Digital Energy BPT. Hack In Paris Paul Coggin Internetwork Consulting Solutions
|
|
|
- Beverly Kelly
- 8 years ago
- Views:
Transcription
1 Digital Energy BPT Hack In Paris 2014 Paul Coggin work Consulting Solutions V## Goes Here 1
2 Digital Energy Basic Persistent Threat APT default excuse for any compromise Default passwords Little to no separation of control, management and data services Layer 2 security issues Lack of Perimeter Egress filtering Lack of Perimeter Egress authentication Trust Relationships Integration Interdependencies Dependencies Vendor remote access Default database client/server protocol configuration Talented attackers exploiting critical infrastructure using basic attack vectors are not an APT. Lack of security policies driving network and security infrastructure configuration Flat earth network architecture philosophy 2
3 Public Network Infrastructure Overview DHCP Server Policy Server Lawful Intercept AAA Server tuational Awareness Servers Provisioning Servers Assurance Servers Online and Internal Billing Servers VoIP GW Web server ICS / SCADA SIP Proxy Video Headend IPTV/VOD λ 1... λ n PLS/IP, DWD, SONET - Vendor/fg. Remote Support - Internal Tech Staff VPN - Customer online bill payment - isconfigured Backdoor i DWD GPON GigE SONET Branch Office Enterprise Residential Residential Telecommuter SOHO Energy Distribution Water / Sewer Treatment Plant Cell Tower 3
4 ANSI/ISA99 ICS Industrial Control Systems SCADA Supervisory Control and Data Acquisition PLC Programmable Logic Controller RTU Remote Terminal Unit IED Intelligent Electronic Device Historian HI Human achine Interface Protocols - odbus, ICCP, DNP3, Others In many networks there is not a firewall securing the integration between the Enterprise and ICS/SCADA network. A multi-homed Windows system is commonly integrates the two networks Typically, the ICS/SCADA network utilizes a flat network architecture. The vendors have VPN, Telnet and/or SSH holes punched through the firewall with weak authentication in most cases. Older systems will have back door modem connections for vendor remote access. Reference: - ANSI/ISA99 Standard 4
5 Voice Soft Switch Network The service provider transport and soft switch vendors commonly provide a ES for their solution. The ES server commonly is multi-homed with one interface connected directly to the and a second connected to the management network. The transport and voice technical staff may have the system installed without the protection of a firewall or VPN. A number of soft switch ES systems have been hacked using SSH brute force attacks. In some cases the ES is installed behind a firewall with ACL s trusting any inbound IP connection destined to the SSH service. Voice Transport Network anagement Network ES Backup ES λ 1 Soft Switch Backup Soft Switch λ 1... λ n 5
6 What Kind of Ring is It? Collapsed Ring Topology Logical Ring for Regulatory Requirements Any disruption to the single physical fiber run disrupts the logical ring. One service provider had their fiber cut between CO s by copper thieves. Ring Topology End point devices such as DSLAs are configured to form a ring on both ends of the fiber run. λ 3 λ 1... λ n 6
7 Dual Purposed Online Bill Paying Web Server & Internal Billing System Provisioning & onitoring Internal Billing System & Online Billing Web Server iddleware Directory Traversal led to root access to Internal billing system that was also the online billing system for customers. A billing system vendor designed architecture. The billing system vendor argued this architecture was secure even after their system was hacked. Power distributors may utilize the transport and access network for smart grid services. Internal Enterprise LAN Billing system hack exposes provisioning, network management, IPTV iddleware etc. to being compromised through trust relationships. AAA IPTV Netgt ES λ 1... λ n λ 3 Video On Demand Services Voice Services 7
8 Transport Network Disrupted by Accidental isconfiguration alware existed on Data (ISP) user computers alware sends ICP packets to DOS target. Transport equipment encapsulated DOS packets into multicast packets. Transport equipment replicated DOS in hardware to all users. TV S Residential Customer IP Phone STB essage On- Line Network enu Guide Ch Up Select Power Ch Dn NLC 3 PC IP Phone Private Virtual Circuits Separation of Service/ VLANs GPON Secure Visualiza-on and Instrumenta-on Deep Inspec-on and onitoring of Network Flows / Packets Diagnosed Configura-on Issue Customer with SVI was alerted to unusual traffic on multicast VLAN for video. Called for remote Incident Analysis/ Forensics on Network Packets showed multicasting of bad Info and misconfiguration of network logical data flows IPTV Video On Demand Services Voice Services TV S STB essage On- Line Network enu Guide Ch Up Select Power Ch Dn NLC 3 PC Service Provider Employee istakenly Integrated Data and Video Networks Services 8
