1 1 00:00:00,480 --> 00:00:02,670 Port security configuration. 2 2 00:00:02,670 --> 00:00:05,340 So far, we've talked about some network appliances 3 3 00:00:05,340 --> 00:00:08,040 like firewalls, intrusion detection systems 4 4 00:00:08,040 --> 00:00:09,750 and intrusion prevention systems 5 5 00:00:09,750 --> 00:00:11,820 but these devices are also a great target 6 6 00:00:11,820 --> 00:00:13,380 for adversary attacks. 7 7 00:00:13,380 --> 00:00:15,780 To protect them, we use port security. 8 8 00:00:15,780 --> 00:00:17,940 Now, port security refers to blocking 9 9 00:00:17,940 --> 00:00:19,950 unauthorized application service ports 10 10 00:00:19,950 --> 00:00:21,480 on hosts and firewalls, 11 11 00:00:21,480 --> 00:00:24,090 or the physical and remote access ports 12 12 00:00:24,090 --> 00:00:25,320 that are used to allow a host 13 13 00:00:25,320 --> 00:00:27,600 to communicate on the local network. 14 14 00:00:27,600 --> 00:00:29,790 Appliances such as switches, routers 15 15 00:00:29,790 --> 00:00:32,490 and firewalls are all subject to software vulnerabilities 16 16 00:00:32,490 --> 00:00:35,520 and patching shortfalls in the same way that a server is 17 17 00:00:35,520 --> 00:00:38,100 and so we need to make sure we're protecting these things. 18 18 00:00:38,100 --> 00:00:40,770 We can't just let them be open to everybody touching them 19 19 00:00:40,770 --> 00:00:43,680 because if so, we're going to be attacked. 20 20 00:00:43,680 --> 00:00:45,300 Now, one of the big issues that you have 21 21 00:00:45,300 --> 00:00:47,010 when you start dealing with these appliances 22 22 00:00:47,010 --> 00:00:50,550 is that many of them run on some embedded operating systems. 23 23 00:00:50,550 --> 00:00:53,250 When you start dealing with an IDs or an IPS appliance 24 24 00:00:53,250 --> 00:00:54,660 they generally run on Linux. 25 25 00:00:54,660 --> 00:00:56,430 They have Linux inside them. 26 26 00:00:56,430 --> 00:00:59,340 Now, the problem is a lot of researchers have discovered 27 27 00:00:59,340 --> 00:01:02,130 that many network appliances are still running vulnerable, 28 28 00:01:02,130 --> 00:01:05,190 outdated, or unpatched versions of the Linux kernel 29 29 00:01:05,190 --> 00:01:06,510 because they're not getting the patches 30 30 00:01:06,510 --> 00:01:07,800 and updates they need to 31 31 00:01:07,800 --> 00:01:08,760 so you need to make sure 32 32 00:01:08,760 --> 00:01:10,830 they are part of your patching routine. 33 33 00:01:10,830 --> 00:01:12,510 You need to make sure that these things 34 34 00:01:12,510 --> 00:01:14,400 are looked at the same way you would a server 35 35 00:01:14,400 --> 00:01:16,620 because essentially they are servers. 36 36 00:01:16,620 --> 00:01:19,560 Now, another area of concern for these network appliances 37 37 00:01:19,560 --> 00:01:21,660 is web administration interfaces. 38 38 00:01:21,660 --> 00:01:24,840 A lot of these products have a nice, beautiful web front end 39 39 00:01:24,840 --> 00:01:25,920 that you can log into 40 40 00:01:25,920 --> 00:01:28,080 and then access their information from there 41 41 00:01:28,080 --> 00:01:29,490 but these are often subject 42 42 00:01:29,490 --> 00:01:31,800 to multiple software vulnerabilities too. 43 43 00:01:31,800 --> 00:01:33,540 There might be things like cross-site scripting 44 44 00:01:33,540 --> 00:01:35,190 and cross-site request forgery 45 45 00:01:35,190 --> 00:01:37,200 that can go against these web interfaces 46 46 00:01:37,200 --> 00:01:39,960 because again, they're on an embedded operating system 47 47 00:01:39,960 --> 00:01:41,430 that may not have been patched. 48 48 00:01:41,430 --> 00:01:43,410 So instead, it is a much better idea 49 49 00:01:43,410 --> 00:01:45,720 for you to disable web administrative interfaces 50 50 00:01:45,720 --> 00:01:49,920 and instead use SSH shells for increased security. 51 51 00:01:49,920 --> 00:01:52,290 Let's talk for a moment about some best practices 52 52 00:01:52,290 --> 00:01:54,240 to secure your network appliances. 53 53 00:01:54,240 --> 00:01:57,120 First, I want you to use ACLS to restrict access 54 54 00:01:57,120 --> 00:01:59,220 to designated host devices. 