enterprise network security in smb environments
Post on 18-Dec-2021
9 Views
Preview:
TRANSCRIPT
Enterprise network security in SMB environments...
Brian Whelton
QUICK INTRODUCTION!
Oscar the Grouch is from Sesame Street
20 years in the IT, started by cable pulling, terminating, testing then network hardware installation
Whelton Network Solutions specialise in:
• Network design.
• Security.
• Auditing.
• Incident response.
• Vulnerability testing.
• IPv6
Owner and technical director of Whelton Network Solutions since 2004.
Brian Whelton
Passed my first CCNA in 2003, now hold multiple vendor and industry certifications.
Before, during and after…..
▪ No such thing as a standard network topology, no ‘one size fits all’, Cisco has Cisco Validated Designs, Juniper has Juniper Validated Solutions.
▪ Using terms like ‘it’ll work’ or ‘that’ll do’ at a design stage means you will hear ‘we have a workaround for that’ at a support stage.
▪ Business don’t like risk (ask Associated Press!), don’t introduce any unnecessary risk, this means from attackers, users, managers and from administrators!
▪ All suggestions in this presentation should be available on managed ‘small business’ switch ranges from Cisco, HP and Netgear etc. Vendors codes are not created equal, some are better and securer then others!
▪ No traffic on a Local Area Network should be unpredictable, it is under YOUR control.
▪ Not everything will be available to everyone.
Design is everything!
http://www.bbc.co.uk/news/world-us-canada-21508660 Fake tweet from Associated Press crashes stocks
Open Systems Interconnection model
International Organization for Standardization Open Systems Interconnection https://www.iso.org/ics/35.100/x/
Physical
Data-Link
Network
Transport
Session
Presentation
Application
DATA
Bits
Frames
Packets
Segments
DSL, ISDN, Wi-Fi, ‘x’BaseT, Cabling, Hardware
ARP, LLDP, MAC addresses, CDP/EDP, DTP, MPLS, STP, VLANs, VTP, 802.1q
IPv4, IPv6, ICMP, IGMP, GRE, IPSec, EIGRP, OSPF
AH, ESP, BGP, RIP, iSCSI, TCP, UDP
L2TP, PAP, PPTP, SMB, SIP, SOCKS, SSH
SSL, TLS, ASCII
DNS, BitTorrent, BOOTP, FTP, HTTP, HTTPS, SNMP, SMTP, DHCP, FTP, TFTP, NTP
1
2
3
4
5
6
7
Layer One – Physical
▪ ONLY defence against attacks is to prevent them.
▪ Document what you have, you can’t support or defend what you don’t know!
▪ The is no defence against equipment failure, have spares!
▪ Restrict access to network equipment.
▪ Be proactive, remove all unused cables, administratively close unused interfaces.
▪ Use 802.11w Management Frame Protection on Wi-Fi networks.
▪ You can’t prevent or fix stupid.
Attacks to Layer One on a network are primarily aimed at denial of, or disruption to, service.
PhysicalBitsDSL, ISDN, Wi-Fi, ‘x’BaseT,
Cabling, Hardware1
Layer Two – Data Link
▪ Server guys finally get it! – Many benefits to Virtualization.
▪ VLANs - Separate traffic into scalable, identifiable, manageable, securable and logical groups.
▪ VLAN 1 – Never use VLAN 1, if you haven’t configured any VLANs, you’re using VLAN 1.
▪ Trunks – Assign a dedicated native VLAN.
Can you guess what’s coming?
VLAN – Virtual Local Area Network
Data-LinkFramesARP, LLDP, MAC addresses, CDP/EDP, DTP,
MPLS, STP, VLANs, VTP, 802.1q2
Layer Two – Data LinkAttacks to layer two mostly rely on the insecurity of L2 protocols, physical access is not required.
Data-LinkFramesARP, LLDP, MAC addresses, CDP/EDP, DTP,
MPLS, STP, VLANs, VTP, 802.1q2
▪ CAM table protection - Instigate Port Security limiting the number of MAC addresses allowed
on switch interfaces.
