This is the reading the assignment is based off which I am pasting below: While reading online forums and frequently asked questions (FAQs) pertaining to network security, inevitably one of the...

While reading online forums and frequently asked questions (FAQs) pertaining to network security, inevitably one of the questions asked is "Is my network secure'" The typical answer is that one can never be completely certain that all security measures have been taken to protect a network from intruders. While this may be true, there are ways to increase the confidence of network administrators with regards to protecting the data and resources entrusted to them. This paper will present a strategy that, if implemented, will improve confidence that all necessary precautions in establishing a secure network have been taken.

Keywords: information security; secure network; network security; security principles

INTRODUCTION

While reading online forums and frequently asked questions (FAQs) pertaining to network security, inevitably one of the questions asked is, "Is my network secure'" The typical answer is that one can never be completely certain that all security measures have been taken to protect a network from intruders. While this may be true, there are ways to increase the confidence of network administrators with regards to protecting the data and resources entrusted to them.

This paper will present a strategy that, if implemented, will improve confidence that all necessary precautions in establishing a secure network have been taken.

Mark Ciampa, author of several network security textbooks, states: "Although you need many defenses to withstand attacks, you base these defenses on a few fundamental security principles: protecting systems by layering, limiting, diversity, obscurity, and simplicity" ([5]).

The author of this paper devised the acronym SOLID (Simplicity,Obscurity,Layering,Impeding,Diversity) from those principles to be used as an aid in designing, developing, and deploying a security strategy to confidently build a SOLID, secure network. The definition of the term solid includes "of good substantial quality or kind," "thoroughly dependable," "reliable," and "serious in purpose or character" ([18]). A network security administrator strives for a solid, impenetrable network. The acronym SOLID will serve as a model throughout the analysis, development, and implementation of a security plan. When reviewing the security strategies, the SOLID principles may be used in a checklist to determine the degree to which each principle has been applied in the security plan.

FUNDAMENTAL SECURITY PRINCIPLES

Examining the five network security principles individually will illustrate the importance of each. As each principle is explained throughout this article, the reader should strive to recognize strategies that relate directly to the network system being managed.

Simplicity

Simplicity is representative of how easy, or complex, it is to access the network. From the user's perspective, the internal policies and procedures should not be too difficult to manage, thus preventing users from being productive in their daily tasks. In contrast, the network should be complex enough to ward off intruders. Network administrators must find the correct balance (unique to each situation) between blocking unwanted and unwarranted access to the networkandproviding the resources necessary to the authorized users of the network. "There is no such thing as 'complete security' in a usable system. Consequently, it is important to concentrate on reducing risk, but not waste resources trying to eliminate it completely. Such a pragmatic mindset provides a fighting chance to achieve fairly good security while still allowing productivity" ([2]).

Establishing policies is critical to a secure network. One network security white paper on "best practices" states to create usage policy statements that outline users' roles and responsibilities with regard to security: "This document should provide the general user community with an understanding of the security policy, its purpose, guidelines for improving their security practices, and definitions of their security responsibilities. If your company has identified specific actions that could result in punitive or disciplinary actions against an employee, these actions and how to avoid them should be clearly articulated in this document" (Cisco Systems, 2009). Education on the use of the system is extremely vital to the success of policy implementation. Another best practices article on wireless network security supports the same: "... develop institution-wide policies with detailed procedures ..." and "conduct regular security awareness and training sessions for both systems administrators and users" ([16]).

An additional strategy that must be considered when implementing the simplicity principle pertains to default settings of hardware and software. In this case, the simplest thing to do is apply all of the default settings when installing new equipment or operating system and application software upgrades, but this is not necessarily done in the best interest of developing a secure network. Default settings often include password, encryption, and authorization settings that are known by anyone familiar with the same hardware or software. Therefore, though it takes a great deal of effort on the part of the technician to manage the new or improved system, changing many of those default settings will protect the system from hackers ([16]).

The SOLID principle of simplicity requires a security strategy responsive to all system functions. An unrestricted environment may allow faster processing but is not practical when handling confidential data. Hardening an operating system to the extent that the user is frustrated with each task submitted is also not a practical solution. A checks and balances system must be in place to weigh the simplicity and complexity of the network. Security measures should be taken that will not jeopardize user productivity.

