END-TO-END NETWORK SECURITY: DEFENSE-IN-DEPTH
CONTENTS PART I INTRODUCTION TO NETWORK SECURITY SOLUTIONS CHAPTER OVERVIEW OF NETWORK SECURITY TECHNOLOGIES FIREWALLS NETWORK FIREWALLS NETWORK ADDRESS TRANSLATION (NAT) STATEFUL FIREWALLS DEEP PACKET INSPECTION DEMILITARIZED ZONES PERSONAL FIREWALLS VIRTUAL PRIVATE NETWORKS (VPN) TECHNICAL OVERVIEW OF IPSEC PHASE SSL VPNS INTRUSION DETECTION SYSTEMS (IDS) AND INTRUSION PREVENTION SYSTEMS (IPS) PATTERN MATCHING PROTOCOL ANALYSIS HEURISTIC-BASED ANALYSIS ANOMALY-BASED ANALYSIS ANOMALY DETECTION SYSTEMS AUTHENTICATION, AUTHORIZATION, AND ACCOUNTING (AAA) AND IDENTITY MANAGEMENT RADIUS TACACS+ IDENTITY MANAGEMENT CONCEPTS NETWORK ADMISSION CONTROL NAC APPLIANCE NAC FRAMEWORK ROUTING MECHANISMS AS SECURITY TOOLS SUMMARY PART II SECURITY LIFESTYLE: FRAMEWORKS AND METHODOLOGIES PREPARATION PHASE RISK ANALYSIS THREAT MODELING PENETRATION TESTING SOCIAL ENGINEERING SECURITY INTELLIGENCE COMMON VULNERABILITY SCORING SYSTEM BASE METRICS TEMPORAL METRICS ENVIRONMENTAL METRICS CREATING A COMPUTER SECURITY INCIDENT RESPONSE TEAM (CSIRT) WHO SHOULD BE PART OF THE CSIRT? INCIDENT RESPONSE COLLABORATIVE TEAMS TASKS AND RESPONSIBILITIES OF THE CSIRT BUILDING STRONG SECURITY POLICIES INFRASTRUCTURE PROTECTION STRONG DEVICE ACCESS CONTROL SSH VERSUS TELNET LOCAL PASSWORD MANAGEMENT CONFIGURING AUTHENTICATION BANNERS INTERACTIVE ACCESS CONTROL ROLE-BASED COMMAND-LINE INTERFACE (CLI) ACCESS IN CISCO IOS CONTROLLING SNMP ACCESS SECURING ROUTING PROTOCOLS CONFIGURING STATIC ROUTING PEERS AUTHENTICATION ROUTE FILTERING TIME-TO-LIVE (TTL) SECURITY CHECK DISABLING UNNECESSARY SERVICES ON NETWORK COMPONENTS CISCO DISCOVERY PROTOCOL (CDP) FINGER DIRECTED BROADCAST MAINTENANCE OPERATIONS PROTOCOL (MOP) BOOTP SERVER ICMP REDIRECTS IP SOURCE ROUTING PACKET ASSEMBLER/DISASSEMBLER (PAD) PROXY ADDRESS RESOLUTION PROTOCOL (ARP) IDENT TCP AND USER DATAGRAM PROTOCOL (UDP) SMALL SERVERS IP VERSION 6 (IPV6) LOCKING DOWN UNUSED PORTS ON NETWORK ACCESS DEVICES CONTROL RESOURCE EXHAUSTION RESOURCE THRESHOLDING NOTIFICATION CPU PROTECTION RECEIVE ACCESS CONTROL LISTS (RACLS) CONTROL PLANE POLICING (COPP) SCHEDULER ALLOCATE/INTERVAL POLICY ENFORCEMENT INFRASTRUCTURE PROTECTION ACCESS CONTROL LISTS (IACLS) UNICAST REVERSE PATH FORWARDING (UNICAST RPF) AUTOMATED SECURITY TOOLS WITHIN CISCO IOS CISCO IOS AUTOSECURE CISCO SECURE DEVICE MANAGER (SDM) TELEMETRY ENDPOINT SECURITY PATCH MANAGEMENT CISCO SECURITY AGENT (CSA) PHASED APPROACH ADMINISTRATIVE TASKS STAFF AND SUPPORT IDENTIFYING AND CLASSIFYING SECURITY THREATS NETWORK VISIBILITY TELEMETRY AND ANOMALY DETECTION NETFLOW ENABLING NETFLOW COLLECTING NETFLOW STATISTICS FROM THE CLI SYSLOG ENABLING LOGGING (SYSLOG) ON CISCO IOS ROUTERS AND SWITCHES ENABLING LOGGING CISCO CATALYST