Archive for the ‘Network Security’ Category

What is a Virtual Private Server?

Sunday, October 4th, 2009

You may have heard the term Virtual Private Server before– you may even be using one– but do you understand the reason why or the technology behind it?  Here’s what Virtual Private Servers do and why companies are increasingly moving toward adopting them:

First, let’s define a Virtual Private Server (VPS). VPS’s are also referred to on occasion as VDS’s or Virtual Dedicated Servers. It’s a method that’s been used for years on mainframe computers and more recently became popular for smaller, enterprise-driven servers.  It allows a physical server computer to be partitioned, or divided, into multiple servers.  Each of these virtual private servers has the ability to run its own operating system, be independently rebooted as needed, and can run on its own dedicated machine.  The benefits are obvious. If one server goes down, or needs maintenance, the rest can continue to run normally.

Because VPS’s are part of a larger server, they’re ideal for web hosting and dedicated hosting services because users can share software but pay less than they would for a physical dedicated server.  And because each VPS runs its own operating system, customers who are sharing the physical server have superuser-level access to that operating system which would not be possible without the partitioning.

There are drawbacks, however, to use of a VPS.  Certain software has trouble running in a virtualized environment, specifically some anti-virus and firewall software which compromises system security. Another problem is VPS processor time, disk space, and RAM. Because multiple  virtualization clients are typically running on a single

Router Security – Expert Tips

Sunday, September 13th, 2009

SANS is one of the most trusted sources for computer security training.  The SANS (SysAdmin, Audit, Network, Security) Institute was established in 1989 as a cooperative research and education organization and provides training courses, newsletters, and resources for auditors, network administrators, and employees in the area of business network security.

Here are some tips on network security from SANS regarding policies and practices designed to keep your network safe and secure:
Every router must meet the following configuration standards:
1. No local user accounts are configured on the router. Routers must use TACACS+ for all user
authentication.


2. The enable password on the router must be kept in a secure encrypted form. The router must have
the enable password set to the current production router password from the router’s support
organization.


3. Disallow the following:
a. IP directed broadcasts
b. Incoming packets at the router sourced with invalid addresses such as RFC1918 address
c. TCP small services
d. UDP small services
e. All source routing
f. All web services running on router


4. Use corporate standardized SNMP community strings.


5. Access rules are to be added as business needs arise.


6. The router must be included in the corporate enterprise management system with a designated
point of contact.


7. Each router must have the following statement posted in clear view:
“UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED. You must have
explicit permission to access or configure this device. All activities performed on this device may
be logged, and violations of this policy may result in disciplinary action, and may be reported to
law enforcement. There is no right to privacy on this device.”


8. Telnet may never be used across any network to manage a router, unless there is a secure tunnel
protecting the entire communication path. SSH is the preferred management protocol.

By purchasing or leasing a new or used Cisco ASA 5500 AIP Security Services Module-20, you can enhance your network’s security.  A router loaded with security features coupled with best practices from an organization like SANS is ideal for keeping data, software, and hardware free from virus, Trojan horses, botnets, and other high security risks.

Router Security Features Made Easy: What is Data Diddling?

Monday, August 10th, 2009

If you’re not an I.T. wiz, some of the descriptions of the router security features might seem more like a foreign language than anything aimed at helping you decipher which integrated services router is right for your company. We’re here to help you understand the security features of a router by breaking them down for you one at a time. Let’s talk about Data Diddling.

First off, what is it?

Data Diddling is one of the worst types of hacker attacks because it’s not immediately obvious that anything has happened. Unlike ‘data destruction’ where the attack results in data being deleted completely – and sometimes, unfortunately, this data is irreplaceable – data diddling changes the data in your system but doesn’t delete so it still appears to be there the assumption is that the data is correct.

Think of it this way, a hacker breaks into a network and deletes your client database and all the data surrounding your account receivables. Your accounting staff come into work, sit down at their computers, and find that the records have vanished. There’s no way know who owes you how much, which invoices are outstanding, who you’ve sold what to. It’s devastating, but at least you can immediately go into crisis mode and get some I.T. professionals in to help you try to recover the data.

