Print this page

White Paper

Data Security: Approach, Guidelines, Assessment, and Best Practices.

Executive Summary

Wability is a management business and technology solutions consulting firm, with an extensive track record in Business Advisory & Planning Services, Risk Assessment and Valuation services. Dedicated to middle Market, Wability provides solutions for a wide range of clients within the Financial Services, Pharmaceutical industries as well as the Federal Government and many other state agencies.
Our unique business model and value proposition is what differentiate us from our competitors. We are focused on providing the precise talents and skills and strategic advice needed to accomplish a client’s objective. We are committed to quality in all phases of the project starting with planning, delivery and ending with service. Wability’s prime goal is customer satisfaction.

Section I:

Data Security and Privacy Best Practices

Security begins with an understanding of how the system or network that needs to be secured works. This section breaks down network security by devices, which allows you to focus on single points of configuration. In keeping with this guidance's philosophy, we will use the approach of analyzing potential threats; without these analyses, it's impossible to properly apply security.

The network infrastructure can be broken into the following three layers: access, distribution, and core. These layers contain all of the hardware necessary to control access to and from internal and external resources. Recommendations apply to an Internet or intranet- facing Web zone and therefore might not apply to your internal or corporate network.

The following are the core network components:

• Router

• Firewall

• Switch

I- Router

The router is the outermost security gate. It is responsible for forwarding IP packets to the networks to which it is connected. These packets can be inbound requests from Internet clients to your Web server, request responses, or outgoing requests from internal clients. The router should be used to block unauthorized or undesired traffic between networks. The router itself must also be secured against reconfiguration by using secure administration interfaces and ensuring that it has the latest software patches and updates applied.

II- Firewall

The role of the firewall is to block all unnecessary ports and to allow traffic only from known ports. The firewall must be capable of monitoring incoming requests to prevent known attacks from reaching the Web server. Coupled with intrusion detection, the firewall is a useful tool for preventing attacks and detecting intrusion attempts, or in worst-case scenarios, the source of an attack.

Like the router, the firewall runs on an operating system that must be patched regularly. Its administration interfaces must be secured and unused services must be disabled or removed.

III- Switch

The switch has a minimal role in a secure network environment. Switches are designed to improve network performance to ease administration. For this reason, you can easily configure a switch by sending specially formatted packets to it.

1- Router Consideration- Best Practices

The router is the very first line of defense. It provides packet routing, and it can also be configured to block or filter the forwarding of packet types that are known to be vulnerable or used maliciously, such as ICMP or Simple Network Management Protocol (SNMP).

The configuration categories for the router are:

• Patches and updates

• Protocols

• Administrative access

• Services

• Auditing and logging

• Intrusion detection

Patches and Updates

Subscribe to alert services provided by the manufacturer of your networking hardware so that you can stay current with both security issues and service patches. As vulnerabilities are found—and they inevitably will be found—good vendors make patches available quickly and announce these updates through e-mail or on their Web sites. Always test the updates before implementing them in a production environment.

Protocols

Denial of service attacks often take advantage of protocol-level vulnerabilities, for example, by flooding the network. To counter this type of attack, you should:

• Use ingress and egress filtering.

• Screen ICMP traffic from the internal network.

Use Ingress and Egress Filtering

Spoofed packets are representative of probes, attacks, and a knowledgeable attacker. Incoming packets with an internal address can indicate an intrusion attempt or probe and should be denied entry to the perimeter network. Likewise, set up your router to route outgoing packets only if they have a valid internal IP address. Verifying outgoing packets does not protect you from a denial of service attack, but it does keep such attacks from originating from your network. This type of filtering also enables the originator to be easily traced to its true source since the attacker would have to use a valid and legitimately reachable source address.

Screen ICMP Traffic from the Internal Network

ICMP is a stateless protocol that sits on top of IP and allows host availability information to be verified from one host to another. Commonly used ICMP messages are shown in Table 1.

Table 1 Commonly Used ICMP Messages

Blocking ICMP traffic at the outer perimeter router protects you from attacks such as cascading ping floods. Other ICMP vulnerabilities exist that justify blocking this protocol. While ICMP can be used for troubleshooting, it can also be used for network discovery and mapping. Therefore, control the use of ICMP. If you must enable it, use it in echo–reply mode only.

