ΕΜΠΟΡΙΚΟ ΚΑΙ ΒΙΟΜΗΧΑΝΙΚΟ ΕΠΙΜΕΛΗΤΗΡΙΟ ΘΕΣΣΑΛΟΝΙΚΗΣ. Ηεπιχείρησημετάταe. Ασφάλεια Δικτύων και Υποδομών

Transcript

1 ΕΜΠΟΡΙΚΟ ΚΑΙ ΒΙΟΜΗΧΑΝΙΚΟ ΕΠΙΜΕΛΗΤΗΡΙΟ ΘΕΣΣΑΛΟΝΙΚΗΣ Ηεπιχείρησημετάταe Ασφάλεια Δικτύων και Υποδομών Παρουσίαση στα πλαίσια των κύκλων εκπαίδευσης του Θεσσαλονίκη, Απρίλιος 2006 Σπύρογλου Οδυσσέας, M.Sc., Υπ. Δρ. ΑΠΘ Μηχανικός Αναλυτής Πληροφοριακών Συστημάτων Agenda Γιατίαπειλείταιηασφάλεια; Πώς απειλείται; Συνιστώσες της ασφάλειας: Ταυτότητα χρηστών (Identity) Χρήση κωδικών, τρόποι πιστοποίησης χρηστών, Kerberos, Digital Signatures 2 Ο. Σπύρογλου 1

2 Agenda cont. Ακεραιότητα πόρων (Integrity) Firewalls, Proxy Servers, Κρυπτογράφηση Δεδομένων, IPSec Καταγραφή και παρακολούθηση (Active Audit) 3 Όλαταδίκτυααπαιτούνασφάλεια Ανεξαρτήτως μεγέθους εταιρείας Internet σήμερα ότι η τηλεφώνια το 1940 Ακόμα και sites μικρών εταιρείων «σπάνε» 4 Ο. Σπύρογλου 2

3 Γιατί ασφάλεια; 3 Κύριοι λόγοι Έλλειψη πολιτικών ασφαλείας Access Control Lists Κενά στην παραμετροποίηση συστημάτων Ξεπερασμένη Ελλιπής τεχνολογία Και πολλοί που θέλουν να τα εκμεταλλευτούν 5 Απειλές telnet company.org username: dan password: I m Bob. Send Me All Corporate Correspondence with Cisco. m-y-p-a-s-s-w-o-r-d d-a-n Loss of Privacy Bob Impersonation Deposit $1000 Deposit $ 100 Denial of Service CPU Customer Loss of Integrity Bank 6 Ο. Σπύρογλου 3

4 Στόχος: Εξισορρόπηση Αναγκών με κίνδυνους Πρόσβαση Συνδεσιμότητα Επιδόσεις Ευκολία Διαχείριση Διαθεσιμότητα Πολιτικές Ασφάλεια Πιστοποίηση Authentication Άδεια Authorization Οικονομία Εξασφάλιση Assurance Εμπιστευτικότητα Confidentiality Ασφάλεια Δεδομένων Data Integrity 7 Ασφάλεια Δικτύων : Αναλογία με φυσικό περιβάλλον Πόρτες, κλειδαριές & φύλακες Κλειδιά & Σήματα Παρακολούθηση κάμερες & σένσορες Firewalls & access controls Authentication Intrusion detection system Συμπληρωματικοί μηχανισμοί 8 Ο. Σπύρογλου 4

5 Στοιχεία της Ασφάλειας Ταυτότητα Ακρίβεια στην ταυτοποίηση Τι μπορούν να κάνουν οι χρήστες Αξιοπιστία Εξασφάλιση λειτουργίας Περιμετρική ασφάλεια Ιδιωτικότητα Εσωτερικός έλεγχος Εντοπισμός Ευπαθών σημείων Εντοπισμός εισβολέων Policy 9 Ταυτότητα Μοναδική ταυτοποίηση χρηστών και εφαρμογών Username/password, PAP, CHAP, AAA server, one-time password, RADIUS, TACACS+, Kerberos, MS-login, digital certificates, directory services, Network Address Translation 10 Ο. Σπύρογλου 5

