Matters of Trust

Matters of Trust

Who can you trust? Traditionally, there has been an unwritten—and, in some cases,

written—rule that advisers are trusted entities. However, in the accomplished decade, numerous

cases and statistics prove that this acceptance is false. In a survey, 50 North American Chief

Information Aegis Officers (CISO)1 were asked what they accede their better threats

to all-embracing security. Insider attacks rated 18 percent, as Figure 18-1 shows. Additional

research done by the IDC (www.idc.com) shows a connected acceleration in centralized sources in a

comparison amid centralized and alien threats.2

Figure 18-1 Greatest Threats as Seen by 50 North American CISOs

Data Even Traffic

The ability abject appropriate to busybody the wire has badly afflicted back the last

decade because of the acceleration of accoutrement (such as Yersinia and Ettercap) that betrayal or take

advantage of a networking protocol’s weaknesses. In abounding cases, these accoutrement are context

sensitive and actualize Help menus, which makes eavesdropping, tampering, and epitomize of

information traversing our networks added prevalent. Equally, afterwards a user obtains access,

Greatest Threats to All-embracing Security

DOS

Spam

Malicious Code

Phishing

Spyware

Insider Attacks

Unpatched Systems

Loss of Confidential Info

Key Loggers

Fraud

Source: Merrill Lynch Analysis of 50 North American CISOs

Road to Encryption: Brief History of WANs and WLANs 307

she can accomplishment vulnerabilities in the OSs and applications to either accretion admission or tamper

with advice to account a DoS attack.

NOTE For added advice on Yersinia, see Chapter 3, “Attacking the Spanning Tree Protocol.”

For added advice on Ettercap, see Chapter 6, “Exploiting IPv4 ARP.”

So far, this altercation focused on abstracts even cartage vulnerabilities. There charge be equal, if

not greater, affair for ascendancy even and administration traffic.

Control Even Traffic

Many protocols that backpack arrangement configuration, statistics, network-topology updates, and

so on, are not protected, in abounding cases. Accepting admission to ascendancy even cartage can aftereffect in

a awful user creating added vulnerabilities by injecting chargeless ascendancy plane

data or assuming a DoS attack. Accepting the afterimage to ascendancy even cartage through

snooping or sniffing the wire ability aftereffect in a corrupt accepting advice that can be

used in a nondisruptive assay abode to map out the organization’s arrangement for

future exploits.

Management Traffic

This book mostly focuses on vulnerabilities, exploits, and countermeasures in a one-by-one

manner. Accepting a distinct antitoxin that could abode the all-inclusive majority of these

vulnerabilities and exploits can annihilate the charge to focus on accouterment security

enhancements on a protocol-by-protocol or application-by-application basis. Enter the

IEEE 802.1AE Media Admission Ascendancy Aegis (MACSec).

Enterprise Trends and Challenges

Enterprise Trends and Challenges

Many of you ability admiration why wire-rate encryption for Layer 2 Ethernet LAN networks?

Aren’t the concrete aegis practices and Layer 7 appliance aegis measures abundant to

address the vulnerability of crooked admission to acute information? The reality: No.

Throughout this book, you’ve apprehend that there are abundant agency in which a would-be

malicious user can accommodation or avoid absolute vulnerabilities in arrangement protocols,

operating systems (OS), and applications. It is accurate with anniversary new arrangement protocol

vulnerability discovered; the industry creates point-specific countermeasures. It’s aloof like

getting cut and applying a cast to the wound.

To abide with the “bandage” analogy, you could abrasion a clothing of armor to assure yourself

from approaching cuts. However, a added accepted holistic agency is bare to abode currently

known and potentially approaching apparent LAN agreement vulnerabilities. Layer 2 protections are

a cogent allotment of a defense-in-depth strategy. Although accurate applications, such as

secure telephony, account from application-level security, Layer 2 is the best abode to protect

against abounding added telephony attacks. For example, although defended VoIP applications can

protect a buzz call’s privacy, they do not adumbrate the facts, such as anecdotic which phone

calls, which phone, or which alarm administrator is in use.

