3.1 Secure Network Design

Layer 3

The segmentation enforced by VLANs at the data link layer can be mapped to logical divisions enforced by IP subnets at ____________.

a single IP address or subnet

Restrict the hosts that can be used to access the management console by enforcing an Access Control List (ACL); restrict permitted hosts to ________ or ________, for instance.

subnet

A _________ is a subdivision of a larger network, isolated from the rest of the network by means of routers (or layer 3 switches).

IP address, by the port it is requesting, or a combination of both

A basic firewall can allow or deny a host access based on its .

soft access point

A computer could allow wireless clients to connect to it in either an ad hoc network or by being configured as a _________________. This makes the laptop create a bridge from one network to another.

ARP or DNS

Man-in-the-Middle attacks can also be launched against antiquated protocols, such as ______ or _______.

mutual authentication

MitM attacks can be defeated using ___________________, where both server and client exchange secure credentials.

security requirements

More than one DMZ might be required as the services that run in them may have different ____________.

physical and data link layers

Network architecture design starts with the way the OSI model ___________ and ___________ layers are implemented.

Firewall

Network traffic between zones should be strictly controlled, using a security device. This device can be software or hardware oriented to filter traffic passing into and out of the network.

ARP Request packet

Normally, a device that needs to send a packet to an IP address but does not know the receiving device's MAC address broadcasts an ___________________.

Screened Subnetting

One important use of subnets is to implement a DMZ. Two firewalls are placed at either end of the DMZ. One restricts traffic on the external interface; the other restricts traffic on the internal interface.

Trojan

One way to launch a MitM attack is to use __________________ software to replace some genuine software on the system.

Lack of documentation and change control

network segments, appliances, and services might be added without proper change control procedures, leading to a lack of visibility into how the network is constituted. It is vital that network managers understand business workflows and the network services that underpin them.

Availability over confidentiality and integrity

often it is tempting to take "shortcuts" to get a service up and running. Compromising security might represent a quick fix but creates long term risks.

Complex dependencies

services that require many different systems to be available. Ideally the failure of individual systems or services should not affect the overall performance of other network services.

dynamic VLANs

VLANs that include using the host's MAC address, protocol type, or even authentication credentials are referred to as _______________.

Bridge

A ______ could be used to divide a network overloaded with hosts and suffering from excessive collisions into separate segments at the physical layer. This device can identify in which segment a host is located by its MAC address and only forwards traffic for that host over that interface.

Routed

A DMZ and intranet are on different subnets so communications between them need to be __________.

Three-Legged Firewall

A DMZ can also be established using a single router / firewall appliance. A _____________ (or triple-homed) firewall is one with three network ports, each directing traffic to a separate subnet: --> One port is the external interface. --> One port is the DMZ. --> One port is the internal interface. This is more complex to configure than a screened subnet. Also, the firewall represents a single point of failure and is easier to compromise. However, this configuration does save on costs.

"null" VLAN

A VLAN that is non-routable to the rest of the network. This VLAN is used for any ports that do not have authorized connected equipment.

air gap

A host or network segment that has no sort of physical connectivity with other hosts or networks.

collision domain

A hub is a multiport repeater; it takes the signal generated by a node and retransmits it to every port on the hub. All the ports are said to be in the same _____________ .

Dsniff, Cain and Abel, or Ettercap

A more sophisticated ARP poisoning attack can be launched by running software such as ________, _________, or __________ from a computer attached to the same switch as the target.

segment

A network ___________ is an area of the network where all the hosts attached to a specific area or the network can communicate freely with one another.

Extranet

A network of semi-trusted hosts, typically representing business partners, suppliers, or customers. Hosts must authenticate to join this network because this network typically is internet-facing. This network could also be set up using leased line connections.

root port

A port that forwards "up" to the root bridge, possibly via intermediate bridges, is identified as a ____________.

blocking; non-designated port

A port that would create a loop is identified as a _________ or ____________ .

Intranet

A private network of trusted hosts owned and controlled by the organization. Hosts are trusted in the sense that they are under the same administrative control and subject to the security mechanisms (anti-virus software, user rights, software updating, and so on) that the organization have set up to defend the network.

Layer 3

A subnet gives the hosts in a particular VLAN a distinct network address at layer ____ of the OSI model (Network).

static entries

A trivial ARP poisoning attack could be launched by adding _______________ to the target's ARP cache.

network interface and subnet

A true DMZ is established by a separate ____________ and ________ so that traffic between hosts in the DMZ and the LAN must be routed (and subject to firewall rules). Most SOHO routers do not have the necessary ports or routing functionality to create a true DMZ.

MAC flooding

A variation of an ARP poisoning attack, that can be directed against a switch.

Internet-facing host

Accepts inbound connections from and makes connections to hosts on the Internet.

isolated

An _____________________ segment is one that has no connectivity with other segments.

