IT Security - Regulations and Technical Aspects. Network concepts. Authors: Andreas Lorenz and Thomas Brandel

Transcription

1 IT Security - Regulations and Technical Aspects Network concepts The following presentations have been used for System Administrator training at FZK and are thus specific to their environment. However many features will be common to most institutes and thus the slides could make a good basis for producing customized training material Authors: Andreas Lorenz and Thomas Brandel Revised for the ISSeG Project by Ursula Epting, Bruno Hoeft and Tobias Koenig

2 Overview: Network Concepts Access from inside Access from outside Access by guests LAN regulations Network protection technology

3 Access of the Network from Inside (1)

4 Access of the Network from Inside (2) General description Each end device (PC, printer, server) in the LAN requires an unambiguous IP address for network communication. An IP address consists of 4 bytes and is represented by 4 decimals separated by points (for example: ). An IP address may be allocated by manual configuration (static address) or dynamically (by a DHCP server). Other TCP/IP parameters (subnet mask, default gateway, DNS domain, DNS and WINS servers) are fixed. Prerequisites for use Connection of an end device to the intranet is subject to the internal regulations and principles ( internal document).

6 Access from Outside Remote Access (1) VPN (Virtual Private Network) Access via any internet provider After VPN setup, complete intranet access Access to internal DNS Firewall is by-passed Problem: An infected computer may infect the entire intranet Solution: Access via VPN / reverse proxy server Check of the accessing Windows computers (host check) for Supported antivirus clients, current antivirus definition Personal firewall Security updates If check fails, direct updating is possible Optional 2-factor authentification (RSA token)

7 Access from Outside Remote Access (2) RSA Token for 2-factor Authentication 2 factors: PIN (knowledge) Device with constantly changing combination of figures (possession) Generation of one-time passwords Key loggers are undermined Attention: If a system is accessed via user name / password after successful VPN log-on, this may be overheard by a key logger.

8 Access from Outside Remote Access (3) RAS (Log-on access) Analog log-on or ISDN With or without call-back Complete access to intranet Internal DNS Firewall is by-passed Same problem as for VPN, but worse: Computers without a rapid internet access are difficult to be kept updated, as the updates have become very large in the meantime RAS without call-back is not reasonable for the user, as log-on accesses with commercial providers usually are much cheaper RAS should only be used in exceptional cases!

9 Access from Outside Remote Access (4) Direct SSH access from the internet Requires clearance of the port in the firewall (nearly) any port may be selected Recommendation: Avoid standard port, as it is frequently the target of automatic attacks Cleared computers are checked regularly for security exposures

11 Access of Guests (1) Computers of guests, who require access to the network, must not be allowed to enter the intranet unchecked Via WLAN, PCs of guests may access a special guest network: Call of any external web site by the web browser Important: without proxy server! Creation of a guest account when a valid watchword is input The watchword is known to the LAN coordinators Log-on with user name and password Guest has access to the internet, no access to the intranet If a LAN socket with a configured guest network is available, the same procedure may be used to access the guest network via cable

12 Access by Guests (2) If the guest needs access to the intranet, he/she has to sign an agreement to observe data protection and IT security If the intranet is to be accessed from a computer of the guest (e.g. notebook), the following conditions have to be fulfilled (Windows): Active personal firewall Active virus protection Updated patch state of the operating system In principle, access of guests to the intranet should be the exception!

14 Overview: LAN Regulations Definitions Principles Rules Log-on, change of registration, and log-off of end devices Network security Control and correcting measures Restrictions

15 LAN Regulations (1) Definitions The LAN comprises the entire network infrastructure of the intranet. The organizational unit is any organizational unit shown in the organizational chart as well as any external institution that is legally independent of the Research Center, which operates end devices on the LAN. LAN coordinators (LAN-KO) are central partners at each organizational unit as far as network operation is concerned. Each organizational unit appoints one LAN coordinator and at least one deputy. An end device is any source or sink of data flows that can be identified in the LAN.