Prevent TTL Expired Messages with Values of 1 or 0

Trace routing uses TTL values of 1 and 0 to count routing hops between a client and a server. Trace routing is a means to collect network topology information. By blocking packets of this type, you prevent an attacker from learning details about your network from trace routes.

Do Not Receive or Forward Directed Broadcast Traffic

Directed broadcast traffic can be used to enumerate hosts on a network and as a vehicle for a denial of service attack. For example, by blocking specific source addresses, you prevent malicious echo requests from causing cascading ping floods. Source addresses that should be filtered are shown in Table 2.

Table 2 Source Addresses That Should be filtered

Administrative Access

From where will the router be accessed for administration purposes? Decide over which interfaces and ports an administration connection is allowed and from which network or host the administration is to be performed. Restrict access to those specific locations. Do not leave an Internet-facing administration interface available without encryption and countermeasures to prevent hijacking. In addition,

• Disable unused interfaces.

• Apply strong password policies.

• Use static routing.

• Audit Web facing administration interfaces.

Disable Unused Interfaces

Only required interfaces should be enabled on the router. An unused interface is not monitored or controlled, and it is probably not updated. This might expose you to unknown attacks on those interfaces.

Apply Strong Password Policies

Brute force password software can launch more than just dictionary attacks. It can discover common passwords where a letter is replaced by a number. For example, if "p4ssw0rd" is used as a password, it can be cracked. Always use uppercase and lowercase, number, and symbol combinations when creating passwords.

Use Static Routing

Static routing prevents specially formed packets from changing routing tables on your router. An attacker might try to change routes to cause denial of service or to forward requests to a rogue server. By using static routes, an administrative interface must first be compromised to make routing changes.

Audit Web Facing Administration Interfaces

Also determine whether internal access can be configured. When possible, shut down the external administration interface and use internal access methods.

Services

On a deployed router, every open port is associated with a listening service. To reduce the attack surface area, default services that are not required should be shut down. Examples include bootps and Finger, which are rarely required. You should also scan your router to detect which ports are open.

Auditing and Logging

By default, a router logs all deny actions; this default behavior should not be changed. Also secure log files in a central location. Modern routers have an array of logging features that include the ability to set severities based on the data logged. An auditing schedule should be established to routinely inspect logs for signs of intrusion and probing.

Intrusion Detection

With restrictions in place at the router to prevent TCP/IP attacks, the router should be able to identify when an attack is taking place and notify a system administrator of the attack. Attackers learn what your security priorities are and attempt to work around them. Intrusion Detection Systems (IDSs) can show where the perpetrator is attempting attacks.

2- Firewall Considerations – Best Practices

A firewall should exist anywhere you interact with an un-trusted network, especially the Internet. It is also recommended that you separate your Web servers from downstream application and database servers with an internal firewall.

After the router, with its broad filters and gatekeepers, the firewall is the next point of attack. In many (if not most) cases, you do not have administrative access to the upstream router. Many of the filters and ACLs that apply to the router can also be implemented at the firewall.

The configuration categories for the firewall include:

• Patches and updates

• Filters

• Logging and auditing

• Perimeter networks

Patches and Updates

Subscribe to alert services provided by the manufacturer of your firewall and operating system to stay current with both security issues and service patches.

Filters

Filtering published ports on a firewall can be an effective and efficient method of blocking malicious packets and payloads. Filters range from simple packet filters that restrict traffic at the network layer based on source and destination IP addresses and port numbers, to complex application filters that inspect application-specific payloads. A defense in depth approach that uses layered filters is a very effective way to block attacks. There are six common types of firewall filters:

Logging and Auditing

Logging all incoming and outgoing requests—regardless of firewall rules—allows you to detect intrusion attempts or, even worse, successful attacks that were previously undetected. Historically, network administrators sometimes had to analyze audit logs to determine how an attack succeeded. In those cases, administrators were able to apply solutions to the vulnerabilities, learn how they were compromised, and discover other vulnerabilities that existed. Apply the following policies for logging and log auditing:

• Log all traffic that passes through the firewall.