6 Username/Password ID/Password ID/Password ID/Password Dial-In User PPP PAP Public Network Password Network Access Server Campus AAA Server User dials in with password to NAS network access server NAS sends ID/password to AAA server AAA server authenticates user ID/password and tells NAS to accept (or reject) NAS accepts (or rejects) call 11 PAP and CHAP Authentication PPP PAP or CHAP Public Network Network Access Server Password Authentication Protocol (PAP) Authenticates caller only Passes password in clear text Challenge Handshake Authentication Protocol (CHAP) Authenticates both sides Password is encrypted 12 Ο. Σπύρογλου 6

7 One-Time Password Token card Soft token S-Key Public Network AAA Server Campus Token or S-Key Server ID/One-Time Password ID/One-Time Password ID/One-Time Password Dial-In User One-Time Password Network Access Server Additional level of security, guards against password guessing and cracking Prevents spoofing, replay attacks Single-use password is generated by token card or in software Synchronized central server authenticates user S-key is a PC application that presents a dialog box to the user upon login into which the user must enter the correct combination of six key words. 13 Authentication, Authorization, and Accounting (AAA) Tool for enforcing security policy Authentication Verifies identity Who are you? Authorization Configures integrity What are you permitted to do? Accounting Assists with audit What did you do? Ο. Σπύρογλου 7

8 AAA Services Dial-In User Internet User Public Network Internet Network Access Server Intercept Connection s Gateway Router TACACS+ RADIUS Firewall AAA Server TACACS+ RADIUS Campus ID/User Profile ID/User Profile ID/User Profile Centralized security database High availability Same policy across many access points Per-user access control Single network login Support for: TACACS+, RADIUS (IETF), Kerberos, one-time password 15 RADIUS Remote Access User Access Server RADIUS Server RADIUS is an industry standard RFC 2138, RFC 2139 Cisco has full IETF RFC implementation Cisco has implemented many nonstandard vendor proprietary attributes Cisco hardware will work well with non-cisco RADIUS AAA servers Cisco is committed to providing the best RADIUS solution 16 Ο. Σπύρογλου 8

9 TACACS+ Authentication Local or centralized Cisco continues to expand TACACS+ and add features in Cisco IOS 11.3 Cisco customers benefit from additional functionality with CiscoSecure server of both TACACS+ and RADIUS Cisco enterprise TACACS customers continue to ask for TACACS+ features Username/Password Additional Information TACACS Database 17 Lock-and-Key Security Authorized User Internet Corporate Site Non-Authorized User Dynamically assigns access control lists on a per-user basis Allows a remote host to access a local host via the Internet Allows local hosts to access a host on a remote network 18 Ο. Σπύρογλου 9

10 Calling Line Identification Compare with Known Numbers Call Setup Message with Local ISDN Numbers 1234 Accept Call Station ISDN Number A 1234 ISDN Station A PPP CHAP Authentication (Optional) 19 User Authentication with Kerberos Remote User (Kerberos Principal) Encrypted Service Credential? Kerberos Server Kerberos Credential (Ticket) Kerberized Router Mail Server Authenticates users and the network services they use Uses tickets or credentials issued by a trusted Kerberos server Limited life span; can be used in place of standard user/password mechanism 20 Ο. Σπύρογλου 10

11 Δημόσια Κλειδιά Public Key Public Key WAN Private Key Private Key By exchanging public keys, two devices can determine a new unique key (the secret key) known only to them DES 21 Ηλεκτρονικές υπογραφές Bob s Document Message Bob s Document Message Hash Bob s Private Key Message Bob s Public Key Hash Same? Message Hash Encrypt Digital Signature Decrypt Message Hash If verification is successful, document has not been altered 22 Ο. Σπύρογλου 11

12 Πιστοποιητικά B A N K? CA Internet CA Certificate Authority (CA) verifies identity CA signs digital certificate containing device s public key Certificate equivalent to an ID card Partners include Verisign, Entrust, Netscape, and Baltimore Technologies 23 Network Address Translation SA SA Internet Inside Local IP Address Inside Global IP Address Provides dynamic or static translation of private addresses to registered IP addresses Eliminates readdressing overhead Large admin. cost benefit Conserves addresses Hosts can share a single registered IP address for all external communications via port-level multiplexing Permits use of a single IP address range in multiple intranets Hides internal addresses Augmented by EasyIP DHCP host function 24 Ο. Σπύρογλου 12