9 CPE Router Hijacking Residential Customer TV S Hacker attacked DSL odems. Changed DNS address to Relay Box. IP Phone STB essage On- Line Network enu Guide Ch Up Select Power Ch Dn NLC 3 PC IP Phone Private Virtual Circuits Separation of Service/ VLANs GPON 6K DSL Routers hacked before stopped Router management access with open trust Unknown default router password Deep Inspection and onitoring of Network Flows / Packets IPTV Video On Demand Services Voice Services TV S STB essage On- Line Network enu Guide Ch Up Select Power Ch Dn NLC 3 PC Hijacked web requests and web traffic redirected to rogue site Services 9
10 BGP Attack from Broadband Subscriber Corporate Broadband subscriber infected with malware A system on the subscriber network starts sending malformed BGP D5 packets directly to legacy router Enterprise Broadband Customer TV S IP Phone STB essage On- Line Network enu Guide Ch Up Select Power Ch Dn NLC 3 PC IP Phone Private Virtual Circuits Separation of Service/ VLANs GPON Legacy router running buggy code crashes when malformed BGP D5 packets are sent to it. The Legacy router was installed in a rush for a temporary fix without close attention to control plane security. Access network subscribers should be blocked from ever initiating connections to control plane and management plane services. IPTV Video On Demand Services Voice Services Legacy BGP Router TV S STB essage On- Line Network enu Guide Ch Up Select Power Ch Dn NLC 3 PC Services 10
11 Utility CATV Head End Scenario Vendor aggregates customer VPN s to HQ site. The customer inherits the security risk of the vendor through the VPN trust relationship. Vendor was hacked enabling billing system integration server to be hacked. No Segmentation No PVLAN, VACL Vendor HQ Dedicated VPN for Remote gt Vendor VPN Router Billing System Integration TV downstream Routers iddleware C STB essage On- Line Network enu Guide Ch Up Select Power Ch Dn NLC 3 S Fiber Node upstream RF Combiner Cable odem Termination System (CTS) Cable Routers IPTV Video On Demand Services Voice Services 11
12 Utility CATV Head End Scenario 2 Vendor 1 If a vendor network, the CATV head end or the enterprise network is exploited. The trust relationships can then be easily used to pivot between networks. Dedicated VPN for Remote gt No Segmentation No PVLAN, VACL Freely Pivot between Vendors & Head End Exploit Enterprise Trust Relationships TV Vendor 2 downstream Routers Vendor VPN Routers Billing System Integration iddleware upstream C STB essage On- Line Network enu Guide Ch Up Select Power Ch Dn NLC 3 S Fiber Node RF Combiner Cable odem Termination System (CTS) Cable Routers Enterprise IPTV Video On Demand Services Voice Services 12
13 Transport Network Remote Support Services ulti-homed ES Server SSH Access for Transport and Access Vendor Firewall Physically Bypassed Open Trust Relationship for SSH OSS / NOC Enterprise Optical ES 13
14 In-Band Network anagement Network anagement Protocols SNP Telnet HTTP/s - XL TFTP TL1 SSH Network anagement Security Access List Firewalls VPN IDS/IPS AAA Trust levels anagement VLAN User VLAN s VLAN Trunks Users Utilize PLS VPN s and VRF s for anagement Network Business and Network anagement Traffic Uses Common Infrastructure NOC Data Center Resources Trust odel Defines Security Posture - Network management features are vulnerabilities (Provides Configuration and Access Information) - Security policies define trust model - Users access - Customer access - Vendor/fg local/remote tech support access - NOC \ Tech support staff - Secure visualization and instrumentation - Internal, Customer, anagement operations in separate IP subnets/vlan s/pvc s etc over shared network infrastructure. - Log everything - 2 Factor authentication 14