55 55 00:01:59,220 --> 00:02:01,770 Now, what I mean by this is you should have a limited number 56 56 00:02:01,770 --> 00:02:04,380 of laptops or desktops that have the ability 57 57 00:02:04,380 --> 00:02:06,540 to go into these management areas. 58 58 00:02:06,540 --> 00:02:09,000 For instance, if you're going to allow SSH access 59 59 00:02:09,000 --> 00:02:11,400 you should probably only have a handful of laptops 60 60 00:02:11,400 --> 00:02:12,840 that allow that to happen 61 61 00:02:12,840 --> 00:02:15,780 and they should only be able to do it from certain places. 62 62 00:02:15,780 --> 00:02:17,430 That brings us to our second tip. 63 63 00:02:17,430 --> 00:02:18,630 You want to make sure you monitor 64 64 00:02:18,630 --> 00:02:20,820 the number of designated interfaces. 65 65 00:02:20,820 --> 00:02:23,640 Are you going to allow anyone to connect over any port 66 66 00:02:23,640 --> 00:02:26,010 or are there going to be maybe five ports in your office 67 67 00:02:26,010 --> 00:02:28,320 that have that connection back to those firewalls 68 68 00:02:28,320 --> 00:02:30,330 and back to those network appliances? 69 69 00:02:30,330 --> 00:02:32,040 That's actually a much better way of doing it 70 70 00:02:32,040 --> 00:02:34,020 because again, if we can control the amount of access 71 71 00:02:34,020 --> 00:02:34,950 to these devices 72 72 00:02:34,950 --> 00:02:36,510 we can increase your security. 73 73 00:02:36,510 --> 00:02:38,100 The third area that we want to think about 74 74 00:02:38,100 --> 00:02:41,400 is denying internet access for remote management. 75 75 00:02:41,400 --> 00:02:42,540 Now, what I mean by this 76 76 00:02:42,540 --> 00:02:44,208 is not that we need to cut these switches in firewalls 77 77 00:02:44,208 --> 00:02:45,690 off from the internet 78 78 00:02:45,690 --> 00:02:48,300 but the management side of them should be. 79 79 00:02:48,300 --> 00:02:49,500 If you need to have a technician 80 80 00:02:49,500 --> 00:02:51,060 work on one of these devices remotely, 81 81 00:02:51,060 --> 00:02:53,280 which often happens in organizations, 82 82 00:02:53,280 --> 00:02:55,230 you should have them connect over a VPN 83 83 00:02:55,230 --> 00:02:57,120 to the Local Area Network first, 84 84 00:02:57,120 --> 00:03:00,600 then get into your management LAN and connect that way. 85 85 00:03:00,600 --> 00:03:03,240 This way you're not opening your management ports 86 86 00:03:03,240 --> 00:03:05,880 of these devices directly to the dirty internet 87 87 00:03:05,880 --> 00:03:07,440 where anybody can attack them. 88 88 00:03:07,440 --> 00:03:08,760 Now, another area of concern 89 89 00:03:08,760 --> 00:03:10,170 is when you start looking at your network 90 90 00:03:10,170 --> 00:03:11,880 and you see rogue devices. 91 91 00:03:11,880 --> 00:03:13,770 If you find a rogue device on your network, 92 92 00:03:13,770 --> 00:03:16,170 you need to make sure you're enforcing port security 93 93 00:03:16,170 --> 00:03:17,280 to prevent this. 94 94 00:03:17,280 --> 00:03:18,780 Now, there are three different types 95 95 00:03:18,780 --> 00:03:20,550 of port security you can use. 96 96 00:03:20,550 --> 00:03:22,980 The first is physical port security. 97 97 00:03:22,980 --> 00:03:24,810 The second is MAC filtering 98 98 00:03:24,810 --> 00:03:27,270 and the third is Network Access Control. 99 99 00:03:27,270 --> 00:03:29,220 Let's talk about each of these for a moment. 100 100 00:03:29,220 --> 00:03:31,560 First, we have physical port security. 101 101 00:03:31,560 --> 00:03:33,360 Now, this means that you have physical access 102 102 00:03:33,360 --> 00:03:35,370 to the switch ports and the switch hardware 103 103 00:03:35,370 --> 00:03:36,900 and you need to make sure this is restricted 104 104 00:03:36,900 --> 00:03:38,760 to just authorized staff. 105 105 00:03:38,760 --> 00:03:41,700 Many times organizations leave switches out in the open 106 106 00:03:41,700 --> 00:03:43,560 and that's a bad plan. 107 107 00:03:43,560 --> 00:03:46,530 Your switches should be in a cabinet, under locking key 108 108 00:03:46,530 --> 00:03:49,560 or in a network closet that has a lock on the door. 109 109 00:03:49,560 --> 00:03:51,090 You want to make sure you have physical distance 110 110 00:03:51,090 --> 00:03:53,400 between anybody who may wish to do you harm 111 111 00:03:53,400 --> 00:03:54,600 and your physical hardware, 112 112 00:03:54,600 --> 00:03:56,400 because if they can touch that switch, 113 113 00:03:56,400 --> 00:03:57,600 they can access that switch 114 114 00:03:57,600 --> 00:03:59,310 and we don't want that happening. 115 115 00:03:59,310 --> 00:04:00,450 Now, another thing you have to worry about 116 116 00:04:00,450 --> 00:04:02,640 is all those ports in your offices. 117 117 00:04:02,640 --> 00:04:04,320 How do you make sure that those ports 118 118 00:04:04,320 --> 00:04:05,490 that are open on the wall 119 119 00:04:05,490 --> 00:04:07,650 aren't being used by some bad person? 120 120 00:04:07,650 --> 00:04:09,300 Well, one of the ways you can do that 121 121 00:04:09,300 --> 00:04:12,300 is by physically unplugging them from the patch panel. 122 122 00:04:12,300 --> 00:04:14,280 That way there might be a jack in that room 123 123 00:04:14,280 --> 00:04:16,110 but that jack doesn't go anywhere. 124 124 00:04:16,110 --> 00:04:18,990 Then, if somebody moves into that office and needs that jack 125 125 00:04:18,990 --> 00:04:20,550 you would then patch them in. 126 126 00:04:20,550 --> 00:04:23,010 This is the idea of physical port security. 127 127 00:04:23,010 --> 00:04:25,320 Now, the problem with this is that doing this 128 128 00:04:25,320 --> 00:04:28,170 takes a lot of manpower and it's prone to error 129 129 00:04:28,170 --> 00:04:31,200 because you might unplug the wrong person or the wrong port 130 130 00:04:31,200 --> 00:04:33,840 and cause an outage for people who actually needed it. 131 131 00:04:33,840 --> 00:04:35,760 This brings us to the second way we can do things, 132 132 00:04:35,760 --> 00:04:37,230 which is MAC filtering. 133 133 00:04:37,230 --> 00:04:39,000 This is an electronic mechanism. 134 134 00:04:39,000 --> 00:04:41,610 With MAC filtering, we can apply an access control list 135 135 00:04:41,610 --> 00:04:43,320 to a switch or an access point, 136 136 00:04:43,320 --> 00:04:45,330 so only clients with an approved MAC address 137 137 00:04:45,330 --> 00:04:46,560 can connect to it. 138 138 00:04:46,560 --> 00:04:48,390 Now, that sounds great, but again, 139 139 00:04:48,390 --> 00:04:50,820 this is a static mechanism, so somebody has to go in 140 140 00:04:50,820 --> 00:04:52,890 and type in these 48 bit numbers 141 141 00:04:52,890 --> 00:04:55,590 into the access control list and keep those up to date. 142 142 00:04:55,590 --> 00:04:58,350 This is another area that can be very prone to errors. 143 143 00:04:58,350 --> 00:05:01,260 Another problem with MAC filtering is if somebody is smart, 144 144 00:05:01,260 --> 00:05:03,030 it only takes 'em about five to 10 seconds 145 145 00:05:03,030 --> 00:05:04,470 to change their MAC address, 146 146 00:05:04,470 --> 00:05:06,750 and so if they can sniff a wireless network, for instance, 147 147 00:05:06,750 --> 00:05:08,760 and determine what MAC addresses are in use, 148 148 00:05:08,760 --> 00:05:10,770 they can change their device to that MAC address 149 149 00:05:10,770 --> 00:05:12,030 and then connect. 150 150 00:05:12,030 --> 00:05:15,360 So MAC address filtering by itself is not enough. 151 151 00:05:15,360 --> 00:05:16,680 Now, the third mechanism 152 152 00:05:16,680 --> 00:05:19,110 and the one that I like the best is actually called NAC. 153 153 00:05:19,110 --> 00:05:21,120 It's Network Access Control. 154 154 00:05:21,120 --> 00:05:23,460 This is a general term for the collective protocols, 155 155 00:05:23,460 --> 00:05:24,900 policies and hardware 156 156 00:05:24,900 --> 00:05:27,450 that authenticates and authorizes access to a network 157 157 00:05:27,450 --> 00:05:29,070 at the device level. 158 158 00:05:29,070 --> 00:05:31,440 Now, we're not going to dive too deeply right now into NAC 159 159 00:05:31,440 --> 00:05:33,990 and instead I'm going to say that for the next lesson.