Security is hard. Security is expensive. Both statements seem to reflect the sentiment of the general population who is in dire need of securing the electronic communications that have become the ubiquitous means of business communication today. The term enterprise network security is becoming more and more prevalent as corporations try to understand and manage the risks associated with the rapidly developing business applications and practices deployed over corporate network infrastructures. Although this statement may at first seem rather dismal, it is just stating reality: Absolute security does not exist. Facts of life: Devices will be misconfigured, new attacks will be created, and software has bugs. The best any corporation can do is assess its risks and vulnerabilities, make decisions on what is critical, and then go on to implement its defined security policy as efficiently as possible. It is also important to verify that the implementation of the defined security policy is adhered to, which entails actively monitoring traffic on your networks and performing regularly scheduled security audits. Network security is a complex subject. This is partly because of the abundance of security technologies available today, some of which solve similar security issues and exist as an evolutionary cycle to a more comprehensive security strategy. Recently, the mechanisms to implement security into your corporate networks have become easier even though the underlying technologies remain complex.
Many outstanding books have been written on the subject of computer security, ranging from simplistic introductory books for the layperson to understand a specific concentrated area to more intricate technical details of security that are necessary for implementers of security products. When starting to teach network security fundamentals to people responsible for designing and operating corporate network infrastructures, I found that there was an overwhelming abundance of information to digest—all are available from many different books for the layperson. Often, these books either concentrated on host security issues, or concentrated specifically on security when connecting to the Internet. There was no single source that provided the fundamentals of cryptography, gave a good overview of some currently used and newly developing security technologies, and showed how these technologies could be used to provide a secure network infrastructure given a specified corporate security policy.
The first edition of this book was an attempt to provide a single starting point for understanding network security and to give enough technical details on cryptography fundamentals and security technologies for those who are new to security. In this revised edition, more recent technical developments have been added as well as chapters that discuss practical deployment issues for virtual private networks, wireless networks, and Voice over IP networks. In addition, a chapter has been added that focuses solely on routing protocol security. By reading this book, you will obtain a good basic understanding of security technologies and issues, recognize the fundamental need to create a corporate security policy, and use the policy as a guide to implement a secure corporate network infrastructure. Topics that have been covered by other books in extensive expert detail are addressed (such as firewalls or intrusion detection systems), but the references in Appendix A, “Sources of Technical Information,” should be also read to get the detailed knowledge.
This book focuses on securing the corporate infrastructure. In the ideal secure networking environment, security would be host-based and all security services would be implemented between the originator and the recipient of the information. In practicality, however, there is no complete control of desktop systems in many corporations, and a corporate security policy must be enforced by all departments at the level of control of the given department.
Most corporations have in place departments that handle any one or a combination of the following functions:
Networking infrastructure
Desktop requirements
Security requirements
The network infrastructure group designs and enforces the overall corporate network design. The desktop requirements group defines specifications for all desktop computers (PCs and workstations) and their supported applications. The security requirements group evaluates security risks and creates appropriate security policies to be enforced by all other corporate departments. All departments need to look at what security measures need to be implemented under their realm of control. This book focuses on the security services that can be used to protect the network infrastructure and the data traversing it.
I would like to emphasize that there is no such thing as absolute security. As stated in the movie The Avengers, “Nothing is impossible, only mathematically improbable.” When a network is called a secure network, it is often misunderstood to mean that there is no possibility of an intrusion or security breach. On the contrary, a secure network means that there are mechanisms in place that will mitigate most of the risks to corporate assets. However slight, some vulnerability will always be there, but as long as it is recognized and understood, it can be dealt with appropriately.
A book that was an inspiration in many ways and that has a great anecdotal chapter on the misconceptions of security is Surely You're Joking, Mr. Feynman, an autobiography of the Nobel Prize-winning physicist, Richard P. Feynman. There is a chapter in which Mr. Feynman recounts how easy he found it to crack safes and file cabinets that were thought to be secure—those containing the secrets of the atomic bomb. Most of his success at breaking in was due to people not locking their file cabinets, not changing default combinations, writing down combinations in obvious places, and keeping the combinations the same for multiple safes. He figured out the obvious method to break in, which nobody had considered because they had concentrated on figuring out only part of the problem. All threats and vulnerabilities must be considered when you create an effective corporate security policy.
The purpose of this book is to help you understand the fundamentals of securing a network infrastructure. Whether you already have a fundamental knowledge of security or are completely new to the topic, this book offers a detailed look at designing and implementing a secure corporate infrastructure. After completing this book, you will have a thorough understanding of basic cryptography, the most widely deployed security technologies, newly emerging security technologies, and how the technologies relate in the context of virtual private networks, wireless networks, and Voice over IP networks. You will be able to guide the architecture and implementation of a security policy for any corporate environment by understanding the steps required for risk management and the specific details needed. You will also be able to specify the features required in network infrastructure equipment to implement the given security policy.
This book is written for internetworking professionals who are responsible for designing and maintaining security services for enterprise network infrastructures. If you are a network engineer, architect, or technician who has a rudimentary knowledge of security protocols and technologies, this book will provide you with practical insights on what you need to consider to design and implement varying degrees of a security policy.
This book also includes useful information for consultants, systems engineers, and sales engineers who design corporate networks for clients. The information in this book covers a wide audience because incorporating some measure of security services is an integral part of any network design process.