Obscurity

WordNet defines obscurity as "the quality of being unclear or abstruse and hard to understand," "not well known," and "the state of being indistinct or indefinite for lack of adequate illumination" ([7]). Obscurity may also be considered the "hidden" aspects of network security. Security by obscurity ... represents one of the truly controversial aspects of security. You will often see mocking references to people whose efforts are dismissed as 'just security by obscurity'" ( [15]). Obscurity is used to lessen a risk or vulnerability by concealing the attack vector, thereby applying a reinforced measure of security to the system.

Examples of obscurity include renaming the administrator account to deter automated attacks and installing honeypots to act as decoys, enticing hackers away from the systems containing critical data. For a wireless network, changing the default Service Set Identifier (SSID) set by the manufacturer is important. The default SSID for Cisco wireless routers is "tsunami," and the default SSID for Linksys wireless routers is "linksys." A complex SSID naming convention should be defined and implemented to avoid easy access by an automated attack or an unauthorized user. The serious hacker may still be able to find a way around these security measures, but it does make the effort more difficult.

Included in obscurity should also be the avoidance of clear patterns of behavior, even to the point of random time settings for synchronizing systems across the network. Consider a communication strategy used by the military in which a continuous signal of spurious transmissions is used to reduce the enemy's detection of a serious communication when it is transmitted. Though spread spectrum techniques do not directly apply to the commercial domain, the implementation of clear behavioral patterns should be avoided.

The implementation of obscurity into the security plan is only one line of defense — nottheline of defense — and is not to be measured but rather used as an early warning sign of exploitation. When such a barrier is breached, a potential and likelihood of a full-scale attack is amplified. This strategy may take some effort, but it is a principle that merits thoughtful consideration and periodic review to preserve the integrity and defense of the network.

Layering

Building layers of defense to protect digital assets is critical. Layering is implemented in the physical security plan as well as policy and administration. "Protecting your proprietary information does not require dozens of specialized solutions or unlimited funds. With an understanding of the overall problem, creating both a strategic and tactical security plan can be a straightforward exercise" ([1]).

Ashley proposes five layers of security to be implemented in any network: Perimeter, Network, Host, Application, and Data. The layered approach requires a technical strategy to ensure implementation at different entries and levels across the network and an organizational strategy requiring participation of all network constituents (i.e., employees at all levels of the organization) ([1]). Table 1 presents the functioning technologies in each of the security levels.

TABLE 1 Security Layers

The physical infrastructure must also be secure. This includes a facility with various and diverse points through which an authorized user will enter. "Physical security should be looked at as a series of concentric perimeters, with each layer more secure than the previous one. What belongs in which circle depends on the value the corporation places on it" ([9]). It also includes employee training. According to a recent CompTIA survey, "companies with 25% or more of their staffs trained on security are 46.3% less likely to suffer a security breach" ([11]). Social engineering is commonly used in attacks; therefore, properly training employees in secure strategies will greatly reduce their vulnerability and reduce the risk of an intrusion.

All aspects of security deployed in Ashley's model, the physical security of the network facilities, and the education provided to the users are forms of layering and are essential to protect the network and the valuable data it houses.

Impeding

Hindering intrusion of unwanted and unwarranted users into and onto the network is essential to maintaining a secure environment. Impeding such attacks involves creating barriers, blocking unauthorized entry, and establishing boundaries for legitimate users by limiting access to network resources. "Limiting access to an application is generally divided into two topics:authentication, which is how an application identifies who you are, andauthorization, which is how an application identifies what you [have] permission to do" (MSDN, 2009). Not every user should have access to everything. Allowing limited access to resources reduces attacks.

In addition, restricting user activity on the network helps to reduce network traffic. Implementing strategies such as reassigning priorities for print jobs or nonbusiness communications will allow relevant jobs to flow through the network without delay. Jobs with lower priority can wait for an opportune time to travel the network. Usually this is handled in seconds, so the end user is not aware of the holdup, but the network congestion and bottlenecks are greatly reduced ([10]).

