Chapter 7: Protecting Advanced

Communications

Security+ Guide to Network Security

Fundamentals
Second Edition
 Objectives

Harden File Transfer Protocol (FTP)

Secure remote access
Protect directory services
Secure digital cellular telephony
Harden wireless local area networks (WLAN)

Security+ Guide to Network Security 2

Fundamentals, 2e
 Hardening File Transfer
Protocol (FTP)
Three ways to work with FTP:
Web browser
FTP client
Command line
FTP servers can be configured to allow
unauthenticated users to transfer files (called
anonymous FTP or blind FTP)

Security+ Guide to Network Security 3

Fundamentals, 2e
 Hardening File Transfer Protocol
(FTP) (continued)
Vulnerabilities associated with using FTP
FTP does not use encryption
Files being transferred by FTP are vulnerable to man-
in-the-middle attacks
Use secure FTP to reduce risk of attack
Secure FTP is a term used by vendors to describe
encrypting FTP transmissions
Most secure FTP products use Secure Socket Layers
(SSL) to perform the encryption
Security+ Guide to Network Security 4
Fundamentals, 2e
 Hardening File Transfer Protocol
(FTP) (continued)
FTP active mode
Client connects from any random port >1,024 (PORT
N) to FTP servers command port, port 21 (Step 1)
Client starts listening to PORT N+1 and sends the FTP
command PORT N+1 to the FTP server
FTP passive mode
Client initiates both connections to server
When opening an FTP connection, client opens two
local random unprivileged ports >1,024

Security+ Guide to Network Security 5

Fundamentals, 2e
 Hardening File Transfer Protocol
(FTP) (continued)

Security+ Guide to Network Security 6

Fundamentals, 2e
 Secure Remote Access

Windows NT includes User Manager to allow dial-in

access, while Windows 2003 uses Computer
Management for Workgroup access and Active
Directory for configuring access to the domain
Windows 2003 Remote Access Policies can lock
down a remote access system to ensure that only
those intended to have access are actually granted it

Security+ Guide to Network Security 7

Fundamentals, 2e
 Tunneling Protocols

Tunneling: technique of encapsulating one packet of

data within another type to create a secure link of
transportation

Security+ Guide to Network Security 8

Fundamentals, 2e
 Tunneling Protocols (continued)

Security+ Guide to Network Security 9

Fundamentals, 2e
 Point-to-Point Tunneling
Protocol (PPTP)
Most widely deployed tunneling protocol
Connection is based on the Point-to-Point Protocol
(PPP), widely used protocol for establishing
connections over a serial line or dial-up connection
between two points
Client connects to a network access server (NAS) to
initiate connection
Extension to PPTP is Link Control Protocol (LCP),
which establishes, configures, and tests the
connection
Security+ Guide to Network Security 10
Fundamentals, 2e
 Point-to-Point Tunneling Protocol
(PPTP) (continued)

Security+ Guide to Network Security 11

Fundamentals, 2e
 Layer 2 Tunneling Protocol (L2TP)
Represents a merging of features of PPTP with
Ciscos Layer 2 Forwarding Protocol (L2F), which
itself was originally designed to address some of the
weaknesses of PPTP
Unlike PPTP, which is primarily implemented as
software on a client computer, L2TP can also be
found on devices such as routers

Security+ Guide to Network Security 12

Fundamentals, 2e
 Authentication Technologies
Authenticating a transmission to ensure that it comes
from an approved sender can provide an increased
level of security for remote access users

Security+ Guide to Network Security 13

Fundamentals, 2e
 IEEE 8021x
Based on a standard established by the Institute for
Electrical and Electronic Engineers (IEEE)
Gaining wide-spread popularity
Provides an authentication framework for 802-based
LANs (Ethernet, Token Ring, wireless LANs)
Uses port-based authentication mechanisms
Switch denies access to anyone other than an
authorized user attempting to connect to the network
through that port

Security+ Guide to Network Security 14

Fundamentals, 2e
 IEEE 8021x (continued)
Network supporting the 8021x protocol consists of
three elements:
Supplicant: client device, such as a desktop computer
or personal digital assistant (PDA), which requires
secure network access
Authenticator: serves as an intermediary device
between supplicant and authentication server
Authentication server: receives request from supplicant
through authenticator

