Netwok Security Architecture.ppt.pptVIP

Network Security Architecture CS461/ECE422 Information Assurance Spring 2008 Reading Material Security In Computing, 7.3-7.5 “Firewalls and Internet Security: Repelling the Wily Hacker”, Cheswick, Bellovin, and Rubin. New second edition “Firewall and Internet Security, the Second Hundred (Internet) Years” /warp/public/759/ipj_2-2/ipj_2-2_fis1.html A firewall overview article from 1999 Overview Network Security Architecture Wireless Security Domains VPN Firewall Technology Address Translation Denial of Service attacks Intrusion Detection Both firewalls and IDS are introductions. Both are covered in more detail in the Security Lab class. IDS is covered in more detail in 463 – Computer Security. 802.11 or Wi-Fi IEEE standard for wireless communication Operates at the physical/data link layer Operates at the 2.4 or 5 GHz radio bands Wireless Access Point is the radio base station The access point acts as a gateway to a wired network e.g., ethernet Can advertise Service Set Identifier (SSID) or not Doesnt really matter, watcher will learn active SSIDs Laptop with wireless card uses 802.11 to communicate with the Access Point Security Mechanisms MAC restrictions at the access point Protects servers from unexpected clients Unacceptable in a dynamic environment No identity integrity. You can reprogram your card to pose as an “accepted” MAC. IPSec To access point or some IPSec gateway beyond Protects clients from wireless sniffers Used by UIUC wireless networks 802.11i Authentication and integrity integral to the 802.11 framework WEP, WPA, WPA2 Perimeter Defense Is it adequate? Locating and securing all perimeter points is quite difficult Less effective for large border Inspecting/ensuring that remote connections are adequately protected is difficult Insiders attack is often the most damaging Virtual Private Networks A private network that is configured within a public network A VPN “appears” to be dedicated network to customer The customer is actually “sharing” trunks