Network and security

1. © 2016 NTT DATA, Inc. 1
Why do we need security ?
Protect vital information while still allowing access to
those who need it
Trade secrets, medical records, etc.
Provide authentication and access control for resources
Guarantee availability of resources

2. © 2016 NTT DATA, Inc. 2
Security attacks and countermeasures
Finding a way into the network
Firewalls
Exploiting software bugs, buffer overflows
Intrusion Detection Systems
Denial of Service
Ingress filtering, IDS
TCP hijacking
IPsec
Packet sniffing
Encryption (SSH, SSL, HTTPS)
Social problems
Education

3. © 2016 NTT DATA, Inc. 3
Secure administration principles
Rule-based management
A rule-based management is a system that comprises of a collection
of 'if-then' statements that employs a series of defenses, to which
rules are made on how to work on those assertions
Firewall rules
The Firewall helps a person getting his computer strong since it
puts up some wall against the attacks so one should surely go for
the firewall
VLAN management
Network segmentation with virtual local area networks (VLANs)
creates a collection of isolated networks within the data center.
Each network is a separate broadcast domain.VLAN segmentation
severely hinders access to system attack surfaces.

4. © 2016 NTT DATA, Inc. 4
Secure administration principles
Secure router configuration
One must change the default username and password in the router
manufacturer web pages to avoid hacking of the account information.
Must change the default SSID, a network name used by the access
points and routers, while configuring wireless security of the network
used
One has to enable the physical address or MAC address filtering; one
has to disable the SSID broadcast feature of the network.
Access control lists
An access control list (ACL) is a catalogue of access control entries
(ACE). In an ACL, each ACE identifies a trustee. It furthermore
specifies the access rights, to be allowed, denied or audited, of that
trustee

5. © 2016 NTT DATA, Inc. 5
Secure administration principles
Port Security
Port security mechanism is applied at interface level to block
unauthorized users to connect to network
Flood guards
Sometimes the data traffic at the security networks and checkpoints
goes to such unusual high volume that it signifies some
malfunctioning running at some other end. This unusual extra float of
traffic is referred as flood and the technology that is used to control
the system there is known as flood guard.
Loop protection
Loop is a network building problem basically. The switches in the
port are made so complex that the same node is used again and
again and thus the network forms a loop. By the loop formation the
ports gets jammed and thus the server either slows down or crashes.
STP is one of the loop avoidance technology

6. © 2016 NTT DATA, Inc. 6
Secure administration principles
Implicit deny
After the primary check-up is over and if no permit entry found for that
specific source automatically access to denied.
Network separation
The network is divided there for users or viewers or staff. Network is
segmented based on users.
Log analysis
This is an authentication tool used in networks to find out the user
specific tools or usage of the server.Thus is used to provide the
details of any user's work in a server. Again they can be used to
lock one user from using a tool or lock the operations that have
been done by that particular user,

7. © 2016 NTT DATA, Inc. 7
IT Threats
Threat- A potential cause of an incident that may result in harm to
a system or organization
Hardware and software failure - such as power loss or data
corruption
Malware - malicious software designed to disrupt computer
operation
Viruses - computer code that can copy itself and spread from one
computer to another, often disrupting computer operations
Spam, scams and phishing - unsolicited email that seeks to fool
people into revealing personal details or buying fraudulent goods
Human error - incorrect data processing, careless data disposal,
or accidental opening of infected email attachments.

8. © 2016 NTT DATA, Inc. 8
IT Threats
Hackers - people who illegally break into computer systems
Fraud - using a computer to alter data for illegal benefit
Passwords theft - often a target for malicious hackers
Denial-of-service - online attacks that prevent website access for
authorized users
Security breaches - includes physical break-ins as well as online
intrusion
Natural disasters and IT systems
Natural disasters such as fire, cyclone and floods also present risks to
IT systems, data and infrastructure.
Damage to buildings and computer hardware can result in loss or
corruption of customer records/transactions

9. © 2016 NTT DATA, Inc. 9
Mitigation strategies
Firewall configurations-Firewall configurations to be regularly reviewed
and ensure that only the absolutely necessary configuration is active.
When performing external penetration testing.
Network segmentation according to security levels-Along with
checking the firewall configuration, it is important to check that
segregation is working effectively across all network egress and ingress
points
Strong/Complex passwords-All users set strong passwords that go
beyond simply meeting the current password complexity criteria
Web applications-Along with regular web application penetration
testing, all applications should be securely coded using an appropriate
methodology

10. © 2016 NTT DATA, Inc. 10
Mitigation strategies
Limit admin privileges
Patch management
Usage of encryption technologies for user devices
Define network access,
Educate employees.
Inventory authorized & unauthorized devices and Users
Controlled network access based on risk posture
Continuous vulnerability assessment and remediation

11. © 2016 NTT DATA, Inc. 11
Application Attacks
ARP spoofing- is a type of attack in which a malicious actor sends
falsified ARP messages over a local area network.
A botnet- is a network of compromised computers under the control
of a malicious actor. Each individual device in a botnet is referred to
as a bot.
Cache poisoning- is a type of attack in which corrupt data is inserted
into the cache database of the Domain Name System (DNS) name
server.
Computer worms- are among the most common types of malware.
They spread over computer networks by exploiting operating system
vulnerabilities
Key loggers- or keystroke loggers are software programs or
hardware devices that track the activities (keys pressed) of a
keyboard.

12. © 2016 NTT DATA, Inc. 12
Malware- is short for “malicious software”: hostile applications that are created
with the express intent to damage or disable mobile devices, computers or
network servers.
A man-in-the-middle (MITM) attack- is a type of cyber-attack where a
malicious actor inserts him/herself into a conversation between two parties.
A rootkit- is a computer program designed to provide privileged access to a
computer while actively hiding its presence. Once a rootkit has been installed,
the controller of the rootkit has the ability to remotely execute files and change
system configurations on the host machine.
A spoofing attack- is when a malicious party impersonates another device or
user on a network in order to launch attacks against network hosts, steal data,
spread malware or bypass access controls.
Spyware- is any software that installs itself on your computer and starts
covertly monitoring your online behavior without your knowledge or permission
Application Attacks

13. © 2016 NTT DATA, Inc.
)
This document contains confidential Company information. Do not disclose it to third parties without permission from the Company.