Security+ Topic - Vulnerability vs Penetration Testing

I had a college classmate who was in computer security penetration testing business.  I always wondered what that must be like and finally got a small taste of it when I started using scanning tools on my own network.  I say that I only got a sample of it because I wasn't really don't any penetration testing at all.  What I was doing is simply looking for any potential vulnerabilities.  There is a big difference between them of which I am going to go over here.

Starting with the vulnerability scanning, this is the easiest thing that you can do.  It starts with a basic scan of a network looking for any ports that may be open or any servers that you may be able to get access to.  By scanning the network for open ports, you could identify a rogue ftp server or someone has setup a personal file server not allowed by company policy.  This plays into the vulnerability scanning due to any old software that these systems may be running.  It doesn't even have to be a rogue device either as you can scan your own equipment to see if there is anything showing on the network that should be.

A scan of the network can be much more than just a scan.  A vulnerability scan is where you start to get into the meat of a simple port scan.  For basic network processing it is required that the listening software report back certain version or function information so that the software wanting to talk to the listening port knows what or how to communicate.  The vulnerability scan will utilize that information against an internal database of vulnerabilities it is aware of.  As an example, the code that it gets back could indicate an outdated FTP server that when certain attacks are performed, it allows login without password.  The information gained could also give away the operating system so that an attacker may know where to start on some specific attacks.  At this point in the game the vulnerability scanning is all about information gather.  Gathering for the bad guys to find a hole or gathering for the good guys to prevent a hole from being exploited.

Now comes the next part of the penetration testing.  Taking all of the previous information we can then push forward with actually breaking or getting into a remote system.  Penetration testing is simply the act of using exploited code or brute forcing your way through a barrier.  Sometimes an attacker can do a scan of the system and find that remote desktop is open.  Then they brute force their way into the system via the remote desktop protocol.  Another scenario is that the previous scan finds an exploit where if they pass certain code to the remote desktop protocol, it overloads the service and then allows passwordless login.  Penetration testing can get quite in-depth and so the actual work could be performed by you or a penetration test company.  Usually these companies do a great job as they don't care what you have in place.  What I mean by that is you may have some unsecure way to initially connect and then use a secure method to go through the WAN.  Well, that penetration company will try anything and if they find the hole you left open even though you thought it was secure then you can bet on it eventually being exploited by the bad guys.  Better for an unbiased company to find it and report it to you than deal with a security breach.

Security+ Topic - NAT

Network address translation was developed to provide one public network address to many internal private network nodes.  In the realm of network security this becomes a big part of layered security.  Any nodes that are behind the network translation device is then easily hidden from everything else on public side of the network.  For full disclosure, NAT in generic terms is a thrown around acronym for network address translation in combination with port address translation.  A google search can give you some good information about the two in combination as that overview is outside the scope of this blog article.

Take for example a small business network with limited finances to put forward on network security.  A network address translation solution is perfect for them as it requires minimal effort.  Another assumption here is that the small business has a DSL or Cable modem as their primary mode of internet connection.  It doesn’t have to be limited to it but makes the example easy to understand.  Using only one consumer grade router (used loosely) that comes standard with network address translation, the business can place their publicly facing server directly connected to the ISP router.  Any ports being forwarded to provide services can be done on the ISP router and makes for easy management.  Then the second router in the environment has its uplink/isp port plugged into another LAN port on the same ISP router.  Company desktops or laptops are then plugged into this second router and are invisible to the public facing server.  As far as the server is concerned, all requests from the company users comes from the uplink address on the second router.

As a company grows they are then able to expand on this idea while still keeping things cheap for the company.  Lets say the company has grown enough for them to have a sales department in addition to their developers.  You wouldn’t want them on the same network as its best practice to keep everyone on their own subnet.  With the purchase of just one more router, plugged into another LAN port on the ISP router, instantly provides another security boundary with its own network.  Each network will be able to reach the servers plugged into the ISP router without easy access to the other network.  Port forwarding could be put in place for any special needs but you need to practice good security setup and only allow through what is absolutely needed.  There is a server on the shared network that can be used as the central hub for any cross-network functions.

Obviously if the company has hit the point of needing to expand even further than a different solution would be needed such as dedicated Cisco router and firewall put in place.  One thing to also note is that by default each network may have the same addressing.  192.168.0.x would be the most common.  As part of setup and easier troubleshooting, each add-on router should have its internal DHCP setup into a different scope.  Example router 1 having internal addressing of 172.16.1.x and router 2 internal addressing of 172.16.2.x would work well.

The security aspect of the network visibility works in reverse as well.  If for some reason the servers directly connected to the ISP router become compromised, they will have no easy way to see any of the user computers behind the router.  Of course if the router you are putting users behind has a flaw to allow them GUI/TUI access then they could create a hop into the network or forward ports as  needed.  Either way the added layer of security provided for cheap makes for a great addition for small businesses.

Security+ Topic - Access Control Lists

When we talk about network and system security, there is an increasing thought of complicated attack scenarios with complex routines written for defending against it.  Sure there may be some complex attacks out there that we should prevent but lets get back to basics for a moment.  What is the one most simple thing that you can do to keep your network resources safe?  Access Control Lists.

Some environments could have an awesome firewall in place that takes care off all their security requirements and some environments could simply have a DSL router.  In either and any case, they can benefit from access control lists setup to prevent any number of network traffic.  In the simplest of terms lets take a scenario with two network segments.  One for servers and one for users.  Normally your users only need specific access to the servers so you would allow one or two ports into your server network from your users network.  Sounds like a firewall right?  Yes an ACL is similar to your firewall in this scenario.  An ACL take it a bit further though on the router level so that traffic gets dropped before it even hits a network or host.

When the environment gets a bit larger though is when a dedicated firewall will be an ideal solution for sorting what traffic is allowed to which networks.  Still though an access control list is very important.  Security is all about layers right?  So why not layer your firewall to specific access as it travels through the network.  It may not be as granular so that your router can focus on routing instead of firewall rules.  One example here is that you could put an ACL in place to block everything but outbound stateful connections on port 80 for a specific department.  Then set your fancy firewall to filter the URL’s or destinations that are trying to be reached.  This allows a drop in network traffic from even attempting escape from their network as well as reducing firewall load so that it can focus on the HTTP traffic.

This brings up ACL’s as part of a security breach network wide.  An access control list can be put in place to block ICMP traffic between networks but OK to the router.  If one machine gets compromised and the malicious user simply tries to ping  hosts for where to make their next attack, then you have slowed their host discovery and possibly eliminated the threat if they rely on that ping response for their next attack.  One common scenario you may encounter is a SQL server physically or logically behind an internet facing server.  The server would only have one network connection to a second NIC on the internet facing server making it look as if it were much more secure on an isolated network.  Again back to layers of security, a network ACL could be put into place here allowing only specific items through so if something does get compromised the attacker wouldn’t have one more layer to break before being able to move compromised data out of your network.

Are access control lists perfect?  No.  That is why there are network firewalls, IDS, IPS, and a slew of technologies available.  Are the still relevant?  YES!  Adding this layer of security is very important as every layer counts.  Most of the time it is already built into your network routing products so you may as well use it!