This document discusses network security. It begins by defining security and explaining why security is needed to protect vital information while allowing authorized access. Common security attacks like firewalls, intrusion detection systems, and denial of service attacks are described along with countermeasures. The conclusion emphasizes that security means different things to different organizations and the key is defining a security policy to evaluate all network activities and components.

1. 1

2. 
Introduction

What is security?

Why do we need security?

Common security attacks and countermeasures
 Firewalls
 Intrusion Detection Systems
 Denial of Service Attacks

Conclusion
2

3. 
The term Security refers to a range from data protection
to protect from unauthorized access.For each company is
different, you might find some existing models, but it
will always fit your case.

New threats emerge every month, quickly followed by
new protection methods ,so it's a never ending task.
3

4.  Freedom from risk or danger; safety.
 Freedom from doubt, anxiety, or fear; confidence.
 Something that gives or assures safety, as:
1. A group or department of private guards: Call building security if a
visitor acts suspicious.
2. Measures adopted by a government to prevent espionage, sabotage, or
attack.
3. Measures adopted, as by a business or homeowner, to prevent a crime
such as burglary or assault: Security was lax at the firm's smaller plant.
4

5. 
Protect vital information while still allowing access to
those who need it
 Trade secrets, medical records, etc.

Provide authentication and access control for resources
 Ex: AFS

Guarantee availability of resources
5

6. 
Finding a way into the network
 Firewalls

Exploiting software bugs, buffer overflows
 Intrusion Detection Systems

Denial of Service
 Ingress filtering, IDS

Packet sniffing
 Encryption (SSH, SSL, HTTPS)
6

7. 
Basic problem – many network applications and
protocols have security problems that are fixed over time
 Difficult for users to keep up with changes and keep host
secure
 Solution
▪ Administrators limit access to end hosts by using a firewall
▪ Firewall is kept up-to-date by administrators
7

8. 
A firewall is like a castle with a drawbridge
 Only one point of access into the network
 This can be good or bad

Can be hardware or software
 Ex. Some routers come with firewall functionality
8

9. 
Used to monitor for “suspicious activity” on a network
 Can protect against known software exploits, like buffer
overflows

Uses “intrusion signatures”
 Well known patterns of behavior
▪ Ping sweeps, port scanning, web server indexing, OS fingerprinting,
DoS attempts, etc.

However, IDS is only useful if contingency plans are in place
to curb attacks as they are occurring
9

10. 
Purpose: Make a network service unusable, usually by
overloading the server or network

Many different kinds of DoS attacks
 SYN flooding
 SMURF
10

11. SYN flooding attack

Send SYN packets with bogus source address
 Why?

Server responds with SYN ACK and keeps state about TCP half-open
connection
 Eventually, server memory is exhausted with this state

Solution: use “SYN cookies”
 In response to a SYN, create a special “cookie” for the connection, and
forget everything else
 Then, can recreate the forgotten information when the ACK comes in from
a legitimate connection
11

12. Smurf attack

In a Smurf attack, the attacker sends ping requests directed to a
broadcast address, with the source address of the IP datagram set to
the address of the target system under attack (spoofed source
address).

All systems within the broadcast domain will answer back to the
target address, thus flooding the target system with ICMP traffic
and causing network congestion => little or no bandwidth left for
legitimate users.
12

13. 
Security is a very difficult topic. Everyone has a different idea of
what ``security'' is, and what levels of risk are acceptable.

The key for building a secure network is to define what security
means to your organization . Once that has been defined, everything
that goes on with the network can be evaluated with respect to that
policy.

Projects and systems can then be broken down into their
components, and it becomes much simpler to decide whether what
is proposed will conflict with your security policies and practices.
13

14. 14