is3220 information technology infrastructure security unit 2 network security basics

© ITT Educational Services, Inc. All rights reserved.

IS3220 Information Technology Infrastructure Security

Unit 2Network Security Basics

© ITT Educational Services, Inc. All rights reserved.IS3220 Information Technology Infrastructure Security

EXPLORE: CONCEPTS


Learning Objective

Explain the fundamental concepts of network security


Key Concepts Confidentiality, integrity, and availability

mandates for network resource security

Network security and its value to the enterprise

Roles and responsibilities in network security

Impact of network infrastructure design on security

Features, uses, and benefits of network security countermeasures


Primary Goals of Information Security

Confidentiality

Security

AvailabilityIntegrity


Secondary Goals of Information Security

Authentication

Authorization

Non-Repudiation

PrivacyConfidentiality

IntegrityAvailability


Seven Domains of a Typical IT Infrastructure


The Need for Information Security

Risk

Threat

Vulnerability


Information Assurance

Seven Domains of a Typical IT Infrastructure

Confid

entia

lityIntegrity

Availability

Non-repudiationAuthentication


Security Policy Establish goals

Address risk

Provide roadmap for security

Set expectations

Link to business objectives

Map of laws and regulations

Supported by standards, procedures, and guidelines


Examples of Network Infrastructures Workgroup

SOHO

Client/Server


General Terms Confidentiality Integrity Availability Trust Privacy Authentication Authorization Non-repudiation


Networking Terminology Network Firewall Router Virtual Private Network IPSec Demilitarized Zone Intrusion Detection System (IDS) Intrusion Prevention System (IPS)


EXPLORE: PROCESS


Policy, Awareness, and Training

Policy ~

− sets expectations

Awareness ~

− promotes security

Training ~

− defines roles and responsibilities


Security CountermeasuresCommon

Countermeasures Uses Benefits Limitations

Firewalls Filter traffic Segmentation

Hardware Software First defense Keep noise out

Perimeter defense Not content oriented Limited to yes or no

Virtual Private Network (VPN)

Remote access Encrypted tunnel

Private tunnel Extends Cover

Man-in-the-middle Not traffic oriented

Intrusion Detection/Prevention System

Monitor traffic May block attacks Host or Network

Notification Prevention

Relies on signatures False positives


Security Countermeasures (Continued)

Common Countermeasures

Uses Benefits Limitations

Data Loss Prevention Monitor data loss Block data loss

Sensitive Config Breach Notification

Signature reliant False positives Circumventable

Security Incident and Event Management

Aggregate sec logs Correlate sec logs

Monitor and review Generate alerts

False positives Data heavy Limit to log info


Security Countermeasures (Continued)

Common Countermeasures

Uses Benefits Limitations

Continuous Control Monitoring

Checks config Standard compliant Real time monitor

Automate monitors Self correction

Emerging tech Policy dependent

Vulnerability Assessment

Tests systems Proactive address Centralize tracking

Limited to known Create noise


EXPLORE: CONTEXT


Consider Business Requirements Availability of the network and its components

• Redundancy• High availability• Single point of failure• Denial of service

Sensitivity of the data• Encryption• Access control


Internet Exposure Remote access

• Will a VPN work?• Is direct internet access required?


Wired Networks Lack of external connectivity creates

physical isolation• Can rely on physical controls to protect network• External threats must breach physical barrier

If external connectivity is required• No control is the same as physical isolation but

security must enable the business• Consider segmentation• Rigorous front door screening


Benefits of Wireless Networking Can be inexpensive to deploy

• No need to run wires• Quick connectivity for multiple users

Convenience

Mobility

Ubiquity• All laptops now come equipped with wireless


Wireless Concerns Introduces new attack surface

• Require additional design considerations to mitigate attack

Data is transmitted over the air and accessible• Use of encryption technology • Consider implementing segmented wireless networks• Require VPN authentication for wireless access

Network can be directly accessed from a distance• Shielding


Mobile Networking Allows user to be completely mobile

Requires considerations for central management

Potential for device to be lost

is3220 information technology infrastructure security unit 2 network security basics

Documents

lan domainthis domain

workstation domainthis

wan domainthis domain

wan network infrastructures

security monitoring

remote access solutions

workstation devices

remote access procedures