• Maintain healthy log cycling that allows quick data analysis. The more data you have, the
      larger the log file size.

• Make sure the firewall clock is synchronized with the other network hardware.

Perimeter Networks

A firewall should exist anywhere your servers interact with an untrusted network. If your Web servers connect to a back-end network, such as a bank of database servers or corporate network, a screen should exist to isolate the two networks. While the Web zone has the greatest degree of exposure, a compromise in the Web zone should not result in the compromise of downstream networks. By default, the perimeter network should block all outbound connections except those that are expected.

Advantages of a Perimeter Network

• Hosts are not directly exposed to untrusted networks.

• Exposed or published services are the only point of external attack.

• Security rules can be enforced for access between networks.
   

Disadvantages of a Perimeter Network

• Network complexity

• IP address allocation and management

• Requirement that the application architecture accommodate the perimeter network design

3- Switch Considerations – Best Practices

A switch is responsible for forwarding packets directly to a host or network segment, rather than sharing the data with the entire network. Therefore, traffic is not shared between switched segments. This is a preventive measure against packet sniffing between networks. An attacker can circumvent this security by reconfiguring switching rules using easily accessed administrative interfaces, including known account names and passwords and SNMP packets.

The following configuration categories are used to ensure secure switch configuration:

• Patches and updates

• Virtual Local Area Networks (VLANs)

• Insecure defaults

• Services

• Encryption

Patches and Updates

Patches and updates must be tested and installed as soon as they are available.

VLANs

Virtual LANs allow you to separate network segments and apply access control based on security rules. However, a VLAN enhances network performance, but doesn't necessarily provide security. Limit the use of VLANs to the perimeter network (behind the firewall) since many insecure interfaces exist for ease of administration. For more information about VLANs, see the article "Configuring VLANS" on the Cisco Web site.

Insecure Defaults

To make sure that insecure defaults are secured, change all factory default passwords and SNMP community strings to prevent network enumeration or total control of the switch. Also investigate and identify potentially undocumented accounts and change the default names and passwords. These types of accounts are often found on well-known switch types and are well publicized and known by attackers.

Services

Make sure that all unused services are disabled. Also make sure that Trivial File Transfer Protocol (TFTP) is disabled, Internet-facing administration points are removed, and ACLs are configured to limit administrative access.

Encryption

Although it is not traditionally implemented at the switch, data encryption over the wire ensures that sniffed packets are useless in cases where a monitor is placed on the same switched segment or where the switch is compromised, allowing sniffing across segments.

4- Additional Considerations- Best Practices

• Ensure that clocks are synchronized on all network devices. Set the network time and have all sources synchronized to a known, reliable time source.

• Use Terminal Access Controller Access Control System (TACACS) or Remote Authentication Dial-In User Service (RADIUS) authentication for highly secure environments as a means of limiting administrative access to the network.

• Define an IP network that can be easily secured using ACLs at subnets or network boundaries whenever possible.

5- Snapshot of a Secure Network- Best Practices

Table 3 provides a snapshot of the characteristics of a secure network. The security settings are abstracted from industry security experts and real-world applications in secure deployments. You can use the snapshot as a reference point when evaluating your own solution.

Table 3: Snapshot of a Secure Network

Section II:

Wability’s Approach to Data Security Projects

Step I- Initial Risk Assessment

The network is the entry point to your application. It provides the first gatekeepers that control access to the various servers in your environment. For example servers are protected with their own operating system gatekeepers, but it is important not to allow them to be deluged with attacks from the network layer. This module breaks down network security by devices, which allows us to focus on single points of configuration. We will use the approach of analyzing potential threats. Without threat analysis, it is impossible to apply security properly.

Perform Security Risk Self Assessment

Security Risk Self-Assessment tool (RSAT) will be used to obtain information and recommendations about best practices to help enhance security within NPS. This application is designed to help our clients assess weaknesses in their current IT security environment. It will help identify processes, resources, and technologies that are designed to promote good security planning and risk mitigation practices within your organization.

