Security - Network Security

Perimeter security

An organization's network is the core to its technology. All the data is flowing across that network, and so it's critical that we implement security in a correct way, that we architect security from the ground up when we're creating that network.

Perimeter security is really talking about how we control the access into our network. So if we think of a large room that we want to control access to, then we would be most concerned around the doorway. We'd be concerned around a window, any access points into that room. So that's really what perimeter security is: what is the access to the inside of our network.

Firewalls

A big way that we guard access into our network is through the use of a firewall. A firewall allows certain traffic in and out of our network while blocking other traffic. And so a firewall is a big key to making sure that we only have the correct traffic going in and out of our network, and that we're safeguarding the communication on the perimeter of our network.

Intrusion detection and prevention

We can also put in intrusion detection systems or intrusion protection systems. Often this comes integrated into our firewall, but it also could possibly be a separate piece of equipment that is helping us out with this IDS/IPS.

An intrusion detection system notifies us when there is some sort of attack, or some sort of malicious behavior, or some sort of suspicious behavior. If there is somebody trying to break into our network, this detection system will detect if somebody's actively trying to poke their way into this network.

Then there's the protection system. The protection system takes it a step forward. It not just detects something that's happened, but it will actually take action against it. And so one question might be, well, why don't I just implement a protection system? That sounds better, doesn't it? Because hey, it'll actually take action and stop that from happening.

Well, one of the problems is that anytime you have something that's looking at certain behavior and trying to determine what the behavior is, what you're going to have is something called false positives. And so if you have something that's actively stopping that traffic from coming into your network, you're going to have times when there's legitimate traffic that can't make a connection. An example is maybe you have this sitting in front of your network, or perhaps it's in front of some web servers, and then it starts preventing certain traffic from accessing those web servers. That could be problematic if it's customers trying to reach your data. So a detection system will detect if there's some sort of malicious activity happening or suspicious activity happening, versus protection will actually take action against it.

Another name for an IDS/IPS would be a network-based intrusion detection system, or a NIDS, a network intrusion detection system. Now, what is the difference with this? Well, it really is just an IDS/IPS here, but this is network-based. What does that mean? There are host-based systems as well, and you would install that maybe as software onto the host, and then it would look for any kind of intrusion detection on the host, versus a network-based one that looks for it on the network. So maybe it's sitting there on the firewall and part of the firewall, or maybe it's on a server. It's somewhere within the network looking for stuff that's happening on the network.

Proxy servers

A proxy server also can be used to protect the network. There are different types of proxy servers, so we're just going to go over one of the standard, one of the main types of proxy servers there are.

A good example of this is maybe you're doing web filtering on your network. You only want people who are on your network to make it to certain sites, and you're going to block certain sites. So it's all going to go through a proxy server to help filter out which traffic should be allowed and which traffic shouldn't be allowed.

What does that look like? Maybe this is a proxy server right here, and it's the only machine that's allowed to get out to the world wide web, to the internet. Anything that gets out to the outside world needs to go through the proxy server. What will happen is a request will be made, but it will be sent to the proxy server, and then the proxy server will go and grab that information. The information will come back and then is sent on to the client machine.

This allows this proxy server to do initial filtering: oh, you can't go to that site, and maybe just send back, oh, you can't go to that site, rather than going and getting that information. Or to do additional steps, like maybe doing virus scans of the information that comes back before it sends it off to the machine. So there are several things that we could be doing with a proxy server. Once again there are different types of proxy servers, but the main concept behind the proxy server is that information is being sent through this proxy server, and that proxy server can balance things out, or do some extra inspection, or do some control with that data flow.

Wireless security

A wired network allows us to connect one piece of equipment to the other. And if we don't want to have communication between two pieces of equipment, we can physically disconnect those wires. Well, that's not the case with wireless. When it comes to wireless, that data is just floating in the air. It's going back and forth through the air, and so anybody can listen in on that data.

So it's really important that that data is encrypted, so that if somebody were to actually retrieve it, they couldn't actually read the data or the information that's going back and forth. Wireless is inherently insecure, and so we need to take steps to make sure it is secure. That is going to be one thing that we're going to want to make sure that we have on our network.