▪ Port Security - Set static devices MAC addresses
▪ DHCP protection - Disable user interfaces from sending DHCP responses (DHCP Trust).
▪ Private VLANs/Isolated interfaces – Force communication from Layer 2 to Layer 3.
▪ Spanning Tree Protocol (STP). Configure STP Root, on user interfaces configure BPDU
Guard and on non Root switches, configure BPDU Root Guard.
▪ Link Local Discovery Protocols – Disable LLDP on user facing interfaces.
Layer Three – Network
▪ IP Address Schemas - Avoid using 192.168.0.0 255.255.255.0 if you want to use VPNs!
▪ Implement Access Control Lists – More on this is a bit!
▪ Virtual Private Networks (VPNs). IPSec anything that requires access from outside your
LAN to your LAN.
▪ Routing Notification Protection – EIGRP, OSPF and RIP all can be secured via MD5.
L3 protocols, it’s all about maths! Physical access is not required.
NetworkPacketsIPv4, IPv6, ICMP, IGMP, GRE,
IPSec, EIGRP, OSPF3
Perimeter Protection – External
▪ Anti-spoofing – Deny RFC1918 IP addresses 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
▪ Prevent reconnaissance - Deny ICMP time exceeded, Unreachables and Echo-Reply.
Access rules for ISP/Partner facing devices.
Inbound
Inbound and Outbound
▪ Deny NetBIOS, SMB and RDP - Deny UDP and TCP 135, 137, 138, 139, 445, 3389
▪ Deny Management traffic, SNMP and Syslog - Deny UDP 161,162 and 514.
▪ Deny data exfiltration using FTP, SSH and TFTP - Deny TCP 20, 21, 22, 23 and UDP 69.
Ensure you log any violations so that you can proactively fix any issues.
Perimeter Protection – Internal
▪ Anti-spoofing – Deny VLAN IP address range from entering VLAN.
▪ Prevent reconnaissance - Deny ICMP Echo-Reply from servers to user and wireless VLANs.
Internal access rules, block from any IP source to any IP destination.
Inbound on VLANs
Outbound on user VLANs
▪ Deny FTP, SSH, Telnet and TFTP, and access to iLO/DRACs and network management,
especially if you have BYOD (Bring Your Own Disaster) policy, from user and Wi-Fi VLANs.
▪ Remember the need to know principle! - Only allow what needs to communicate, to
communicate.
▪ Not a one time thing – Access Lists should be reviewed on a periodic basis to ensure that
they are working for you, not against you.
▪ Deny or Permit first – A decision only you can decide! Don’t forget to log violations!
Logical Traffic Flow
Web Server VLAN 100172.16.0.16 255.255.255.0
Database Server VLAN 101192.168.0.2 255.255.255.0
Users VLAN 1010.0.0.53 255.255.255.0
TCP 443
TCP 443
TCP 1433
TCP 1433
Protecting a database server
Further Reading!
▪ Larry Zeltser – How To Suck At Information Security.
https://zeltser.com/media/docs/suck-at-security-cheat-sheet.pdf
▪ Computer Network Defence Ltd Cyber Threat Intelligence Page.
http://www.securitywizardry.com/radar.htm
▪ Jeremy Stretch - Packet Life Cheat Sheets on various topics.
http://packetlife.net/library/cheat-sheets/
▪ SANS Internet Storm Centre
https://isc.sans.edu/
Badger Badge – brianwhelton
This deserves a BADGER BADGE!!!!!!
Badger Badge – Ste Maunder
This deserves a BADGER BADGE!!!!!!
Badger Badge – craig_of_snyde
This deserves a BADGER BADGE!!!!!!
Badger Badge - Andy8633
This deserves a BADGER BADGE!!!!!!
Badger Badge - Samricharduk
This deserves a BADGER BADGE!!!!!!
I know you want another cat picture!
© Lemmy the cat
Thank you for listening!
@brianwhelton
brianwhelton
brianwhelton
brian@whelton.co.uk
Any questions?
top related