Tutorial 3 June 8, 2015
I. Basic Notions 1. Multiple-choice (Review Questions Chapter 6, 8 and 11) 2. Answers by a small paragraph (Chapter 2: viruses: MBR, rootkits, )
Multiple choice X. Which is the preferred location of a spam filter? 1. Install the spam filter the SMTP server 2. Install the spam filter on the proxy server 3. Install the spam filter on the local host client Y.. 4.. 5.. 6 7
II. Familiar Problem Solving 3. Client side attacks, buffer overflow, )(Chapter 3) 4. Network Address Translation, Network Access Technology, (chapter 6)
Network Address Translation, Network Access Technology, Recall: Security Through Network Technologies Network address translation (NAT) in fact a technique just for substituting addresses Allows private IP addresses to be used on the public Internet (Internet routers normally drop packet with a private address) Private IP address public address Security+ Guide to Network Security Fundamentals, Fourth Edition 5
Class A 0.0.0.0 127.255.255.255 Class B 128.0.0.0 191.255.255.255 Class C 192.0.0.0 223.255.255.255 Public IP addresses Table 6-7 Private IP addresses Figure 6-9 Network address translation (NAT) Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 6
Network Address Translation, Network Access Technology, (cont d.) Port address translation (PAT) Variation of NAT Outgoing packets given same IP address but different TCP port number This allows a single public IP address to be used by several users. Advantages of NAT Masks (hides)ip addresses of internal devices Allows multiple devices to share smaller number of public IP addresses Security+ Guide to Network Security Fundamentals, Fourth Edition 7
Network Address Translation, Network Access Technology, (cont d.) Network Access Control Examines current state of system or network device: Before allowing network connection Device must meet set of criteria If not met, Network Access Control allows connection to quarantine network until deficiencies corrected Security+ Guide to Network Security Fundamentals, Fourth Edition 8
Figure 6-10 Network access control framework Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 9
5. DMZ, subnetting, (chapter 6)
DMZ, subnetting, Recall: Security Through Network Design Elements Elements of a secure network design DeMilitarized Zones (DMZ) Subnetting Virtual LANs Remote access Security+ Guide to Network Security Fundamentals, Fourth Edition 11
Demilitarized Zone (DMZ) Separate network located outside secure network perimeter Untrusted outside users can access DMZ but not secure network Security+ Guide to Network Security Fundamentals, Fourth Edition 12
Figure 6-11 DMZ with one firewall Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 13
Figure 6-12 DMZ with two firewalls Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 14
Subnetting IP address may be split anywhere within its 32 bits Network can be divided into three parts Network Subnet Host Each network can contain several subnets Each subnet can contain multiple hosts Security+ Guide to Network Security Fundamentals, Fourth Edition 15
Subnetting (cont d.) Improves network security by isolating groups of hosts Allows administrators to hide internal network layout Security+ Guide to Network Security Fundamentals, Fourth Edition 16
Figure 6-13 Subnets Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 17
6. Key stream attack, (chapter 8)
Key stream attack, Recall: Wired Equivalent Privacy (WEP) IEEE 802.11 security protocol Encrypts plaintext into ciphertext Secret key is shared between wireless client device and AP Key used to encrypt and decrypt packets WEP vulnerabilities WEP can only use 64-bit or 128-bit number to encrypt Initialization vector (IV) is only 24 of those bits Short length makes it easier to break Security+ Guide to Network Security Fundamentals, Fourth Edition 19
ICV: Integrity Check Value PRNG: pseudo-random number generator IV changes each time a packet is encrypted Figure 8-9 WEP encryption process Cengage Learning 2012 The IV is prepended to the Ciphertext Security+ Guide to Network Security Fundamentals, Fourth Edition 20
Key stream attack, (cont d) WEP vulnerabilities (cont d.) Violates cardinal rule of cryptography: avoid a detectable pattern Attackers can see duplication when IVs start repeating Keystream attack (or IV attack) Attacker identifies two packets derived from same IV Uses XOR to discover plaintext Security+ Guide to Network Security Fundamentals, Fourth Edition 21
Figure 8-10 XOR operations Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 22
Figure 8-11 Capturing packets Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 23
III. Unfamiliar Problem Solving Two questions (answer one or the other)