february 2, 2004 cissp prep, university of buffalo domain 2b - 2004 1 cissp review course domain 2b:...

February 2, 2004CISSP Prep, University of Buffalo

Domain 2b - 20041

CISSP Review Course

Domain 2b:

Telecommunications and

Network Security

This presentation includes a compendium of slides, both original and gathered from various public information sources and is not intended for use by any for-profit individuals or organizations


Domain 2b - 20042

Domain Objective:Telecommunications and Network Security

The objective of this domain is to understand:• data communications in terms of physical and logical

networks, including local area, metropolitan area, wide area, remote access, Internet, intranet, extranet, their related technologies of firewalls, bridges, routers, and the TCP/IP and OSI models

• communications and network security as it relates to voice, data, multimedia, and facsimile

• communications security management techniques that prevent, detect, and correct errors

We will cover most, but not all of these areas in this review


Domain 2b - 20043

Domain Summary:Telecommunications and Network Security

The telecommunications and network security domain is a very significant part of the CBK. The information for this domain typically represents 15% of the CISSP exam content and includes the structures, transmission methods, transport formats, and security measures used to provide and ensure the integrity, availability, authentication, and confidentiality of transmissions over private and public communications networks.


Domain 2b - 20044

Last Session:Network Structure

• OSI Model• Internet Protocols• Network Devices• Network Topologies• Internet Protocol• LAN Topologies• Access Technologies


Domain 2b - 20045

This Session:

• Internet, intranet, extranet, & remote access, their related technologies of firewalls, Proxy servers, and controls

• communications security management techniques that prevent, detect, and correct errors


Domain 2b - 20046

Internet/Intranet/Extranet

• Internet- global network of public networks and service providers

- uses TCP/IP protocol

• Intranet internal network of WAN- used for connecting to private web pages, internal web sites,

internal web applications

• Extranet – segment of WAN physically or logically isolated from the other

WAN segments

- activities on segment are considered untrusted


Domain 2b - 20047

Firewall Terms

Network address translation (NAT) Internal addresses unreachable from external

network

DMZ - De-Militarized Zone Hosts that are directly reachable from untrusted

networks

ACL - Access Control List can be router or firewall term


Domain 2b - 20048

Firewall Terms

• Choke, Choke router– A router with packet filtering rules (ACLs) enabled

• Gate, Bastion host, Dual Homed Host– A server that provides packet filtering and/or proxy

services

• proxy server– A server that provides application proxies


Domain 2b - 20049

Firewall Types

Packet-filtering router Most common Uses Access Control Lists (ACL)

Port Source/destination address

Screened host Packet-filtering and Bastion host Application layer proxies

Screened subnet (DMZ) 2 packet filtering routers and bastion host(s) Most secure


Domain 2b - 200410

Firewall Types

• boundary routers- provide entry to and from network perimeters

- permit or deny predefined network traffic

- forward permitted traffic from a secure device

• secure gateways- enforce network security policy between two or more networks

- usually a firewall type device

- used for central network administration

- circuit level – application level using TCP without additional processing

- application level – proxy service


Domain 2b - 200411

Firewall Mechanisms

Stateful Inspection State and context analyzed on every packet in

connection

Proxy servers Intermediary Think of bank teller


Domain 2b - 200412

Proxies

– Defined: A server acts on behalf of your or your PC to increase security or accelerate data flow.

– Types of Proxies• Forward Proxy - many internal clients to one external

server.• Reverse Proxy - many external clients to one internal

server.


Domain 2b - 200413

Proxies

• Brands of Proxies• Cisco • SUN / Netscape I-Planet• CacheFlow - Blue Jacket

• Examples of Proxies:• FTP Telnet HTTP SSH• Network Appliance• Microsoft ISA


Domain 2b - 200414

Intrusion Detection (IDS)

• Host or network based• Context and content monitoring• Positioned at network boundaries• Basically a sniffer with the capability to detect

traffic patterns known as attack signatures


Domain 2b - 200415

Web Security

• Secure sockets Layer (SSL) • Transport layer security (TCP based)• Widely used for web based applications• by convention, https:\\

• Secure Hypertext Transfer Protocol (S-HTTP)• Less popular than SSL• Used for individual messages rather than

sessions


Domain 2b - 200416

Web Security

• Secure Electronic Transactions (SET)• PKI• Financial data• Supported by VISA, MasterCard, Microsoft,

Netscape


Domain 2b - 200417

IPSEC

• IP Security• Set of protocols developed by IETF• Standard used to implement VPNs• Two modes• Transport Mode