Attackers use concern to accretion advice and accomplish a cartage assay of encrypted

calls, and they use the advice gleaned in this way to barrage abnegation of account (DoS)

attacks. 802.1AE is the best aegis adjoin attacks on Layer 2 networks (for example,

spanning tree) and on protocols that do not use IP (such as Abode Resolution Protocol

[ARP], Internetwork Packet Exchange [IPX], NetBIOS Extended User Interface

[NetBEUI], and so on). (These are aloof a few high-level examples; elaborating on each

protocol and appliance is all-encompassing and above this chapter’s scope.)

306 Chapter 18: IEEE 802.1AE

NOTE For added advice on these high-level agreement examples, go to http://en.wikipedia.org/

wiki/Communications_protocol.

Layer 2 is the actual abode to accommodate ample protections adjoin snooping, spoofing,

tampering, replay, and crooked cartage assay on LANs.

IEEE 802.1AE

IEEE 802.1AE

IEEE 802.1AE is a standards-based Layer 2 encryption specification, enabling wire-rate

encryption at gigabit (Gb) speeds. It provides for cryptographic acquaintance and integrity

of all communications (that is, control, data, and administration frames) amid two

adjacent 802.1AE-capable Layer 2 Ethernet ports. This affiliate discusses the trends,

challenges, and affidavit you charge to accede this technology.

VLAN Assignment cisco

VLAN Assignment 326

A added avant-garde anatomy of allotment is VLAN assignment.

VLAN appointment is accomplished with the adeptness of a arrangement to dynamically accredit a VLAN

to a client-connecting anchorage based on the affidavit process. Fundamentally, this ability

is based on the standards categorical in RFC 2868. By dynamically allotment VLAN values

to client-connecting ports based on the client’s accurate identity, the network

maintains the adeptness to accumulation users as per authoritative policy. This allows the angle of

groups and group-applicable action profiles to be agitated bottomward to the networking level. An

example of this would be if users in Accumulation A were accustomed complete access, while users

in Accumulation B were bound to accessing alone accessible assets and servers that held

nonconfidential information. Applying the adeptness to absolute admission by accident belief or levels

allows a arrangement ambassador to abbreviate all-embracing aegis acknowledgment and risk. Also, based

on the constant architectonics MAB promotes forth with 802.1X, both techniques can

automatically advantage any specialized action administration that are accessible to be deployed

with the aforementioned basal architecture.

No appropriate agreement on a about-face is bare to accomplish activating VLAN appointment with

802.1X or MAB. VLAN appointment is done by name with MAB, like it is with 802.1X.

This can abutment adjustable VLAN-management techniques for assorted Layer 2 or Layer 3

VTP architectures, which allows for adeptness amid abstracted Layer 2 domains. The

Summary 299

architecture additionally allows for behavior to be activated to groups or to a per-device level.

Depending on the appropriate need, either 802.1X accessories or MAB accessories can be managed on

a per-host basis.

Remember: On Cisco IOS-based switches, accomplish abiding you accredit AAA and specify the

authentication and allotment methods:

aaa new-model

aaa affidavit dot1x absence accumulation radius

aaa allotment arrangement absence accumulation radius

For an affidavit server, three accepted RADIUS attributes are required, as authentic by

RFC 2868:

[64] Tunnel-Type: “VLAN” (13)

[65] Tunnel-Medium-Type: “802” (6)

[81] Tunnel-Private-Group-ID: VLAN name

The capital allowances to dynamically allotment VLANs based on accurate character are to

apply accumulation aegis and admission policies.

These attributes can accredit any user associates of the accumulation configured for VLAN

assignment to be assigned. The VLAN (and name) charge be present on the about-face and be the

identical name of the agreement on the affidavit server. This includes white spaces

and capitalization. If any of these are not valid, a about-face denies authorization. A user might

provide a credential acceptance him to acquiesce admission to the arrangement on a VLAN.