15 Out of Band anagement Network Network anagement Protocols SNP Telnet HTTP/s - XL TFTP TL1 SSH Custom\Proprietary NOC Data Center Resources Network anagement Security Access Lists VACL s Firewalls VPN IDS/IPS Terminal Server AAA Trust levels Terminal Server/Console gmt Network Dedicated gmt Interface User VLAN s VLAN Trunks Users Network management utilizes dedicated out of band IP network infrastructure Dedicated Network anagement Network - Network devices and servers now come built with dedicated management interfaces. - Cisco routers and switches have built-in mgt. int. - Utilize un-attributable for remote VPN access - 2 factor authentication - Strict policy for enabling/disabling remote vendor access - Log everything 15
16 Layer 2 Security Issues Prevalent Rogue Insider Routers Crafted HSRP coup packet with higher priority Common Issues STP / BPDU VTP VLAN Hopping ARP Poisoning FHRP Rogue DHCP Server Horizontal and Vertical Pivoting Suggested Remediation BPDU and Root Guard Secure VTP Disable Dynamic Trunking Dynamic ARP Inspection Limit ACs per Port Secure FHRP DHCP Snooping, Disable DHCP Trust PVLAN s, VACL s, DHCP Option 82 L2 NetFlow Secure Information Flow Trust Relationships 16
17 Bottom Line Whitelist the Applications Whitelist the Network Trust Relationships Whitelist Trusted Information Flows in onitoring 17
18 18
Exploiting First Hop Protocols to Own the Network. Rocket City TakeDownCon 2015. Paul Coggin Senior Principal Cyber Security Analyst @PaulCoggin
Exploiting First Hop Protocols to Own the Network Rocket City TakeDownCon 2015 Paul Coggin Senior Principal Cyber Security Analyst @PaulCoggin www.dynetics.com V## Goes Here 1 OSI and TCP/IP Model OSI
BSides Nashville 2014
Bending and Twisting Networks BSides Nashville 2014 Paul Coggin Internetwork Consulting Solutions Architect @PaulCoggin www.dynetics.com V## Goes Here 1 SNMP Blow Defeat SNMP w/ ACL $ snmpblow.pl -s
Recommended IP Telephony Architecture
Report Number: I332-009R-2006 Recommended IP Telephony Architecture Systems and Network Attack Center (SNAC) Updated: 1 May 2006 Version 1.0 SNAC.Guides@nsa.gov This Page Intentionally Left Blank ii Warnings
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
Secure Networks for Process Control
Secure Networks for Process Control Leveraging a Simple Yet Effective Policy Framework to Secure the Modern Process Control Network An Enterasys Networks White Paper There is nothing more important than
Configuring the Transparent or Routed Firewall
5 CHAPTER This chapter describes how to set the firewall mode to routed or transparent, as well as how the firewall works in each firewall mode. This chapter also includes information about customizing
Security Considerations in IP Telephony Network Configuration
Security Considerations in IP Telephony Network Configuration Abstract This Technical Report deals with fundamental security settings in networks to provide secure VoIP services. Example configurations
Cisco Networking Professional-6Months Project Based Training
Cisco Networking Professional-6Months Project Based Training Core Topics Cisco Certified Networking Associate (CCNA) 1. ICND1 2. ICND2 Cisco Certified Networking Professional (CCNP) 1. CCNP-ROUTE 2. CCNP-SWITCH
Voice over IP. VoIP (In) Security. Presented by Darren Bilby NZISF 14 July 2005
Voice over IP VoIP (In) Security Presented by Darren Bilby NZISF 14 July 2005 Security-Assessment.com Who We Are NZ s only pure-play security firm Largest team of security professionals in NZ Offices in
Multi-Homing Dual WAN Firewall Router
Multi-Homing Dual WAN Firewall Router Quick Installation Guide M73-APO09-400 Multi-Homing Dual WAN Firewall Router Overview The Multi-Homing Dual WAN Firewall Router provides three 10/100Mbit Ethernet
Cisco Certified Network Associate Exam. Operation of IP Data Networks. LAN Switching Technologies. IP addressing (IPv4 / IPv6)
Cisco Certified Network Associate Exam Exam Number 200-120 CCNA Associated Certifications CCNA Routing and Switching Operation of IP Data Networks Operation of IP Data Networks Recognize the purpose and
HughesNet Broadband VPN End-to-End Security Enabled by the HN7700S-R
HughesNet Broadband VPN End-to-End Security Enabled by the HN7700S-R HughesNet Managed Broadband Network Services include a high level of end-toend security utilizing a robust architecture designed by
A Network Design Primer
Network Design Recommendations Recommendations for s to take into account when doing network design to help create a more easily defendable and manageable network K-20 Network Engineering 6/30/15 Network
A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
IMPLEMENTING CISCO SWITCHED NETWORKS V2.0 (SWITCH)
