Inside Network Perimeter Security

Stephen Northcutt is a graduate of Mary Washington College. Before entering the field of computer security, he worked as a Navy helicopter search and rescue crewman, whitewater raft guide, chef, martial arts instructor, cartographer, and network designer. Stephen is author/coauthor of Incident Handling Step-by-Step, Intrusion Signatures and Analysis, Inside Network Perimeter Security, 2nd Edition, IT Ethics Handbook, SANS Security Essentials, SANS Security Leadership Essentials, and Network Intrusion Detection, 3rd Edition. He was the original author of the Shadow Intrusion Detection System before accepting the position of Chief for Information Warfare at the Ballistic Missile Defense Organization. Stephen currently serves as Director of the SANS Institute.Lenny Zeltser's work in information security draws upon experience in system administration, software architecture, and business administration. Lenny has directed security efforts for several organizations, co-founded a software company, and consulted for a major financial institution. He is a senior instructor at the SANS Institute, having written and taught a course on reverse-engineering malware. Lenny is also a coauthor of books such as SANS Security Essentials and Malware: Fighting Malicious Code. He holds a number of professional certifications, including CISSP and GSE, and is an incident handler at SANS Internet Storm Center. Lenny has earned a bachelor of science in engineering degree from the University of Pennsylvania and a master in business administration degree from MIT. More information about Lenny's projects and interests is available at http://www.zeltser.com.Scott Winters has been working in all aspects of networking and computer security for over 14 years. He has been an Instructor, Network Engineer, and Systems Administrator and is currently employed as a Senior Consultant for Unisys at the Commonwealth of Pennsylvania Enterprise Server Farm. He has SANS GIAC Firewalls and Incident Handling certifications, as well as MCSE, CNE, Cisco CCNP, CCDP, and other industry certifications. Other accomplishments include authoring and editing of SANS GIAC Training and Certification course content, as well as exam content. He was a primary author of the first edition of Inside Network Perimeter Security and a contributing author for SANS Security Essentials with CISSP CBK. He has also been involved in the SANS GIAC Mentoring program and has served on the SANS GCFW Advisory Board.Karen Kent is an Associate with Booz Allen Hamilton, where she provides guidance to Federal agencies on a broad range of information assurance concerns, including incident handling, intrusion detection, VPNs, log monitoring, and host security. Karen has earned a bachelor's degree in computer science from the University of Wisconsin-Parkside and a master's degree in computer science from the University of Idaho. She holds the CISSP certification and four SANS GIAC certifications. Karen has contributed to several books, including Intrusion Signatures and Analysis, published numerous articles on security, and coauthored several publications for the National Institute of Standards and Technology (NIST), including NIST Special Publication 800-61: Computer Security Incident Handling Guide.Ronald W. Ritchey has an active interest in secure network design and network intrusion techniques. He gets to exercise this interest regularly by conducting penetration testing efforts for Booz Allen Hamilton, where he has had the opportunity to learn firsthand the real-world impact of network vulnerabilities. He is also an active researcher in the field with peer-reviewed publications in the area of automated network security analysis. Ronald has authored courses on computer security that have been taught across the country, and he periodically teaches graduate-level courses on computer security. Ronald holds a masters degree in computer science from George Mason University and is currently pursuing his Ph.D. in information technology at their School of Information Technology and Engineering. His doctoral research involves automating network security analysis.About the Technical Editors Todd Chapman has 10+ years of experience delivering IT services as varied as systems management, security, networking, clustering, Perl programming, and corporate development and training. Currently, Todd is a consultant for gedas USA, Inc., in Auburn Hills, Michigan, where he provides security consulting services for Volkswagen/Audi of America. For the last three years Todd has been an active member of the SANS GCFW advisory board and has written SANS certification exam questions in a number of disciplines. Todd's certifications include Red Hat Certified Engineer (RHCE), Microsoft Certified Systems Engineer (MCSE), GIAC Certified Firewall Analyst (GCFW), GIAC Certified Intrusion Analyst (GCIA), and GIAC Systems and Network Auditor (GSNA).Anton Chuvakin, Ph.D., GCIA, GCIH, is a Security Strategist with netForensics, a security information management company, where he is involved with designing the product, researching potential new security features, and advancing the security roadmap. His areas of infosec expertise include intrusion detection, UNIX security, forensics, honeypots, and more. He is the author of the book Security Warrior (O'Reilly, January 2004) and a contributor to "Know Your Enemy II" by the Honeynet Project (AWL, June 2004) and "Information Security Management Handbook" (CRC, April 2004). In his spare time he maintains his security portal http://www.info-secure.org website.Dan Goldberg recently created MADJiC Consulting, Inc., to provide network design and architecture reviews, intrusion detection and response, and vulnerability assessments in Central Virginia. He also works on research and writing projects for the SANS Institute and as technical director for Global Information Assurance Certification (GIAC). When not occupied by these activities, you may find him riding a mountain bike in the Blue Ridge Mountains.John Spangler is a freelance Network Systems Engineer. Having over 10 years of experience, he has worked on everything from small office systems to large enterprise and ISP networks. John has worked as a technical editor for Cisco certification manuals.

