security study guide phần 1 pot

SYBEX Sample Chapter
Security+
™
Study Guide
Michael Pastore
Chapter 3: Infrastructure and Connectivity
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved. No part of this
publication may be stored in a retrieval system, transmitted, or reproduced in any way, including but not limited to
photocopy, photograph, magnetic or other record, without the prior agreement and written permission of the publisher.
ISBN: 0-7821-4098-X
SYBEX and the SYBEX logo are either registered trademarks or trademarks of SYBEX Inc. in the USA and other
countries.
TRADEMARKS: Sybex has attempted throughout this book to distinguish proprietary trademarks from descriptive terms
by following the capitalization style used by the manufacturer. Copyrights and trademarks of all products and services
listed or described herein are property of their respective owners and companies. All rules and laws pertaining to said
copyrights and trademarks are inferred.
This document may contain images, text, trademarks, logos, and/or other material owned by third parties. All rights
reserved. Such material may not be copied, distributed, transmitted, or stored without the express, prior, written consent
of the owner.
The author and publisher have made their best efforts to prepare this book, and the content is based upon final release
software whenever possible. Portions of the manuscript may be based upon pre-release versions supplied by software
manufacturers. The author and the publisher make no representation or warranties of any kind with regard to the
completeness or accuracy of the contents herein and accept no liability of any kind including but not limited to
performance, merchantability, fitness for any particular purpose, or any losses or damages of any kind caused or alleged
to be caused directly or indirectly from this book.
Sybex Inc.
1151 Marina Village Parkway
Alameda, CA 94501
U.S.A.
Phone: 510-523-8233
www.sybex.com

Chapter

3

Infrastructure and
Connectivity

THE FOLLOWING COMPTIA SECURITY+ EXAM
OBJECTIVES ARE COVERED IN THIS CHAPTER:


2.1 Remote Access


2.1.1 802.1x


2.1.2 VPN


2.1.3 RADIUS


2.1.4 TACACS/+


2.1.5 L2TP/PPTP


2.1.6 SSH


2.1.7 IPSEC


2.1.8 Vulnerabilities


2.2 Email


2.2.3 Vulnerabilities


2.2.3.1 Spam


2.2.3.2 Hoaxes


2.3 Web


2.3.1 SSL/TLS


2.3.2 HTTP/S


2.3.4 Vulnerabilities


2.3.4.1 Java Script


2.3.4.2 ActiveX


2.3.4.3 Buffer Overflows


2.3.4.4 Cookies


2.3.4.5 Signed Applets


2.3.4.6 CGI


2.3.4.7 SMTP Relay
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.


2.5 File Transfer


2.5.1 S/FTP


2.5.2 Blind FTP/Anonymous


2.5.3 File sharing


2.5.4 Vulnerabilities


2.5.4.1 Packet Sniffing


3.1 Devices


3.1.1 Firewalls


3.1.2 Routers


3.1.3 Switches


3.1.4 Wireless


3.1.5 Modems


3.1.6 RAS


3.1.7 Telecomm/PBX


3.1.8 VPN


3.1.9 IDS


3.1.10 Network Monitoring/Diagnostics


3.1.11 Workstations


3.1.12 Servers


3.1.13 Mobile Devices


3.2 Media


3.2.1 Coax


3.2.2 UTP/STP


3.2.3 Fiber


3.2.4 Removable Media


3.2.4.1 Tape


3.2.4.2 CDR


3.2.4.3 Hard Drives


3.2.4.4 Diskettes


3.2.4.5 Flashcards


3.2.4.6 Smartcards
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.

Y

our network is composed of a variety of

media

and devices
that both facilitate communications and provide security. Some of these
devices (such as routers, modems, and PBX systems) provide external con-
nectivity from your network to other systems and networks. Some of the
devices (such as CDRs, disks, and tape) provide both internal archival storage
and working storage for your systems. In order to provide reasonable security,
you must know how these devices work and how they provide or fail to
provide security. This chapter deals with issues of infrastructure and media.
They are key components of the Security+ exam and necessary for you to
understand in order to secure your network.