IMPLEMENTING CISCO SWITCHED NETWORKS V2.0 (SWITCH) COURSE OVERVIEW: Implementing Cisco Switched Networks (SWITCH) v2.0 is a five-day instructor-led training course developed to help students prepare for
Joe Andrews, MsIA, CISSP-ISSEP, ISSAP, ISSMP, CISA, PSP Sr. Compliance Auditor Cyber Security
Joe Andrews, MsIA, CISSP-ISSEP, ISSAP, ISSMP, CISA, PSP Sr. Compliance Auditor Cyber Security CIP-005-3 Audit Approach, ESP Diagrams, Industry Best Practices September 24 25, 2013 SALT LAKE CITY, UTAH
CCT vs. CCENT Skill Set Comparison
Operation of IP Data Networks Recognize the purpose and functions of various network devices such as Routers, Switches, Bridges and Hubs Select the components required to meet a given network specification
Chapter 1 The Principles of Auditing 1
Chapter 1 The Principles of Auditing 1 Security Fundamentals: The Five Pillars Assessment Prevention Detection Reaction Recovery Building a Security Program Policy Procedures Standards Security Controls
Security Testing in Critical Systems
Security Testing in Critical Systems An Ethical Hacker s View Peter Wood Chief Executive Officer First Base Technologies Who is Peter Wood? Worked in computers & electronics since 1969 Founded First Base
Securing end devices
Securing end devices Securing the network edge is already covered. Infrastructure devices in the LAN Workstations Servers IP phones Access points Storage area networking (SAN) devices. Endpoint Security
Southwest Arkansas Telephone Cooperative Network Management Practices
Southwest Arkansas Telephone Cooperative Network Management Practices Page 1 of 11 Release Date 05/18/15 INTRODUCTION... 3 CORE NETWORK OVERVIEW... 3 DISTRIBUTION NETWORK OVERVIEW... 3 ACCESS NETWORK OVERVIEW...
IT Security and OT Security. Understanding the Challenges
IT Security and OT Security Understanding the Challenges Security Maturity Evolution in Industrial Control 1950s 5/4/2012 # 2 Technology Sophistication Security Maturity Evolution in Industrial Control
Firewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment
Secure Networking for Critical Infrastructure Using Service-aware switches for Defense-in-Depth deployment Introduction 1 Distributed SCADA security 2 Radiflow Defense-in-Depth tool-set 4 Network Access
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
Firewalls and VPNs. Principles of Information Security, 5th Edition 1
Firewalls and VPNs Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to: Understand firewall technology and the various approaches
Cisco Virtual Office Express
. Q&A Cisco Virtual Office Express Overview Q. What is Cisco Virtual Office Express? A. Cisco Virtual Office Express is a solution that provides secure, rich network services to workers at locations outside
Edgewater Routers User Guide
Edgewater Routers User Guide For use with 8x8 Service May 2012 Table of Contents EdgeMarc 250w Router Overview.... 3 EdgeMarc 4550-15 Router Overview... 4 Basic Setup of the 250w, 200AE1 and 4550... 5
NETE-4635 Computer Network Analysis and Design. Designing a Network Topology. NETE4635 - Computer Network Analysis and Design Slide 1
NETE-4635 Computer Network Analysis and Design Designing a Network Topology NETE4635 - Computer Network Analysis and Design Slide 1 Network Topology Design Themes Hierarchy Redundancy Modularity Well-defined
Network Virtualization Network Admission Control Deployment Guide
Network Virtualization Network Admission Control Deployment Guide This document provides guidance for enterprises that want to deploy the Cisco Network Admission Control (NAC) Appliance for their campus
Chapter 5. Figure 5-1: Border Firewall. Firewalls. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall
Figure 5-1: Border s Chapter 5 Revised March 2004 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Border 1. (Not Trusted) Attacker 1 1. Corporate Network (Trusted) 2 Figure
The IINS acronym to this exam will remain but the title will change slightly, removing IOS from the title, making the new title
Introduction The CCNA Security IINS exam topics have been refreshed from version 2.0 to version 3.0. This document will highlight exam topic changes between the current 640-554 IINS exam and the new 210-260
Building Secure Network Infrastructure For LANs
Building Secure Network Infrastructure For LANs Yeung, K., Hau; and Leung, T., Chuen Abstract This paper discusses the building of secure network infrastructure for local area networks. It first gives
Company Co. Inc. LLC. LAN Domain Network Security Best Practices. An integrated approach to securing Company Co. Inc.
