Instructor: Port security configuration. 2 2
So far, we've talked about some network appliances 3 3
like firewalls, intrusion detection systems 4 4
and intrusion prevention systems 5 5
but these devices are also a great target 6 6
for adversary attacks. 7 7
To protect them, we use port security. 8 8
Now, port security refers to blocking 9 9
unauthorized application service ports 10 10
on hosts and firewalls, 11 11
or the physical and remote access ports 12 12
that are used to allow a host 13 13
to communicate on the local network. 14 14
Appliances such as switches, routers 15 15
and firewalls are all subject to software vulnerabilities 16 16
and patching shortfalls in the same way that a server is 17 17
and so we need to make sure we're protecting these things. 18 18
We can't just let them be open to everybody touching them 19 19
because if so, we're going to be attacked. 20 20
Now, one of the big issues that you have 21 21
when you start dealing with these appliances 22 22
is that many of them run on some embedded operating systems. 23 23
When you start dealing with an IDs or an IPS appliance 24 24
they generally run on Linux. 25 25
They have Linux inside them. 26 26
Now, the problem is a lot of researchers have discovered 27 27
that many network appliances are still running vulnerable, 28 28
outdated, or unpatched versions of the Linux kernel 29 29
because they're not getting the patches 30 30
and updates they need to 31 31
so you need to make sure 32 32
they are part of your patching routine. 33 33
You need to make sure that these things 34 34
are looked at the same way you would a server 35 35
because essentially they are servers. 36 36
Now, another area of concern for these network appliances 37 37
is web administration interfaces. 38 38
A lot of these products have a nice, beautiful web front end 39 39
that you can log into 40 40
and then access their information from there 41 41
but these are often subject 42 42
to multiple software vulnerabilities too. 43 43
There might be things like cross-site scripting 44 44
and cross-site request forgery 45 45
that can go against these web interfaces 46 46
because again, they're on an embedded operating system 47 47
that may not have been patched. 48 48
So instead, it is a much better idea 49 49
for you to disable web administrative interfaces 50 50
and instead use SSH shells for increased security. 51 51
Let's talk for a moment about some best practices 52 52
to secure your network appliances. 53 53
First, I want you to use ACLS to restrict access 54 54
to designated host devices. 55 55
Now, what I mean by this is you should have a limited number 56 56
of laptops or desktops that have the ability 57 57
to go into these management areas. 58 58
For instance, if you're going to allow SSH access 59 59
you should probably only have a handful of laptops 60 60
that allow that to happen 61 61
and they should only be able to do it from certain places. 62 62
That brings us to our second tip. 63 63
You want to make sure you monitor 64 64
the number of designated interfaces. 65 65
Are you going to allow anyone to connect over any port 66 66
or are there going to be maybe five ports in your office 67 67
that have that connection back to those firewalls 68 68
and back to those network appliances? 69 69
That's actually a much better way of doing it 70 70
because again, if we can control the amount of access 71 71
to these devices 72 72
we can increase your security. 73 73
The third area that we want to think about 74 74
is denying internet access for remote management. 75 75
Now, what I mean by this 76 76
is not that we need to cut these switches in firewalls 77 77
off from the internet 78 78
but the management side of them should be. 79 79
If you need to have a technician 80 80
work on one of these devices remotely, 81 81
which often happens in organizations, 82 82
you should have them connect over a VPN 83 83
to the Local Area Network first, 84 84
then get into your management LAN and connect that way. 85 85
This way you're not opening your management ports 86 86
of these devices directly to the dirty internet 87 87
where anybody can attack them. 88 88
Now, another area of concern 89 89
is when you start looking at your network 90 90
and you see rogue devices. 91 91
If you find a rogue device on your network, 92 92
you need to make sure you're enforcing port security 93 93
to prevent this. 94 94
Now, there are three different types 95 95
of port security you can use. 96 96
The first is physical port security. 97 97
The second is MAC filtering 98 98
and the third is Network Access Control. 99 99
Let's talk about each of these for a moment. 100 100
First, we have physical port security. 101 101
Now, this means that you have physical access 102 102
to the switch ports and the switch hardware 103 103
and you need to make sure this is restricted 104 104
to just authorized staff. 105 105
Many times organizations leave switches out in the open 106 106
and that's a bad plan. 107 107
Your switches should be in a cabinet, under locking key 108 108
or in a network closet that has a lock on the door. 109 109
You want to make sure you have physical distance 110 110
between anybody who may wish to do you harm 111 111
and your physical hardware, 112 112
because if they can touch that switch, 113 113
they can access that switch 114 114
and we don't want that happening. 115 115
Now, another thing you have to worry about 116 116
is all those ports in your offices. 117 117
How do you make sure that those ports 118 118
that are open on the wall 119 119
aren't being used by some bad person? 120 120
Well, one of the ways you can do that 121 121
is by physically unplugging them from the patch panel. 122 122
That way there might be a jack in that room 123 123
but that jack doesn't go anywhere. 124 124
Then, if somebody moves into that office and needs that jack 125 125
you would then patch them in. 126 126
This is the idea of physical port security. 127 127
Now, the problem with this is that doing this 128 128
takes a lot of manpower and it's prone to error 129 129
because you might unplug the wrong person or the wrong port 130 130
and cause an outage for people who actually needed it. 131 131
This brings us to the second way we can do things, 132 132
which is MAC filtering. 133 133
This is an electronic mechanism. 134 134
With MAC filtering, we can apply an access control list 135 135
to a switch or an access point, 136 136
so only clients with an approved MAC address 137 137
can connect to it. 138 138
Now, that sounds great, but again, 139 139
this is a static mechanism, so somebody has to go in 140 140
and type in these 48 bit numbers 141 141
into the access control list and keep those up to date. 142 142
This is another area that can be very prone to errors. 143 143
Another problem with MAC filtering is if somebody is smart, 144 144
it only takes 'em about five to 10 seconds 145 145
to change their MAC address, 146 146
and so if they can sniff a wireless network, for instance, 147 147
and determine what MAC addresses are in use, 148 148
they can change their device to that MAC address 149 149
and then connect. 150 150
So MAC address filtering by itself is not enough. 151 151
Now, the third mechanism 152 152
and the one that I like the best is actually called NAC. 153 153
It's Network Access Control. 154 154
This is a general term for the collective protocols, 155 155
policies and hardware 156 156
that authenticates and authorizes access to a network 157 157
at the device level. 158 158
Now, we're not going to dive too deeply right now into NAC 159 159
and instead I'm going to say that for the next lesson.