IT Arkitektur og Sikkerhed Netværks-, Internet- og applikationssikkerhed.

Præsentationer af emnet: "IT Arkitektur og Sikkerhed Netværks-, Internet- og applikationssikkerhed."— Præsentationens transcript:

1

2 IT Arkitektur og Sikkerhed Netværks-, Internet- og applikationssikkerhed

3 Indhold Authentikering Firewalls Intrusion Detection

4 2. Autorisation (Adgang) 3. Accounting Username: Password: User 0. Identifikation Jeg er: "Username" asteffen 1.Autentifikation Bevise at jeg er "Username" ******** Autentifikation

5 Hvad du ved (password, PIN, shared secret) Username: aznHu4Um Password: asteffen FaceIris/Retina ScanningFingerprintVoice Hvad du har (Token, Smartcard, Certifikat, Scratch List) Hvad du er (Biologisk pattern, f.eks. fingeraftryk) 01 Z4GH 06 IKDX 02 67TS 07 9PL7 03 UR2A 08 NFLB 04 TIQV 09 K91D 05 3Z5P 10 HA85 Typer af Autentificering

6 Fysisk sikkerheds perimeter Direkte autentifikation Password kan blive sniffet Mest til små sites?  Autentifikations mekanisme Adgangs kontrol mekanisme SysAdmin

7 Problem??? Hvad med en klient der forbinder sig til mange systemer?

8 Indirekte Autentifikation Bruges ofte med one-time passwords, F.eks. RSA‘s SecureID Ved hjælp af Extensible Authentication Protocol (EAP) supporterer radius i dag også andre typer (smartcards, biometrical devices, etc.). RADIUS Agent RADIUS Server user: jdoe pw: asdf Brugeren som gerne have adgang til en server eller ressource logon at... eller access denied Access Request Access-Accept or Access-Reject Secured Radius Protocol

9 Eksempler på indirekte autentifikation Remote autentificerings protokoller TACACS+ óg RADIUS Microsoft Windows NT LAN Manager (NTLM) Domain Controllers er autentifikations servere Kerberos En nøgle distributions protokol der også kan lave autentifikation Internet Standard, oprindeligt udviklet på MIT Bliver brugt i Windows 2000 og fremefter med det formål at erstatte NTLM

10 NTLM protokollen Windows NT LAN Manager er en propritær Microsoft standard Meget typisk eksempel på en Challenge-Response protocol. User Alice Server Domain Controller (DC) Domain:Wonderland Username:Alice Password:2Uh7& Alice 51ff1d83 f68ba0537 OK H: Hash function E(x, k): Encryption of x with key k H(2Uh7&) = Key A E(f68ba0537, Key A ) = 51ff1d83 User Alice: Key A Alice, f68ba0537, 51ff1d83 Challenge: f68ba0537 E(f68ba0537, Key A ) = 51ff1d83 Comparison with 51ff1d83 – ok?

11 Kerberos

12 Off-line authentication F.eks. af browser til verifikation af server Check af credentials off-line F.eks. public keys til verifikation af digitale signaturer

13 Biometriske passwords Sammenligner brugers biometriske data med tidligere pattern False Acceptance Rate (FAR) måler sandsynligheden for et falsk match. VIGTIGT!