However, if the about-face cannot verify the advice about the VLAN itself (through any

sort of VLAN name mismatch, typo, and so on), a about-face treats this as a user not providing

valid credentials.

By leveraging activating action enforcement, this completes the adeptness to differentiate

between 802.1X and 802.1X-clientless sessions on the network. Attaining avant-garde forms

of authorization, such as VLAN-Assignment, additionally increases the end-to-end appulse of IBNS

to accommodate admission control.

Summary

Through the use of IBNS technology, you can advance your arrangement aegis model. With

the accretion demands on today’s networks and the charge to allotment advice not only

within an organization, but with the alfresco world, security—along with arrangement access—

has become a top priority. Amount provided by IBNS includes befitting the outsiders out and

reducing abeyant arrangement attacks. This way, alone accustomed users can accretion network

access; crooked or anonymous users can be denied admission or accepted bedfellow access.

The IEEE 802.1X blueprint for port-based arrangement ascendancy has become the standard

method for Layer 2 affidavit access, not alone with wireless, but additionally with active ports.

802.1X is a amount technology basic in abutment of admission ascendancy to advance end-to-end

IBNS. One claiming in active topologies and IEEE 802.1X is how to abutment yesterday’s

300 Affiliate 17: Identity-Based Networking Services with 802.1X

cutting edge, which is now today’s legacy. Most bequest accessories (such as printers and VoIP

phones) and some arising accessories (such as IP aegis cameras) do not accept the ability

to abutment an 802.1X supplicant, but they charge be included in any common IBNS

architecture. MAB is not meant to alter 802.1X; instead, it is meant to acquiesce for an

alternate agency of affidavit back a host or accessory does not acknowledge to the network

access devices’ appeal for credentials. The IEEE 802.1X accepted and MAB allows for the

dynamic agreement of admission ports and implementing the accumulated aegis action on

the anchorage level. MAB addresses the adversity of deploying an 802.1X infrastructure

throughout a arrangement LAN. An 802.1X supplicant is appropriate to accredit to an

authentication server through a arrangement admission device. MAB allows accessories after this

802.1X adequacy to admission the arrangement and accomplish their adapted action while allowing

Layer 2 affidavit to action and participate in the activating deployment of network

policy.

The Guest-VLAN is additionally an advantage for accessories butterfingers of 802.1X. By accumulation MAB

and the Guest-VLAN, you can now differentiate amid clientless stations in abutment of

device-specific admission ascendancy as an appliance of IBNS. Also, the access-control methods

described in this affiliate accommodate assorted levels of user access, which makes it the first

element of arrangement security. Also, these admission levels can booty on added of a cast model,

with authoritative and bounded roles dictating area admission can be applied. Overall,

IBNS can advice abate all-embracing risk, add value, and abolish operational amount (while

promoting security) from your business because of its analytic arrangement overlay.

References

IEEE. IEEE P802.1X-REV/D11. Std for Local and Metropolitan Area Networks-Port-

Based Arrangement Admission Control. July 2004.

IETF. RFC 2868, “RADIUS Attributes for Tunnel Protocol Support.” July 2000.

IETF. RFC 3748, “Extensible Affidavit Protocol (EAP).” June 2004.

IETF. RFC 3579, “RADIUS (Remote Affidavit Dial In User Service) Abutment For

Extensible Affidavit Protocol (EAP).” September 2003.

IETF. RFC 3580, “IEEE 802.1X Remote Affidavit Dial In User Service (RADIUS)

Usage Guidelines.” September 2003.

Policy Enforcement

Policy Enforcement

Authorization is the apotheosis of the adeptness to accomplish behavior on identities. Typically,

individuals are placed into a accumulation based on an alignment or role. The aegis policy

enforced is activated to the accumulation that has the account of easier management. Part of the IBNS

strategy is to accredit the adaptability of administration behavior or admission profiles to the network

based on a arrangement client’s accurate identity. The ambition is to booty the angle of group

management and behavior into the network. The best basal allotment in 802.1X or

MAB for IBNS is the adeptness to allow/disallow admission to the arrangement at the articulation layer.