Securing EtherNet/IP Using DPI Firewall Technology
|
|
|
- Luke Fitzgerald
- 8 years ago
- Views:
Transcription
1 Securing EtherNet/IP Using DPI Firewall Technology Technical Track
2 About Us Erik Schweigert Leads device firmware development at Tofino Security BSc in Computer Science from VIU Michael Thomas Leads management/configuration software development at Tofino Security BSc in Computer Science from VIU Technical Track 2014 Industry Conference & 16 th Annual Meeting page 2
3 Introduction Industry has embraced technology like Ethernet and TCP/IP Increases efficiency, but also increases exposure to security threats A simple, robust security solution is needed In this talk we will look at using Deep Packet Inspection (DPI) technology for securing EtherNet/IP and CIP Protocols Technical Track 2014 Industry Conference & 16 th Annual Meeting page 3
4 Topics I. The Common Industrial Protocol (CIP) Overview II. Security Threats to EtherNet/IP Deployments III. Possible Methods to Secure EtherNet/IP IV. Analysis of EtherNet/IP for Deep Packet Inspection (DPI) V. Implementing DPI for EtherNet/IP VI. Field Usability of DPI for EtherNet/IP VII. Case History Technical Track 2014 Industry Conference & 16 th Annual Meeting page 4
5 The Common Industrial Protocol General Overview Technical Track 2014 Industry Conference & 16 th Annual Meeting page 5
6 The Common Industrial Protocol CIP can be used above varying network protocols including DeviceNet, ControlNet, EtherNet/IP, and CompoNet EtherNet/IP uses the standard Ethernet layer of TCP/IP CIP is based on abstract object modeling Object classes Services Technical Track 2014 Industry Conference & 16 th Annual Meeting page 6
7 The Common Industrial Protocol Two types of Communication: Class 1 implicit messaging low jitter and latency (typically UDP) Class 3 explicit messaging reliable connection based (typically TCP) The CIP layer is complex, but follows a consistent format It can map itself to various functions, physical entities, and products Technical Track 2014 Industry Conference & 16 th Annual Meeting page 7
8 Security Threats to EtherNet/IP Implementations Technical Track 2014 Industry Conference & 16 th Annual Meeting page 8
9 US ICS-CERT Security Advisories Prior to Stuxnet: 2011: security advisories 3 vendors involved 215 disclosed vulnerabilities 104 security advisories 39 vendors involved 248 disclosed vulnerabilities ~ 400 disclosed vulnerabilities 40% of disclosed vulnerabilities included working attack code Technical Track 2014 Industry Conference & 16 th Annual Meeting page 9
10 Security Threats to EtherNet/IP Deployments Linking corporate and control systems together increases exposures to threats Protocols like EtherNet/IP not secure by design The lack of authentication presents a vector for attack Threats can also stem from implementation issues Technical Track 2014 Industry Conference & 16 th Annual Meeting page 10
11 Lack of Command Granularity July 2008 DHS warning to energy companies: A vulnerability has been identified and verified within the firmware upgrade process used in control systems deployed in Critical Infrastructure and Key Resources (CIKR) development of a mitigation plan is required to protect the installed customer base and the CIKR of the nation. Firmware Vulnerability Mitigation Steps [include] blocking network firmware upgrades with appropriate firewall rules. BUT traditional firewalls only provide complete protocol allow or deny Technical Track 2014 Industry Conference & 16 th Annual Meeting page 11
12 Methods to Secure EtherNet/IP Technical Track 2014 Industry Conference & 16 th Annual Meeting page 12
13 Methods to Secure EtherNet/IP Security issues that are part of the current EtherNet/IP standards and implementations are likely to remain with us for at least the next decade Industry must explore methods to secure these existing protocols and systems, independent of future improvements to the specifications There are two primary technologies used in the IT world to secure on-the-wire messages Encryption, signing and cryptographic techniques Packet filtering Technical Track 2014 Industry Conference & 16 th Annual Meeting page 13
