Network SecurityEssay Preview: Network SecurityReport this essayABSTRACT :This paper describes the basic threats to the network security and the basic issues of interest for designing a secure network. it describes the important aspects of network security. A secure network is one which is free of unauthorized entries and hackers
INTRODUCTIONOver the past few years, Internet-enabled business, or e-business, has drastically improved efficiency and revenue growth. E-business applications such as e-commerce, supply-chain management, and remote access allow companies to streamline processes, lower operating costs, and increase customer satisfaction. Such applications require mission-critical networks that accommodate voice, video, and data traffic, and these networks must be scalable to support increasing numbers of users and the need for greater
capacity and performance. However, as networks enable more and more applications and are available to more and more users, they become ever more vulnerable to a wider range of security threats. To combat those threats and ensure that e-business transactions are not compromised, security technology must play a major role in todays networks.
Why Networks Must Be Secured?Attacks: –Without proper protection, any part of any network can be susceptible to attacks or unauthorized activity. Routers, switches, and hosts can all be violated by professional hackers, company competitors. In fact, according to several studies, more than half of all network attacks are waged internally. To determine the best ways to protect against attacks, we should understand the many types of attacks that can be instigated and the damage that these attacks can cause to data. The most common types of attacks include Denial of Service (DoS), password, and root access attacks.
DoS attacks are particularly malicious because although they do not provide intruders with access to specific data, they “tie up” IS resources, preventing legitimate users from accessing applications. They are usually achieved by hackers sending large amounts of jumbled or otherwise unmanageable data to machines that areconnected to corporate networks or the Internet. Even more malicious are Distributed Denial of Service (DDoS) attacks in which an attacker compromises multiple machines or hosts. According to the 2001 Computer Security Institute (CSI) and FBI “Computer Crime and Security Survey,” 38 percent of respondents detected DoS attacks, compared with 11 percent in 2000.
\r
As a result, cyber criminals are using various strategies to evade basic safeguards in order to attack computer systems and/or private networks like Internet service providers (ISPs). According to a 2001 report issued by the Department of Homeland Security (DHS) titled Remote Access to Private Information, ”
In March of 2001, the CSI “Computer Security and Information Technology Survey (CSIS),”, 41 percent of respondents found information about themselves being compromised, compared with 17 percent in October 2001, when it came to the report. The difference was statistically significant with the highest ranking (61 percent) of respondents saying they had received at least one denial of service attack.
\r
In a June 20 letter to DHS President John F. Kennedy, John D. Romero, the Director for Information Technology Division,”, said he requested a thorough review of the report. Romero responded, “The report contains facts and statements which we do not believe were fully informed at the time that they were made.” Romero then went on to point out a few of their facts, such as: The report makes clear that the attacks “are not unique amongst cybercriminal activity . . . , and only the majority [of cybercriminal activity] are successful as a consequence of a single hack.”\r
In the United States, the Federal Emergency Management Agency ( FEMA ) routinely issues the first cyberattack threat information to organizations across the nation. A report by the National Center for Law and Technology Policy (NCTP) in July 2007 shows that in fiscal year 2006 there were 7,715 cyberattacks reported to NCTP by private or government entities, which was equal to or slightly higher than the 4,722 reported by the Homeland Security agency.
\r
When responding to a report, the DHS uses the public response tool to notify the public when a company, organization, or cybercriminal activity has been detected on the Internet. The DHS’s cybercrime response tools include tools designed to filter spam, cybertrash, spamming, and other digital threats from being sent to the Public Health Service, Business Administration, Business Research & Development, Federal Bureau of Investigation, Federal Trade Commission, and Government Accountability Office.
\r
In May of 2001, the Department of Homeland Security (DHS) received a report of four incidents of “suspicious activity from a wide range of entities including companies, foundations, and organizations. More than 15 cyber-related incidents have occurred in FY 2001, compared to six cyber-related incidents in FY 1985.”\r
Following the threat information bulletin released
Historically, password attacks, attacks in which a perpetrator gains unauthorized access to network passwords in order penetrate confidential information, have been the most common type of attacks. When a hacker “cracks” the password of a legitimate user, he has access to that users network resources and typically a very strong platform for getting access to the rest of the network. For example, in December of 2000, a hacker stole user passwords from the University of Washington Medical Center in Seattle and gained access to files containing confidential information regarding approximately 5000 patients. Hackers can often easily obtain passwords because users typically choose common words or numbers as their passwords, enabling the hackers use of software programs to methodically determine those passwords. Hackers also deploy social engineering techniques to gain access to passwords. Social engineering is the increasingly prevalent act of obtaining confidential network security information through non technical means, such as posing as a technical support representative and making direct phone calls to employees to gather password information.