• Introduction.Who Should Read This Book.Why We Created This Book’s Second Edition.Overview of the Book’s Contents.Conventions.I. THE ESSENTIALS OF NETWORK PERIMETER SECURITY.1. Perimeter Security Fundamentals.Terms of the Trade.The Perimeter.Border Routers.Firewalls.Intrusion Detection Systems.Intrusion Prevention Systems.Virtual Private Networks.Software Architecture.De-Militarized Zones and Screened Subnets.Defense in Depth.Components of Defense in Depth.Case Study: Defense in Depth in Action.Summary.2. Packet Filtering.TCP/IP Primer: How Packet Filtering Works.TCP and UDP Ports.TCP’s Three-way Handshake.The Cisco Router as a Packet Filter.An Alternative Packet Filter: IPChains.The Cisco ACL.Rule Order.Cisco IOS Basics.Effective Uses of Packet-Filtering Devices.Filtering Based on Source Address: The Cisco Standard ACL.Egress Filtering.Tracking Rejected Traffic.Filtering by Port and Destination Address: The Cisco Extended ACL.The Cisco Extended ACL.Problems with Packet Filters.Spoofing and Source Routing.Fragments.Opening a “Hole” in a Static Packet Filter.Two-way Traffic and the established  Keyword.Protocol Problems: Extended Access Lists and FTP.Dynamic Packet Filtering and the Reflexive Access List.FTP Problems Revisited with the Reflexive Access List.Reflexive ACLs with UDP and ICMP Traffic: Clearing Up DNS Issues.Trouble in Paradise: Problems with Reflexive Access Lists.Cisco IPv6 Access Lists.Summary.References.3. Stateful Firewalls.How a Stateful Firewall Works.The Concept of State.Transport and Network Protocols and State.Application-Level Traffic and State.Stateful Filtering and Stateful Inspection.Stateful Firewall Product Examples.Summary.References.4. Proxy Firewalls.Fundamentals of Proxying.Pros and Cons of Proxy Firewalls.Advantages of Proxy Firewalls.Disadvantages of Proxy Firewalls.Types of Proxies.Web Proxies.Reverse Proxies.Anonymizing Proxies.Tools for Proxying.Firewall Toolkit (FWTK).SOCKS.Squid.Summary.5. Security Policy.Firewalls Are Policy.Active Policy Enforcement.Unenforceable Policy.How to Develop Policy.Identify Risks.Communicate Your Findings.Create or Update the Security Policy as Needed.Determine Policy Compliance.Sound Out the Organization’s Rules and Culture.Elements of Policy.Hallmarks of Good Policy.Perimeter Considerations.Real-world Operations and Policy.Rules of the Road.Summary.References.II. FORTIFYING THE SECURITY PERIMETER.6. The Role of a Router.The Router as a Perimeter Device.Routing.Secure Dynamic Routing.The Router as a Security Device.The Router as a Part of Defense in Depth.The Router as a Lone Perimeter Security Solution.Router Hardening.Operating System.Locking Down Administration Points.SSH.The Console Port.TFTP and FTP.Configuration Management Tricks with TFTP and Scripts.Simple Network Management Protocol.Disable Unneeded Services.Configure NTP and NTP Authentication.Cisco TCP Keepalives Services.Unicast Reverse Path Forwarding.Internet Control Message Protocol Blocking.Spoofing and Source Routing.Router Logging.Automatic Securing and Auditing of Cisco Routers.Summary.7. Virtual Private Networks.VPN Basics.Basic VPN Methodology.Advantages and Disadvantages of VPNs.Benefits of a VPN.Disadvantages of VPN.IPSec Basics.IPSec Protocol Suite.IKE.IPSec Security Protocols AH and ESP.IPSec Configuration Examples.Other VPN Protocols: PPTP and L2TP.PPTP.L2TP.Comparison of PPTP, L2TP, and IPSec.PPTP and L2TP Examples.Summary.References.8. Network Intrusion Detection.Network Intrusion Detection Basics.The Need for Intrusion Detection.Anomaly Detection.Signature Detection.False Positives and False Negatives.Alerting, Logging, and Reporting.Intrusion Detection Software.Intrusion-Related Services.The Roles of Network IDS in a Perimeter Defense.Identifying Weaknesses.Detecting Attacks from Your Own Hosts.Incident Handling and Forensics.Complementing Other Defense Components.IDS Sensor Placement.Deploying Multiple Network Sensors.Placing Sensors Near Filtering Devices.Placing IDS Sensors on the Internal Network.Working with Encryption.Processing in High-traffic Situations.Configuring Switches.Using an IDS Management Network.Maintaining Sensor Security.Case