Myths, Mistakes and Outright Lies When it comes to network security P U R E S E C U R I T Y

Size: px

Start display at page:

Download "Myths, Mistakes and Outright Lies When it comes to network security P U R E S E C U R I T Y"

Cynthia Washington
8 years ago
Views:

1 Myths, Mistakes and Outright Lies When it comes to network security P U R E S E C U R I T Y

2 Things to be considered 2

3 All you need is.... AUTHENTICATION SERVERS VULNERABILITY ASSESSMENT TOOLS NIDS SCANNERS/SENSORS HARDENED ROUTERS & SWITCHES HIDS/APPLICATION SHIELDS VPN GATEWAYS NETWORK FIREWALLS CONTENT FILTERS APPLICATION FIREWALLS Internet ANTIVIRUS FIREWALLS WIRELESS GATEWAYS FILE ENCRYPTORS/DECRYPTORS CERTIFICATE AUTHORITIES REPORTING/MONITORING TOOLS IN-LINE IDS/IPS TRAFFIC ANALYZERS POLICY MANAGEMENT/SECURITY ADMINISTRATION TOOLS 3

SWITCHES HIDS/APPLICATION SHIELDS VPN GATEWAYS NETWORK FIREWALLS CONTENT FILTERS APPLICATION FIREWALLS

4 But you asked me to.... Know what s really critical Secure network connections to external organizations Develop, maintain, enforce corporate IT security policy Know security tools Stop theft of proprietary information Optimize administrative efficiencies Understand implementation problems Define key infrastructure elements Grow while continuing to protect assets Update Internet attack defenses Internet Prevent internal network abuse Justify new investments Identify security support personnel Determine mission statements Respond to and investigate incidents Implement additional measures to further protect primary investments Avoid performance bottlenecks Ensure and document the effectiveness of infrastructure Determine which functions to outsource 4

information Optimize administrative efficiencies Understand implementation problems Define key infrastructure elements Grow while continuing to protect assets Update Internet attack

5 Bulletproof Security! 5

6 For Example.... An exploit designed around two core concepts: 1) The exploit would be allowed by any network security policy 2) The victim MUST have a network security system in place like an IDS/IPS/Firewall 6

7 %20%20%%<script>I Hate Purple Dinosaurs </script>%20%20 Corporate Network BADSRC=abc.com.. %20%20%%<script>I Hate Purple Dinosaurs </script>%% Web Server BADSRC DST SRV DNS Internet IDS Reporter Admin Console BADSRC DST SRV DNS 7

8 Is this Tool Good Enough? 8

9 Keeping an eye on the internet Internal network Switch Gateway firewall Gateway firewall management Internet DMZ 9

10 Keeping an eye on the internet Internal network Switch Gateway firewall Gateway firewall management Internet DMZ 10

11 Keeping an eye on the internet Internal network Switch Gateway firewall Gateway firewall management Internet DMZ 11

12 What is the challenge? 12

13 So what is this buying me? 13

14 Let s get a look around... Internal network Switch Gateway firewall Gateway firewall management Internet DMZ 14

15 and see what we discover! Internal network Switch Gateway firewall Gateway firewall management Internet DMZ 15

16 So what is this buying me? 16

17 Myth : focus on what s coming in! 17

18 Protecting the end user from themselves 18

19 My Network Internal network Switch Gateway firewall My Bank Internet DMZ 19

20 My Network Internal network Switch Gateway firewall My Bank Internet DMZ 20

21 My Network Internal network Switch Gateway firewall My Bank Internet DMZ 21

22 MYTH My personal information is really personal, on someone else's equipment 22

23 Remote Access versus Remote Control Corporate Network Servers DNS/DHCP/WEB/SMTP Internet? SSL and Portal Technologies Remote User/Partner 23

24 MYTH You can trust a computer on your network that you don t control 24

25 The Risk Of Data Exposure Recent CNN/Canadian News Moments BANK OF AMERICA LOSES 1.2 MILLION CUSTOMER INFORMATION RESEARCHER AT SICK KIDS PHI THEFT OF LAPTOP IN VEHICLE CHOICEPOINT IS FINED 15.6 MILLION DOLLARS BY THE FTC FOR PERSONAL DATA LOSS VA LOSES 26.2 MILLION VETERAN S IDENTITIES CHR THEFT OF LAPTOP FROM HOME MENTAL HEALTH - PHI FIDELITY INVESTMENTS LOSES 254K HP EMPLOYEES DATA AMERIPRISE FINANCIAL LOSES 226K CUSTOMER AND EMPLOYEES DATA 25

26 Explosion of a BotNet 26

27 Click fraud SPAM Piracy DDoS 27

28 28

29 Who Can You Trust? 29

30 WMF Vulnerability Late December 2006, a vulnerability in the handling of wmf files is discovered. Within a week, over 100 different instances of exploitation are released. Exploit generation tool quickly renders AV signatures out of date Software engineers who have looked closely at the Windows code that enables the vulnerability have concluded that, for whatever reason, it is operating exactly the way its designers intended it to. 30

31 Who Left The Backdoor Open? M.I.C.E Metafile Image Code Execution 31

32 MYTH I have to worry about hackers 32

33 33

34 I love my Swiss army knife 34

35 MYTH I m getting the all in wonder box that does anything and everything 35

36 Security is like an onion 36

37 Internal network Switch Gateway firewall Internet DMZ 37

38 Why Dual Firewalls? said it was a good idea If one firewall is compromised, the other will protect me 38

39 Internal network Switch Gateway firewall Internet DMZ 39

40 So what is this buying me? 40

41 Policy Approval Internal network Team B Switch Gateway firewalls Team A Internet DMZ 41

42 So what is this buying me? 42

43 Internal network Switch Gateway firewall Internet DMZ 43

44 So what is this buying me? 44

45 MYTH Double the Security, double the safety 45

46 Virtual Machine Technology 46

47 Lets recap... I might be attacked My security is good enough People are stupid I trust my users, and they trust me I have protected my computer assets 47

48 Lets recap... Your data is always at risk Threats are evolving, as should your security People need information to protect themselves I have taken ownership of my data I have done all I can to protect my data 48

49 Questions? Yah, me too. 49

Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1

Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton