they present a security problem Can be added by attackers who have gained unauthorized access to a device. When added, the backdoor can be used at a future time to easily bypass security controls. Can be used to remotely control the device at a later date Rely on secrecy to maintain security To protect against backdoors, do not allow programmers to bypass security during development. Carefully examine the code before release to remove any traces of backdoors that might have been included. Network Application Facts This lesson covers the following topics:  Application threats  Control networking software Application Threats Some applications can pose a threat to your network. The following table lists some of these applications and some of the security concerns with each. Software Considerations Peer-to-peer (P2P) software allows users to share content and access content shared by other users without using centralized servers or centralized access control. P2P software uses ad hoc connections that allow peers to connect and disconnect at will. A common example of P2P file sharing software is BitTorrent. The latest version of Windows also has a built-in peer-to-peer component for distributing operating system updates. Security considerations for P2P software include the following:  Peer-topeer (P2P)    Files accessible from other users might be posted illegally. Files available for download could contain malware. File sharing uses network bandwidth and could consume so much bandwidth that regular traffic is affected. Weaknesses in P2P software could allow attackers to access more than just the files shared on a system. Steps a security administrator can take include the following:    Instant messaging (IM) Use content filters to block downloading and uploading copyrighted files that the file owners do not want to be shared. Block the port the P2P software is using. Enable encryption in the P2P program. Instant messaging (IM) provides real-time text messaging communication and supports picture, music, and document exchange. Some examples of instant messaging are: Google Talk, Skype, iMessage, Facebook Messenger, Internet Relay Chat (IRC), and Slack. Although it offers a quick way to communicate, IM has the following problems:  Use of peer-to-peer networking makes IM clients less secure than other communication methods.     IM is either in cleartext or uses an easily broken basic encryption scheme to protect integrity rather than confidentiality. IM traffic is subject to sniffing, capturing, and viewing by others. Loss of productivity is considered a major IM problem. Malicious code propagation, worms, and viruses are easily spread through IM. May contain spim, which is a type of spam targeting users of instant messaging (IM) services. o IM systems contain user directories, making it easy to identify spim targets. o IM systems often contain demographic information about users. o Information in contact lists can be remotely accessed. Create a whitelist or use an IM blocker as a countermeasure to spim.   Client-side scripting allows attackers to send messages on behalf of other IM users and can be used to create social engineering attacks. IM clients often indicate when you are online, even without your consent. IM software, especially free software with ads, may track your use for marketing purposes. Control Networking Software Use the following to control the use of networking software:     Have a written policy that identifies the allowed or prohibited usage of all software. Use Group Policy or other methods to prevent installation of the software. Block firewall ports that are used by the software. Consider implementing an application control solution. o A firewall alone may be insufficient in blocking the use of network applications.  Knowledgeable users can circumvent firewall ACLs by reconfiguring network applications to use ports commonly left open.  Packet filtering firewalls do not inspect the contents of a packet. Only the source IP address, destination IP address, protocol, and port are used to determine if a packet should be blocked. o An application control solution can be used to block unauthorized network applications.  Application control implementations use application signatures to identify specific applications.  The contents of packets are inspected and compared against these signatures to identify the associated application. o An application whitelist is defined centrally and applied to all network devices.  Only applications contained in the whitelist are allowed.  Several actions can be applied to applications that not whitelisted:  Flagged applications are allowed but a violation is logged when they are identified.  Blocked applications are not allowed and are blocked. The session is dropped if it uses UDP and reset if it uses TCP.  Tarpitted applications are not allowed. However, the connection between hosts is kept alive while the application data itself is silently dropped. This makes it appear to both hosts that the other host is receiving the data but not responding. Not all application control solutions support tarpitting application traffic. o If a user tries to use a disallowed application, they can be prompted to contact the help desk or system administrator to get the application reviewed and approved for use.