Security+ Guide to Network Security 15

Fundamentals, 2e
 IEEE 8021x (continued)

Security+ Guide to Network Security 16

Fundamentals, 2e
 IEEE 8021x (continued)

Several variations of EAP can be used with 8021x:

EAP-Transport Layer Security (EAP-TLS)
Lightweight EAP (LEAP)
EAP-Tunneled TLS (EAP-TTLS)
Protected EAP (PEAP)
Flexible Authentication via Secure Tunneling (FAST)

Security+ Guide to Network Security 17

Fundamentals, 2e
 Remote Authentication Dial-In User
Service (RADIUS)
Originally defined to enable centralized authentication
and access control and PPP sessions
Requests are forwarded to a single RADIUS server
Supports authentication, authorization, and auditing
functions
After connection is made, RADIUS server adds an
accounting record to its log and acknowledges the
request
Allows company to maintain user profiles in a central
database that all remote servers can share
Security+ Guide to Network Security 18
Fundamentals, 2e
 Terminal Access Control Access
Control System (TACACS+)
Industry standard protocol specification that forwards
username and password information to a centralized
server
Whereas communication between a NAS and a
TACACS+ server is encrypted, communication
between a client and a NAS is not

Security+ Guide to Network Security 19

Fundamentals, 2e
 Secure Transmission Protocols
PPTP and L2TP provide a secure mechanism for
preventing eavesdroppers from viewing
transmissions

Security+ Guide to Network Security 20

Fundamentals, 2e
 Secure Shell (SSH)
One of the primary goals of the ARPANET (which
became todays Internet) was remote access
SSH is a UNIX-based command interface and
protocol for securely accessing a remote computer
Suite of three utilitiesslogin, ssh, and scp
Can protect against:
IP spoofing
DNS spoofing
Intercepting information

Security+ Guide to Network Security 21

Fundamentals, 2e
 Secure Shell (SSH) (continued)

Security+ Guide to Network Security 22

Fundamentals, 2e
 IP Security (IPSec)

Different security tools function at different layers of

the Open System Interconnection (OSI) model
Secure/Multipurpose Internet Mail Extensions
(S/MIME) and Pretty Good Privacy (PGP) operate at
the Application layer
Kerberos functions at the Session layer

Security+ Guide to Network Security 23

Fundamentals, 2e
 IP Security (IPSec) (continued)

Security+ Guide to Network Security 24

Fundamentals, 2e
 IP Security (IPSec) (continued)
IPSec is a set of protocols developed to support the
secure exchange of packets
Considered to be a transparent security protocol
Transparent to applications, users, and software
Provides three areas of protection that correspond to
three IPSec protocols:
Authentication
Confidentiality
Key management

Security+ Guide to Network Security 25

Fundamentals, 2e
 IP Security (IPSec) (continued)

Supports two encryption modes:

Transport mode encrypts only the data portion
(payload) of each packet, yet leaves the header
encrypted
Tunnel mode encrypts both the header and the data
portion
IPSec accomplishes transport and tunnel modes by
adding new headers to the IP packet
The entire original packet is then treated as the data
portion of the new packet
Security+ Guide to Network Security 26
Fundamentals, 2e
 IP Security (IPSec) (continued)

Security+ Guide to Network Security 27

Fundamentals, 2e
 IP Security (IPSec) (continued)

Both Authentication Header (AH) and Encapsulating

Security Payload (ESP) can be used with Transport
or Tunnel mode, creating four possible transport
mechanisms:
AH in transport mode
AH in tunnel mode
ESP in transport mode
ESP in tunnel mode

Security+ Guide to Network Security 28

Fundamentals, 2e
 Virtual Private Networks (VPNs)

Takes advantage of using the public Internet as if it

were a private network
Allow the public Internet to be used privately
Prior to VPNs, organizations were forced to lease
expensive data connections from private carriers so
employees could remotely connect to the
organizations network