14 Encryption of Data and Virtual Private Networks One common method of securing communications is to use cryptographic techniques, such as encryptionbased tunneling Usually referred to as Virtual Private Network (VPN) VPN technologies create a secure tunnel between two end points over an untrusted network Technical Track 2014 Industry Conference & 16 th Annual Meeting page 14
15 Encryption of Data and Virtual Private Networks VPNs provide three key capabilities: Privacy Authentication Integrity Limitations: Overhead of encryption negative impact on time sensitive communications No data validation Bad data in means bad data out Reliable key or certificate management is challenging Technical Track 2014 Industry Conference & 16 th Annual Meeting page 15
16 Packet Filtering via Firewalls A firewall is a device that monitors and controls traffic flowing in or between networks Traditional IT firewalls apply filters at the TCP and IP layers of a message, using Access Control Lists (ACLs) to check three primary fields in a message: Address of the computer sending the message Address of the computer receiving the message Application layer protocol contained by the IP message Technical Track 2014 Industry Conference & 16 th Annual Meeting page 16
17 Limitations of Traditional Firewalls IT firewalls do not allow for fine grained control This is an issue as discussed, SCADA/ICS protocols have no granularity A data read message looks EXACTLY like a firmware update message to IT firewall If you allow data read messages, you are also allowing programming or firmware upgrade messages to pass through - This is a serious security risk Technical Track 2014 Industry Conference & 16 th Annual Meeting page 17
18 Firewalls and Deep Packet Inspection Deep Packet Inspection (DPI) is an extension to traditional firewall technology that can provide the fine grained management of EtherNet/IP traffic DPI allows the firewall to understand what tasks the protocol is being used for (e.g. read, write, etc) It can interpret specific ICS protocols and apply filters on fields and values that matter to control systems It can also check the validity of the messages do they conform to the specifications? Technical Track 2014 Industry Conference & 16 th Annual Meeting page 18
19 What Deep Packet Inspection Is and Is Not DPI is: The deterministic and repeatable filtering of packets based on parsing at all layers Think of it as Wireshark in real-time DPI is not: A signature based intrusion detection system (IDS) like SNORT An authentication mechanism Technical Track 2014 Industry Conference & 16 th Annual Meeting page 19
20 Analysis of EtherNet/IP for Deep Packet Inspection (DPI) Technical Track 2014 Industry Conference & 16 th Annual Meeting page 20
21 Analysis of EtherNet/IP for Deep Packet Inspection (DPI) Must understand the structure of the protocol in its most basic form; that is bits and bytes For example, consider the field Length in an EtherNet/IP message that is executing the Get Attribute All service on an Analog Input object What exactly does Length indicate? Is there a minimum or maximum that, if violated, might indicate an attempted attack? Would these values change depending on the CIP object or service involved? Technical Track 2014 Industry Conference & 16 th Annual Meeting page 21
22 EtherNet/IP Header Structure The EtherNet/IP header is a 24 byte fixed length header with a trailing optional data portion The Command Specific Data field encapsulates CIP Technical Track 2014 Industry Conference & 16 th Annual Meeting page 22
23 CIP Messaging Structure The CIP header has multiple static fields and a request path that contains a set of CIP segments This includes port segments, logical segments, network segments, symbolic segments, data segments, and key segments Not every packet contains every type of segment. There is always a CIP service executing some action upon the logical class segment Technical Track 2014 Industry Conference & 16 th Annual Meeting page 23
24 CIP Messaging Structure For DPI design, the logical object class is a main field of interest, with the logical segment encoding being the most important The logical segment is an 8 bit field with The 3 highest bits denote the logical segment type The following 3 bits denote the logical type The last 2 bits denote the logical format Used to identify the size of the logical value that follows the logical segment field Technical Track 2014 Industry Conference & 16 th Annual Meeting page 24
25 CIP Messaging Structure Technical Track 2014 Industry Conference & 16 th Annual Meeting page 25
26 Analysis of EtherNet/IP Summary The architecture of the EtherNet/IP and CIP layers are not trivial and contain many moving parts Session establishment utilizes a set of commands with varying results and dynamic fields Session establishment spread over 3 layers, so DPI engine must communicate between layers CIP in itself carries complexity based on the type of connection, whether it is using a message router or Unconnected Send affects the packet structure Technical Track 2014 Industry Conference & 16 th Annual Meeting page 26
27 Implementing DPI for EtherNet/IP Technical Track 2014 Industry Conference & 16 th Annual Meeting page 27
28 What s Important? How can you interpret this complexity and design a usable filter mechanism to ensure credible network traffic in an efficient manner? Two main tasks for DPI: Sanity Check Does this message conform to spec? Identify critical fields or actions - What makes sense to filter for security? Pick carefully - You don t want to sanity check or filter absolutely every field or else: Latency will be excessive The end user will be confused with too many options Configuration mistakes will occur Technical Track 2014 Industry Conference & 16 th Annual Meeting page 28
29 Sanity Checking EtherNet/IP Messages There is no shortage of ways in which an attacker could harm a PLC by sending malformed frames Sanity checking needs to protect against the most dangerous field violations From the user s perspective, sanity checking is executed behind the scenes Must be a selectable option because in some cases a vendor may fall short when attempting to adhere to the specification Technical Track 2014 Industry Conference & 16 th Annual Meeting page 29
30 Sanity Checking EtherNet/IP Messages Technical Track 2014 Industry Conference & 16 th Annual Meeting page 30
31 Managing Sessions When Packets are Dropped If a packet fails a sanity check, then it is dropped Any message that is dropped is part of a TCP stream If one message within a TCP stream is just silently dropped, then the TCP sequence count in the frame received by the target wouldn t align For many HMIs this will cause a lockup until the TCP timer resets the session (a long time) To mitigate this, a TCP reset must be sent to both parties to properly close and re-establish the session Technical Track 2014 Industry Conference & 16 th Annual Meeting page 31
32 Identifying Critical CIP Fields for Filtering Since CIP is an object based system with various CIP services acting upon these objects, it makes sense to filter on the fields that denote what object and service is being invoked Users can then specify object and service pairs that are safe for the firewall to allow (and block all others) The ODVA specification outlines a set of common services and optional object specific services that an object may adhere to. It also allows for vendor specific services Each object supports a specific set of CIP services Technical Track 2014 Industry Conference & 16 th Annual Meeting page 32
33 Field Usability of DPI for EtherNet/IP Technical Track 2014 Industry Conference & 16 th Annual Meeting page 33
34 Field Usability of DPI for EtherNet/IP Customers rarely understand what is on-the-wire 99% of the options are never used Must be easy to use, or customers will make mistakes Technical Track 2014 Industry Conference & 16 th Annual Meeting page 34
35 Field Usability of DPI for EtherNet/IP Start with the traditional IT Firewall as a platform Keeps all rules in one ACL style list Add DPI filtering to extend firewall filtering capabilities Technical Track 2014 Industry Conference & 16 th Annual Meeting page 35
36 DPI Security Made Easy 1. Select Client 2. Select Server 3. Select Protocol 4. Select DPI Permission 5. Select Allowed Services 6. Select Options Technical Track 2014 Industry Conference & 16 th Annual Meeting page 36
37 Advanced DPI Configuration for EtherNet/IP Provide advanced CIP filtering for skilled customers Technical Track 2014 Industry Conference & 16 th Annual Meeting page 37
38 Allow User Defined Objects and Services Technical Track 2014 Industry Conference & 16 th Annual Meeting page 38
