Security+ Topic - Wireless Networks

One of the most simple ways that you can create a security boundary on your wireless network is to not only logically separate the wireless clients but to also “physically” separate them as well.  Most of the time we see access points setup through an environment on the same SSID so that as people walk through a building there is a seamless transition and the network is available anywhere they go.  What happens when you have to add a layer of security to this environment?  What happens when manufacturing wants this same functionality as the support department?

Lucky for us we can have multiple SSID’s mapped to VLAN’s quite easily…. depending on your hardware.  Lets break that scenario down a little bit by going to older methods first.  If your hardware doesn’t support multiple SSID’s or multiple VLAN’s then your only option is to have double, triple, etc access points in your wireless environment.  Each department will be dedicated to that SSID and each access point will have a dedicated connection back to your switch which will implement the VLAN setup.  Simple….ish until you have to provide for multiple departments as that increases hardware cost and additional cabling.

What about that multi-SSID access point you have?  Again it depends on the level of the hardware that you have.  If your access point simply allows for multiple SSID’s then that is great from a bandwidth perspective.  Not so great from a security perspective as the data from those SSID’s is shared on the same subnet/network uplink from that access point.  SSID ‘one’ computers would be able to directly access SSID ‘two’ computers.

Ok  ok; I bought the most expensive access point from Cisco where money wasn’t an issue.  Now what?  Well you most likely don’t have to purchase the most expensive one to get the multi-SSID and multi-VLAN options.  Even my 10 year old wireless B/G access point has software loaded on it to support the security we desire.  What we are going for is quite simply a mapping of SSID ‘one’ to VLAN ‘one’ as well as SSID ‘two’ to VLAN ‘two’ on the same access point.  Of course the implementation will be different from vendor to vendor but the concept is the same.

You can treat each one of these network setups as independent setups for the needs of the department by only have one or two access points for their area of the building.  Why does this matter in the security realm?  It matter big time.  When trying to track down the source of someone breaking into your wireless network, it is a bit easier to track down one side of the building than it is to track down an intruder over a multi-acre building.  It can also help with management depending on your setup.  For some implementations it could be easy to say one config for 3 access points and another config for 3 other access points.  This allows easier management of any ACL’s or routing that needs to happen.  In other environments it may be easier to say all access points require the same config so that you only have to manage one config file.

In the end it all comes back to security in the form of layers.  Sure it may be easy to setup the company on one SSID that spans the building but then you take on the security risks associated with that setup.  For additional cost you can setup a robust wireless solution allowing additional bandwith as well as security from one department to the next.  What level of risk are  you willing to take on?

Security+ Topic - DoS

Protocols are the lifeblood of the internet as they carry the traffic from host A to host B. There are a variety of protocols and each have a specific function in order to accomplish the task at hand. There are way to many protocols to cover in this blog post but for the sake of at least covering a few of them, the most common you will deal with are tcp, udp, icmp, rip, ospf, etc. Each one of these can be used in an attack by modifying their original properties to do something they were not originally designed to do.


One of the very visible to the world type of attacks is the Denial of Service attack. The main goal of the Denial of Service attack is deprive users from being able to access a resource. Services become interrupted and productivity is lost. In this type of attack there usually isn't the goal of destroying any data. Its more of being an annoyance for the network under attack.


Why should you care about DoS when you arn't that big of a company?


It goes back to how much money is lost when your company is dead to the internet due to a denial of service. One of the big issues here is if your company utilized Voip technology to talk to the rest of the world. Does your Voip trunk use the same uplink to the world as your data network? If it does then you could have some major issues with customer complaints when they are unable to talk to someone while your site is down. The secondary effect of bringing your site down is the reputation you hold with your customers. If they are unable to access your site when they want to then they may think you went out of business or arn't stable enough to be a business partner.


Sometimes these attacks arn't based soley on the consumption of bandwidth but on the clogging of your web server or mail server. When your web server is only able to handle a certain amount of traffic and suddenly that limit is reached, legitimate traffic will be ignored while the server tries to deal junk traffic and discard it. In the case of the mail server, the queue could be so built up with random massive amounts of email junk that other mail servers are unable to connect and send legitimate emails. If you have a policy of a 24 hour fix-or-free on issues then all an attacker has to do is keep it up for a day or so and cause financial harm to your business. Generally speaking most DoS attacks happen for days at a time.


I will cover DDoS at another time (didn't want to leave you hanging) which will allow me to get into a little bit of depth when it comes to a regular Denial of Service. Three of the mail types of DoS is the SYN flood, smurf, and ping of death. Ping of death isn't that common anymore but the basics of it is that the ping is so big it causes the system to crash as it can't handle such a large packet.


The other attacks are of concern as the SYN flood attack simply floods your server half-open connections. As your server tries to deal with these the server can overwhelmed and start to ignore legitimate traffic. Eventually they will time out but usually the attack continues so long that when a new connection becomes available, it is quickly filled with another SYN flood.


Generally speaking you need to be aware of these issues so that when you see problems happening on your network you know what they are. Keep a keen eye on your log files and watch for abnormal traffic. Heck, even invest in an IDS :)

-- Joe McShinsky

Security+ Topic - AAA

AAA, no not alcoholics anonymous after-party! We are talking about Authentication, Authorization, and Accounting. These three things are the key components to how users and other services are able to work in conjunction with each other.


Authentication is the process where the server tries to correctly identify the user or system service in order to process further requests. This could be for secured information or services that require elevation to run. As of this writing there isn't anything as drastic as a blood sample to determine who you are but there are some cool technologies such as retina scanning that can provide for highly accurate detection of the correct authentication. Even still, the most basic way to provide the authentication is a simple username and password.


Authorization is the level of access that a user is given. The resources available at that level could be files or system processes.


Accounting is the process for which log files are created after events occur. Depending on the set detail level, the logs could contain simple timestamps or other more detailed actions that happened.


When it comes to the security of your credentials there are some basic rules to cover. They may seem redundant but in my history as a Network Administrator it astounds me that some people still don't see the importance of a complex password.

• Never write it down!
  
• Use a different password for different systems/websites
  
• Minimum 8 characters long
  
• Use at least one of each: Uppercase, Lowercase, Number, Special Characters
  
• Change passwords ideally every 60 days, minimum twice a year
  
• Never use the same password
  

The main issue that I run into when dealing with people setting passwords is that they cannot remember it very easily. The complexity requirements are so high that even after they type it in, they forget it almost right away. To help with this situation, try to remember a phrase or song that you like and base the password off of the that. “Mary had a little lamb, her fleece was white as snow” = mh@L1h5WW@$ It sure looks complicated when you look at it but try singing the song as you look at the characters. It becomes quite simple after that. Also notice that it has all the requirements listed above. It is the passwords like this that will keep people from guessing it, and brute force attempts at bay.


One thing to mention here is the use of substitution. In the password above I used some common substitutions such as @ for a and $ for s. While this is ok to certain extent, you wouldn't want to make something obvious into a substitution. Take my last name of McShinsky. M3$h1n$kY would be a poor choice as it would be easy for an attack to make substitutions of the letters in my name when attempting to guess my password.


Lastly I would like to comment on password managers. Are they right for you? In some cases they can be. It is possible for you to never know the password to your websites you visit. A password manager could generate a very complex password and then remember it for the next time you visit the site. The passwords would never be the same between sites and even if one site got compromised, there would be no way to use that password to log into any other sites you visit.

-- Joe McShinsky