SWITCHES RUNNING CATOS ENABLING LOGGING ON CISCO ASA AND CISCO PIX SECURITY APPLIANCES SNMP ENABLING SNMP ON CISCO IOS DEVICES ENABLING SNMP ON CISCO ASA AND CISCO PIX SECURITY APPLIANCES CISCO SECURITY MONITORING, ANALYSIS AND RESPONSE SYSTEM (CS-MARS) CISCO NETWORK ANALYSIS MODULE (NAM) OPEN SOURCE MONITORING TOOLS CISCO TRAFFIC ANOMALY DETECTORS AND CISCO GUARD DDOS MITIGATION APPLIANCES INTRUSION DETECTION AND INTRUSION PREVENTION SYSTEMS (IDS/IPS) THE IMPORTANCE OF SIGNATURES UPDATES THE IMPORTANCE OF TUNING ANOMALY DETECTION WITHIN CISCO IPS DEVICES TRACEBACK TRACEBACK IN THE SERVICE PROVIDER ENVIRONMENT TRACEBACK IN THE ENTERPRISE REACTING TO SECURITY INCIDENTS ADEQUATE INCIDENT-HANDLING POLICIES AND PROCEDURES LAWS AND COMPUTER CRIMES SECURITY INCIDENT MITIGATION TOOLS ACCESS CONTROL LISTS (ACL) PRIVATE VLANS REMOTELY TRIGGERED BLACK HOLE ROUTING FORENSICS LOG FILES LINUX FORENSICS TOOLS WINDOWS FORENSICS POSTMORTEM AND IMPROVEMENT COLLECTED INCIDENT DATA ROOT-CAUSE ANALYSIS AND LESSONS LEARNED BUILDING AN ACTION PLAN PROACTIVE SECURITY FRAMEWORK IDENTITY AND TRUST AAA CISCO GUARD ACTIVE VERIFICATION DHCP SNOOPING IP SOURCE GUARD DIGITAL CERTIFICATES AND PKI IKE NETWORK ADMISSION CONTROL (NAC) ROUTING PROTOCOL AUTHENTICATION STRICT UNICAST RPF VISIBILITY ANOMALY DETECTION IDS/IPS LAYER 2 AND LAYER 3 INFORMATION (CDP, ROUTING TABLES, CEF TABLES) CORRELATION CS-MARS ARBOR PEAKFLOW SP AND PEAKFLOW X CISCO SECURITY AGENT MANAGEMENT CONSOLE (CSA-MC) BASIC EVENT CORRELATION INSTRUMENTATION AND MANAGEMENT CISCO SECURITY MANAGER CONFIGURATION LOGGER AND CONFIGURATION ROLLBACK EMBEDDED DEVICE MANAGERS CISCO IOS XR XML INTERFACE SNMP AND RMON SYSLOG ISOLATION AND VIRTUALIZATION CISCO IOS ROLE-BASED CLI ACCESS (CLI VIEWS) ANOMALY DETECTION ZONES NETWORK DEVICE VIRTUALIZATION SEGMENTATION WITH VLANS SEGMENTATION WITH FIREWALLS SEGMENTATION WITH VRF/VRF-LITE VISUALIZATION TECHNIQUES PART III DEFENSE-IN-DEPTH APPLIED WIRELESS SECURITY OVERVIEW OF CISCO UNIFIED WIRELESS NETWORK ARCHITECTURE AUTHENTICATION AND AUTHORIZATION OF WIRELESS USERS WEP WPA 802 1X ON WIRELESS NETWORKS CISCO LEAP EAP-TLS PEAP EAP TUNNELED TLS AUTHENTICATION PROTOCOL (EAP-TTLS) EAP-FAST EAP-GTC CONFIGURING 802 1X WITH EAP-FAST IN THE CISCO UNIFIED WIRELESS SOLUTION CONFIGURING THE WLC CONFIGURING THE CISCO SECURE ACS SERVER FOR 802 1X AND EAP-FAST CONFIGURING THE CSSC LIGHTWEIGHT ACCESS POINT PROTOCOL (LWAPP) WIRELESS INTRUSION PREVENTION SYSTEM INTEGRATION CONFIGURING IDS/IPS SENSORS IN THE WLC UPLOADING AND CONFIGURING IDS/IPS SIGNATURES MANAGEMENT FRAME PROTECTION (MFP) PRECISE LOCATION TRACKING NETWORK ADMISSION CONTROL (NAC) IN WIRELESS NETWORKS NAC APPLIANCE CONFIGURATION WLC CONFIGURATION IP TELEPHONY SECURITY PROTECTING THE IP TELEPHONY INFRASTRUCTURE ACCESS