Topology

Any given switch port can be assigned to any VLAN in the same _________________, regardless of the physical location of the switch.

sniffing

As hubs broadcast communications to all ports, this makes _________ network traffic easier.

network mapping and eavesdropping

Attacks at the physical and data link layer are often focused on information gathering: Such as _______________ and _______________________ on network traffic.

Virtual LANs (VLAN)

Because enterprise networks typically feature hundreds of switching appliances and network ports (not to mention wireless access and remote access), segmentation is more likely to be enforced using _______________ .

ARP Poisoning Attack

Broadcasting unsolicited ARP reply packets. Because ARP is an "antiquated protocol" with no security, the receiving devices trust this communication and update their MAC:IP address cache table with the spoofed address.

MAC spoofing

Changing the Media Access Control (MAC) address configured on an adapter interface or asserts the use of an arbitrary MAC address.

Layer 3 switch

In CISCO Systems __________ switch or router appliances are capable of many different types of routing (especially over Wide Area Networks [WAN]) and tend not to have many interface ports. On a campus Ethernet network, the internal routers will typically be moving traffic between VLANs and have no need to perform WAN routing.

Access Layer

In CISCO Systems this layer allows end-user devices, such as computers, printers, and smartphones, to connect to the network. Another important function of the this layer is to prevent the attachment of unauthorized devices.

router or layer 3 switch.

Communication between the groups of ports would only be possible via a ________ or _______________.

authorized management station

Configure the SNMP interface on the switch to report only to an a_____________________ or disable SNMP if it is not required.

segmented

Different functions could be implemented either by completely separate DMZs or by using ___________ demilitarized zones.

HTTP (TCP/UDP Port 80), HTTPS (TCP/Port 443), and Telnet (TCP/Port 23)

Disable unused management console access methods. For example, if you use SSH, disable the serial ports, _______, ________, and ________.

security configuration

Dividing a campus network or data center into zones implies that each zone has a different ___________.

Core Layer

In CISCO Systems this layer provides a highly available network backbone. Devices such as clients and server computers should not be attached directly to this layer. Its purpose should be kept simple: provide redundant traffic paths for data to continue to flow around the access and distribution layers of the network.

broadcast

Each subnet(work) is in its own ____________ domain

Distribution

In CISCO Systems this layer provides fault-tolerant interconnections between different access blocks and either the core or other distribution blocks. This layer is often used to implement traffic policies, such as routing boundaries, filtering, or Quality of Service (QoS).

IP address

In CISCO Systems, a Router provides connectivity between subnetworks based on their

distribution and core layers

In CISCO Systems, the _______________ and _________ layers provide switching and routing between different access layer locations and server groups.

Bastion Hosts

Hosts in a DMZ are not fully trusted by the internal network because of the possibility that they could be compromised from the Internet. They are referred to as___________ . These hosts would not be configured with any services that run on the local network, such as user authentication.

Segregation

Hosts in one segment are restricted in the way they communicate with hosts in other segments. They might only be able to communicate over certain network ports, for instance.

Failopen Mode

If a switch's cache table is overloaded by flooding it with frames containing different (usually random) source MAC addresses, it will typically start to operate as a hub. This is called ______?

Proxy

If communication is required between hosts on either side of a DMZ, a host within the DMZ acts as a __________. This device takes the request and checks it. If the request is valid, it re-transmits it to the destination. External hosts have no idea about what (if anything) is behind the DMZ.

attacker

If the ARP poisoning attack is successful, all traffic destined for remote networks will be sent to the ___________________ .

Ethernet

In a network with multiple bridges (implemented these days as switches and routers), there may be more than one path for a frame to take to its intended destination. As a layer 2 protocol, __________ has no concept of Time To Live. Therefore, layer 2 broadcast traffic could continue to loop through a network with multiple paths indefinitely.

segregated

In order to enforce the concept of a zone, zones must be ____________.

Disable unused ports by placing them in an otherwise unused VLAN with no connectivity to the rest of the network. Secure the switch's management console by renaming the administrative account (if possible) and setting a strong password. Use a secure interface to access the management console. Use encrypted communications, such as HTTPS or SSH, or use the switch's console serial port. Install the latest firmware updates and review vendor security bulletins to be forewarned about possible exploits or vulnerabilities.

In order to secure a switch, the following guidelines should be met.

Address Resolution Protocol (ARP)

In terms of TCP/IPv4, the most significant protocol operating at the Data Link layer is the __________________. This protocol maps a network interface's hardware (MAC) address to an IP address.

Demilitarized Zone (DMZ)

Internet-facing hosts are placed this zone that is also referred to as a perimeter network. The idea of a this zoneis that traffic cannot pass through it.

