To say that security is important is to state the obvious. With Cisco routers and switches forming the backbone to today’s network infrastructures, it becomes especially important to keep security in mind. Should your backbone be breached, the entire network could be crippled, sensitive information could be eavesdropped on, and data could be corrupted or altered in a way that could have drastic effects on your operations. For this reason, Cisco expects you to have a general understanding of network security, which includes

The goal of security is to keep that which is vulnerable from being exploited. Servers, network devices, operating systems, and applications can all contain vulnerabilities that you may be responsible for protecting against attacks. These vulnerabilities exist because of coding errors and configuration problems. Today’s networks are becoming increasingly complex and more difficult to manage. As networks become more complex, the number of vulnerabilities in a network increases.

A second reason for the rise of threats is the constant challenge of software developers balancing features and ease of use and at the same time providing a secure product. People want software and hardware that contains many features and is easy for them to operate; introducing security into their software often limits the amount of features that can be offered and introduces more configuration steps.

No matter what software or hardware you decide to use in your environment, securing your network is a never-ending task that involves addressing three key goals:

Table 9.1 describes each of these goals and the general ways to mitigate threats against them.

At this point it might appear that all the security problems and solutions are technology related. In reality, this could not be further from the truth. At the end of the day, the problem of security is not with technology, but with the existence and enforcement of security policies. Wherever security measures are lacking, the security policy is either lacking or is not enforced. For example, if you do not have a policy stating that only management-approved software may be installed on a user’s computer, a user may install software that contains malicious code that could have drastic effects on your network. Your security policy should include a high-level overview as to your organization’s stance on security.

A security policy is good at detailing an organization’s overall position on security, but it does not define the specific processes for how threats should be handled. You should have a plan before an attack occurs for how you will mitigate any infrastructure threats.

Attacks against your Cisco infrastructure can fall into one of three categories:

Access Attacks

If a reconnaissance attack is like finding the doors and locks on a house, an access attack is like trying to break the locks and get into a house. Examples of access attacks include

• Password attacks

• Trust exploitation

• Man-in-the-middle

Your routers and switches can—and should—be configured with passwords. If an attacker can crack the password to your router or switch, he or she can subsequently gain access to configurations and change them to either take down your network or redirect all traffic to another computer where the attacker can read, replay, alter, or destroy the data.

Trust exploitation is when an attacker elevates his or her privileges. An example would be a user on your network that has limited access but is able to exploit an application to have administrator access.

Man-in-the-middle (MiTM) attacks involve capturing data in transit and changing it or using that data to launch another attack. This is similar to the packet-capturing reconnaissance attack. For example, in Figure 9.1 a user named Chris is sending an email to Brian, and he is offering him a raise in salary. However, Tami is a malicious hacker who intercepts the email and alters it so that it reads that there is a reduction in salary. If Tami can successfully intercept the email, alter it, and forward it on to Brian while still making it appear as if it came from Chris, she will have successfully carried out a man-in-the-middle attack.

Figure 9.1. Man-in-the-middle (MiTM) attack.

Many of the access attacks may use malicious software, called malware, to exploit a system. Examples of malware include viruses and worms. Although the terms virus and worm are often used interchangeably, there is a difference. A virus is malware that cannot spread to another computer without human assistance. In comparison, a worm does not require human assistance to spread from computer to computer.

There are almost as many countermeasures against access attacks as there are exploits. A good countermeasure that you should always employ to defend against access attacks is to keep your operating system and applications current with the latest vendor patches.

Denial of Service Attacks

A denial of service attack is when a malicious attacker attempts to deny legitimate access to a network, system, or application. A variation of this is a distributed denial of service attack (DDoS) where an attacker will first compromise a number of zombie hosts before launching an attack on a victim host, application, or network (see Figure 9.2). In addition to increasing the severity of the attack by using multiple attacking hosts, it also makes it difficult to trace the attack back to the original attacker because there may be thousands of compromised computers used in the attack.

Figure 9.2. Distributed denial of service (DDoS) attack.

Protecting against DoS and DDoS attacks is similar to protecting against access attacks in that you should always keep your systems up to date with the current patches. A second step to protecting against DoS and DDoS attacks is to configure rate limiting on our Internet facing routers to prevent against traffic floods. (Rate limiting configuration is covered in the Cisco Certified Network Professional track.)

Exam Alert

Be sure to recognize a description of a denial of service attack on the exam. For example, flooding a system with malformed packets in an effort to crash a server is an example of a denial of service attack.

Networks must be able to absorb attacks and remain operational much like a person’s immune system functions when infected with a virus. The rate of increased security threats makes it difficult for information technology professionals to maintain control over their networks. Cisco recognizes the importance of security for your organization’s network infrastructure. Their self-defending network (SDN) initiative integrates security into your network to identify, prevent, and adapt to threats. Cisco SDN solutions include

The Cisco Intruder Prevention System (IPS) listens to all traffic on your network to detect an attack. When an attack is matched against a signature, the IPS can automatically modify firewall and access control lists on your routers to block the attacker. An IPS can be a standalone device or can be integrated into the IOS of a router and into Cisco’s Adaptive Security Appliance.

The Cisco Adaptive Security Appliance (ASA) is the replacement to the Cisco PIX firewall. It not only operates as a firewall but can also support antivirus, IPSec, network admission control, IPS, and virtual private network (VPN) technologies into a single device.

Cisco DDoS Guard protects against distributed denial of service (DDoS) attacks. A DDoS attack is a DoS attack involving many distributed systems (often thousands) that are working in sync to attack a single system or service. Cisco DDoS Guard will detect the presence of a potential DDoS attack and block malicious traffic in real-time while not affecting the flow of legitimate, mission-critical transactions.

The Anomaly Guard and Protector (also called the Cisco Anomaly Guard) works in conjunction with the DDoS Guard. The DDoS Guard matches only known DDoS signatures; it cannot detect new forms of attacks for which there is no signature. The Anomaly Guard uses behavior analysis to maintain a profile for normal traffic and detect any deviations from the normal traffic profile. It can send alerts or interact with the DDoS guard to mitigate the attack.

The Cisco Secure Agent (CSA) is software installed on endpoint systems such as desktop clients, servers, and point-of-sale (POS) systems. It defends against targeted attacks, spyware, rootkits, and day-zero attack (a threat for which no patch has been written). CSA features include a built-in IPS, malicious mobile code protection, OS patch assurance, and audit logs.

Network Admission Control (NAC), formerly called Cisco Clean Access, allows administrators to authenticate, authorize, evaluate, and remediate wired and wireless users prior to allowing the users on the network. It can quarantine and prevent noncompliant end stations from accessing the network until they achieve security policy compliance.

Finally, the security Monitoring, Analysis, and Response System (MARS) provides security monitoring for security devices and host applications. It offers event aggregation, device discovery, compliance reporting, and notifications. Using MARS can greatly assist with analysis and response of threats on your network.

Although no one can claim to secure your network entirely, Cisco has made great strides with its self-defending network solutions to give you peace of mind that your network is guarded and protected against most current and future threats.

With all the attacks occurring today, it may be tough to know where to begin protecting your network. No matter what your level of experience is with Cisco routers, there are a few basic best practices that you should use whenever setting up a new Cisco router. These include the following:

After you have taken these initial steps, you can then decide what additional steps you may need to take to protect your network.