Security+ Guide to Network Security 29

Fundamentals, 2e
 Virtual Private Networks (VPNs)
(continued)
Two common types of VPNs include:
Remote-access VPN or virtual private dial-up network
(VPDN): user-to-LAN connection used by remote users
Site-to-site VPN: multiple sites can connect to other
sites over the Internet
VPN transmissions achieved through communicating
with endpoints
An endpoint can be software on a local computer, a
dedicated hardware device such as a VPN
concentrator, or even a firewall

Security+ Guide to Network Security 30

Fundamentals, 2e
 Virtual Private Networks (VPNs)
(continued)

Security+ Guide to Network Security 31

Fundamentals, 2e
 Protecting Directory Services

A directory service is a database stored on the

network itself and contains all information about
users and network devices
A directory service contains information such as the
users name, telephone extension, e-mail address,
and logon name
The International Standards Organization (ISO)
created a standard for directory services known as
X500

Security+ Guide to Network Security 32

Fundamentals, 2e
 Protecting Directory Services
(continued)
Purpose of X500 was to standardize how data was
stored so any computer system could access these
directories
Information is held in a directory information base
(DIB)
Entries in the DIB are arranged in a directory
information tree (DIT)

Security+ Guide to Network Security 33

Fundamentals, 2e
 Protecting Directory Services
(continued)
The X500 standard defines a protocol for a client
application to access the X500 directory called the
Directory Access Protocol (DAP)
The DAP is too large to run on a personal computer
The Lightweight Directory Access Protocol (LDAP), or
X500 Lite, is a simpler subset of DAP

Security+ Guide to Network Security 34

Fundamentals, 2e
 Securing Digital Cellular Telephony
The early use of wireless cellular technology is
known as First Generation (1G)
1G is characterized by analog radio frequency (RF)
signals transmitting at a top speed of 96 Kbps
1G networks use circuit-switching technology
Digital cellular technology, which started in the early
1990s, uses digital instead of analog transmissions
Digital cellular uses packet switching instead of
circuit-switching technology

Security+ Guide to Network Security 35

Fundamentals, 2e
 Wireless Application Protocol (WAP)
Provides standard way to transmit, format, and
display Internet data for devices such as cell phones
A WAP cell phone runs a microbrowser that uses
Wireless Markup Language (WML) instead of HTML
WML is designed to display text-based Web content on
the small screen of a cell phone
Because the Internet standard is HTML, a WAP
Gateway (or WAP Proxy) must translate between WML
and HTML

Security+ Guide to Network Security 36

Fundamentals, 2e
 Wireless Application Protocol (WAP)
(continued)

Security+ Guide to Network Security 37

Fundamentals, 2e
 Wireless Transport Layer
Security (WTLS)
Security layer of the WAP
Provides privacy, data integrity, and authentication for
WAP services
Designed specifically for wireless cellular telephony
Based on the TLS security layer used on the Internet
Replaced by TLS in WAP 20

Security+ Guide to Network Security 38

Fundamentals, 2e
 Hardening Wireless Local Area
Networks (WLAN)
By 2007, >98% of all notebooks will be wireless-
enabled
Serious security vulnerabilities have also been
created by wireless data technology:
Unauthorized users can access the wireless signal
from outside a building and connect to the network
Attackers can capture and view transmitted data
Employees in the office can install personal wireless
equipment and defeat perimeter security measures
Attackers can crack wireless security with kiddie scripts

Security+ Guide to Network Security 39

Fundamentals, 2e
 IEEE 80211 Standards

A WLAN shares same characteristics as a standard

data-based LAN with the exception that network
devices do not use cables to connect to the network
RF is used to send and receive packets
Sometimes called Wi-Fi for Wireless Fidelity, network
devices can transmit 11 to 108 Mbps at a range of
150 to 375 feet
80211a has a maximum rated speed of 54 Mbps and
also supports 48, 36, 24, 18, 12, 9, and 6 Mbps
transmissions at 5 GHz

Security+ Guide to Network Security 40

Fundamentals, 2e
 IEEE 80211 Standards (continued)

In September 1999, a new 80211b High Rate was

amended to the 80211 standard
80211b added two higher speeds, 55 and 11 Mbps
With faster data rates, 80211b quickly became the
standard for WLANs
At same time, the 80211a standard was released