This book is organized into four parts. Part I establishes the technical background. Part II focuses on your corporate environment, such as how to determine possible vulnerabilities and create an appropriate security policy. Part III demonstrates the practical implementations with sample configurations using Cisco equipment. Finally, Part IV is a set of appendixes that lists references for further information on network security and gives additional examples for security contingency plans and steps to mitigate distributed denial-of-service attacks.
Part I, “Security Fundamentals”
The first part of the book is dedicated to explaining the fundamentals of cryptography, some of the more widely deployed security technologies, and how these technologies apply to specific networking scenarios including virtual private networks, wireless networks, and Voice over IP networks.
Chapter 1, “Basic Cryptography,” focuses on cryptography basics; the emphasis is placed on explaining what the differences are between different cryptographic functions and how they are used in practical implementations. The intent is to give enough detail to understand some relative strengths and weaknesses and get the technical realities to combat marketing hype. Many of the mathematical complexities are avoided because they are mainly required for implementers of security products. Interested parties can get the details from the books referenced in Appendix A, which were written by the ultimate crypto experts.
Chapter 2, “Security Technologies,” details emerging security technologies that are widely deployed. This chapter is quite expansive and was the most difficult to represent because it could easily be a book of its own. It is organized in a way that helps you make comparative decisions about which technology is best suited for you when you decide how to implement a given security policy. Many of the technologies overlap because they provide similar solutions to similar problems, and many are stepping stones to the more secure solutions that, in the past, were too complex to implement.
Chapter 3, “Applying Security Technologies to Real Networks,” shows how the technologies discussed in Chapter 3 can be used and applied to secure specific scenarios: virtual private networks, wireless networks, and Voice over IP networks.
Chapter 4, “Routing Protocol Security,” details some commonly used routing protocols and what built-in functionality exists to effectively secure them (at least to the extent possible today). Most of the mechanisms to provide security have been available for years but have not been widely deployed or are not clearly understood (probably leading to the nondeployment issue). The discussion focuses on most of the routing protocols used in deploying IP routing architectures: RIP, EIGRP, OSPF, IS-IS, and BGP.
Part II, “The Corporate Security Policy”
Understanding the vulnerabilities and risks is the most important step in defining a security policy. The second part of the book focuses on how to go about creating a security policy—the practicalities of what you should think about when designing a policy to fit into your particular environment.
Chapter 5, “Threats in an Enterprise Network,” introduces you to the possible threats and common attacks to a network infrastructure.
Chapter 6, “Considerations for a Site Security Policy,” details the considerations for a security policy and describes how to carry out a risk management analysis.
Chapter 7, “Design and Implementation of the Corporate Security Policy,” is dedicated to the design of the security policy after a risk analysis has been completed; it presents guidelines and procedures that a corporation should follow.
Chapter 8, “Incident Handling,” is dedicated to describing how to handle and recover from a security breach.
Part III, “Practical Implementation”
The third part of the book is dedicated to explaining implementation scenarios. Many specific configuration examples are given for Cisco-specific devices. The implementations will vary greatly depending on your established security policy but should be used as guidelines for what features to think about when implementing a given corporate security policy.
Chapter 9, “Securing the Corporate Network Infrastructure,” focuses on security requirements for the internal corporate infrastructure to ensure restricted, confidential access to network infrastructure equipment and network areas.
Chapter 10, “Securing Internet Access,” concentrates on securing Internet access as well as any defined network perimeters.
Chapter 11, “Securing Remote Dial-In Access,” is dedicated to securing the remote access environment where emphasis is placed on dial-in environments.
Chapter 12, “Securing VPN, Wireless, and VoIP Networks,” provides comprehensive design considerations and examples for securing virtual private networks, wireless networks, and Voice over IP networks.
Part IV, “Appendixes”
Appendix A, “Sources of Technical Information,” lists sources of more information. It includes books specifically tailored to cryptography and firewalls, points you to IETF working groups for more detailed information about current work on security technologies, and directs you to information that provides guidance for creating network security policies and incident response teams.
Appendix B, “Reporting and Prevention Guidelines: Industrial Espionage and Network Intrusions,” shows an example of a contingency planning guide for reporting and preventing industrial espionage and network intrusions. It was created by John C. Smith to help organizations develop the ability to prevent proprietary theft and network intrusion and to know how to respond to recover their property and stop further intrusions when they do occur.
Appendix C, “Port Numbers,” is a list of assigned port numbers from the Internet Assigned Numbers Authority (IANA) that specifically relate to the security technologies discussed in Chapter 2.
Appendix D, “Mitigating Distributed Denial-of-Service Attacks,” details the steps that should be taken on network infrastructure routers to cause the least amount of harm in any network due to distributed denial-of-service attacks.
Appendix E, “Answers to Review Questions,” provides answers and explanations to the questions found at the end of each chapter.
Finally, there is a glossary of the most important terms used in this book.
Cisco Systems, Inc. uses a standardized set of icons to represent devices in network topology illustrations. The icon legend that follows shows the most commonly used icons that you might encounter throughout this book.
The conventions used to present command syntax in this book are the same conventions used in the Cisco IOS Software Command Reference. The Command Reference describes these conventions as follows:
Vertical bars (|) separate alternative, mutually exclusive elements.
Square brackets ([ ]) indicate optional elements.
Braces ({ }) indicate a required choice.
Braces within brackets ([{ }]) indicate a required choice within an optional element.
Boldface indicates commands and keywords that are entered exactly as shown.
Italic indicates arguments for which you supply values.