Company Co. Inc. LLC Multiple Minds, Singular Results LAN Domain Network Security Best Practices An integrated approach to securing Company Co. Inc. LLC s network Written and Approved By: Geoff Lacy, Tim
Edgewater Routers User Guide
Edgewater Routers User Guide For use with 8x8 Service Version 1.0, March 2011 Table of Contents EdgeMarc 200AE1-10 Router Overview...3 EdgeMarc 4550-15 Router Overview...4 Basic Setup of the 200AE1 and
Course Contents CCNP (CISco certified network professional)
Course Contents CCNP (CISco certified network professional) CCNP Route (642-902) EIGRP Chapter: EIGRP Overview and Neighbor Relationships EIGRP Neighborships Neighborship over WANs EIGRP Topology, Routes,
Campus LAN at NKN Member Institutions
Campus LAN at NKN Member Institutions RS MANI rsm@nkn.in 1/7/2015 3 rd Annual workshop 1 Efficient utilization Come from: Good Campus LAN Speed Segregation of LANs QoS Resilient Access Controls ( L2 and
WAN Failover Scenarios Using Digi Wireless WAN Routers
WAN Failover Scenarios Using Digi Wireless WAN Routers This document discusses several methods for using a Digi wireless WAN gateway to provide WAN failover for IP connections in conjunction with another
SCADA System Security. ECE 478 Network Security Oregon State University March 7, 2005
SCADA System Security ECE 478 Network Security Oregon State University March 7, 2005 David Goeke Hai Nguyen Abstract Modern public infrastructure systems
Innovative Defense Strategies for Securing SCADA & Control Systems
1201 Louisiana Street Suite 400 Houston, Texas 77002 Phone: 877.302.DATA Fax: 800.864.6249 Email: info@plantdata.com Innovative Defense Strategies for Securing SCADA & Control Systems By: Jonathan Pollet
Firewall VPN Router. Quick Installation Guide M73-APO09-380
Firewall VPN Router Quick Installation Guide M73-APO09-380 Firewall VPN Router Overview The Firewall VPN Router provides three 10/100Mbit Ethernet network interface ports which are the Internal/LAN, External/WAN,
How To Make A Network Secure
1 2 3 4 -Lower yellow line is graduate student enrollment -Red line is undergradate enrollment -Green line is total enrollment -2008 numbers are projected to be near 20,000 (on-campus) not including distance
How To Understand and Configure Your Network for IntraVUE
How To Understand and Configure Your Network for IntraVUE Summary This document attempts to standardize the methods used to configure Intrauve in situations where there is little or no understanding of
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security
CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by
CUSTOMIZED ASSESSMENT BLUEPRINT COMPUTER SYSTEMS NETWORKING PA. Test Code: 8148 Version: 01
CUSTOMIZED ASSESSMENT BLUEPRINT COMPUTER SYSTEMS NETWORKING PA Test Code: 8148 Version: 01 Specific competencies and skills tested in this assessment: Personal and Environmental Safety Wear personal protective
Disaster Recovery Design Ehab Ashary University of Colorado at Colorado Springs
Disaster Recovery Design Ehab Ashary University of Colorado at Colorado Springs As a head of the campus network department in the Deanship of Information Technology at King Abdulaziz University for more
Security Technology: Firewalls and VPNs
Security Technology: Firewalls and VPNs 1 Learning Objectives Understand firewall technology and the various approaches to firewall implementation Identify the various approaches to remote and dial-up
Broadband Network Architecture
Broadband Network Architecture Jan Martijn Metselaar May 24, 2012 Winitu Consulting Klipperaak 2d 2411 ND Bodegraven The Netherlands slide Broadband Services! Dual play, Triple play, Multi play! But what
Basic Network Configuration
Basic Network Configuration 2 Table of Contents Basic Network Configuration... 25 LAN (local area network) vs WAN (wide area network)... 25 Local Area Network... 25 Wide Area Network... 26 Accessing the
State of Texas. TEX-AN Next Generation. NNI Plan
State of Texas TEX-AN Next Generation NNI Plan Table of Contents 1. INTRODUCTION... 1 1.1. Purpose... 1 2. NNI APPROACH... 2 2.1. Proposed Interconnection Capacity... 2 2.2. Collocation Equipment Requirements...