Infrastructure Security

I

nfrastructure security

deals with the most basic aspects of how informa-
tion flows and how work occurs in your network and systems. An

infrastructure


is simply the basis for all of the work occurring in your organization.
When discussing infrastructures, bear in mind that this includes servers,
networks, network devices, workstations, and the processes in place to

facilitate work.
To evaluate the security of your infrastructure, you must examine the
hardware and its characteristics, and also examine the software and its
characteristics. Each time you add a device, change configurations, or switch
technologies, you are potentially altering the fundamental security capabilities
of your network.
Networks are tied together using the Internet and other network tech-
nologies, thereby making them vulnerable to attack in any number of
manners. The job of a security professional is to eliminate the obvious threats,
to anticipate how the next creative assault on your infrastructure might
occur, and to neutralize it before it happens.
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.

104

Chapter 3


Infrastructure and Connectivity

The following sections deal with the hardware and software components
that make up a network.

Hardware Components

Hardware components include physical devices, such as routers, servers, and
firewalls. Figure 3.1 depicts a typical network infrastructure and some of
the common hardware components in the environment. From a security per-
spective, this infrastructure is more than the sum of all of its parts. You must
evaluate your network from the perspective of each device in it. The complexity

of most networks makes securing them extremely complicated. In order to
provide reasonable security, every device must be evaluated to determine its
strengths and weaknesses.

FIGURE 3.1

A typical network infrastructure

Notice in this figure that the network we will be evaluating has Internet
connections. Internet connections expose your network to the highest
number of external threats. These threats can come from virtually any location
worldwide. The network includes routers, firewalls, switches, servers,
Internet
Clients
Clients
Server
Accounting
Server
Engineering
Router
Firewall
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.

Infrastructure Security

105

and workstations. Each of these devices has its own unique vulnerabili-
ties and strengths. These devices are covered in more detail later in this
chapter. As you can see from Figure 3.1, your infrastructure is complicated

and dynamic.

Software Components

Hardware exists to run software. Most of the devices that we use today have
a certain amount of artificial intelligence. This intelligence makes them easy
to configure, easy to support, and to a certain extent, easy to bypass. The
network infrastructure illustrated in Figure 3.1 includes servers, workstations
running operating systems, routers, firewalls (which may run as applications
on servers), and dedicated devices that have their own communications and
control programs.
This situation leaves networks open to attacks and security problems
because many of these systems work independently. Many larger organiza-
tions have built a single area for network monitoring and administrative control
of systems. This centralization allows a larger overall picture of the network to
be seen, and it allows actions to be taken on multiple systems or network
resources if an attack is underway. These centralized areas are called a

Network Operations Center (NOC)

. Using a NOC makes it easier to see
how an attack develops and easier to provide counter measures. Unfortu-
nately, a NOC is beyond the means of most businesses. They are expensive
and require a great deal of support.

ATT Wireless NOCs

ATT Wireless maintains a huge NOC for each of the cell centers they man-
age. These centers provide 24/7 real-time monitoring of all devices in the
cellular and computer network that they support. The operators in the NOC

have the ability to literally reach out and touch any device in the network to
configure, repair, and troubleshoot. A single NOC has dozens of people
working around the clock to keep on top of the network. When an ATT Wire-
less center goes down, it effectively takes down the entire cell-phone
service for an entire region. As you can imagine, this is horrendously expen-
sive and they do not let it happen very often. There are several NOC facilities
in the United States, and one region can support or take over operations for
another region if that center becomes inoperable.
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.

106

Chapter 3


Infrastructure and Connectivity

Supporting an infrastructure in a large corporation can be a horrendously
expensive proposition, and it requires literally years of development to create
an effective NOC.
Devices
Connecting all of these components requires physical devices. Large
multinational corporations, as well as small and medium-sized corporations,
are building networks of enormous complexity and sophistication. These
networks work by utilizing miles and miles of both wiring and wireless tech-
nologies. Whether the network is totally wire and fiber-based, or totally
wireless, the method of transmitting data from one place to another opens
vulnerabilities and opportunities for exploitation. These vulnerabilities
appear whenever an opportunity exists to intercept information from
the media.