• encrypted payload (data), clear text header• Tunnel Mode

• encrypted payload and header• IPSEC requires shared secret key & security

association


Domain 2b - 200418

Common Attacks

• This section covers common hacker attacks• No need to understand them completely,

need to be able to recognize the name and basic premise


Domain 2b - 200419

Spoofing

• TCP Sequence number prediction• UDP - trivial to spoof (CL)• DNS - spoof/manipulate IP/hostname pairings• Source Routing


Domain 2b - 200420

Denial of Service (DoS)

• Attempts to "flood" a network, thereby preventing legitimate network traffic

• Attempts to disrupt connections between two machines, thereby preventing access to a service

• Attempts to prevent a particular individual from accessing a service

• Attempts to disrupt service to a specific system or person

• Distributed Denial of Service (DDoS); multiple systems controlled to conduct the attack


Domain 2b - 200421

Sniffing

• Passive attack• Monitor the “wire” for all traffic - most effective

in shared media networks• Sniffers used to be “hardware”, now are a

standard software tool


Domain 2b - 200422

Session Hijacking

• Uses sniffer to detect sessions, get pertinent session info (sequence numbers, IP addresses)

• Actively injects packets, spoofing the client side of the connection, taking over session with server

• Bypasses I&A controls• Encryption is a countermeasure, stateful

inspection can be a countermeasure


Domain 2b - 200423

IP Fragmentation

• Use fragmentation options in the IP header to force data in the packet to be overwritten upon reassembly

• Used to circumvent packet filters


Domain 2b - 200424

IDS Attacks

• Insertion Attacks• Insert information to confuse pattern

matching• Evasion Attacks

• Trick the IDS into not detecting traffic• Example - Send a TCP RST with a TTL

setting such that the packet expires prior to reaching its destination


Domain 2b - 200425

Syn Floods

• Remember the TCP handshake?• Syn, Syn-Ack, Ack

• Send a lot of Syns • Don’t send Acks• Victim has a lot of open connections, can’t

accept any more incoming connections• Denial of Service


Domain 2b - 200426

Telecom/Remote Access Security

• Dial up lines are favorite hacker target• War dialing• social engineering

• PBX is a favorite phreaker target• blue box, gold box, etc.• Voice mail


Domain 2b - 200427

Telecommunications Security

• Facsimile Security • Technical controls - FAX encryptor and bulk data link encryption

• Management controls - activity and exception reports• Physical Access Controls

• Voice Mail Security• exposure to toll fraud if compromised• PINs should be generated randomly• unassigned or unused mailboxes removed• block access to transfer to local or long distance lines


Domain 2b - 200428

Telecommunications Security

• Private Branch Exchange (PBX) Security • PBX - a switching system that controls and manages a

companies physical phones and connections to the local telephone company

• security goal is to prevent unauthorized use, manipulation, or access of the switch, operating software, or system configuration

• security measures• detail call recording • control remote maintenance access• install strong passwords for system management• block all unassigned access codes


Domain 2b - 200429

Remote Access Security

• SLIP - Serial Line Internet Protocol• PPP - Point to Point Protocol

• SLIP/PPP about the same, PPP adds error checking, SLIP obsolete

• PAP - Password authentication protocol• clear text password

• CHAP - Challenge Handshake Auth. Prot.• Encrypted password


Domain 2b - 200430

Remote Access Security

• TACACS, TACACS+• Terminal Access Controller Access Control

System • Network devices query TACACS server to

verify passwords• “+” adds ability for two-factor (dynamic)

passwords• Radius

• Remote Auth. Dial-In User Service


Domain 2b - 200431

Virtual Private Networks

• PPTP - Point to Point Tunneling Protocol• Microsoft standard• creates VPN for dial-up users to access

intranet• IPSEC client

• Cisco Secure Client• Nortel VPN Client


Domain 2b - 200432

Transport Layer Protocols

• SSH - Secure Shell• allows encrypted sessions, file transfers• can be used as a VPN

• SSL – Secure Sockets Layer• Enables client/server applications to communicate,

minimizing the risk of eavesdropping, tampering or message forgery

• Provides data confidentiality, integrity control, server authentication and client authorization


Domain 2b - 200433

Tranport Layer Protocols

• Wireless Transport Layer Security (WTLS)• Security in the Wireless Application Protocol v1.2

users WTLS instead of standard SSL• Wireless gateway must user WTLS to secure the

channel to the wireless device and SSL to secure the channel from the destination web server.

• A security issue is that the information on the gateway is unencrypted.