LAYER DISTRIBUTION LAYER CORE SECURING THE IP TELEPHONY APPLICATIONS PROTECTING CISCO UNIFIED CALLMANAGER PROTECTING CISCO UNIFIED COMMUNICATIONS MANAGER EXPRESS (CME) PROTECTING CISCO UNITY PROTECTING CISCO UNITY EXPRESS PROTECTING CISCO PERSONAL ASSISTANT HARDENING THE CISCO PERSONAL ASSISTANT OPERATING ENVIRONMENT CISCO PERSONAL ASSISTANT SERVER SECURITY POLICIES PROTECTING AGAINST EAVESDROPPING ATTACKS DATA CENTER SECURITY PROTECTING THE DATA CENTER AGAINST DENIAL OF SERVICE (DOS) ATTACKS AND WORMS SYN COOKIES IN FIREWALLS AND LOAD BALANCERS INTRUSION PREVENTION SYSTEMS (IPS) AND INTRUSION DETECTION SYSTEMS (IDS) CISCO NETFLOW IN THE DATA CENTER CISCO GUARD DATA CENTER INFRASTRUCTURE PROTECTION DATA CENTER SEGMENTATION AND TIERED ACCESS CONTROL SEGMENTING THE DATA CENTER WITH THE CISCO FWSM CISCO FWSM MODES OF OPERATION AND DESIGN CONSIDERATIONS CONFIGURING THE CISCO CATALYST SWITCH CREATING SECURITY CONTEXTS IN THE CISCO FWSM CONFIGURING THE INTERFACES ON EACH SECURITY CONTEXT CONFIGURING NETWORK ADDRESS TRANSLATION CONTROLLING ACCESS WITH ACLS VIRTUAL FRAGMENT REASSEMBLY DEPLOYING NETWORK INTRUSION DETECTION AND PREVENTION SYSTEMS SENDING SELECTIVE TRAFFIC TO THE IDS/IPS DEVICES MONITORING AND TUNING DEPLOYING THE CISCO SECURITY AGENT (CSA) IN THE DATA CENTER CSA ARCHITECTURE CONFIGURING AGENT KITS PHASED DEPLOYMENT IPV6 SECURITY RECONNAISSANCE FILTERING ACCESS CONTROL LISTS (ACL) ICMP FILTERING SPOOFING HEADER MANIPULATION AND FRAGMENTATION BROADCAST AMPLIFICATION OR SMURF ATTACKS IPV6 ROUTING SECURITY PART IV CASE STUDIES CASE STUDIES CASE STUDY OF A SMALL BUSINESS RALEIGH OFFICE CISCO ASA CONFIGURATION CONFIGURING IP ADDRESSING AND ROUTING CONFIGURING PAT ON THE CISCO ASA CONFIGURING STATIC NAT FOR THE DMZ SERVERS CONFIGURING IDENTITY NAT FOR INSIDE USERS CONTROLLING ACCESS CISCO ASA ANTISPOOFING CONFIGURATION BLOCKING INSTANT MESSAGING ATLANTA OFFICE CISCO IOS CONFIGURATION LOCKING DOWN THE CISCO IOS ROUTER CONFIGURING BASIC NETWORK ADDRESS TRANSLATION (NAT) CONFIGURING SITE-TO-SITE VPN CASE STUDY OF A MEDIUM-SIZED ENTERPRISE PROTECTING THE INTERNET EDGE ROUTERS CONFIGURING THE AIP-SSM ON THE CISCO ASA CONFIGURING ACTIVE-STANDBY FAILOVER ON THE CISCO ASA CONFIGURING AAA ON THE INFRASTRUCTURE DEVICES CASE STUDY OF A LARGE ENTERPRISE CREATING A NEW COMPUTER SECURITY INCIDENT RESPONSE TEAM (CSIRT) CREATING NEW SECURITY POLICIES PHYSICAL SECURITY POLICY PERIMETER SECURITY POLICY DEVICE SECURITY POLICY REMOTE ACCESS VPN POLICY PATCH MANAGEMENT POLICY CHANGE MANAGEMENT POLICY INTERNET USAGE POLICY DEPLOYING IPSEC REMOTE ACCESS VPN CONFIGURING IPSEC REMOTE ACCESS VPN CONFIGURING LOAD-BALANCING REACTING TO A SECURITY INCIDENT IDENTIFYING, CLASSIFYING, AND TRACKING THE SECURITY INCIDENT OR ATTACK REACTING TO THE INCIDENT POSTMORTEM