Transcription

1 If security were all that mattered, computers would never be turned on, let alone hooked into a network with literally millions of potential intruders. Dan Farmer, System Administrators Guide to Cracking The only secure computer is one that's unplugged, locked in a safe, and buried 20 feet under the ground in a secret location... and I'm not even too sure about that one -- Dennis Huges, FBI NETWORK SECURITY

2 FIREWALLS Function: "A computer firewall protects networked computers from intentional hostile intrusion that could compromise confidentiality or result in data corruption or denial of service. A network firewall sits at the junction point or gateway between the two networks, usually a private network and a public network such as the Internet. The earliest computer firewalls were simple routers. The term "firewall" comes from the fact that by segmenting a network into different physical subnetworks, they limited the damage that could spread from one subnet to another (ie. just like firedoors or firewalls)

3

4 TYPES OF FIREWALLS Network Level Hardware device (Figure Left) Application Level Software program (Figure Right) running on a secure host computer. Both must have at least two network interfaces, one for the network it is intended to protect, and one for the network it is exposed to

5 ENCRYPTION Function: The process of making data unreadable by other humans and/or computers for the purpose of preventing others from gaining access to its contents. Public key can be viewed or used by anyone Private key is kept secret by the creator and is the only method of decrypting the data encrypted by the public key.

6 AUTHENTICATION Used to describe the process of identifying a person/data and making sure they are really who they say they are. For example, a password is a very basic method of authorizing someone.

7 WEP Wired Equivalent Privacy Designed to provide the same security as a wired LAN Allows a group of devices (i.e. computers) on a network to exchange encoded messages with each other while hiding the contents of the messages from easy viewing by outsiders. Is comprised of hexadecimal numbers (0 to 9 and A to F) The keys must match on the devices for communication to occur Length of WEP key can be changed 64-bit WEP: 10 digit key 128-bit WEP: 26 digit key 256-bit WEP: 58 digit key

8 WEP ISSUES Serious flaws were found in 2001 WEP has led a troubled existence due to many security issues. A high percentage of wireless networks have WEP disabled because of the administrative overhead of maintaining a shared WEP key. WEP has the same problem as all systems based upon shared keys: any secret held by more than one person soon becomes public knowledge. Take for example an employee who leaves a company they still know the shared WEP key. The ex-employee could sit outside the company with an NIC and sniff network traffic or even attack the internal network.

9 WPA & WPA2 Wi-Fi Protected Access Enhanced on the technology of WEP in 2003 Designed to prevent the vulnerabilities of WEP WPA2 replaced WPA in 2004 One variation of WPA is called WPA Pre Shared Key WPA-PSK works well for home networks I. To use WPA-PSK, a person sets a static key or "passphrase" similar to as with WEP. You will NeVer Gu3e5 this K3y but It ShOlD b3 L0nG3r II. III. But, using TKIP (Temporal Key Integrity Protocol), WPA-PSK automatically changes the keys at a preset time interval Making it more difficult for hackers to find and exploit them.

10 WIRELESS IMPLEMENTATION Wireless Access or Router During setup you should be able to select the security protocol to use Default in many is WEP Use at least WPA or WPA2 Create a passphrase that is strong (upper and lowercase letters, numbers, and symbols if possible) Client Side Whenever you try to connect to a secured wireless network you should be prompted for the passphrase Passphrase available from administrator or provider

11 1. Change default Administrator password 2. Enable WPA or WPA2 encryption 3. Change your network SSID Change to something that has meaning to you, but will not identify to an outside location / identity 4. Enable MAC Address filtering Allows you to specify the specific MAC address of the devices you authorize to connect on the network Hackers can fake MAC address though

12 5. Disable SSID Broadcast This will prevent your router from broadcasting your wireless network to potential clients (most likely not needed in a home environment) This setup is needed typically at Hotspot locations 6. Do Not Auto-Connect to Open Wi-Fi Networks Auto connecting to open Wi-Fi networks can expose your computer to risks 7. Assign Static IP Addresses to Devices Set fixed IP address for your network devices Turn off DHCP feature of the router so hackers cannot acquire a valid IP address Set a fixed range of IP addresses to only be allowed

13 8. Enable Firewalls On Each Computer and the Router Make sure the router firewall is engaged Extra protection, consider running personal firewall software on computers inside network 9. Position the Router or Access Point Safely Try to position the router centrally in the house to reduce network signal spanning to far outside 10. Turn Off the Network During Extended Periods of Non-Use Not practical to shut down all the time, but turn off the network when travelling or away an extended length of time