39 Case History Securing Pipeline Compressor Controls Technical Track 2014 Industry Conference & 16 th Annual Meeting page 39
40 Securing Pipeline Compressor Controls Compressor packages are complex, high risk systems Monitoring of platforms is critical in remote locations Risk of rogue insiders and unpatched vulnerabilities (even with VPN) Technical Track 2014 Industry Conference & 16 th Annual Meeting page 40
41 Read-only Controller Firewall Firewall inspects each EtherNet/IP message to ensure only data-read commands are allowed to the PLCs Requires no configuration, no network changes and no disruption to monitoring or turbine operations Technical Track 2014 Industry Conference & 16 th Annual Meeting page 41
42 Conclusions There is a need for an effective security solution for IDS/SCADA systems Deep Packet Inspection of EtherNet/IP significantly increases reliability and security There is a way to make use of EtherNet/IP DPI without adding overwhelming complexity EtherNet/IP DPI is applicable to real world situations Technical Track 2014 Industry Conference & 16 th Annual Meeting page 42
43 Questions? Technical Track 2014 Industry Conference & 16 th Annual Meeting page 43
Securing EtherNet/IP Control Systems using Deep Packet Inspection Firewall Technology
Securing EtherNet/IP Control Systems using Deep Packet Inspection Firewall Technology Eric Byres, Chief Technology Officer Erik Schweigert, Lead Embedded Systems Developer Michael Thomas, Lead Systems
Internet Firewall CSIS 3230. Internet Firewall. Spring 2012 CSIS 4222. net13 1. Firewalls. Stateless Packet Filtering
Internet Firewall CSIS 3230 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 8.8: Packet filtering, firewalls, intrusion detection Ch
Firewalls and VPNs. Principles of Information Security, 5th Edition 1
Firewalls and VPNs Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to: Understand firewall technology and the various approaches
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Industrial Communication Whitepaper. Principles of EtherNet/IP Communication
Industrial Communication Whitepaper Principles of EtherNet/IP Communication 1 Contents Introduction...3 Producer/Consumer Model...4 EtherNet/IP Messaging Types...7 Real Time Data Exchanges...9 Typical
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
Firewall Introduction Several Types of Firewall. Cisco PIX Firewall
Firewall Introduction Several Types of Firewall. Cisco PIX Firewall What is a Firewall? Non-computer industries: a wall that controls the spreading of a fire. Networks: a designed device that controls
Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
Network Access Security. Lesson 10
Network Access Security Lesson 10 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Firewalls Given a scenario, install and configure routers and switches.
Symantec Enterprise Firewalls. From the Internet Thomas Jerry Scott
Symantec Enterprise Firewalls From the Internet Thomas Symantec Firewalls Symantec offers a whole line of firewalls The Symantec Enterprise Firewall, which emerged from the older RAPTOR product We are
Security Technology: Firewalls and VPNs
Security Technology: Firewalls and VPNs 1 Learning Objectives Understand firewall technology and the various approaches to firewall implementation Identify the various approaches to remote and dial-up
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
Solution of Exercise Sheet 5
Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
OPC & Security Agenda
OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information
Firewalls, Tunnels, and Network Intrusion Detection. Firewalls
Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.
Voice Over IP and Firewalls
Introduction Voice Over IP and Firewalls By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com Use of Voice Over IP (VoIP) in enterprises is becoming more and more
Are Second Generation Firewalls Good for Industrial Control Systems?
Are Second Generation Firewalls Good for Industrial Control Systems? Bernie Pella, CISSP Schneider Electric Cyber Security Services bernie.pella@schneider-electric.com Firewall Overview Firewalls provide
Securing Modern Substations With an Open Standard Network Security Solution. Kevin Leech Schweitzer Engineering Laboratories, Inc.