16 LAN Regulations (2) Principles LAN operation is subject to aspects of security, performance, cost efficiency, and legitimacy. For the operation of an end device, the organizational unit, to which this end device is allocated, is responsible. Operation of an end device must not adversely affect LAN operation. The LAN-KOs settle network matters of and disseminate information to the members of the organizational unit and the network operator. They act as an interface between the network operator and the user of the end device.

17 LAN Regulations (3) Rules (Conditions for the operation of end devices) 1. The computing center has to possess the following information: a. Name of the device, i.e. the host name or computer name b. Hardware address of the network interface card c. Responsible operator. The operator must be entered in the central database d. Place of installation (building and room) of the end device 2. Exceptions are made for the rules of DHCPs. 3. As far as network security and compatibility are concerned, the end device has to fulfill the conditions made on the LAN in terms of equipment and configuration. 4. The transmission protocol of the backbone router is the internet protocol (IP).

18 LAN Regulations (4) Log-on, Change of Registration, and Log-off of End Devices First log-on of an end device is associated with a registration, during which the information required for operation is transmitted to the computing center. The operating organizational unit must immediately notify changes of the information required for the operation of an end device. Log-off is required, if the end device is no longer operated in the network.

19 LAN Regulations (5) Network Security Communication links are subject to the general network security rules of the site ( see document on the intranet).

20 LAN Regulations (6) Control and Correcting Measures Operation of the LAN is controlled and failures are eliminated as rapidly as possible. Control is subject to the provisions of the Telecommunications Act and the Telecommunication Data Protection Ordinance as well as to site-specific in-house agreements and bilateral agreements with associated external institutions. End devices that significantly disturb operation or do not fulfill the conditions for the operation of end devices may be separated from the LAN by the computing center. This also applies to entire LAN areas..

21 LAN Regulations (7) Restrictions Moreover, modifications of the LAN shall require approval by the responsible staff members of the computing center.

23 Overview: Network Protection Technology Firewall structure Central firewall Decentralized firewall Desktop firewall Danger warning

24 Network Protection Technology (1) Firewall Structure

25 Network Protection Technology (2) Central Firewall It controls the connection between the network of the site (LAN) and the internet. It protects against computers on the internet that want to access devices of the site. It restricts connections of internal computers to services on the internet. It is called central, because it is effective for all devices connected to the LAN. It provides effective protection against specific attacks from computers on the internet to computers of the site (protection against hackers). It does not offer any protection in case of connections from a LAN computer to a computer on the internet. Clearances may be provided in the firewall in order to make selected computers accessible for special services. The central firewall is designed in a redundant manner.

26 Network Protection Technology (3) Decentralized Firewall The decentralized firewall of the site acts like a blocked safety door to the organizational units that have an increased need for network security and data protection in their network area (sub network). The decentralized firewall protects the organizational unit from attacks from the intranet, i.e. from the other organizational units of the Center.

27 Network Protection Technology (4) Desktop Firewall

28 Network Protection Technology (5) Desktop Firewall Why a personal firewall? Due to certain regulations, incoming or outgoing data packages are blocked by the personal firewall or may pass the firewall. As each employee uses his/her PC for various purposes, these rules cannot be defined centrally. In case of new and unknown connections, the desktop firewall generally asks the user how it is supposed to react.

29 Network Protection Technology (6) Danger Warning Why can worms infect the intranet? Notebooks are frequent travelers. On these travels, they are linked to other networks at other institutions, for instance. Here, they may catch the virus which then spreads all over the site. Unprotected log-on PCs also are a risk for the intranet. A virus spreads in various ways. It may also be sent by as a program for execution. Some people like to use password-protected archives, as these are not controlled by the virus scanner. If the recipient is so uncareful to open them, the virus may enter the intranet in this way.

30 Final Remark Thank you for your attention

31 Copyright Members of the ISSeG Collaboration, Licensed under the Apache License, Version 2.0 (the "License"); you may not use this material except in compliance with the License. You may obtain a copy of the License at Unless required by applicable law or agreed to in writing, Work distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.