Network Security Onno W. Purbo onno@indo.net.id. Buku Keamanan Jaringan Internet Toko Buku Gramedia

Network Security

Onno W. Purboonno@indo.net.id

Buku Keamanan Jaringan Internet Toko Buku Gramedia

http://www.sans.org

http://www.rootshell.com

Overview Roadmap SANS Integrating Security Into Your Site How to Get the Work Done Where to Find the Right

Information Pitfalls and Vulnerabilities

Integrating Security Into Your Site

Integrating Security Into Your Site How do you justify the security

infrastructure investment? How do you determine your site's security

mission statement? What are the key elements of a successful

security awareness training program? What are the key elements of a good

security infrastructure? What are some common security problems

which continue to plague many sites?

How to Get the Work Done

How to Get the Work Done duties of security support personnel? ensure or document security infrastructure? types of security tools and the most popular

tools in use today? Where can you find some consolidated

information security vulnerabilities? find vendor-specific security patches? find many of the public domain security tools? seven items when responding to incident? five low-cost security improvements?

7 items to remember? Follow your organization’s policies and

procedures. Contact incident response agencies. Communication via out-of-band (e.g., a phone

call). Document your actions. Make copies of files the intruders may have

left or touched & store them off-line. If you are unsure of what actions to take, seek

additional help and guidance. Contact law enforcement officials.

5 low-cost improvements Document and publish what you expect. Configure your routers to deny all

unnecessary incoming traffic. Keep sendmail properly configured and

updated.  Use freeware vulnerability assessment

tools. Publish the results. Install freeware host and network based

auditing and traffic analysis tools on critical hosts.

Where to Find the Right Information

Where to Find the Right Information What are some incident response

centers? Where can you find vendor-specific

security information? What are some of the good security web

sites? What are some good security books? What are some good security mailing

lists?

Good security web sites? ftp://ciac.llnl.gov/pub/ciac/

sectools/unix/ ftp://ftp.cerias.purdue.edu ftp://ftp.cert.org/pub/tools/ ftp://ftp.win.tue.nl/pub/security/ ftp://ftp.funet.fi/pub/unix/security/

Pitfalls and Vulnerabilities

Pitfalls and Vulnerabilities What are some of the frequently

targeted system binaries and directories?

What are some common Internet attack methods in use today?

What are some common problems with security perimeter implementations?

targeted system binaries & directories? /bin/login /usr/etc/in.telnetd /usr/etc/in.ftpd /usr/etc/in.tftpd /usr/ucb/netstat /bin/ps /bin/ls /usr/sbin/ifconfig /bin/df /usr/lib/libc.a /usr/ucb/cc

/.rhosts /etc/hosts.equiv /bin/.rhosts /etc/passwd /etc/group /var/yp/* (nis maps) root environment

files (.login, .cshrc, .profile, .forward)

Common Internet attack? Exploitation vulnerabilities in vendor

programs. Exploitation of cgi-bin vulnerabilities. Email bombing, spamming & relaying. Exploitation anon-FTP & web servers. Exploitation of named/BIND vulnerabilities. Exploitation of MTA & mail readers. Denial of Services (DoS) attacks. Sending hostile code & attack programs as

mail attachments.

Security perimeter implementations? Further security checks & controls are

needed on internal network. Members can request analog lines at

workspace & bypassing the security perimeter.

Some network services (e.g., ftp, tftp, http, sendmail) destined for internal hosts are passed through the security perimeter control points unscreened.

Security perimeter implementations? The firewall hosts or routers accept

connections from multiple hosts on the internal network and from hosts on the DMZ network

Access lists are often configured incorrectly, allowing unknown and dangerous services to pass through freely.

Security perimeter implementations? Logging of connections through the

security perimeter is either insufficient or not reviewed on a regular basis.

People frequently implement encrypted tunnels through their security perimeter without fully considering the security of the endpoints of the tunnel.