IP For Broadcast Engineers

IP for Broadcast Engineers Basic Security and IPv6 Kit Peters KMOS Channel 6 / KTBG 90.9 FM University of Central Missouri [email_address]

Why Security? - It's all computers nowadays
More and more, broadcast equipment is moving toward specialized software on commodity PC hardware
These computers are running standard operating systems (Windows XP, Linux)
The vendor may not have "locked down" the OS appropriately
A particular piece of essential broadcast equipment might just be a PC running something like Winamp, or Burk's AutoPilot software

Why Security? - Protect vital equipment
Keep your equipment from going down at an inappropriate time
Example: CE from KPLU in Tacoma, WA reports that he had a student put a Win2K box on the network for web stream encoding. There was no firewall in place protecting the box from the outside world. Within half an hour, the machine was running very slowly, and turned out to be “infected with half a dozen kinds of malware”.
Another station had its ContentDepot (NPR) storage receiver hacked within minutes of putting it on the campus network

Why Security? - Keep IT off your back!
We have enough to deal with during the work day (however long that might be)
If malware (i.e. software you don't want on your network for whatever reason) or viruses are on your network - or IT think that's the case - they will start to breathe down your neck quite heavily.
They might even decide to "fix" things their way, which could cause more problems with your equipment

Why Security? - Keep control of your signal
Keep unauthorized people from messing with the settings of your equipment
Your web stream goes from 128 kbps to 16 kbps
Your audio processor switches from "Rock" to "Talk"
Keep people from stealing your bandwidth
If you're using IP for an STL solution, and someone is hogging your bandwidth, your broadcast signal quality could rapidly drop

Where do attacks come from?
An attack could come from outside or inside your network
A compromised computer - say someone who opened an email they ought not to have done
Someone looking to show off their cracking skills
Someone with a grudge against your station
Someone who is simply bored

Background: the OSI Model
Models networks from bare wire up to application
A series of layers, where each layer is a higher abstraction of what's going on
Each layer serves the one above it
"It's only a model"

Background: OSI model layers
Physical: physical connection of hardware to the network. A cable in an Ethernet jack
Data Link: transferring data between devices connected to the network. A LAN.
Network: transferring data between networks. Two LANs connected via a router. IP.
Transport: Transferring data between end users. TCP, UDP.
Session: manages connections between applications. TCP fits in here as well.
Presentation: takes data from one application and presents it in a format the other understands
Application: the end user
We're mostly concerned with Layer 3

Background: IP packets
Packet
A package full of data
Contents:
Source address
Destination address
Other useful stuff (checksums and the like)
Data
Small - the size varies, but tends to be between 576 and 1500 bytes

Background: IP addresses
An IP address uniquely identifies a device connected to an IP network
IP address must be unique on that network
If routeable (more on this later), should be globally unique
An integer
Formats:
IPv4: 0-255.0-255.0-255.0-255
corresponds to a 32-bit integer from 0 - (2 32 - 1)
IPv6: 8 groups of hexadecimal integers, 0 - FFFF, separated by colons
corresponds to a 128-bit integer from 0 - (2 128 - 1)
Written, can be compressed a bit - two or more consecutive groups of zeroes may be represented by "::", and leading zeroes in a group may be omitted

Background: IP Networks
A network is a collection of devices that share a logical wire
Identified by an IP address and subnet mask
The subnet mask defines how many IP addresses are on the network
A special type of address, the "broadcast" address, is used by a device to call out to all devices on the network at once. This is used to translate IP addresses (Layer 3) to physical (Layer 2, e.g. an Ethernet MAC address) addresses
Two networks can be connected by means of routing

Background: IP routing
Routing is the process of allowing two distinct IP networks to talk to each other without putting them on the same logical wire.
A router is a device that is connected to multiple networks and knows which IP addresses are on each (by the IP / subnet mask combination)
Certain predefined ranges of IP addresses are "non-routeable". If a router sees a packet bound for an IP address in one of those ranges, it will drop that packet. This makes them useful for local networks that don’t need to be accessed from outside (the router ignores local traffic).

Background: Protocols running on top of IP
You may have heard of these...
TCP
Transmission Control Protocol
"Connected" - makes sure that a given packet reaches its destination
UDP
User Datagram Protocol
"Connectionless" - makes a "best effort" attempt to deliver packets, but doesn't confirm receipt
Real-time broadcast IP protocols (e.g. RTP (audio over IP), SIP (Skype, Internet telephony)) run over UDP

Background: Protocols running on top of IP (continued)
One thing TCP and UDP have in common: ports
A port number is an integer from 0 - 65535 (2 16 - 1)
Allows several applications to "listen" to different ports on the same IP address
Without ports, each IP service would need its own IP address

Security best practices for IP based devices
For PC's, these are in addition to the stuff IT is always telling you to do
Keep your virus scanner updated
Install security updates to your operating system as soon as they're released
Don't open attachments you're not expecting
Stay away from sketchy websites
For specialized broadcast equipment, install software updates from the manufacturer as soon as practical
Maintain a "healthy paranoia"
Isolate networks where practical
Make liberal use of firewalls

Security best practices: "Healthy Paranoia"
"An ounce of prevention is worth a pound of cure"
If you work under the assumption that someone, somewhere, is going to try and crack your network if they can, you won't get caught unawares when they do
Don't trust the vendor to make their device secure
Find a healthy balance between security and your business needs!

Security best practices: isolated networks
Why isolate your network(s)? If a cracker can't get to your device, they can't mess with it
Use non-routeable IP addresses
Keep networks as small as practical - remember that you can have more than 16 million IP's (and that's IPv4) if you use non-routeable IP ranges
Don't connect two networks - physically or logically - unless you need to

Security best practices: Firewalls
A firewall is a device that blocks access to devices behind it
If a device must be connected to the public Internet, put it behind a firewall
Only open those ports on the firewall that are strictly necessary
Use software firewalls (i.e. Windows Firewall, iptables) for individual computers
Use dedicated firewalls for networks

IPv6: Threat or Menace?
It's not that bad!
IPv6 is the next version of IP
Provides for ~3.4 x 10 38 possible addresses vs 4.3 billion in IPv4
Might actually happen soon
The last blocks of IPv4 addresses were handed out in February

IPv6: Do I need to convert?
Do I need to convert?
Only devices connected to the public Internet will need to convert
Until the conversion is complete, mechanisms will be in place to allow IPv4 hosts and IPv6 hosts to interconnect
Is this somebody else's problem?
This can probably be handled by your IT staff, but you should be aware of it in case this falls in your lap.
If you don’t have an IT staff, you can always hire a contractor.

IP For Broadcast Engineers

by Kit Peters on Apr 22, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

Statistics

IP For Broadcast Engineers — Presentation Transcript