With data diddling, the hacker goes in and keeps all the account receivable records, but changes the amounts that you’re owed. Or changes a few bank account numbers. Or tinkers with some addresses, or credit card numbers you have on file, or whatever else he feels like tinkering with. You don’t immediately know anything has happened. It could be weeks or months before a payment comes in that’s completely different than what you expected and someone actually decides to go into the system and start figuring out the source of the discrepancy.

At first, it might be assumed to be human error, but then it happens again a week later, and then again. Finally, you realize you must’ve been hacked—things are different and wrong – but when? How do you know which records are accurate? How can you roll back to the records that you had before the attack when you don’t even know when the attack occurred?

That’s why data diddling is such a problem and keeping your network secure with a security module is necessary to prevent both data diddling and data destruction attacks.

Networking 101: What is the Difference Between a Router and a Splitter?

Monday, July 13th, 2009

The router and a splitter, for your personal PC, provide the same basic function. They both allow more than one computer on a network to connect to the internet. While a splitter simply splits the connection, a router is slightly more sophisticated in the way it is configured. If two individual computers are connected to the internet with a splitter, they have no more protection than what the individual computers provide. They retain their own IP addresses and interact as individual PCs.

A router works differently. First, it has a firewall designed to protect the computers on its network. Any virus or threat must breach the router’s firewall first before it can get to the individual computers. A router stores the incoming IP, giving different IPs to the computers connected on the network. Your cable modem senses only the router’s IP, that is, it views it as only one IP connected to the internet instead of many.

Where a router can really shine is when it protects a company’s network. For example, the Cisco 3825 integrated services router provides its network superior security features such as: Cisco IOS Firewall support, Intrusion Prevention, encryption, as well as many others. Because businesses that deal with confidential data, consumer credit card information, extensive client lists, the government, and other data that’s highly attractive to hackers or botnets, must secure that data, routers help do exactly that and still allow them to use multiple terminals on the same network– each terminal benefitting from the router’s advanced security features.

Dedicated routers can also log packet information. When data enters the router in the form of a packet, the router decides whether it can pass through, or whether the router should drop it to protect the computers receiving it. Either way, many routers can log what is passed and dropped giving you, or the administrator, the ability to see what kind of data is being sent to your network without having to open a virus-ridden email to discover that a virus attempted an attack.

Obama’s Future Outlook on Cybersecurity and Cisco

Wednesday, June 24th, 2009

On May 29, 2009, President Obama made an announcement regarding the U.S. government’s role in ensuring cybersecurity for the country as a whole, businesses operating within the U.S., and American citizens in the Cyberspace Policy Review:
Assuring a Trusted and Resilient Information
and Communications Infrastructure
. The 76-page document stated,

The globally-interconnected digital information and communications infrastructure known as “cyberspace”underpins almost every facet of modern society and provides critical support for the U.S. economy, civil infrastructure, public safety, and national security. This technology has transformed the global economy and connected people in ways never imagined. Yet, cybersecurity risks pose some of the most serious economic and national security challenges of the 21st Century. The digital infrastructure’s architecture was driven more by considerations of interoperability and efficiency than of security. Consequently, a growing array of state and non-state actors are compromising, stealing, changing, or destroying information and could cause critical disruptions to U.S. systems. At the same time, traditional telecommunications and Internet networks continue to converge, and other infrastructure sectors are adopting the Internet as a primary means of interconnectivity. The United States faces the dual challenge of maintaining an environment that promotes efficiency, innovation, economic prosperity, and free trade while also promoting safety, security, civil liberties, and privacy rights.1 It is the fundamental responsibility of our government to address strategic vulnerabilities in cyberspace and ensure that the United States and the world realize the full potential of the information technology revolution.

But how can you, as a business owner, provide security for both your business’ data as well as keep confidential information about your vendors, customers, and employees private? There are several ways. Among them are: the use of one or more members of the Cisco PIX Security Appliance Series. PIX delivers cost effective, easy to redistribute user and application policy implementation, multi-vector attack protection, and secure connectivity services. Cisco is the leader in security-featured IT networking equipment. The Cisco Self-Defending Network enables IT organizations to protect critical assets, enforce business policies, and rapidly identify and respond to evolving threats while easing the administrative burden of IT making the total cost of ownership of Cisco network devices lower.

Router Security Features Made Easy: What is a Worm?