13 Integrity Network Availability Ensure the network infrastructure remains available TCP Intercept, route authentication 25 TCP Intercept Request Intercepted Connection Established Connection Transferred Protects networks against denial of service attacks TCP SYN flooding can overwhelm server and cause it to deny service, exhaust memory, or waste processor cycles TCP Intercept protects network by intercepting TCP connection requests and replying on behalf of the destination Can be configured to passively monitor TCP connection requests and respond if connection fails to be established in a configurable interval 26 Ο. Σπύρογλου 13

14 Route Authentication Home Gateway Trusted Source Internet Enables routers to identify one another and verify each other s legitimacy before accepting route updates Ensures that routers receive legitimate update information from a trusted source 27 Integrity Perimeter Security Control access to critical network applications, data, and services Access control lists, firewall technologies, content filtering, CBAC, authentication 28 Ο. Σπύρογλου 14

15 Access Lists Standard Filter source address only Permit/deny entire protocol suite Extended Filter source, destination addresses Inbound or outbound Port number Permit/deny specific protocols Reflexive Time-based 29 Policy Enforcement Using Access Control Lists Home Gateway Inbound Telnet Stopped Here Internet Ability to stop or reroute traffic based on packet characteristics Access control on incoming or outgoing interfaces Works together with NetFlow to provide high-speed enforcement on network access points Violation logging provides useful information to network managers 30 Ο. Σπύρογλου 15

16 Importance of Firewalls Permit secure access to resources Protect networks from: Unauthorized intrusion from both external and internal sources Denial of service (DOS) attacks 31 What Is a Firewall? All traffic from inside to outside and vice versa must pass through the firewall Only authorized traffic, as defined by the local security policy, is allowed in or out The firewall itself is immune to penetration 32 Ο. Σπύρογλου 16

17 Micro Webserver Micro W ebserver zip 100 ΑΣΦΑΛΕΙΑ ΔΙΚΤΥΩΝ Packet-Filtering Routers Users Users Protected Network Router with ACLs ISP and Internet Server Web Server Public Access 33 Proxy Service Provides user-level security Most effective when used with packet filtering Internet/ Intranet Proxy Server Internal Network 34 Ο. Σπύρογλου 17

18 Stateful Sessions Firewall Mail Server WWW Server Highest performance security Maintains complete session state Connection oriented Tracks complete connection Establishment and termination Strong audit capability Easy to add new applications Internet 35 Performance Requirements Company Network Meg Per/Sec Internet Video Audio Private link Web commerce 36 Ο. Σπύρογλου 18

19 Integrity Privacy Provide authenticated private communication on demand VPNs, IPSec, IKE, encryption, DES, 3DES, digital certificates, CET, CEP 37 Encryption and Decryption Clear Text Clear Text Bob Is a Fink 8vyaleh31&d ktu.dtrw8743 $Fie*nP093h Bob Is a Fink Encryption Decryption Cipher Text 38 Ο. Σπύρογλου 19

20 What Is IPSec? Network-layer encryption and authentication Open standards for ensuring secure private communications over any IP network, including the Internet Provides a necessary component of a standards-based, flexible solution for deploying a network-wide security policy Data protected with network encryption, digital certification, and device authentication Implemented transparently in network infrastructure Includes routers, firewalls, PCs, and servers Scales from small to very large networks 39 IPSec Everywhere! Router to Firewall Router to Router PC to Firewall PC to Router PC to Server 40 Ο. Σπύρογλου 20

21 IKE Internet Key Exchange Automatically negotiates policy to protect communication Authenticated Diffie-Hellman key exchange Negotiates (possibly multiple) security associations for IPSec 3DES, MD5, and RSA Signatures, OR IDEA, SHA, and DSS Signatures, OR Blowfish, SHA, and RSA Encryption IDEA, SHA, and DSS Signatures IKE Policy Tunnel 41 How IPSec Uses IKE 1. Outbound packet from Alice to Bob No IPSec security association yet 4. Packet is sent from Alice to Bob protected by IPSec SA Router A Router B IKE Router A IKE Tunnel IKE Router B 2. Router A s IKE begins negotiation with router B s IKE 3. Negotiation complete; router A and router B now have complete IPSec SAs in place 42 Ο. Σπύρογλου 21