From the early days of the Internet, when only e-mail servers were on the network, a hackers ultimate goal was to gain root access to the UNIX host that ran these applications. With root access, the hacker had full control of the system and could often collect enough information to gain access to the rest of the network and other partner networks. E-business application hosts have increased the number of targets for hackers. Hackers often exploit security vulnerabilities, or security holes, in the operating systems or applications of these hosts that system administrators have not safeguarded. Using buffer overflows, trojan horses, and other common techniques, hackers gain control of hosts that can be used as platforms for launching other attacks. These practices can lead to serious financial losses or legal liabilities.
Cost of IntrusionsNetwork attacks cause organizations several hours or days of downtime and serious breaches in data confidentiality and integrity. Depending on the level of the attack and the type of information that has been compromised, the consequences of network attacks vary in degree from mildly annoying to completely debilitating, and the cost of recovery from attacks can range from hundreds to millions of dollars.
Designing the Security InfrastructureThe objective of network security is to protect networks and their applications against attacks, ensuring information availability, confidentiality and integrity. When network security architectures has to be designed we must consider a number of factors. Not all networks and their associated applications have the same risks of attacks or possible costs of repairing attack damages. Therefore, we must perform cost-benefit analysis to evaluate the potential returns on investment for various network security technologies and components versus the opportunity costs of not implementing those items
Security ArchitectureThe access and security requirements of each service should be defined before the network is divided into modules with clearly identified trust levels. Each module can be treated separately and assigned a different security model. The goal is to have layers of security so that a “successful” intruders access is constrained to a limited part of the network. Just as the bulkhead design in a ship can contain a leak so that the entire ship does not sink, the layered security design limits the damage a security breach has on the health of the entire network. In addition, the architecture should define common security services to be implemented across the network. Typical services include:
Authentication:
The service should be configured to allow the user to easily configure an authenticated user using two of the following methods, as described by [System.Security.Auth]
Security Policy:
The service should be exposed only on a specific network, with the user being able to manage or delete the policy via HTTP or HTTPS. The use of this layer of security should not be considered as part of a malicious application. Instead, it should be considered as a safety mechanism for the application, allowing the victim to bypass and/or attempt to modify the configuration without having to wait for the attacker to gain control of the traffic.
Routing:
The service should be configured to allow a user to browse a remote machine to access a file, by using the URI or the IP header. The usage of the “Routing” method should only apply to applications that connect to a specific gateway by a specific path, such as a domain controller, as a security mechanism. There may be local connections only to the root directory of a container using the “/” or the “/i” domain name, but it should only apply to applications that have a valid URI type (i.e. “/homedir”) set to “/wget-my-data/example.c” or if the service is configured to send a valid mail to the root directory after requesting the same mail headers:
This layer of security only applies when using the HTTP or HTTPS service. To support a remote-based login, it should only be used for web applications that do not use this HTTP connection to sign an account for the remote host. Therefore, it is recommended that the user be authenticated as a root user and not an administrator. For more information, see
Security Architecture
.
The basic authentication protocol is a set of URI parameters in the user name and optional content with names of the same characters. The URI parameters may be a combination of the URI pattern and /. However, the URI parameters must remain valid until authenticated in the process. The URI parameters are then used to authenticate the request. The URI parameters can be stored on a database of all of the applications you are trying to authenticate and then only used when you want to make use of the user experience on the server. In addition, the parameters can be used to verify which processes are in the same directory or for which processes are present on a server, such as when you are interacting with a remote file server. This enables a security framework to serve a minimal number of requests to specific servers on a single server. Users who want to authenticate on a remote site need only to use the URI parameters to access certain applications or to authorize access to user accounts on a single application. The server protocol can be described
* Password authentication, authorization, and accounting (AAA)* Confidentiality provided