Domain 2b - 200434

Application Layer Security Protocols

• Secure Hypertext Transfer Protocol (S-HTTP)• Supports fine grained application security, such

as:• Key distribution using shared secrets or PKI• Web-page specific encryption controls for

highly granular access control• Overshadowed by transport layer security

protocols such as Secure Socket Layer (SSL)• It is not the same as HTTPS, which is SSL running

under HTTP


Domain 2b - 200435

Application Layer Security Protocols

• Electronic Payment schemes• Examples are Ecash, Netcash, Mondex,

Cybercash• Secure Electronic Transaction (SET)

• SET provides payment protection but not link encryption

• Goal to provide worldwide payment card protocol• Authentication and non-repudiation of purchaser

and merchant


Domain 2b - 200436

Communications

• Security techniques to prevent detect, and correct errors for Confidentiality Integrity & Availability (CIA).

• Tunneling• VPN• IDS• Protocol & Packet Analyzers (Sniffers)


Domain 2b - 200437

Communications

• NAT• PAT• Hash• CRC• Transmission Logging, error correction,

retransmission


Domain 2b - 200438

Email Security

• Privacy• Ownership• Legal Liability• Financial communications• Personal email security versus business

email security


Domain 2b - 200439

Email SecurityEncryption - Personal Email

• Email has less security than a letter or postcard sent in the U.S. Mail.

• A postcard has nonrepudiation; a signature on the card identifies who sent the card.

• A letter has confidentiality; no one should be able to see inside the envelope

• A letter has integrity; tampering with the envelope should be noticed.


Domain 2b - 200440

Encryption - Personal Email

• Why would you want to encrypt or digitally sign your personal email?• Personal Privacy• Professional Association / Law Enforcement /

Information Security Company requires secure communications

• Identification • Credibility • Use latest technology


Domain 2b - 200441

Domain 2 Questions


Domain 2b - 200442

Domain 2 Practice Questions

Spoofing can be defined as:

A) Eavesdropping on communications between persons or processes

B) Person or process emulating another person or process

C) A hostile or unexpected entity concealed within another entity

D) The testing of all possibilities to obtain information


Domain 2b - 200443


The purpose of Nessus is to?

A) Close network security holes

B) Establish network audit trails

C) Identify vulnerabilities in networks

D) Exploit system-related vulnerabilities


Domain 2b - 200444


Which of the following is an attack specificallly against mail systems?

A) Smurf

B) SYN/Ack

C) Spam

D) Teardrop


Domain 2b - 200445


What role does biometrics have in logical access control?

A) Certification

B) Authorization

C) Authentication

D) Confidentiality


Domain 2b - 200446


How many types of intrusion detection engines are there?

A) One

B) Two

C) Three

D) Four

E) Seven


Domain 2b - 200447


Which protocol is commonly used to verify dial-up connections between hosts?

A) Unix-to-Unix Communication Protocol (UUCP)

B) Challenge Handshake Authentication Protocol (CHAP)

C) C) Point-to-Point Tunneling Protocol (PPTP)

D) D) Simple Key Management for Internet Protocol (SKIP)


Domain 2b - 200448


The UDP protocol is a connectionless and reliable service for applications?

A) True

B) False


Domain 2b - 200449


A) Firewall Types can be which of those listed below? (Choose all that apply)

B) Packet Filtering

C) Stateful Inspection

D) Application level Proxy

E) Personal

F) Circuit level Proxy


Domain 2b - 200450


Which form of firewall performs the highest level of control?

A) Packet Filtering

B) Stateful Inspection

C) Application level Proxy

D) Personal

E) Circuit level Proxy


Domain 2b - 200451


All implementations of IPSEC must support a Security Authentication?

A) True

B) False


Domain 2b - 200452


Telnet is the much preferred over SSH for it’s secure connection attributes.

A) True

B) False


Domain 2b - 200453


Wireless Security and Access control has which of the following as a noted security issue? (Choose all that apply)

A) Access Point Mapping

B) SSID Broadcasting

C) Compatibility between devices

D) Authentication

E) Encryption

F) Default Settings


Domain 2b - 200454


Network Disaster Prevention might include which of the following practices?

A) Redundant LAN routes

B) On demand WAN connections

C) Creation of a single point of failure for added redundancy

D) Use of Frame Relay

E) Leased line or T1 connections


Domain 2b - 200455


Use of Trivial File Transfer Protocol (TFTP) is a recommended practice for securing device configuration data?

A) True

B) False


Domain 2b - 200456


Which of the following RAID levels provide for server fault-tolerance?

A) RAID 1

B) BlackFlag Technique

C) RAID 5

D) RAID 0

E) RAID 10

february 2, 2004 cissp prep, university of buffalo domain 2b - 2004 1 cissp review course domain 2b:...

Documents

network security domain

network perimeterspermit

network security policy

network securitythe

security measures

remote access

public communications

internal web sites