Business Risk Profile

Understanding how the nature of your business affects risk is important in determining where to apply resources in order to help mitigate those risks. Recognizing areas of business risk will help you to optimize allocation of your security budget.

Defense-in-Depth

The "Defense-in-Depth" (DiD) concept refers to the implementation of layered defenses that include technical, organizational, and operational controls. This assessment is based on accepted standards and best practices to help reduce risk in IT environments.

Results and Reports

We will develop a full-length report that describes your company's security posture, based on the findings, and provides industry-recognized best practices and recommendations for achieving those practices.

Areas of Analysis

RSAT Tool is a detailed questionnaire that we will fill out based on your environment. We will processes your responses and evaluate your organization’s security practices in such areas as Infrastructure, Applications, Operations, and People.

The following table lists the areas that are included in this security risk assessment

Checklist

The checklist will be used as a quick evaluation snapshot of the corresponding modules.

Router Considerations

Firewall Considerations

Switch Considerations

 

Check	Description
□	Latest patches and updates are installed.
□	Administrative interfaces are enumerated and secured.
□	Unused administrative interfaces are disabled.
□	Unused services are disabled.
□	Available services are secured.

Step II- Identification of Threats and Countermeasures

The network is the entry point to your application. It provides the first gatekeepers that control access to the various servers in your environment. Servers are protected with their own operating system gatekeepers, but it is important not to allow them to be deluged with attacks from the network layer. It is equally important to ensure that network gatekeepers cannot be replaced or reconfigured by imposters. In a nutshell, network security involves protecting network devices and the data that they forward.

The basic components of a network, which act as the front-line gatekeepers, are the router, the firewall, and the switch. Figure 1 shows these core components.

Figure 1. Network components: router, firewall, and switch

An attacker looks for poorly configured network devices to exploit. Common vulnerabilities include weak default installation settings, wide-open access controls, and un-patched devices. The following are examples of high-level network threats:

1) Information gathering
2) Sniffing
3) Spoofing
4) Session hijacking
5) Denial of service

1) Information Gathering

Information gathering can reveal detailed information about network topology, system configuration, and network devices. An attacker uses this information to mount pointed attacks at the discovered vulnerabilities.

Vulnerabilities

• The inherently insecure nature of the TCP/IP protocol suite

• Configuration information provided by banners

• Exposed services that should be blocked

Attacks

• Using Tracert to detect network topology

• Using Telnet to open ports for banner grabbing

• Using port scans to detect open ports

• Using broadcast requests to enumerate hosts on a subnet

Countermeasures

•  Use generic service banners that do not give away configuration information such as
       software versions or names.

•  Use firewalls to mask services that should not be publicly exposed.

2) Sniffing

Sniffing, also called eavesdropping, is the act of monitoring network traffic for data, such as clear-text passwords or configuration information. With a simple packet sniffer, all plaintext traffic can be read easily. Also, lightweight-hashing algorithms can be cracked and the payload that was thought to be safe can be deciphered.

Vulnerabilities

• Weak physical security

• Lack of encryption when sending sensitive data

• Services that communicate in plain text or weak encryption or hashing

Attacks

The attacker places packet-sniffing tools on the network to capture all traffic.

Countermeasures

• Strong physical security that prevents rogue devices from being placed on the network

• Encrypted credentials and application traffic over the network

3) Spoofing

Spoofing, also called identity obfuscation, is a means to hide one's true identity on the network. A fake source address is used that does not represent the actual packet originator's address. Spoofing can be used to hide the original source of an attack or to work around network access control lists (ACLs) that are in place to limit host access based on source address rules.

Vulnerabilities

• The inherently insecure nature of the TCP/IP protocol suite

• Lack of ingress and egress filtering. Ingress filtering is the filtering of any IP packets with un-trusted source addresses before they have a chance to enter and affect your system or network. Egress filtering is the process of filtering outbound traffic from your network.

Attacks

An attacker can use several tools to modify outgoing packets so that they appear to originate from an alternate network or host.

Countermeasures

You can use ingress and egress filtering on perimeter routers.