Security+ Guide to Network Security 41

Fundamentals, 2e
 WLAN Components

Each network device must have a wireless network

interface card installed
Wireless NICs are available in a variety of formats:
Type II PC card Mini PCI
CompactFlash (CF) card USB device
USB stick

Security+ Guide to Network Security 42

Fundamentals, 2e
 WLAN Components (continued)

An access point (AP) consists of three major parts:

An antenna and a radio transmitter/receiver to send
and receive signals
An RJ-45 wired network interface that allows it to
connect by cable to a standard wired network
Special bridging software

Security+ Guide to Network Security 43

Fundamentals, 2e
 Basic WLAN Security

Two areas:
Basic WLAN security
Enterprise WLAN security
Basic WLAN security uses two new wireless tools
and one tool from the wired world:
Service Set Identifier (SSID) beaconing
MAC address filtering
Wired Equivalent Privacy (WEP)

Security+ Guide to Network Security 44

Fundamentals, 2e
 Service Set Identifier (SSID)
Beaconing
A service set is a technical term used to describe a
WLAN network
Three types of service sets:
Independent Basic Service Set (IBSS)
Basic Service Set (BSS)
Extended Service Set (ESS)
Each WLAN is given a unique SSID

Security+ Guide to Network Security 45

Fundamentals, 2e
 MAC Address Filtering
Another way to harden a WLAN is to filter MAC
addresses
The MAC address of approved wireless devices is
entered on the AP
A MAC address can be spoofed
When wireless device and AP first exchange packets,
the MAC address of the wireless device is sent in
plaintext, allowing an attacker with a sniffer to see the
MAC address of an approved device

Security+ Guide to Network Security 46

Fundamentals, 2e
 Wired Equivalent Privacy (WEP)

Optional configuration for WLANs that encrypts

packets during transmission to prevent attackers from
viewing their contents
Uses shared keysthe same key for encryption and
decryption must be installed on the AP, as well as
each wireless device
A serious vulnerability in WEP is that the IV is not
properly implemented
Every time a packet is encrypted it should be given a
unique IV
Security+ Guide to Network Security 47
Fundamentals, 2e
 Wired Equivalent Privacy (WEP)
(continued)

Security+ Guide to Network Security 48

Fundamentals, 2e
 Untrusted Network

The basic WLAN security of SSID beaconing, MAC

address filtering, and WEP encryption is not secure
enough for an organization to use
One approach to securing a WLAN is to treat it as an
untrusted and unsecure network
Requires that the WLAN be placed outside the
secure perimeter of the trusted network

Security+ Guide to Network Security 49

Fundamentals, 2e
 Untrusted Network (continued)

Security+ Guide to Network Security 50

Fundamentals, 2e
 Trusted Network

It is still possible to provide security for a WLAN and

treat it as a trusted network
Wi-Fi Protected Access (WPA) was crafted by the
WECA in 2002 as an interim solution until a
permanent wireless security standard could be
implemented
Has two components:
WPA encryption
WPA access control
Security+ Guide to Network Security 51
Fundamentals, 2e
 Trusted Network (continued)

WPA encryption addresses the weaknesses of WEP

by using the Temporal Key Integrity Protocol (TKIP)
TKIP mixes keys on a per-packet basis to improve
security
Although WPA provides enhanced security, the IEEE
80211i solution is even more secure
80211i is expected to be released sometime in 2004

Security+ Guide to Network Security 52

Fundamentals, 2e
 Summary
The FTP protocol has several security
vulnerabilitiesit does not natively use encryption
and is vulnerable to man-in-the-middle attacks
FTP can be hardened by using secure FTP (which
encrypts using SSL)
Protecting remote access transmissions is
particularly important in todays environment as more
users turn to the Internet as the infrastructure for
accessing protected information

Security+ Guide to Network Security 53

Fundamentals, 2e
 Summary (continued)
Authenticating a transmission to ensure it came from
the sender can provide increased security for remote
access users
SSH is a UNIX-based command interface and
protocol for securely accessing a remote computer
A directory service is a database stored on the
network itself and contains all the information about
users and network devices
Digital cellular telephony provides various features to
operate on a wireless digital cellular device
WLANs have a dramatic impact on user access to
data
Security+ Guide to Network Security 54
Fundamentals, 2e