Saturday, March 7th, 2009

If you’re not an I.T. wiz, some of the descriptions of the router security features might seem more like a foreign language than anything aimed at helping you decipher which integrated services router is right for your company. We’re here to help you understand the security features of a router by breaking them down for you one at a time. Let’s talk about Worms.

First off, what is a Worm?

It’s not the kind you go fishing with, although phishing is another computer contaminant you need to protect your network from. In this case, a worm is a form of Malware that gets its name because of the way it spreads from computer to computer, network to network. Unlike a virus which infects executable software and can only spread when the software is run, a worm transmits itself over a network in an effort to infect all computers on the network. Like a virus, it can carry what is called a payload which performs other actions which are usually malicious and destructive.

Protecting your network against Worms is important if you want to maintain network security. Because a Worm is a standalone contaminant, and doesn’t rely on the user choosing to operate a program before it clones itself, attaches to your contact list, and spreads, Worms tend to spread very quickly. If one computer in a network has a Worm, it is pretty much a given that all the networked PCs have it as well. Worms can launch distributed denial of service (DDoS) attacks and even initiate remote logins to your computer. The best way to protect your network from a Worm is to purchase anti-Worm software from a reliable company. Because these companies constantly test dummy networks to identify Worms and other Malware, and once a protection method is devised, can rush it to you instantly via updates, anti-Worm software significantly reduces the risk of network infection.

Router Security Features Made Easy: What is a Botnet?

Wednesday, February 25th, 2009

If you’re not an I.T. wiz, some of the descriptions of the router security features might seem more like a foreign language than anything aimed at helping you decipher which integrated services router is right for your company. We’re here to help you understand the security features of a router by breaking them down for you one at a time. Let’s talk about Botnets.

First off, what is a Botnet?

A Botnet is a collection of computers that are all infected by “bots.” Considered one of the top security threats to any network, an attack of software robots can morph your healthy network into ‘botnet’ and a botnet can host fraudulent websites, steal data, and participate in Denial of Service attacks that can render an entire network useless—at least to you. Once a botnet is created, the system of hijacked computers can then be controlled by the command of a “botmaster.”

One of the most destructive worms to date is the Storm Worm. Spread by spam, no one is sure how many computers are infected with Storm (it could be anywhere from 1 million to 25 million), but it is one of the largest, most powerful botnets ever. Because it has the power of so many computers behind it, it is believed that Storm has the ability to cripple any Website that exists.

Botnets are capable of exposing their host PCs to a plethora of internet threats like spyware, adware, Denial of Service attacks, and phishing. Because they come in so many forms, to protect your network, you need something that will recognize each of these forms as bad and kick them off the network before they do any harm. A simple firewall won’t cut it. To detect malware and mitigate it, it’s important to install not only anti-malware tools, but a reliable IDS and IPS.

Router Security Features Made Easy: What is a Firewall?

Sunday, February 22nd, 2009

If you’re not an I.T. wiz, some of the descriptions of the router security features might seem more like a foreign language than anything aimed at helping you decipher which integrated services router is right for your company. We’re here to help you understand the security features of a router by breaking them down for you one at a time. Let’s talk about Firewalls.

First off, what is a Firewall?

A firewall is a device that provides basic security for your computer or network. Network-level firewalls are typically built into your router and acts as sort of a gatekeeper for all the packets of data that enter your network from the expansive internet (which can be a dangerous place). The firewall examines each data packet and looks at the data packet’s header. The header must match a list of ‘rules’ that the firewall knows, and if it does, it can pass. If it doesn’t, the firewall stops it. Who sets these rules? The network administrator typically sets the rules for the firewall to follow, but can also set up the opposite—a set of rules that are negative. If the firewall detects that a packet’s header contains something on the firewall’s list of ‘negative rules,’ it will also stop the packet in its tracks.

While in theory, a firewall might be enough of a security system to protect a network, it usually isn’t. Most firewalls do not detect and defuse viruses, worms, and most application-specific attacks. To the firewall, the headers for these ‘bad packets’ appear to be good headers which is why additional security like and IDS, IPS, application-level firewalls, and anti-spyware/anti-virus applications are needed for more reliable network protection.

