Security+ Topic - Access Control Lists

When we talk about network and system security, there is an increasing thought of complicated attack scenarios with complex routines written for defending against it.  Sure there may be some complex attacks out there that we should prevent but lets get back to basics for a moment.  What is the one most simple thing that you can do to keep your network resources safe?  Access Control Lists.

Some environments could have an awesome firewall in place that takes care off all their security requirements and some environments could simply have a DSL router.  In either and any case, they can benefit from access control lists setup to prevent any number of network traffic.  In the simplest of terms lets take a scenario with two network segments.  One for servers and one for users.  Normally your users only need specific access to the servers so you would allow one or two ports into your server network from your users network.  Sounds like a firewall right?  Yes an ACL is similar to your firewall in this scenario.  An ACL take it a bit further though on the router level so that traffic gets dropped before it even hits a network or host.

When the environment gets a bit larger though is when a dedicated firewall will be an ideal solution for sorting what traffic is allowed to which networks.  Still though an access control list is very important.  Security is all about layers right?  So why not layer your firewall to specific access as it travels through the network.  It may not be as granular so that your router can focus on routing instead of firewall rules.  One example here is that you could put an ACL in place to block everything but outbound stateful connections on port 80 for a specific department.  Then set your fancy firewall to filter the URL’s or destinations that are trying to be reached.  This allows a drop in network traffic from even attempting escape from their network as well as reducing firewall load so that it can focus on the HTTP traffic.

This brings up ACL’s as part of a security breach network wide.  An access control list can be put in place to block ICMP traffic between networks but OK to the router.  If one machine gets compromised and the malicious user simply tries to ping  hosts for where to make their next attack, then you have slowed their host discovery and possibly eliminated the threat if they rely on that ping response for their next attack.  One common scenario you may encounter is a SQL server physically or logically behind an internet facing server.  The server would only have one network connection to a second NIC on the internet facing server making it look as if it were much more secure on an isolated network.  Again back to layers of security, a network ACL could be put into place here allowing only specific items through so if something does get compromised the attacker wouldn’t have one more layer to break before being able to move compromised data out of your network.

Are access control lists perfect?  No.  That is why there are network firewalls, IDS, IPS, and a slew of technologies available.  Are the still relevant?  YES!  Adding this layer of security is very important as every layer counts.  Most of the time it is already built into your network routing products so you may as well use it!

Security+ Topic - Wireless Networks

One of the most simple ways that you can create a security boundary on your wireless network is to not only logically separate the wireless clients but to also “physically” separate them as well.  Most of the time we see access points setup through an environment on the same SSID so that as people walk through a building there is a seamless transition and the network is available anywhere they go.  What happens when you have to add a layer of security to this environment?  What happens when manufacturing wants this same functionality as the support department?

Lucky for us we can have multiple SSID’s mapped to VLAN’s quite easily…. depending on your hardware.  Lets break that scenario down a little bit by going to older methods first.  If your hardware doesn’t support multiple SSID’s or multiple VLAN’s then your only option is to have double, triple, etc access points in your wireless environment.  Each department will be dedicated to that SSID and each access point will have a dedicated connection back to your switch which will implement the VLAN setup.  Simple….ish until you have to provide for multiple departments as that increases hardware cost and additional cabling.

What about that multi-SSID access point you have?  Again it depends on the level of the hardware that you have.  If your access point simply allows for multiple SSID’s then that is great from a bandwidth perspective.  Not so great from a security perspective as the data from those SSID’s is shared on the same subnet/network uplink from that access point.  SSID ‘one’ computers would be able to directly access SSID ‘two’ computers.

Ok  ok; I bought the most expensive access point from Cisco where money wasn’t an issue.  Now what?  Well you most likely don’t have to purchase the most expensive one to get the multi-SSID and multi-VLAN options.  Even my 10 year old wireless B/G access point has software loaded on it to support the security we desire.  What we are going for is quite simply a mapping of SSID ‘one’ to VLAN ‘one’ as well as SSID ‘two’ to VLAN ‘two’ on the same access point.  Of course the implementation will be different from vendor to vendor but the concept is the same.

You can treat each one of these network setups as independent setups for the needs of the department by only have one or two access points for their area of the building.  Why does this matter in the security realm?  It matter big time.  When trying to track down the source of someone breaking into your wireless network, it is a bit easier to track down one side of the building than it is to track down an intruder over a multi-acre building.  It can also help with management depending on your setup.  For some implementations it could be easy to say one config for 3 access points and another config for 3 other access points.  This allows easier management of any ACL’s or routing that needs to happen.  In other environments it may be easier to say all access points require the same config so that you only have to manage one config file.

In the end it all comes back to security in the form of layers.  Sure it may be easy to setup the company on one SSID that spans the building but then you take on the security risks associated with that setup.  For additional cost you can setup a robust wireless solution allowing additional bandwith as well as security from one department to the next.  What level of risk are  you willing to take on?

Security+ Topic - DoS

Protocols are the lifeblood of the internet as they carry the traffic from host A to host B. There are a variety of protocols and each have a specific function in order to accomplish the task at hand. There are way to many protocols to cover in this blog post but for the sake of at least covering a few of them, the most common you will deal with are tcp, udp, icmp, rip, ospf, etc. Each one of these can be used in an attack by modifying their original properties to do something they were not originally designed to do.


One of the very visible to the world type of attacks is the Denial of Service attack. The main goal of the Denial of Service attack is deprive users from being able to access a resource. Services become interrupted and productivity is lost. In this type of attack there usually isn't the goal of destroying any data. Its more of being an annoyance for the network under attack.


Why should you care about DoS when you arn't that big of a company?


It goes back to how much money is lost when your company is dead to the internet due to a denial of service. One of the big issues here is if your company utilized Voip technology to talk to the rest of the world. Does your Voip trunk use the same uplink to the world as your data network? If it does then you could have some major issues with customer complaints when they are unable to talk to someone while your site is down. The secondary effect of bringing your site down is the reputation you hold with your customers. If they are unable to access your site when they want to then they may think you went out of business or arn't stable enough to be a business partner.


Sometimes these attacks arn't based soley on the consumption of bandwidth but on the clogging of your web server or mail server. When your web server is only able to handle a certain amount of traffic and suddenly that limit is reached, legitimate traffic will be ignored while the server tries to deal junk traffic and discard it. In the case of the mail server, the queue could be so built up with random massive amounts of email junk that other mail servers are unable to connect and send legitimate emails. If you have a policy of a 24 hour fix-or-free on issues then all an attacker has to do is keep it up for a day or so and cause financial harm to your business. Generally speaking most DoS attacks happen for days at a time.


I will cover DDoS at another time (didn't want to leave you hanging) which will allow me to get into a little bit of depth when it comes to a regular Denial of Service. Three of the mail types of DoS is the SYN flood, smurf, and ping of death. Ping of death isn't that common anymore but the basics of it is that the ping is so big it causes the system to crash as it can't handle such a large packet.


The other attacks are of concern as the SYN flood attack simply floods your server half-open connections. As your server tries to deal with these the server can overwhelmed and start to ignore legitimate traffic. Eventually they will time out but usually the attack continues so long that when a new connection becomes available, it is quickly filled with another SYN flood.


Generally speaking you need to be aware of these issues so that when you see problems happening on your network you know what they are. Keep a keen eye on your log files and watch for abnormal traffic. Heck, even invest in an IDS :)

-- Joe McShinsky