Impeding can also be applied to open ports on a system. On a desktop system, Windows File Sharing, Windows Messenger, and Windows Plug-n-Play services are open doors that are vulnerable to attacks. Software firewalls can be used to recognize when an application requests to open access to the system. If that request was not made by the user or a recognized application, the firewall can deny the request ([14]). Software firewall settings may, however, be modified by a user, leading to potential vulnerabilities in the effectiveness of that strategy, so additional measures may be necessary.

"Because attackers can observe Media Access Control (MAC) addresses of stations in use on the network, they can adopt those addresses for malicious transmission ... station addresses, not the users themselves, are identified. That is not a strong authentication technique, and it can be compromised by an unauthorized party" ([16]). Kennedy suggests that by barring access to specific MAC addresses (filtered via a firewall), the overall security strategy of the network is improved. Though this technique is fallible since MAC addresses can be spoofed (or fooled) across the network, it is a common strategy found in network security plans.

Numerous vendors have developed tools to restrict access to systems, applications, and other network resources. HP Visual User Environment (VUE) identifies several techniques to limit access to the display, local file system, and system services. These are all handled through command line utilities. Cisco Systems has developed a method to limit the operating systems that can access the network using NAC Appliance. When users connect to the network, they are redirected to predefined login pages, depending on their operating system. Operating systems not configured for network access are denied.

As with layering, consideration must also be given to the physical security of the network. "No amount of firewalls, encryption or access lists can stop a criminal who gets into a server room" ([9]). Intruders who gain physical access to network resources can remove components quickly. In 2004, Bill Farwell, head of digital forensics at Deloitte Touche, admitted that he could remove a hard drive from a computer in less than five minutes. Since that time, mobile and portable devices are even more common, so the intruder needs only seconds to remove the desired equipment from the facility.

Diversity

"Diversity creates a natural firebreak for computers. I have never seen a virus that can infect both Linux and Windows boxes, and only a few can cross between Macs and PCs ... diversity in computer platforms can prevent viruses from taking over" ([12]). Integrating various manufacturers, equipment, and security devices with different operating system platforms is an effective implementation of diversity on the network. Single-vendor solutions can create a weakness and points of failure.

Implementing a variety of access and authentication technologies (e.g., biometrics, barcodes, access keys) aids in strengthening security. "The application of security techniques (e.g., technologies, hardware and software manufacturers, passwords, traffic filters) that are different will ensure that intrusion at one layer will not guarantee further access by the same method" ([8]).

Recognizing that not all network environments have the resources to support numerous types of security hardware or network systems, other strategies can be implemented to apply the diversity principle in the security plan. Diversity can include a change in authentication at various levels within the system. It should also be included in the security plan of the physical facility, as simple as a different key used to access each lock-down device.

If hackers do penetrate one layer of the network, the plan is to keep them from proceeding. Diversity strategies impose such actions, discouraging further access. "The best containment strategy to avoid catastrophic failure is diversification" ([12]).

APPLICATION

Applying the SOLID principles to a security strategy is not always a clear-cut process. Many of the strategies span more than one principle and, depending upon how detailed each strategy or point is defined, may be categorized differently by other network security administrators. However, the following exercise is intended to demonstrate that all SOLID principles have been covered in the security plan.

Purdue University established a list of common best practices pertaining to system security ([20]). Though some of the points are specific to Purdue students/staff and the network supported for them, Table 2 demonstrates how those points can be implemented using the five security principles of the SOLID model.

TABLE 2 Applying SOLID Model to Purdue University's Security Plan

The SOLID security principles can be applied to all types of networks. Andre Muscat, director of engineering at GFI, recommended a list of points to be considered when developing a security plan for a network in which mobile devices are prevalent ([17]). Table 3 shows how those strategies can be implemented using the five security principles of the SOLID model.

TABLE 3 Applying SOLID Model to Security Plan for Mobile Devices

CONCLUSION

The implementation of the five security principles (Simplicity,Obscurity,Layering,Impeding, andDiversity) into any network will improve confidence that all reasonable measures have been taken to protect the network. Frequent review of the security plan is necessary to ensure the efficiency and effectiveness of the plan. The more frequent the application of each of the five principles defined in the SOLID model, the more reliable and solid the security of the system.

