# Presentation: 333435

## Building Secure Networks

**March 25****th****, 2003**

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Security Overview

**Objective**
- To build secure networks
- To keep networks secure
- Where Do We Start?
- Distinguish between different types of computer security
- Computer systems and network devices
- Understand physical security requirements
- Access controls
- Monitoring devices

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Identify What is Required

- Identify the security threats
- Understand the components
- Policies
- Personnel
- Hardware
- Software
- Understand what you need to protect from whom
- Secure the Perimeter
- Secure the Inside

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Plan Your Security Needs

- Company policies
- Develop Business Continuity Requirements
- Develop Disaster Recovery Plan
- Minimize Potential for Common Exploits
- DoS
- Web Server / Database hacking
- Open Ports, for services not required

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Plan Your Security Needs ...

- Remote Access
- Employees
- Business partners
- Network Availability Requirements
- Failover components
- Load Balancing and Load Sharing
- Multiple ISPs
- Encryption and Key Management
- Logging, Monitoring, Detection and Response Procedures
- Consider type of data captured and retention policy
- Consider importance of capturing and managing too much data
**Security in Layers with different technologies**

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Typical Network

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Securing the Perimeter

- Identify ALL External Access Points
- Internet access
- Business Partner access
- Partnership access
- Employee access
- Identify Placement for Firewalls / Proxies
- Demilitarized Zone (DMZ)
- Protecting Inside from Out
- Limiting Inside Access Out
- Limiting Inside Access from Inside
- Consider what technology works best for the particular environment

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Securing the Perimeter ...

- Wireless Access Points
- Always require the use of encryption
- Always require non-standard SSIDs
- Monitor the traffic
- Third Party Connectivity
- Internet access
- Private network access (consider link encryptors)
- Secure E-mail Gateway
- Antivirus (plan for updates)
- SPAM

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Securing Remote Access

- Dial-up
- Dial back
- Turn on only when needed
- SSH
- Use of certificates and/or passwords
- VPN
- IPSec, PPTP, etc.
- Tunneling over TCP
- Authentication Solution
- RADIUS
- TACACS+
- LDAP server
- Two-Factor Authentication

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Securing Remote Access ...

- Personal Firewalls
- Specification for minimum access
- Control configuration
- Procedure for maintaining current patches
- Business Partner controls
- What type of data traverses the connection?
- How is access controlled at the Business Partner site?
- How is access controlled at network entry point?
- Contracts
- Service Level Agreements (SLA)
- Contractual Obligations

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Securing the Inside

- Secure the Components
- Harden the OS
- Harden Servers
- Harden Network Devices
- Routers / Switches
- PBX
- Secure the Desktop
- Standard Build
- Antivirus / Personal Firewall
- Restricted Administration of the machine

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Securing the Inside ...

- Secure the Network
- Review and understand local area network traffic
- Define what areas of the network should have strict access controls
- Consider the use of Enclaves
- Consider the use of router ACLs
- Restrict file sharing, e.g., NFS, Windows shares, Samba
- Secure E-mail Server
- Harden
- Antivirus
- Encryption, e.g., PGP

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Monitoring and Managing

- Managing PKI
- How are encryption keys managed
- What is the procedure for recovering encrypted data, e.g. in the event an employee leaves the company
- Audit Controls
- Logging: what, where and how much
- Accountability for remote connections – b2b, e-mail, web surfing
- Business Continuity / Disaster Recovery
- Outsource versus In-house
- Consider 24x7 monitoring
- Use of tools, e.g., ISS, Snort, Dragon, FWs, etc.

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Monitoring and Managing...

- Intrusion Prevention / Intrusion Detection
- NIDS
- HIDS
- File system monitoring, e.g., Tripwire
- CIRT
- Documented process, who, levels

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Conclusions

- Continued Vigilance
- Monitoring for current web hacks and viruses
- Applying current patches
- Day-to-day monitoring of logs and IDS data
- Periodic vulnerability assessments

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential

## Questions?

- _[stacey.oconnor@guardent.com](mailto:stacey.oconnor@guardent.com)_

- © Copyright 2001 Guardent, Inc. Proprietary and Confidential