22 Encryption DES and 3DES Widely adopted standard Encrypts plain text, which becomes cyphertext DES performs 16 rounds Triple DES (3DES) The 56-bit DES algorithm runs three times 112-bit triple DES includes two keys 168-bit triple DES includes three keys Accomplished on a VPN client, server, router, or firewall 43 Breaking DES Keys Exhaustive search is the only way to break DES keys (so far) Would take hundreds of years on fastest general purpose computers (56-bit DES) Specialized computer would cost $1,000,000 but could crack keys in 35 minutes (Source: M.J. Wiener) Internet enables multiple computers to work simultaneously Electronic Frontier Foundation and distributed.net cracked a 56-bit DES challenge in 22 hours and 15 minutes Consensus of the cryptographic community is that 56-bit DES, if not currently insecure, will soon be insecure 44 Ο. Σπύρογλου 22

23 Why Active Audit? The hacker might be an employee or trusted partner Up to 80% of security breaches come from the inside (Source: FBI) Your defense might be ineffective One out of every three intrusions occur where a firewall is in place (Source: Computer Security Institute) Your employees might make mistakes Misconfigured firewalls, servers, etc. Your network will grow and change Each change introduces new security risks Firewalls, authorization, and encryption do not provide VISIBILITY into these problems 45 Why Active Audit? Network security requires a layered defense Point security PLUS active systems to measure vulnerabilities and monitor for misuse Network perimeter and the intranet Security is an ongoing, operational process Must be constantly measured, monitored, and improved 46 Ο. Σπύρογλου 23

24 Active Audit Network Vulnerability Assessment Assess and report on the security status of network components Scanning (active, passive), vulnerability database 47 Active Audit Intrusion Detection System Identify and react to known or suspected network intrusion or anomalies Passive promiscuous monitoring Database of threats or suspect behavior Communication infrastructure or access control changes 48 Ο. Σπύρογλου 24

25 Kdkfldkal oee kjfkjajjakjkjkjkajkjfiejijgkd kdj fkdkdkdkddf kdj fkdj kdkd kfjdkkdj kfd kfjdkfjdkj kdj kdj kaj kj fdkj fkdj kfjkj ajj aj dj fla kj dfkj eiieie fkeieooei ************************ USA Kjkjkjdgdk kj dkj fdki kdfjkdj Ikej kej Kkdkd fdkkjkdjd Kj kdj fkdkj kd Kjdkfjkdj Kjdk ************************ ΑΣΦΑΛΕΙΑ ΔΙΚΤΥΩΝ IDS Attack Detection Context: (Header) Ping of Death Land Attack Port Sweep SYN Attack TCP Hijacking Content: (Data) MS IE Attack DNS Attacks Telnet Attacks Character Mode Attacks Atomic Single Packet Composite Multiple Packets 49 Active Audit Actively audit and verify policy Detect intrusion and anomalies Report UNIVERSAL PASSPORT UNIVERSAL PASSPORT 50 Ο. Σπύρογλου 25

26 Περίληψη Κρίσιμη απαίτηση για όλα τα δίκτυα Απαιτεί κοινή, ευρέως εφαρμογή Απαιτεί πολύ-επίπεδη υλοποίηση 51 Πολιτική Χρηστών Ποιοι είναι; Που έχουν πρόσβαση; Σε τι επίπεδο; Τι απαιτήσεις έχουν; 52 Ο. Σπύρογλου 26

27 Λύσεις Λογισμικού Firewall Antivirus Antispyware Filtering Cryptography 53 Servers Student PCs Staff PCs SIGMA-TITAN ( ) SIGMA-KRONOS ( ) LAB1 LAB2 LAB3 OSLaptop Secretariat DFS: Sigmanet.lan Sigma1-1 Sigma2-1 Sigma3-1 Sigma1-10 Sigma2-10 Sigma3-8 Sigma- Admin HP 2410 SIGMANET_DATA INSTALLFILES HP 870Cxi Sigma1-7 HP 6P Sigma3-5 StelioPC STUDENT_DATA IMAGEBANK Students HP 1300N Staff nur1 nur2 nur3 ecdl1 ospy students Beg1 Beg2 Beg3 Levb ecdl2 Staff xristos Levb1 Levb2 Levc1 Levc2 ecdl3 loukia Levc3 Levd1 Levd2 Levd3 ecdl4 dimitra Levd4 tee ecdla Stelios acad1 54 Ο. Σπύρογλου 27