The devices briefly described here are the components that you will typically
encounter in a network.
Firewalls
Firewalls are one of the first lines of defense in a network. There are different
types of firewalls, and they can be either stand-alone systems or included
in other devices such as routers or servers. Many firewalls are add-in software
available for servers or workstations. The basic purpose of a firewall is to
isolate one network from another. Firewalls are becoming available as appli-
ances, meaning they are installed into the network between two networks.
Appliances are freestanding devices that operate in a largely self-contained
manner. They should require less maintenance and support than a server-based
product.
Firewalls function as one of the following:

Packet filter

Proxy firewall

Stateful inspection
The proxy shown in Figure 3.2 effectively limits access from outside
networks, while allowing inside network users to access outside resources.
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.
Devices 107
The proxy in this illustration is also performing firewall functions. The end
user in this network uses the proxy server to manage traffic and receive
returning information. This section discusses three of the most common
functions that firewalls perform.
FIGURE 3.2 A proxy firewall blocking network access from external networks
Packet Filter
A firewall operating as a packet filter will pass or block traffic to specific

addresses based on the type of application. A packet filter may allow web
traffic on Port 80 and block Telnet traffic on Port 23. This type of filtering
is included in many routers. If a received packet request asks for a port
that is not authorized, the filter may reject the request or simply ignore it.
Many packet filters can also specify which IP addresses can request which
ports and allow or deny them based on the security settings of the firewall.
Packet filters are growing in sophistication and capability. A packet filter
does not analyze the contents of a packet; it decides whether to pass it or not
based on the addressing information of the packet.
Proxy Firewall
Think of a proxy firewall as an intermediary between your network and
another. Proxy firewalls are used to process requests from an outside network
and evaluate whether the request is forwarded or not. The proxy will
intercept all of the packages and reprocess them for use internally. This
process includes hiding IP addresses. The proxy firewall will examine the
data and make rules-based decisions about whether to forward the request
or refuse it.
External
Network
Proxy
Internal
Network
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.
108 Chapter 3

Infrastructure and Connectivity
The proxy firewall provides better security than packet filtering because
of the increased intelligence that a proxy firewall offers. Requests from
internal network users are routed through the proxy. The proxy, in turn,
repackages the request and sends it along, thereby effectively isolating the

user from the external network.
A server-based proxy firewall will typically use two NIC cards. This type
of firewall is referred to as a dual-homed firewall. One of the cards is
connected to the outside network and one is connected to the internal network.
The proxy software manages the connection between the two NIC cards.
This effectively segregates the two networks from each other and offers
increased security. Figure 3.3 illustrates a dual-homed firewall segregating
two networks from each other.
FIGURE 3.3 A dual-homed firewall segregating two networks from each other
Dual-Homed Server-Based Proxy Firewall
You are the network administrator of a small network. You are installing a
new firewall server using Windows 2000. After you complete the installa-
tion, you notice that the network does not appear to be routing traffic
through the firewall and that inbound requests are not being blocked. This
presents a security problem for the network because you have been getting
unusual network traffic lately.
NIC A NIC B
Network A Network B
NIC Card
Make sure routing or IP
forwarding is disabled in
operating system.
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.
Devices 109
The proxy function can occur at either the application level or the
circuit level. Application-level proxy functions will read the individual
commands of the protocols that are being served. This type of server is
very advanced and must know the rules and capabilities of the protocol
used. This type of proxy would know the difference between a GET and
a PUT operation, for example, and would have rules specifying how to

execute them. A circuit-level proxy creates a circuit between the client and
the server and does not deal with the contents of the packets that are being
processed.
A unique application-level proxy server must exist for each protocol
supported. Many proxy servers also provide full auditing, accounting, and
other usage information that would not normally be kept by a circuit-level
proxy server.
Combining firewalls with other firewalls will provide a variety of configuration
and security options. See Chapter 6, “Working with a Secure Network,” for
further details.
Stateful Inspection
The last section on firewalls focuses on the concept of stateful inspection.
Stateful Inspection is also referred to as stateful packet filtering. Most of the
devices we use in networks do not keep track of how information is routed or
used. Once a packet is passed, the packet and path are forgotten. In stateful
inspection or stateful packet filtering, records are kept using a state table that
tracks every communications channel. Stateful inspections occur at all levels
of the network and provide additional security, especially in connectionless
protocols such as User Datagram Protocol (UDP) and Internet Control
The most likely solution to this problem deals with the fact that Windows 2000
offers the ability to use IP forwarding in a dual-homed server. IP forwarding
bypasses your firewall and uses the server as a router. Even though the
two networks are effectively isolated, the new router is doing its job well
and it is routing IP traffic.
You will need to verify that IP forwarding and routing services are not
running on this server
Copyright © 2003 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved.