Please enable JavaScript.
Coggle requires JavaScript to display documents.
CHAPTER 11: IT'S A NETWORK - Coggle Diagram
CHAPTER 11: IT'S A NETWORK
Device Selection for a Small Network
Factors to be considered when selecting intermediate
devices
Speed
Expandable Modular
Ports
Manageable
Cost
Addressing for a Small Network
Examples of devices that will be part of the IP design:
Servers and peripherals
Hosts that are accessible from the Internet
End devices for users
Intermediary devices
Planned IP schemes help the administrator:
Track devices and troubleshoot
Control access to resources
IP addressing scheme should be planned, documented and maintained based on the type of devices receiving the address
Redundancy in a Small Network
Redundancy helps to eliminate single points of failure.
Improves the reliability of the network
Design Considerations for a Small Network
The following should be included in the network
design:
Protect the location by physical and logical security measures.
Create redundancy in the server farm.
Secure file and mail servers in a centralized location.
Configure redundant paths to the servers
Threats to Network Security
Data loss and manipulation
Identity theft
Information Theft
Disruption of Service
Physical Security
Environmental threats
- temperature extremes (too hot
or too cold) or humidity extremes (too wet or too dry)
Electrical threats
- voltage spikes, insufficient supply voltage (brownouts), unconditioned power (noise), and total loss power
Hardware threats
- physical damage to servers, routers,
switches, cabling plant, and workstations.
Maintenance threats
- poor handling of key electrical components (electrostatic discharge), lack of critical spare parts, poor cabling, and poor labeling
Types of Security Vulnerabilities
Configuration weaknesses
Security policy weaknesses
Technological weaknesses
Viruses, Worms and Trojan Horses
A
Trojan horse
- the entire application was written to
look like something else, when in fact it is an attack tool
Worms
- self-contained programs that attack a system
and try to exploit a specific vulnerability in the target. The worm copies its program from the attacking host to the newly exploited system to begin the cycle again
A
virus
- malicious software that is attached to another program to execute a particular unwanted function on a workstation
Reconnaissance Attacks
Ping sweeps
Port scans
Internet queries
Packet sniffers
Denial of Service Attacks (DoS)
Resource overloads
Ping floods such as smurf
Packet storms such as UDP bombs and fraggle
Disk space, bandwidth, buffer
Malformed data
Overlapping packet such as winuke
Unhandled data such as teardrop
Oversized packets such as ping of death
Backup, Upgrade, Update, and Patch
Keep current with the latest versions of antivirus software.
Install updated security patches
Authentication, Authorization, and Accounting
Authorization
- which resources the user can access and which operations the user is allowed to perform .
Accounting
- records what the user accessed, the amount of time the resource is accessed, and any changes made
Authentication
- Users and administrators must prove their identity. Authentication can be established using username and password combinations, challenge and response questions, token cards, and other methods.
Firewalls
Methods used are:
Packet Filtering
Application Filtering
URL Filtering
Stateful Packet Inspection (SPI) - Incoming packets must be legitimate responses to requests from internal hosts
A firewall resides between two or more networks. It controls traffic and helps prevent unauthorized access
Endpoint Security
Employees must follow the companies documented security policies to secure their devices
Policies often include the use of anti-virus software and
host intrusion prevention
Common endpoints are laptops, desktops, servers, smart phones, and tablets.
Introduction to Securing Devices
Access to system resources should be restricted to only
the individuals that are authorized to use those resources
Any unnecessary services and applications should be
turned off and uninstalled, when possible.
Default usernames and passwords should be changed immediately.
Update with security patches as they become available
Part of network security is securing devices, including end devices and intermediate devices
Basic Security Practices
Block brute force attacks
Use Banner Message
Require minimum length passwords
Set EXEC timeout
Encrypt passwords
Common Show Commands Revisited
The status of nearly every process or function of the
router can be displayed using a show command.
Frequently used show commands:
show running-config
show interfaces
show arp
show ip route
show protocols
show version
ipconfig Command Options
ipconfig /all – also displays MAC address
Ipconfig /displaydns - displays all cached dns entries in a Windows system
ipconfig - displays ip address, subnet mask, default gateway.
Router File Systems
show file systems
command - lists all of the available file systems on a Cisco 1941 route
Asterisk indicates this is the current default file system
Switch File Systems
show file systems
command - lists all of the available file systems on a Catalyst 2960 switch.
Backup and Restore using TFTP
copy running-config tftp – save running configuration to a tftp server
copy startup-config tftp
- save startup configuration
to a tftp server
Configuration files can be stored on a Trivial File Transfer Protocol (TFTP) server
Using USB Interfaces on a Cisco Router
Can hold multiple copies of the Cisco IOS and multiple router configurations.
Allows administrator to easily move configurations from router to router.
USB flash drive must be formatted in a FAT16 format.
Multi-function Device
Provides routing, switching and wireless connectivity.
Linksys wireless routers, are simple in design and used
in home networks
Incorporates a switch, router, and wireless access point.
Cisco Integrated Services Router (ISR) product family offers a wide range of products, designed for small office to larger networks
Wireless Capability
Service Set Identifier (SSID)
-Case-sensitive, alpha-numeric name for your home wireless network.
Wireless Channel
– RF spectrum divided up into channels
Wireless Mode
-Most integrated wireless routers support 802.11b, 802.11g and 802.11n
Basic Security of Wireless
Disable SSID broadcasting
Configure Encryption using WEP or WPA
Change default values
Wired Equivalency Protocol (WEP)
- uses preconfigured keys to encrypt and decrypt data Every wireless device allowed to access the network must have the same WEP key entered..
Wi-Fi Protected Access (WPA)
– also uses encryption keys from 64 bits up to 256 bits. New keys are generated each time a connection is established with the AP. Therefore more secure.
Configuring the Integrated Router
The connecting device will automatically obtain IP addressing information from Integrated Router
Change default username and password and the default Linksys IP address for security purposes.
Access the router by cabling a computer to one of the router’s LAN Ethernet ports.
Enabling Wireless
Configure the SSID
Configure RF channel
Configure the wireless mode
Configure any desired security encryption
Configure a Wireless Client
The wireless client configuration settings must match that
of the wireless router
Security settings
Channel
SSID
Wireless client software can be integrated into the device
operating system or stand alone, downloadable, wireless utility software