Securing Modern Substations With an Open Standard Network Security Solution Kevin Leech Schweitzer Engineering Laboratories, Inc. Copyright SEL 2009 What Makes a Cyberattack Unique? While the resources
Classic IOS Firewall using CBACs. 2012 Cisco and/or its affiliates. All rights reserved. 1
Classic IOS Firewall using CBACs 2012 Cisco and/or its affiliates. All rights reserved. 1 Although CBAC serves as a good foundation for understanding the revolutionary path toward modern zone based firewalls,
Networking for Caribbean Development
Networking for Caribbean Development BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n o g. o r g N E T W O R K I N G F O R C A R I B B E A N D E V E L O P M E N T BELIZE NOV 2 NOV 6, 2015 w w w. c a r i b n
OS/390 Firewall Technology Overview
OS/390 Firewall Technology Overview Washington System Center Mary Sweat E - Mail: sweatm@us.ibm.com Agenda Basic Firewall strategies and design Hardware requirements Software requirements Components of
Recommended IP Telephony Architecture
Report Number: I332-009R-2006 Recommended IP Telephony Architecture Systems and Network Attack Center (SNAC) Updated: 1 May 2006 Version 1.0 SNAC.Guides@nsa.gov This Page Intentionally Left Blank ii Warnings
CSE 4482 Computer Security Management: Assessment and Forensics. Protection Mechanisms: Firewalls
CSE 4482 Computer Security Management: Assessment and Forensics Protection Mechanisms: Firewalls Instructor: N. Vlajic, Fall 2013 Required reading: Management of Information Security (MIS), by Whitman
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
Intro to Firewalls. Summary
Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer
CYBER ATTACKS EXPLAINED: PACKET CRAFTING
CYBER ATTACKS EXPLAINED: PACKET CRAFTING Protect your FOSS-based IT infrastructure from packet crafting by learning more about it. In the previous articles in this series, we explored common infrastructure
CIP Security Phase 1 Secure Transport for EtherNet/IP
CIP Security Phase 1 Secure Transport for EtherNet/IP Brian Batke, Principal Engineer Rockwell Automation (babatke@ra.rockwell.com, +1-440-646-5277) Joakim Wiberg, Team Manager Technology and Platforms
Link Layer and Network Layer Security for Wireless Networks
Link Layer and Network Layer Security for Wireless Networks Interlink Networks, Inc. May 15, 2003 1 LINK LAYER AND NETWORK LAYER SECURITY FOR WIRELESS NETWORKS... 3 Abstract... 3 1. INTRODUCTION... 3 2.
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
21.4 Network Address Translation (NAT) 21.4.1 NAT concept
21.4 Network Address Translation (NAT) This section explains Network Address Translation (NAT). NAT is also known as IP masquerading. It provides a mapping between internal IP addresses and officially
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall
INTRODUCTION TO FIREWALL SECURITY
INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ
HughesNet Broadband VPN End-to-End Security Using the Cisco 87x
HughesNet Broadband VPN End-to-End Security Using the Cisco 87x HughesNet Managed Broadband Services includes a high level of end-to-end security features based on a robust architecture designed to meet
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
"Charting the Course...
Description "Charting the Course... Course Summary Interconnecting Cisco Networking Devices: Accelerated (CCNAX), is a course consisting of ICND1 and ICND2 content in its entirety, but with the content
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES
PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute
SCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005
SCADA System Security ECE 478 Network Security Oregon State University March 7, 2005 David Goeke Hai Nguyen Abstract Modern public infrastructure systems
We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall
Chapter 10 Firewall Firewalls are devices used to protect a local network from network based security threats while at the same time affording access to the wide area network and the internet. Basically,
Network Defense Tools
Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds ravikantvanjara@gmail.com What is Firewall? A firewall
12/3/08. Security in Wireless LANs and Mobile Networks. Wireless Magnifies Exposure Vulnerability. Mobility Makes it Difficult to Establish Trust
Security in Wireless LANs and Mobile Networks Wireless Magnifies Exposure Vulnerability Information going across the wireless link is exposed to anyone within radio range RF may extend beyond a room or
Cisco Integrated Services Routers Performance Overview