Studies.Case Study 1: Simple Network Infrastructure.Case Study 2: Multiple External Access Points.Case Study 3: Unrestricted Environment.Summary.9. Host Hardening.The Need for Host Hardening.Removing or Disabling of Unnecessary Programs.Controlling Network Services.Removing Extraneous Software Components.Limiting Access to Data and Configuration Files.Controlling User and Privileges.Managing Unattended Accounts.Protecting Administrative Accounts.Enforcing Strong Passwords.Controlling Group Membership.Maintaining Host Security Logs.Windows Logging and Auditing.UNIX Logging and Auditing.Applying Patches.Additional Hardening Guidelines.Automating Host-Hardening Steps.Common Security Vulnerabilities.Hardening Checklists.Summary.10. Host Defense Components.Hosts and the Perimeter.Workstation Considerations.Server Considerations.Antivirus Software.Strengths of Antivirus Software.Limitations of Antivirus Software.Host-Based Firewalls.Firewalls for Workstations.Firewalls for Servers.Host-Based Intrusion Detection.The Role of Host-Based IDS.Host-Based IDS Categories.Challenges of Host Defense Components.Defense Components on Compromised Hosts.Controlling Distributed Host Defense Components.Summary.References.11. Intrusion Prevention Systems.Rapid Changes in the Marketplace.What Is IPS?An IPS Must Be Fast.An IPS Must Keep State.An IPS Must Be Accurate and Up to Date.An IPS Must Have the Ability to Nullify an Attack.IPS Limitations.An Excuse to Ignore Sound Practice.An IPS Simply Buys You Time.NIPS.How Chokepoint NIPS Work.Switch-Type NIPS.Switch NIPS Deployment Recommendations.Host-Based Intrusion Prevention Systems.Real-world Defense Scenarios.Dynamic Rule Creation for Custom Applications.Monitoring File Integrity.Monitoring Application Behavior.HIPS Advantages.HIPS Challenges.More HIPS Challenges.HIPS Recommendations.Summary.III. DESIGNING A SECURE NETWORK PERIMETER.12. Fundamentals of Secure Perimeter Design.Gathering Design Requirements.Determining Which Resources to Protect.Determining Who the Potential Attackers Are.Defining Your Business Requirements.Design Elements for Perimeter Security.Firewall and Router.Firewall and VPN.Multiple Firewalls.Summary.References.13. Separating Resources.Security Zones.A Single Subnet.Multiple Subnets.Common Design Elements.Mail Relay.Split DNS.Client Separation.VLAN-Based Separation.VLAN Boundaries.Jumping Across VLANs.Firewalls and VLANs.Private VLANs.Summary.References.14. Wireless Network Security.802.11 Fundamentals.Securing Wireless Networks.Network Design.Wireless Encryption.Hardening Access Points.Defense in Depth for Wireless Networks.Auditing Wireless Security.Auditing the Wireless Network Design.Auditing Encryption.Case Study: Effective Wireless Architecture.Summary.References.15. Software Architecture.Software Architecture and Network Defense.The Importance of Software Architecture.The Need to Evaluate Application Security.How Software Architecture Affects Network Defense.Firewall and Packet-Filtering Changes.Web Services and Interapplication Communications.Conflicts with Network Configuration.Encrypting Connections.Performance and Reliability.Atypical Operating System.Software Component Placement.Single-System Applications.Multitier Applications  Administrator Access to Systems.Applications for Internal Users Only.Identifying Potential Software Architecture Issues.Software Evaluation Checklist.Sources of Application Information.How to Handle an Unsecurable.Application.Software Testing.Host Security.Network Configuration and Security.Network Defense Design Recommendations.Case Study: Customer Feedback System.Deployment Locations.Architecture Recommendation.Case Study: Web-Based Online Billing Application.Deployment Locations.Architecture Recommendation.Summary.References.16. VPN Integration.Secure Shell.Standard SSH Connections.SSH Tunnels.Secure Sockets Layer.SSL Standard Connections.SSL Tunnels.SSL Proxy Servers.Remote Desktop Solutions.Single Session.Multiple Session.IPSec.IPSec Client Integration.IPSec Server Integration.IPSec Perimeter Defense Adjustments.IPSec Architectures.Other VPN Considerations.Proprietary VPN Implementations.Compromised or Malicious