ACKNOWLEDGEMENTS

The author acknowledges the assistance of the following: Carolyn Carvalho, assistant professor, Technology, Kent State University; Christine Naylor, assistant professor, Technology, Kent State University; Stephen Oeffner, adjunct faculty, Computer Technology, Kent State University; and Sanjay Anand, chairperson, SOX Institute, GRC Group.

1Ashley, M. (2006). "Layered Network Security 2006: A Best-practices Approach." StillSecure, January. Available fromhttp://www.stillsecure.com

2Avolio, F.M. (2000). "Best Practices in Network Security." Network Computing, March 20. Available fromhttp://www.networkcomputing.com

3Beale, J. (2000). "'Security Through Obscurity.' Ain't What They Think It Is." Bastille Linux Project. Available fromhttp://www.bastille-linux.org

4Chee, R. (2008). "Limiting Operating Systems Allowed Through Cisco NAC Appliance." Network Security, September 21. Available fromhttp://blog.netcraftsmen.net

5Ciampa, M.2005. Security+ guide to network security fundamentals, 2nded. MA: Course Technology

6Cisco Systems (2005, October 4). "Network Security Policy: Best Practices White Paper." Available fromhttp://www.cisco.com

7Princeton (2006). "WordNet: A Lexical Database for the English Language." Princeton University. Available fromhttp://wordnet.princeton.edu

8Edge, I.E. (2008). "Building a SOLID, Secure Network." AITP, Information Executive, June 11. Available fromhttp://www.aitp.org

9Greene, T. (2004). "Let's Get Physical: IT Security Must Include Locked Doors and Premises Protection, Not Just Firewalls." Network World, January 12. Available fromhttp://www.networkworld.com

Hakala, D. (2008). "Eliminate Network Congestion by Limiting User Activity. IT Management, January 3. Available fromhttp://www.itmanagement.com

Higbie, C. (2006). "Why Seven-layer Security Is Crucial for Networks." ComputerWorld, February 1. Available fromhttp://www.computerworld.com.au.ezproxy.snhu.edu

Holtzman, D. (2003). "Diversity Training: When Systems Are Homogenized, Security Suffers." CSO Online, June 1. Available fromhttp://www.csoonline.com

HP (1998, April 7). "HP Visual User Environment User's Guide." Hewlett Packard. Available fromhttp://docs.hp.com

JMU (2009). "Personal Firewalls." Computing Security, April 18. Available fromhttp://www.jmu.edu

Johansson, J.M. and Grimes, R. (2008). "The Great Debate: Security by Obscurity." Microsoft TechNet, June. Available fromhttp://technet.microsoft.com

Kennedy, S. (2003). "Best Practices for Wireless Network Security." Computerworld, November 24. Available fromhttp://www.computerworld.com

MacKinnon, C. (2008). "Off-network security best practices: How SMEs can protect mobile Devices," Processor, May 9http://www.processor.com

Merriam-Webster. 2004. The Merriam-Webster dictionary, MA: Merriam-Webster Inc.

Microsoft. (2008). "Limiting Access to ASP.NET Web Sites." Microsoft Corporation. Available fromhttp://msdn.microsoft.com

SecurePurdue. (2005). "Common Best Practices." Purdue University. Available fromhttp://www.purdue.edu

Yahoo. (2008). "How Do I Make Sure My Wireless Network Is Secure'" Yahoo! Answers (UK and Ireland). Available fromhttp://uk.answers. yahoo.com

~~~~~~~~

By IreneE. Edge

Reported by Author

Irene E. Edge is a tenured, assistant professor of Computer Technology at Kent State University, Ashtabula, Ohio. She holds an A.A.B. in Computer Technology and a B.S.T. and M.T. in Technology from Kent State University. She teaches undergraduate courses primarily in computer hardware and networking, network security, operating systems, and computer programming. She has been teaching full-time for nearly ten years; prior to that, she was network systems manager at the Ashtabula Campus of Kent State University for 17 years.

Copyright of Information Security Journal: A Global Perspective is the property of Taylor & Francis Ltd and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.