14 Biometriske passwords Alphanume ric 10k 388 MB Contains the LanManage r hashes of 99.9% of all alphanumer ical passwords. These are passwords made of mixed case letters and numbers (about 80 billion hashes). Because the LanManage r hash cuts passwords into two pieces of 7 characters, passwords of length 1 to 14 can be cracked with this table set. Since the LanManage r hash is also not case sensitive, the 80 billion hashes in this table set corresponds to 12 septillion (or 2 83 ) passwords. Alphanume ric 5k 720 MB Contains the LanManage r hashes of 99.9% of all alphanumer ical passwords. However, because the tables are twice as large, cracking is about four times faster if you have at least 1 GB of RAM. Extended7.5 GB Contains the LanManage r hashes of 96% of all passwords made of up to 14 mixed case letters, numbers and the following 33 special characters: !"#$%&'()* +,-./:; ?@[\ ]^_`{|} ~. There are about 7 trillion hashes in this table set covering 5 octillion (or 2 92 ) passwords. NT8.5 GB You can use this table set to crack the NT hashes on machines where the LanManage r hash has been disabled. The set contains 99.0% of the hashes of the passwords made of the following characters:  up to 6 mixed case letters, numbers and 33 special characters (same as above)  7 mixed- case letters and numbers  8 lower- case letters and numbers There are 7 trillion hashes in this table, correspondi ng to 7 trillion passwords (the NT hash does not suffer from the weaknesses of the LanManage r hash).

15 Rainbow Tables Alphanumeric 10k388 MBContains the LanManager hashes of 99.9% of all alphanumerical passwords. These are passwords made of mixed case letters and numbers (about 80 billion hashes). Because the LanManager hash cuts passwords into two pieces of 7 characters, passwords of length 1 to 14 can be cracked with this table set. Since the LanManager hash is also not case sensitive, the 80 billion hashes in this table set corresponds to 12 septillion (or 2 83 ) passwords. Alphanumeric 5k720 MBContains the LanManager hashes of 99.9% of all alphanumerical passwords. However, because the tables are twice as large, cracking is about four times faster if you have at least 1 GB of RAM. Extended7.5 GBContains the LanManager hashes of 96% of all passwords made of up to 14 mixed case letters, numbers and the following 33 special characters: !"#$%&'()*+,-./:; ?@[\]^_`{|} ~. There are about 7 trillion hashes in this table set covering 5 octillion (or 2 92 ) passwords. NT8.5 GBYou can use this table set to crack the NT hashes on machines where the LanManager hash has been disabled. The set contains 99.0% of the hashes of the passwords made of the following characters:  up to 6 mixed case letters, numbers and 33 special characters (same as above)  7 mixed-case letters and numbers  8 lower-case letters and numbers There are 7 trillion hashes in this table, corresponding to 7 trillion passwords (the NT hash does not suffer from the weaknesses of the LanManager hash).

16 Rainbw Tables Note that all rainbow tables have specific lengths and character sets they work in. Passwords that are too long, or contain a character not in the table's character set, are completely immune to attack from that rainbow table. Unfortunately, Windows servers (2000 and 2003) are particularly vulnerable to rainbow table attack, due to unforgivably weak legacy Lan Manager hashes. Windows Server 2008 have finally killed LM hashes. Windows Vista already removed support for these obsolete hashes on the desktop. Running OphCrack on my Vista box results in this dialog: “All LM hashes are empty. Please use NT hash tables to crack the remaining hashes. “

17 Rainbow Tables + always add some salt to your hash so the resulting hash values are unique. Salting a hash sounds complicated (and vaguely delicious), but it's quite simple. You prefix a unique value to the password before hashing it: hash = md5('deliciously-salty-' + password) If you've salted your password hashes, an attacker can't use a rainbow table attack against you-- the hash results from "password" and "deliciously-salty-password" won't match. Unless your hacker somehow knows that all your hashes are "delicously- salty-" ones. Even then, he or she would have to generate a custom rainbow table specifically for you.

18

19 Forskellige typer firewall’s Packet Filtering Stateful Inspection Application-Layer Internet

20 Sammenhæng med OSI Typiske netværks firewall Applikations firewall

21 Content scanner Typisk ikke ”stand-alone” firewall men i sammenhæng med firewall (ICAP) ”Højere” end application layer Tjekker for data i f.eks. HTTP eller SMTP strøm. Kunne være ting som: Virus scanning Java/ActiveX Ord Downlaod af ulovlige filtyper Screening for P2P, Messaging etc.