Integrated Services Routers Performance Overview What You Will Learn The Integrated Services Routers Generation 2 (ISR G2) provide a robust platform for delivering WAN services, unified communications,
Final exam review, Fall 2005 FSU (CIS-5357) Network Security
Final exam review, Fall 2005 FSU (CIS-5357) Network Security Instructor: Breno de Medeiros 1. What is an insertion attack against a NIDS? Answer: An insertion attack against a network intrusion detection
NETWORK SECURITY (W/LAB) Course Syllabus
6111 E. Skelly Drive P. O. Box 477200 Tulsa, OK 74147-7200 NETWORK SECURITY (W/LAB) Course Syllabus Course Number: NTWK-0008 OHLAP Credit: Yes OCAS Code: 8131 Course Length: 130 Hours Career Cluster: Information
The Advantages of a Firewall Over an Interafer
FIREWALLS VIEWPOINT 02/2006 31 MARCH 2006 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor organisation to the Centre for the Protection
FIREWALLS. Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others
FIREWALLS FIREWALLS Firewall: isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others FIREWALLS: WHY Prevent denial of service attacks: SYN flooding: attacker
HANDBOOK 8 NETWORK SECURITY Version 1.0
Australian Communications-Electronic Security Instruction 33 (ACSI 33) Point of Contact: Customer Services Team Phone: 02 6265 0197 Email: assist@dsd.gov.au HANDBOOK 8 NETWORK SECURITY Version 1.0 Objectives
Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment
Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment Introduction 1 Distributed SCADA security 2 Radiflow Defense-in-Depth tool-set 4 Network Access
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 9 Firewalls and Intrusion Prevention Systems First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Firewalls and Intrusion
Considerations In Developing Firewall Selection Criteria. Adeptech Systems, Inc.
Considerations In Developing Firewall Selection Criteria Adeptech Systems, Inc. Table of Contents Introduction... 1 Firewall s Function...1 Firewall Selection Considerations... 1 Firewall Types... 2 Packet
Interconnecting Cisco Network Devices 1 Course, Class Outline
www.etidaho.com (208) 327-0768 Interconnecting Cisco Network Devices 1 Course, Class Outline 5 Days Interconnecting Cisco Networking Devices, Part 1 (ICND1) v2.0 is a five-day, instructorled training course
- Introduction to PIX/ASA Firewalls -
1 Cisco Security Appliances - Introduction to PIX/ASA Firewalls - Both Cisco routers and multilayer switches support the IOS firewall set, which provides security functionality. Additionally, Cisco offers
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasakh10/ Fall 2010 Sonja Buchegger buc@kth.se Lecture 6, Nov. 10, 2010 Firewalls, Intrusion Prevention, Intrusion Detection
FIREWALLS IN NETWORK SECURITY
FIREWALLS IN NETWORK SECURITY A firewall in an information security program is similar to a building s firewall in that it prevents specific types of information from moving between the outside world,
8 Steps for Network Security Protection
8 Steps for Network Security Protection cognoscape.com 8 Steps for Network Security Protection Many small and medium sized businesses make the mistake of thinking they won t be the target of hackers because
8 Steps For Network Security Protection
8 Steps For Network Security Protection 8 Steps For Network Security Protection Many small and medium sized businesses make the mistake of thinking they won t be the target of hackers because of their
Chapter 8 Security Pt 2
Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
Deploying ACLs to Manage Network Security
PowerConnect Application Note #3 November 2003 Deploying ACLs to Manage Network Security This Application Note relates to the following Dell PowerConnect products: PowerConnect 33xx Abstract With new system
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 4 Finding Network Vulnerabilities
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 4 Finding Network Vulnerabilities Learning Objectives Name the common categories of vulnerabilities Discuss common system
Network Security Administrator
Network Security Administrator Course ID ECC600 Course Description This course looks at the network security in defensive view. The ENSA program is designed to provide fundamental skills needed to analyze
MPLS Layer 3 and Layer 2 VPNs over an IP only Core. Rahul Aggarwal Juniper Networks. rahul@juniper.net
MPLS Layer 3 and Layer 2 VPNs over an IP only Core Rahul Aggarwal Juniper Networks rahul@juniper.net Agenda MPLS VPN services and transport technology Motivation for MPLS VPN services over an IP only core
Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.
Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols
SonicWALL Clean VPN. Protect applications with granular access control based on user identity and device identity/integrity
SSL-VPN Combined With Network Security Introducing A popular feature of the SonicWALL Aventail SSL VPN appliances is called End Point Control (EPC). This allows the administrator to define specific criteria
BlackRidge Technology Transport Access Control: Overview
2011 BlackRidge Technology Transport Access Control: Overview 1 Introduction Enterprises and government agencies are under repeated cyber attack. Attacks range in scope from distributed denial of service
How To Protect Your Network From Attack
Department of Computer Science Institute for System Architecture, Chair for Computer Networks Internet Services & Protocols Internet (In)Security Dr.-Ing. Stephan Groß Room: INF 3099 E-Mail: stephan.gross@tu-dresden.de
VPN. Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu
VPN Date: 4/15/2004 By: Heena Patel Email:hpatel4@stevens-tech.edu What is VPN? A VPN (virtual private network) is a private data network that uses public telecommunicating infrastructure (Internet), maintaining
Securing Local Area Network with OpenFlow
Securing Local Area Network with OpenFlow Master s Thesis Presentation Fahad B. H. Chowdhury Supervisor: Professor Jukka Manner Advisor: Timo Kiravuo Department of Communications and Networking Aalto University
FIREWALLS & CBAC. philip.heimer@hh.se
FIREWALLS & CBAC philip.heimer@hh.se Implementing a Firewall Personal software firewall a software that is installed on a single PC to protect only that PC All-in-one firewall can be a single device that
OLD VULNERABILITIES IN NEW PROTOCOLS? HEADACHES ABOUT IPV6 FRAGMENTS
OLD VULNERABILITIES IN NEW PROTOCOLS? HEADACHES ABOUT IPV6 FRAGMENTS Eric Vyncke (@evyncke) Cisco Session ID: ARCH W01 Session Classification: Advanced Agenda Status of WorldWide IPv6 Deployment IPv6 refresher:
From Network Security To Content Filtering
Computer Fraud & Security, May 2007 page 1/10 From Network Security To Content Filtering Network security has evolved dramatically in the last few years not only for what concerns the tools at our disposals
Chapter 15. Firewalls, IDS and IPS
Chapter 15 Firewalls, IDS and IPS Basic Firewall Operation The firewall is a border firewall. It sits at the boundary between the corporate site and the external Internet. A firewall examines each packet
How Network Transparency Affects Application Acceleration Deployment
How Network Transparency Affects Application Acceleration Deployment By John Bartlett and Peter Sevcik July 2007 Acceleration deployments should be simple. Vendors have worked hard to make the acceleration
20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7
20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic
Lecture 23: Firewalls
Lecture 23: Firewalls Introduce several types of firewalls Discuss their advantages and disadvantages Compare their performances Demonstrate their applications C. Ding -- COMP581 -- L23 What is a Digital
CSCI 4250/6250 Fall 2015 Computer and Networks Security
CSCI 4250/6250 Fall 2015 Computer and Networks Security Network Security Goodrich, Chapter 5-6 Tunnels } The contents of TCP packets are not normally encrypted, so if someone is eavesdropping on a TCP
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
Security vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in
IPv6 SECURITY. May 2011. The Government of the Hong Kong Special Administrative Region
IPv6 SECURITY May 2011 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the express
Howto: How to configure static port mapping in the corporate router/firewall for Panda GateDefender Integra VPN networks
Howto: How to configure static port mapping in the corporate router/firewall for Panda GateDefender Integra VPN networks How-to guides for configuring VPNs with GateDefender Integra Panda Security wants
How To Learn Cisco Cisco Ios And Cisco Vlan
Interconnecting Cisco Networking Devices: Accelerated Course CCNAX v2.0; 5 Days, Instructor-led Course Description Interconnecting Cisco Networking Devices: Accelerated (CCNAX) v2.0 is a 60-hour instructor-led
100-101: Interconnecting Cisco Networking Devices Part 1 v2.0 (ICND1)
100-101: Interconnecting Cisco Networking Devices Part 1 v2.0 (ICND1) Course Overview This course provides students with the knowledge and skills to implement and support a small switched and routed network.