Gigabit Content Security Router
Gigabit Content Security Router As becomes essential for business, the crucial solution to prevent your connection from failure is to have more than one connection. PLANET is the Gigabit Content Security
Cconducted at the Cisco facility and Miercom lab. Specific areas examined
Lab Testing Summary Report July 2009 Report 090708 Product Category: Unified Communications Vendor Tested: Key findings and conclusions: Cisco Unified Communications solution uses multilayered security
Firewalls CSCI 454/554
Firewalls CSCI 454/554 Why Firewall? 1 Why Firewall (cont d) w now everyone want to be on the Internet w and to interconnect networks w has persistent security concerns n can t easily secure every system
DMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch
DMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch What You Will Learn A demilitarized zone (DMZ) is a separate network located in the neutral zone between a private (inside)
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
642 552 Securing Cisco Network Devices (SND)
642 552 Securing Cisco Network Devices (SND) Course Number: 642 552 Length: 1 Day(s) Course Overview This course is part of the training for the Cisco Certified Security Professional, Cisco Firewall Specialist,
IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT
IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT Roopa K. Panduranga Rao MV Dept of CS and Engg., Dept of IS and Engg., J.N.N College of Engineering, J.N.N College of Engineering,
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1
Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3
This chapter covers the following topics:
This chapter covers the following topics: Components of SAFE Small Network Design Corporate Internet Module Campus Module Branch Versus Headend/Standalone Considerations for Small Networks C H A P T E
Chapter 3 LAN Configuration
Chapter 3 LAN Configuration This chapter describes how to configure the advanced LAN features of your ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN. This chapter contains the following sections
Securing Web Applications...at the Network Layer
Securing Web Applications......at the Network Layer OWASP Spain Chapter Meeting 16 th June, 2006 Barcelona (ES) Carlos Fragoso Mariscal Chief Technical Director carlos@jessland.net Securing Web Applications
IP Phone Security: Packet Filtering Protection Against Attacks. Introduction. Abstract. IP Phone Vulnerabliities
W H I T E P A P E R By Atul Verma Engineering Manager, IP Phone Solutions Communications Infrastructure and Voice Group averma@ti.com Introduction The advantages of a converged voice and data network are
Cyber Security for SCADA/ICS Networks
Cyber Security for SCADA/ICS Networks GANESH NARAYANAN HEAD-CONSULTING CYBER SECURITY SERVICES www.thalesgroup.com Increasing Cyber Attacks on SCADA / ICS Systems 2 What is SCADA Supervisory Control And
OPC & Security Agenda
OPC & Security Agenda Cyber Security Today Cyber Security for SCADA/IS OPC Security Overview OPC Security Products Questions & Answers 1 Introduction CYBER SECURITY TODAY The Need for Reliable Information
Network Security. Ensuring Information Availability. Security
Ensuring Information Availability Security - Ensuring Information Availability Introduction The advent of the Internet and the huge array of connected devices has led to an insatiable demand for access