Spanning Tree Protocol (STP)

Layer 2 loops are prevented by the ____________, defined in the IEEE 802.1D MAC Bridges standard.

static VLANs

Port-based switching is the simplest means of configuring a VLAN. These VLANs are referred to as ___________.

designated ports

Ports that can forward traffic "down" through the network with the least cost are identified as ____________.

network policies or Control Lists (ACL)

Router enforce _____________ or Access ____________ to restrict communications between the two segments.

virtualization

Segregation and isolation of hosts or applications can also be accomplished using

screened host

Smaller networks may not have the budget or technical expertise to implement a DMZ. In this case, Internet access can still be implemented using a dual-homed proxy server acting as a ____________ .

DoS

Sometimes the term DMZ (or "DMZ host") is used by SOHO router vendors to mean an Internet-facing host or zone not protected by the firewall. This might be simpler to configure and solve some access problems but makes the whole network very vulnerable to intrusion and ____________ Attack .

Root Bridge

Spanning tree is a means for the bridges to organize themselves into a hierarchy. The bridge at the top of the hierarchy is the _____________ .

Bridge

Split tunneling is another example of a potential __________ between different networks.

filtering and access control

Subnets are useful for security, as traffic passing between each subnet can be subjected to ____________ and ________________ at the router.

geographical or logical

Subnets can be used to represent __________________ or _____________________ divisions in the network.

Layer 2

Subnets will usually be mapped to VLANs. The VLAN establishes a logical grouping of hosts at layer ________ of the OSI model (Data Link Layer).

Topology Change Notifications

Subsequently, bridges exchange ____________ if devices are added or removed, enabling them to change the status of forwarding / blocked ports appropriately.

port authentication

Switches that can perform "_______________", can prevent connected devices from changing their MAC address.

Man-in-the-middle (MITM) attack or a Denial of Service (DoS) Attack

The attacker in ARP poisoning can perform a ______________, either by monitoring the communications (forwarding them to the router to avoid detection) or modifying the packets before forwarding them and/or a ___________________ by not forwarding the packets.

ARP Reply

The device with the matching IP from the ARP Request Packet responds with an ________________.

Access Control List (ACL)

The firewall bases its decisions on a set of rules called _____________.

web servers, mail and other communications servers, proxy servers, and remote access servers.

The hosts that provide the extranet or public access services should be placed in one or more demilitarized zones. These would typically include

Zone

The main building block of a security topology of a particular network location and is an area of the network (or of a connected network) where the security configuration is the same for all hosts within it.

Content Addressable Memory (CAM)

The switch cache table is referred to as _______________ so the attack is also called CAM table overflow.

Top-of-Rack (ToR) switches

These switches are deployed in data centers.

Aggregation switch

These switches are functionally similar to layer 3 switches, but the term is often used for very high-performing switches deployed in a large enterprise or service provider's routing infrastructure. Rather than 1 Gbps access ports and 10 Gbps uplink ports (as would be typical of a workgroup switch), basic interfaces on an aggregation switch would be 10 Gbps and uplink / backbone ports would be 40 Gbps.

Man-in-the-Middle (MitM)

This attack is where the attacker sits between two communicating hosts, and transparently captures, monitors, and relays all communication between the hosts. This attack could also be used to covertly modify the traffic.

Internet / guest

This is a zone permitting anonymous access (or perhaps a mix of anonymous and authenticated access) by untrusted hosts over the public network.

access, distribution, and core

Three layers of hierarchy that Cisco recommends designing a campus network with.

external interface and internal interface

To configure a DMZ, two different security configurations must be enabled: one on the ________________ and one on the _______________.

Out-of-Band

Using an access method other than the normal data network is referred to as _________ management.

network backdoor; switching loop

When a soft access point is configured, it can create a potential ____________ or could cause a _______________ .

OS commands, alterations to the network driver configuration, or using packet crafting software

While a unique MAC address is assigned to each network interface by the vendor at the factory, it is often possible to override it in software via ___________, ________________________, __________________.

802.1D-2004 / 802.1w

With basic STP, configuration changes can disrupt network communications for extended periods. STP is now more likely to be implemented as _____________ or Rapid STP (RSTP). The rapid version creates outages of a few seconds or less.

Logical

__________________ divisions might represent departmental functions or distinguish servers from clients.

Geographical

_______________________ divisions might represent different floors of an office or networks connected by WAN links.

Single points of failure

a "pinch point" relying on a single hardware server or appliance or network channel.

Server Type (i.e Email Mailbox Server)

ensure that the file (mailbox) is only accessed by authorized clients and that it is fully available and fault tolerant. Ensure that the file (email) service runs with a minimum number of dependencies and that the service is designed to be resilient to faults.

Overdependence on perimeter security

if the network architecture is "flat" (that is, if any host can contact any other host), penetrating the network edge gives the attacker freedom of movement.

Access

the client device must access the network, obtaining a physical channel and logical address. The user must be authenticated and authorized to use an application. The corollary is that unauthorized users and devices must be denied access.

Transfer Server (Mail)

this must connect with untrusted Internet hosts, so communications between the untrusted network and trusted LAN must be carefully controlled. Any data or software leaving or entering the network must be subject to policy-based controls.