Zero trust

With traditional networking you are mostly concerned with the security around the access points to your network. So this would be like from the internet into your network. You would put things like a firewall there, because that would be a hot place right there. Same thing with access points. The security of the different ports on a switch could go either way, because if it was a secured building then the idea is if you were inside the building then you were okay on the network. But there are some times when this would also be an access point into the network as well. The idea though is that as long as you controlled access into your network, once you were on the network then you had a certain level of legitimacy on the network.

But this concept came about where, well, that doesn't really cover us, because what happens if a machine is infected in here, or somebody breaks into the building and plugs into our network, or plugs some sort of other device into our network. And so really this is the idea that we should have zero trust on our network: that whoever connects into our network, no matter what it is, is consistently authenticated onto our system and authorized to certain resources.

So the idea behind zero trust is that we are not just going to assume that because somebody is inside of our building they are now safe, or because they've been connected to our equipment for x amount of days that they're still safe. We're going to continue to monitor them and make sure that they are safe and should be accessing the resources that they can access.

Port security

Port security is something that we can implement on a switch to verify whatever is connected into that switch. The switch could be placed in an insecure environment. But even if it's placed in a secure environment, you never know who is going to be able to break into that environment and then be able to have access to your network by plugging in.

So what we can do is, on a port-by-port basis, set up port security that will allow us to control who has access to that port and who can communicate across that port. There are several methods that we can actually use to implement port security. But that's what it is: we are implementing security on a port-by-port basis for this switch.

Network access control

Network access control, or NAC, can be used to help us implement zero trust. It's one of the ways that we can make sure that things that come onto our network should be on our network.

An example of this is that this machine right here might have the login credentials to access the network. However, is this machine fully patched? Does it have its antivirus? Is it up to date with its antivirus? What we would do is install software on here that would monitor the state of this machine, whether it's got its patches and whether it's all up to date, and it wouldn't allow it on the network until it met certain qualifications. So that's what network access control allows us to do. It allows us to control the access from certain machines depending on what we say that machine needs before it can actually get access onto the network.

Segmentation

One thing that we may want to practice on our network is segmentation, where we segment the different resources to certain roles or departments or certain types of users that we have on our system. Here we have maybe several departments. So we have the administration department and they have access to different resources. Operations has access to different resources, and sales. We can actually have a separate network, separate equipment, separate data, separate servers, separate databases, separate keys, separate ways to get access to each one of these different segments. This allows it so somebody from administration doesn't necessarily have access to operations, or operations doesn't necessarily have access to sales.

One thing we may want to segment is the management traffic. We have different pieces of equipment here. We have switches here that need to be managed. We have servers here that need to be managed. We have database servers that need to be managed. So there's different stuff on our network that needs to be managed. We may want the administration group to be able to access these servers from a web portal standpoint, and maybe they need access to some of the data through that, but they don't need direct access to the databases. That would not necessarily be something that they need to have access to, and same thing with the administration of that server.

And so we wanted to break out this management traffic separately and put it on its own network. Then the only people that have access to the management traffic that gains access to these switches, gains access to the back end of these servers, would be people who need to have access to managing that. And then we put things on there like our simple network management protocol, which I said we can use to monitor the traffic that's going across here. We could secure this so that other people aren't going to be able to see the management traffic that's going across on this network.

IoT, OT and embedded systems

Another great thing to segment onto its own network would be things like IoT, OT and embedded systems. What do these mean? What are they?

IoT is internet of things. These are the things that we've connected now to the internet that typically have not been connected to the internet before. These are things like our automated house systems and our thermostats and our appliances that we connect now to networks. And the problem is that there are a lot of issues with security on them. We don't have great insight into knowing whether they are up to date. The companies that manage those don't always push out the firmware. They don't always have connectivity. So traditionally speaking, they've been a little on the insecure side. They've been a little bit of a vulnerability within our network. If they are included with the rest of our network, then the problem is that it could compromise the rest of our network. So we put them on their own device. A lot of times what we see, even in our home networks, is that we separate out our IoT devices to be on a separate network.