22 Firewalls – Ekstra sikkert Internet External Firewall LAN Internal Firewall Screened Subnet

23 Internet LAN Firewall Firewalls – Normal firewall design

24 Trafik, der ikke kommer gennem den Malicious trafik, som kommer på en åben port, og som ikke tjekkes på applikationslaget Malicious krypteret trafik på en lovlig port Angreb efter at et netværk er kompromiteret Trafik, der ser legitim ud Brugere, der kommer til at installere en virus Hvad beskytter en firewall ikke mod?

25 Gode principper ved valg af firewall Minimum to lag firewall Firewall lag bør være af forskellig fabrikat - Cisco, CheckPoint, CyberGuard etc.) Firewall bør være forskellig type - netværks firewall (stateful inspection), applikations firewall (i.e. ikke circuit-level) Ingen direkte sessioner. Alle sessioner til og fra internt netværk termineres/proxies i DMZ Alle udgående sessioner SKAL authentikeres (Kerberos, Certifikat etc.)

26 Gode principper ved valg af firewall Udgående WWW sessioner SKAL content checkes (virus, kode, SSL osv.) Indgående sessioner skal anvende stærk authenikering (certifikat/two-factor) Indgående og udgående sessioner og pakker må ikke være krypterede MEDMINDRE de bliver content scannede centralt Indgående sessioner skal gennem application layer filter (check af datastrøm med applikationsforståelse) Intrusion Detection på DMZ + logging af alt på alle sikkerhedskomponenter til central logkonsoliderings server

27 Hvad er Intrusion Detection? The art of detecting inappropriate, incorrect, or anomalous activity. ID systems that operate on a host to detect malicious activity on that host are called host-based ID systems, and ID systems that operate on network data flows are called network-based ID systems. http://www.sans.org/newlook/resources/IDFAQ/what_is_ID.htm

28 HIDS og NIDS Host Based Intrusion Detection System (HIDS) Er typisk noget software installeret på et system Agent-baseret Monitorerer multiple data sources, f.eks. filsystem, meta- data og logfiler Wrapper-baseret Virker som en slags firewall – forbyder eller accepterer forbindelser eller logon baseret på en policy

29 HIDS og NIDS Network Intrusion Detection System (NIDS) Monitorerer trafik på netværket Reporterer om trafik der ikke ser normal ud Anomaly-baseret Pakkestørrelse, destination, protokoldistribution etc. Kan være svært at lave en god base-line for, hvad “normal” trafik er Signatur-baseret Anvender signatur fra DB Fleste produkter i dag bruger signatur-baserede teknologier

30 Signaturbaserede NIDS Signaturbaserede Prøver at matche header fields, portnumre, indhold Sniffer trafik Fordele Ingen indlæringskurve Virker out-of-the-box for velkendte angreb Snort har ~1900 signaturer Dragon har ~1700 signaturer Ulemper Nye angreb! Falske positive Nemt at overvinde

31 Signaturer T A A S 10 20 6668 IRC:XDCC /5Bxdcc/5Dslt | | | | | | | | | | | | | | | | | SEARCH STRING | | | | | | | EVENT NAME | | | | | | PORT | | | | | | | | COMPARE BYTES | | | | | | | | | DYNAMIC LOG | | | | | BINARY OR STRING | | | | | PROTECTED NETWORKS | | DIRECTION | PROTOCOL

32 NIDS – Styring Korrelation er vigtigt!!! Brug mange sensorer Et enkelt data opsamlingssted Syslog DBMS Tekstfiler

33 NIDS – Hvor??? Indenfor firewall’en Mange gange for meget data, men færre falsk positive Udenfor Viser også ting som alligevel bliver afvist NIDS SKAL kunne klare alt data!!!

34 Intrusion Prevention Skal være in-line Hardware Redundans Er en slags IDS/Firewall hybrid Hogwash

35 Og så… Til gruppe arbejde