Think of it like this. Your network is a night club. The firewall is the bouncer who stands at the door letting people come in. Even the biggest, most intimidating bouncer has no way of knowing that the underage boy showing him a fake ID is really underage. To the bouncer who sees the fake ID, the kid looks legit. And so he lets the kid go in, and in turn, the boy is caught drinking and the entire club is shut down—which is exactly what malware like a virus or worm can do to your network. An IDS/IPS combo, and anti-spyware/anti-virus applications along with application-level firewalls take a harder look at the underage kid’s I.D. So once the kid gets past the bouncer, he hands his ID to a hostess who runs it through a scanner. The ID comes up as a fake, the threat is detected, and the kid is then promptly kicked out of the club before ever reaching the bar. These added layers of security are like the ID scanner. They use complex rules when they examine a packet, scrutinizing its content, its source, the ports involved, the destination address, the type of traffic it is, and the applications being called to open it. Only under this advanced scrutiny can hidden attackers like viruses and worms be detected.

Router Security Features Made Easy: What is L2TP?

Monday, February 16th, 2009

If you’re not an I.T. wiz, some of the descriptions of the router security features on our site might seem more like a foreign language than anything aimed at helping you decipher which integrated services router is right for your company. We’re here to help you understand the security features of a router by breaking them down for you one at a time. Let’s talk about L2TP.

What is L2TP?

L2TP stands for ‘Layer Two Tunneling Protocol.’ L2TP is a method that tunneling—which is a way to keep data secure as it’s being transmitted—uses. First, you need to understand what tunneling is. Simply, tunneling is a method of moving data from one place to another. When data is tunneled, it is broken up into smaller packets and then each packet is encrypted with a tunneling encryption before it’s sent to the recipient. The additional layer of encryption and the fact that it’s being sent in small pieces instead of one big chunk, makes tunneling a good way to keep data secure.

L2TP is an even more secure way of sending data. Most agree it is the safest way because it takes the great method of tunneling and makes it even better.

Layer Two Tunneling Protocol was first proposed by Cisco Systems—a leader in the I.T. hardware manufacturing world. L2TP is now industry-standard. It can be used to set up tunnels across intervening networks. Basically, that means that users can remotely run programs – even those dependent on specific network protocols – using L2TP. For example, when a customer online in Boston wants to send her credit card information over the internet to Company X, Company X’s server breaks her credit card information down into packets, sends them through the tunnel, and then once it’s received a heading on each packet routes it to the appropriate place. Once the packets are in the right place (say to only one endpoint like accounts receivable instead of everyone in the company), they are decoded and the customer’s credit card info can now be used to make a purchase.


Router Security Features Made Easy: What is IDS?

Sunday, February 15th, 2009

If you’re not an I.T. wiz, some of the descriptions of the router security features might seem more like a foreign language than anything aimed at helping you decipher which integrated services router is right for your company. We’re here to help you understand the security features of a router by breaking them down for you one at a time. Let’s talk about IDS.

First off, what is IDS?

IDS stands for ‘intrusion detection system’ and is commonly used along with an IPS (intrusion prevention system) for maximum security protection, but doesn’t always have to. Some IDS’s stand alone, but do little to actually protect a network from intrusion. While an IPS is designed to actually shut down a network the moment an intrusion is detected to keep it safe, an IDS acts more as an observer. The IDS is passive. It simply examines packets of data traversing the network and it does so from afar—the IDS is located in a monitoring port. When the IDS sees something that doesn’t meet configured rules, it sets off an alarm. For systems with the IPS also, the IPS then kicks in and either shuts down the network or isolates the malicious traffic.

The problem with an IDS, other than it doesn’t do more than simply detect something bad has entered the network, is that it tends to be pessimistic—and often sees ‘good’ data as ‘bad’ data simply because it doesn’t recognize that the good data is good. That creates an atmosphere were false positives abound and like a car alarm that goes off not only when a thief is breaking in, but also when the wind hits it just right, or the rain, or a tree branch, administrators spend significant time dealing with things that aren’t problematic at all.

There are certainly some pluses to an IDS though. An IDS has the ability to detect more, and different types of attacks, that a simple firewall can’t. An IDS can sense data-driven attacks, host-based attacks, network attacks, unauthorized logins, and malware like worms, Trojan horses, and viruses. The reason they’re more sensitive is that IDS’s employ multiple methods in threat detection all at once.