The Trivial Cisco IP Phones Compromise
Security analysis of the implications of deploying Cisco Systems SIP-based IP Phones model 7960 Ofir Arkin Founder The Sys-Security Group ofir@sys-security.com http://www.sys-security.com September 2002
Intelligent Threat Management TM Coupled with Automated Threat Management
Intelligent Threat Management TM Coupled with Automated Threat Management Identifies and Stops not only the known events but the Mutated or never before seen events Abstract Intelligent Threat Management
Best Practices for Securing IP Telephony
Best Practices for Securing IP Telephony Irwin Lazar, CISSP Senior Analyst Burton Group Agenda VoIP overview VoIP risks Mitigation strategies Recommendations VoIP Overview Hosted by VoIP Functional Diagram
Gigabit SSL VPN Security Router
As Internet becomes essential for business, the crucial solution to prevent your Internet connection from failure is to have more than one connection. PLANET is the ideal to help the SMBs increase the
SSVP SIP School VoIP Professional Certification
SSVP SIP School VoIP Professional Certification Exam Objectives The SSVP exam is designed to test your skills and knowledge on the basics of Networking and Voice over IP. Everything that you need to cover
WAN Traffic Management with PowerLink Pro100
Whitepaper WAN Traffic Management with PowerLink Pro100 Overview In today s Internet marketplace, optimizing online presence is crucial for business success. Wan/ISP link failover and traffic management
Why an Intelligent WAN Solution is Essential for Mission Critical Networks
Why an Intelligent WAN Solution is Essential for Mission Critical Networks White Paper Series WP100135 Charles Tucker Director of Marketing June 1, 2006 Abstract: Reliable Internet connectivity is now
IINS Implementing Cisco Network Security 3.0 (IINS)
IINS Implementing Cisco Network Security 3.0 (IINS) COURSE OVERVIEW: Implementing Cisco Network Security (IINS) v3.0 is a 5-day instructor-led course focusing on security principles and technologies, using
ACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD SEGURIDAD EN REDES. NIVEL I. VERSION 2.0
ACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD SEGURIDAD EN REDES. NIVEL I. VERSION 2.0 Module 1: Vulnerabilities, Threats, and Attacks 1.1 Introduction to Network Security
Codes of Connection for Devices Connected to Newcastle University ICT Network
Code of Connection (CoCo) for Devices Connected to the University s Author Information Security Officer (Technical) Version V1.1 Date 23 April 2015 Introduction This Code of Connection (CoCo) establishes
IP Telephony Management
IP Telephony Management How Cisco IT Manages Global IP Telephony A Cisco on Cisco Case Study: Inside Cisco IT 1 Overview Challenge Design, implement, and maintain a highly available, reliable, and resilient
Wholesale IP Bitstream on a Cable HFC infrastructure
Wholesale IP Bitstream on a Cable HFC infrastructure In order to understand the issues related to an ISP reselling Cable Based Internet access it is necessary to look at similarities and dissimilarities
Cisco Nexus 1000V Switch for Microsoft Hyper-V
Data Sheet Cisco Nexus 1000V Switch for Microsoft Hyper-V Product Overview Cisco Nexus 1000V Switches provide a comprehensive and extensible architectural platform for virtual machine and cloud networking.