VPN Clients.VPN Design Case Study.Case Study: Home Users and Multiple Applications.Summary.References.17. Tuning the Design for Performance.Performance and Security.Defining Performance.Understanding the Importance of Performance in Security.Network Security Design Elements That Impact Performance.The Performance Impacts of Network Filters.Network Architecture.Case Studies to Illustrate the Performance Impact of Network Security Design Elements.Impact of Encryption.Cryptographic Services.Understanding Encryption at the Network and Transport Layers.Using Hardware Accelerators to Improve Performance.Case Studies to Illustrate the Performance Impact of Encryption.Using Load Balancing to Improve Performance.Problems with Load Balancing.Layer 4 Dispatchers.Layer 7 Dispatchers.Mitigating the Effects of DoS Attacks.ICMP Flooding.SYN Flooding.Summary.References.18. Sample Designs.Review of Security Design Criteria.Case Studies.Case Study 1: Telecommuter Who Is Using a Broadband Connection.Case Study 2: A Small Business That Has a Basic Internet Presence.Case Study 3: A Small E-Commerce Site.Case Study 4: A Complex E-Commerce Site.Summary.IV. MAINTAINING AND MONITORING PERIMETER SECURITY19. Maintaining a Security Perimeter.System and Network Monitoring.Big Brother Fundamentals.Establishing Monitoring Procedures.Security Considerations for Remote Monitoring.Incident Response.Notification Options.General Response Guidelines.Responding to Malicious Incidents.Automating Event Responses.Accommodating Change.Fundamentals of Change Management.Implementing Change-Management Controls.Summary.References.20. Network Log Analysis.The Importance of Network Log Files.Characteristics of Log Files.Purposes of Log Files.Log Analysis Basics.Getting Started with Log Analysis.Automating Log Analysis.Timestamps.Analyzing Router Logs.Cisco Router Logs.Other Router Logs.Analyzing Network Firewall Logs.Cisco PIX Logs.Check Point FireWall-1 Logs.IPTables Logs.Analyzing Host-Based Firewall and IDS Logs.ZoneAlarm.Norton Personal Firewall.Summary.21. Troubleshooting Defense Components.The Process of Troubleshooting.Collecting Symptoms.Reviewing Recent Changes.Forming a Hypothesis.Testing the Hypothesis.Analyzing the Results.Repeating If Necessary.Troubleshooting Rules of Thumb.Make Only One Change at a Time.Keep an Open Mind.Get a Second Opinion.Stay Focused on Fixing the Problem.Don’t Implement a Fix That Further Compromises Your Security.The Obvious Problems Are Often Overlooked.Document, Document, Document!.The Troubleshooter’s Toolbox.Application Layer Troubleshooting.Other Useful Utilities.Transport Layer Troubleshooting.Network Layer Troubleshooting.Link Layer Troubleshooting.Summary.References.22. Assessment Techniques.Roadmap for Assessing the Security of Your Network.Planning.Reconnaissance.Network Service Discovery.System Enumeration.Service Discovery.Vulnerability Discovery.Nessus.ISS Internet Scanner.Retina.LANguard.Vulnerability Research.Verification of Perimeter Components.Preparing for the Firewall Validation.Verifying Access Controls.Remote Access.Wardialing.Wardriving.VPNs and Reverse Proxies.Exploitation.Results Analysis and Documentation.Summary.23. Design Under Fire.The Hacker Approach to Attacking Networks.Adversarial Review.GIAC GCFW Student Practical Designs.Practical Design 1.Practical Design 2.Summary.References.24. A Unified Security Perimeter: The Importance of Defense in Depth.Castles: An Example of Defense-in-Depth Architecture.Hard Walls and Harder Cannonballs.Secret Passages.Hiding in the Mist.Defense on the Inside.Absorbent Perimeters.Honeypots.Rate Limiting.Failover.Defense in Depth with Information.The Problem of Diffusion.Cryptography and Defense in Depth.Summary.V. APPENDIXESAppendix A. Cisco Access List Sample Configurations.Complete Access List for a Private-Only Network.Complete Access List for a Screened Subnet Network That Allows Public Server Internet Access.Example of a Router Configuration as Generated by the Cisco Auto Secure Feature.Appendix B. Crypto 101.Encryption Algorithms.Shared Key: Symmetric.Public—Private Key: Asymmetric.Digital Signatures and Hash Algorithms.References.Index.