Cyber Security for NERC CIP Version 5 Compliance
GE Measurement & Control Cyber Security for NERC CIP Version 5 Compliance imagination at work Contents Cyber Security for NERC CIP Compliance... 5 Sabotage Reporting... 6 Security Management Controls...
ΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
Lecture Objectives. Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks. Agenda. References
Lecture Objectives Wireless Networks and Mobile Systems Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks Introduce security vulnerabilities and defenses Describe security functions
Secure Networks for Process Control
Secure Networks for Process Control Leveraging a Simple Yet Effective Policy Framework to Secure the Modern Process Control Network An Enterasys Networks White Paper There is nothing more important than
Interconnecting Cisco Networking Devices, Part 1 (ICND1) v3.0
Interconnecting Cisco Networking Devices, Part 1 (ICND1) v3.0 COURSE OVERVIEW: Interconnecting Cisco Networking Devices, Part 1 (ICND1) v3.0 is a five-day, instructor-led training course that teaches learners
Virtual Private Networks (VPN) Connectivity and Management Policy
Connectivity and Management Policy VPN Policy for Connectivity into the State of Idaho s Wide Area Network (WAN) 02 September 2005, v1.9 (Previous revision: 14 December, v1.8) Applicability: All VPN connections
Security and Access Control Lists (ACLs)
Security and Access Control Lists (ACLs) Malin Bornhager Halmstad University Session Number 2002, Svenska-CNAP Halmstad University 1 Objectives Security Threats Access Control List Fundamentals Access
Report to WIPO SCIT Plenary Trilateral Secure Virtual Private Network Primer. February 3, 1999
Report to WIPO SCIT Plenary Trilateral Secure Virtual Private Network Primer February 3, 1999 Frame Relay Frame Relay is an international standard for high-speed access to public wide area data networks
Overview. Firewall Security. Perimeter Security Devices. Routers
Overview Firewall Security Chapter 8 Perimeter Security Devices H/W vs. S/W Packet Filtering vs. Stateful Inspection Firewall Topologies Firewall Rulebases Lecturer: Pei-yih Ting 1 2 Perimeter Security
Security Frameworks. An Enterprise Approach to Security. Robert Belka Frazier, CISSP belka@att.net
Security Frameworks An Enterprise Approach to Security Robert Belka Frazier, CISSP belka@att.net Security Security is recognized as essential to protect vital processes and the systems that provide those
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
CISCO IOS NETWORK SECURITY (IINS)
CISCO IOS NETWORK SECURITY (IINS) SEVENMENTOR TRAINING PVT.LTD [Type text] Exam Description The 640-553 Implementing Cisco IOS Network Security (IINS) exam is associated with the CCNA Security certification.
Computer Security DD2395
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/dd2395/dasak12/ Fall 2012 Sonja Buchegger buc@kth.se Lecture 9 Firewalls (maybe start on Multilevel Security) DD2395 Sonja Buchegger
TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY
IT FIREWALL POLICY TABLE OF CONTENT 1. INTRODUCTION... 3 2. TERMS AND DEFINITION... 3 3. PURPOSE... 5 4. SCOPE... 5 5. POLICY STATEMENT... 5 6. REQUIREMENTS... 5 7. OPERATIONS... 6 8. CONFIGURATION...
Network System Design Lesson Objectives
Network System Design Lesson Unit 1: INTRODUCTION TO NETWORK DESIGN Assignment Customer Needs and Goals Identify the purpose and parts of a good customer needs report. Gather information to identify network