Network Security Topologies. Chapter 11
Network Security Topologies Chapter 11 Learning Objectives Explain network perimeter s importance to an organization s security policies Identify place and role of the demilitarized zone in the network
JOB READY ASSESSMENT BLUEPRINT COMPUTER NETWORKING FUNDAMENTALS - PILOT. Test Code: 4514 Version: 01
JOB READY ASSESSMENT BLUEPRINT COMPUTER NETWORKING FUNDAMENTALS - PILOT Test Code: 4514 Version: 01 Specific Competencies and Skills Tested in this Assessment: PC Principles Identify physical and equipment
Smart Tips. Enabling WAN Load Balancing. Key Features. Network Diagram. Overview. Featured Products. WAN Failover. Enabling WAN Load Balancing Page 1
Smart Tips Enabling WAN Load Balancing Overview Many small businesses today use broadband links such as DSL or Cable, favoring them over the traditional link such as T1/E1 or leased lines because of the
Implementing Cisco IOS Network Security
Implementing Cisco IOS Network Security IINS v3.0; 5 Days, Instructor-led Course Description Implementing Cisco Network Security (IINS) v3.0 is a 5-day instructor-led course focusing on security principles
CCNA Security. IINS v2.0 Implementing Cisco IOS Network Security (640-554)
CCNA Security Öngereksinimler: CCNA http://www.cliguru.com/ccna Kurs Tanımı: CCNA Security network'ün temellerini anlamış olan katılımcılara network güvenliği hakkında temel bilgi sağlamaya yönelik hazırlanmış
Voice Over IP (VoIP) Denial of Service (DoS)
Introduction Voice Over IP (VoIP) Denial of Service (DoS) By Mark Collier Chief Technology Officer SecureLogix Corporation mark.collier@securelogix.com Denial of Service (DoS) is an issue for any IP network-based
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
Configure A VoIP Network
Configure A VoIP Network Prof. Mr. Altaf. I. Darvadiya Electronics & Communication C.U.Shah College of Engg. & Tech. Wadhwan(363030), India e-mail: alto.ec@gmail.com Ms. Zarna M. Gohil Electronics & Communication
Implementing Secured Converged Wide Area Networks (ISCW) Version 1.0
COURSE OVERVIEW Implementing Secure Converged Wide Area Networks (ISCW) v1.0 is an advanced instructor-led course that introduces techniques and features that enable or enhance WAN and remote access solutions.
Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1
Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton
CCNP: Implementing Secure Converged Wide-area Networks
CCNP: Implementing Secure Converged Wide-area Networks Cisco Networking Academy Version 5.0 This document is exclusive property of Cisco Systems, Inc. Permission is granted to print and copy this document
Microsoft. CompTIA Network+ Rapid Review. (Exam N10-005) Craig Zacker
Microsoft CompTIA Network+ Rapid Review (Exam N10-005) Craig Zacker Introduction xix Preparing for the exam xxiii Chapter 1 Network Concepts 1 Objective 1.1: Compare the layers of the OSI and TCP/IP models
Ron Shuck, CISSP, CISM, CISA, GCIA Infrastructure Security Architect Spirit AeroSystems
Ron Shuck, CISSP, CISM, CISA, GCIA Infrastructure Security Architect Spirit AeroSystems VOIP Components Common Threats How Threats are Used Future Trends Provides basic network connectivity and transport
Session Border Controllers in Enterprise
A Light Reading Webinar Session Border Controllers in Enterprise Thursday, October 7, 2010 Hosted by Jim Hodges Senior Analyst Heavy Reading Sponsored by: Speakers Natasha Tamaskar VP Product Marketing
Top-Down Network Design
Top-Down Network Design Chapter Five Designing a Network Topology Copyright 2010 Cisco Press & Priscilla Oppenheimer Topology A map of an internetwork that indicates network segments, interconnection points,
OS3 Fiber Day Broadband networks - Network Architecture. May 20, 2016 / Jan Martijn Metselaar Vodafone
OS3 Fiber Day Broadband networks - Network Architecture May 20, 2016 / Jan Martijn Metselaar Vodafone Quizzz Dual play, Triple play, Multi play IP all the way! But what does the end-user care? 2 Current
Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA
Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..
www.pwc.com Network Security Auditing April 2015
www.pwc.com Network Security Auditing Agenda Objectives Concepts Definitions Key Review Areas Architecture Assessment Types Nipper Overview Firewall Configuration Review Case Study AlgoSec Overview Firewall
The Internet of Things (IoT) and Industrial Networks. Guy Denis gudenis@cisco.com Rockwell Automation Alliance Manager Europe 2015
The Internet of Things (IoT) and Industrial Networks Guy Denis gudenis@cisco.com Rockwell Automation Alliance Manager Europe 2015 Increasingly Everything will be interconnected 50 Billion Smart Objects
Computer Network Engineering
226 Computer Network Engineering Computer Network Engineering Degrees, Certificates and Awards Associate in Science: Computer Network Engineering Certificate of Achievement: Computer Network Engineering
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT
HOW TO PREVENT DDOS ATTACKS IN A SERVICE PROVIDER ENVIRONMENT The frequency and sophistication of Distributed Denial of Service attacks (DDoS) on the Internet are rapidly increasing. Most of the earliest