Same thing with operational technology. It's kind of along the same lines as IoT devices, but they're more for the operational technology, the things that are happening within the company, like robots that are doing different jobs for us, assembly lines, that type of stuff. And embedded systems is just a similar type of concept, where the chip is embedded into the system and everything's just kind of all incorporated into one device. Same examples here: IoT and operational technologies have embedded systems in them. And so we need to protect those. One way that we can protect those items, and also all the rest of the equipment that is on our network, is by segmenting it out onto its own network.

Micro segmentation and VLANs

Segmenting our networks has been a part of how we implement security for a long time. But one thing that is happening in companies now is that some of them are going to micro segmentation, breaking down their networks into really small little segments so that they can better control their traffic. So micro segmentation is just this idea of breaking down our segments into very small segments.

Another thing that can help with segmentation is VLANs. Creating VLANs, or virtual local area networks, is one way that we can break down our networks into separate segments. Now the thing is, if you wanted to segment things before VLANs came about, you would have to have a separate switch for every single network. But that can get really expensive to do when you're buying a single switch for every single network, especially if you're doing something like micro segmentation. So we can split things off using VLANs.

Historically, a hub or a switch would just be part of one local area network. But if we want to segment things into multiple local area networks, then we would have had to have separate switches. With VLANs, we can take a single switch and break it down into different virtual local area networks. They can be varying sizes here, and we break it down so that each one of these ports belongs to a separate VLAN. This allows us to split out our traffic without buying extra switches.

Screened subnets

Another way that we may segment is using a screened subnet, also known as a DMZ or demilitarized zone. A screened subnet is a separate network that has maybe some more publicly accessible devices on it. So for instance, this is a bank of web servers right here. We want people to visit our web servers, and so we have rules in place on the firewall that allow traffic to get to these web servers.

Now the problem is that if those web servers existed on our internal network, if they were ever compromised then our whole internal network is compromised as well. So we put it on a separate network over here that gives access to external users to access them, but allows us to continue to protect our internal servers and network, so that people don't have access to this internal network.

Deceptive and disruption technologies

We could also use deceptive or disruption technologies. An example of this might be a honeypot. We would set up a separate machine here that would be in its own little segment, and then if somebody is trying to hack into our network, we could actually put them onto this machine. What they'll do is think that they're actually on one of our machines on the network and start looking into it, start researching, and we can monitor their activity and see what's going on, to see how they're attempting to get into our network.

A honeynet is the same thing, except it's like setting up a whole other network that does the analyzation. A honey file is the same thing, except it's a file that looks tantalizing, that looks like something that they would want to hack into and gain access to. And a honey token is just any data that we would put out there.

It would all be deceptive in the sense that it's not actual data. It's not an actual network. It's not an actual machine. It's not an actual file. It's not something that we're too concerned about. It just mimics something that looks like what an attacker would want. They go after that instead, and it helps us analyze the behavior of an attacker and then be able to put safeguards in place on our network to make sure that we're not susceptible to the same methodology that that hacker is using.

Bringing it together

It's really important to get that perimeter security right. That's your first line of defense against threats that are out there. So we're going to put up things like firewalls, and IDS and IPS systems, and wireless security to make sure we secure that network, and even things like port security.

Once we have access into our network though, things can actually change. Different people can get onto that machine; that machine could get infected. So we may want to implement a zero trust model, and that model really says that we're not going to trust anybody that's on our network. We're going to consistently authenticate them and make sure that they should be on our network. And so we implement things like network access control to make sure that machines have the proper updates and patches and antivirus and things in place, to make sure that they are going to be safe on our network.

Segmentation allows us to make us less vulnerable, and to put things like our management traffic onto separate networks so we keep those more secure. Creating a DMZ or a screened network can allow us to open up resources to the outside world without opening up our internal networks to the outside world. And deceptive technologies, things that we can put in place like a honeynet or a honeypot, would attract a threat so that they go after that instead, and then we could analyze their behavior to implement controls on our internal network.