2.
Introduction
What is security?
Why do we need security?
Common security attacks and countermeasures
Firewalls
Intrusion Detection Systems
Denial of Service Attacks
Conclusion
2
3.
The term Security refers to a range from data protection
to protect from unauthorized access.For each company is
different, you might find some existing models, but it
will always fit your case.
New threats emerge every month, quickly followed by
new protection methods ,so it's a never ending task.
3
4. Freedom from risk or danger; safety.
Freedom from doubt, anxiety, or fear; confidence.
Something that gives or assures safety, as:
1. A group or department of private guards: Call building security if a
visitor acts suspicious.
2. Measures adopted by a government to prevent espionage, sabotage, or
attack.
3. Measures adopted, as by a business or homeowner, to prevent a crime
such as burglary or assault: Security was lax at the firm's smaller plant.
4
5.
Protect vital information while still allowing access to
those who need it
Trade secrets, medical records, etc.
Provide authentication and access control for resources
Ex: AFS
Guarantee availability of resources
5
6.
Finding a way into the network
Firewalls
Exploiting software bugs, buffer overflows
Intrusion Detection Systems
Denial of Service
Ingress filtering, IDS
Packet sniffing
Encryption (SSH, SSL, HTTPS)
6
7.
Basic problem – many network applications and
protocols have security problems that are fixed over time
Difficult for users to keep up with changes and keep host
secure
Solution
▪ Administrators limit access to end hosts by using a firewall
▪ Firewall is kept up-to-date by administrators
7
8.
A firewall is like a castle with a drawbridge
Only one point of access into the network
This can be good or bad
Can be hardware or software
Ex. Some routers come with firewall functionality
8
9.
Used to monitor for “suspicious activity” on a network
Can protect against known software exploits, like buffer
overflows
Uses “intrusion signatures”
Well known patterns of behavior
▪ Ping sweeps, port scanning, web server indexing, OS fingerprinting,
DoS attempts, etc.
However, IDS is only useful if contingency plans are in place
to curb attacks as they are occurring
9
10.
Purpose: Make a network service unusable, usually by
overloading the server or network
Many different kinds of DoS attacks
SYN flooding
SMURF
10
11. SYN flooding attack
Send SYN packets with bogus source address
Why?
Server responds with SYN ACK and keeps state about TCP half-open
connection
Eventually, server memory is exhausted with this state
Solution: use “SYN cookies”
In response to a SYN, create a special “cookie” for the connection, and
forget everything else
Then, can recreate the forgotten information when the ACK comes in from
a legitimate connection
11
12. Smurf attack
In a Smurf attack, the attacker sends ping requests directed to a
broadcast address, with the source address of the IP datagram set to
the address of the target system under attack (spoofed source
address).
All systems within the broadcast domain will answer back to the
target address, thus flooding the target system with ICMP traffic
and causing network congestion => little or no bandwidth left for
legitimate users.
12
13.
Security is a very difficult topic. Everyone has a different idea of
what ``security'' is, and what levels of risk are acceptable.
The key for building a secure network is to define what security
means to your organization . Once that has been defined, everything
that goes on with the network can be evaluated with respect to that
policy.
Projects and systems can then be broken down into their
components, and it becomes much simpler to decide whether what
is proposed will conflict with your security policies and practices.
13