4) Session Hijacking

With session hijacking, also known as man in the middle attacks, the attacker uses an application that masquerades as either the client or the server. This results in either the server or the client being tricked into thinking that the upstream host is the legitimate host. However, the upstream host is actually an attacker's host that is manipulating the network so that it appears to be the desired destination. Session hijacking can be used to obtain logon information that can then be used to gain access to a system or to confidential information.

Vulnerabilities

• Weak physical security

• The inherent insecurity of the TCP/IP protocol suite

• Unencrypted communication

Attacks

An attacker can use several tools to combine spoofing, routing changes, and packet manipulation.

Countermeasures

• Session encryption

• Stateful inspection at the firewall

5) Denial of Service

A denial of service attack is the act of denying legitimate users access to a server or services. Network-layer denial of service attacks; usually try to deny service by flooding the network with traffic, which consumes the available bandwidth and resources.

Vulnerabilities

• The inherent insecurity of the TCP/IP protocol suite

• Weak router and switch configuration

• Unencrypted communication

• Service software bugs

Attacks

• Brute force packet floods, such as cascading broadcast attacks

• SYN flood attacks

• Service exploits, such as buffer overflows

Countermeasures

• Filtering broadcast requests

• Filtering Internet Control Message Protocol (ICMP) requests

• Patching and updating of service software

Step III- System Security Diagnostic Reviews

The systems review and testing task compliments the external and internal penetration testing. This testing is important to help gain an understanding of the effectiveness of internal controls in place to protect the client information from unauthorized access. The internal testing involves assessments of the systems that support financial applications, as well as an assessment of the policies, procedures and processes that support the IT operation. During the risk assessment/site survey, we will determine which of the following items are required during the external penetration review.

Database review:

The team will assess the database security controls. The purpose of this review is to gain a representative understanding of the specific DB controls. It will also identify the potential vulnerabilities in the configuration of the databases and compares current security controls with best practices and DISA database STIG. Specifically, the database review addresses the following topics

• User Management && Password Management

• High risk Users && Authentication methods for both the operating system and the
      database

• System Privileges && Object Privileges

• Operating system data file information

• Operating system roles && Profiles Information

• Database roles && Stored procedures

• Triggers && Protocols && Distributed Database Features

• Audit and Log configuration && Backup and Recovery

• Parameter files && Security Monitoring

• Patch and Upgrade management

• Third Party access to the database

Web Server Review:

In this task, the team will assess the web server configurations that support the systems that process all the data. Because end users are directly communicating with web servers, the security surrounding these servers is critical. During this assessment, the team will evaluate the following:

• Files permissions and ownership

• Authentication mechanisms and controls

• Encryption, including SSL

• Services and Application settings

• Actual and Virtual web site permissions and addresses

• Use of session tokens

• Use of Java, Java Scripts, CGI, ASP or Active X

• Use of third party web tools

• Manufacturers specific vulnerabilities

• Database integration

• Logging, Auditing, Monitoring and Alerts

Step IV- External Network Penetration Testing

The approach to conduct the client external network analysis consists of twp phases. The first phase focuses on the access points to the network through Internet connections. The second phase examines access to the network via dial-in telephone line connections such as modems and remote access points. Both phases are performed using our lab in NY.

Prior to beginning of the testing activities, the team will meet with the client management to review the requirements. These requirements will be developed and will detail the conditions under which the testing will occur and delineates reporting for emergences in the event that a weakness with significant operational impact is detected or if an event occurs that threatens production data.

Step V- Internal Network Penetration Testing

There are two different scenarios of Internal Network Penetration testing that can be performed. The first scenario will take place within the client’s Headquarter facilities and the other can be done from any client’s field site.

Approach to Internal Penetration Testing activities:

• Attempting to gain a network access without a valid user account

• Performing detail search and footprint analysis of internal network paths

• Conducting systematic attempts to gain unauthorized access and privileges via internal
      and trusted links by exploiting vulnerabilities and network services.

• Analyze vulnerabilities to exploitation by attempting to map network topology, increase
      level of privileges, obtain access to password files, emails and gain access to other
      network segments or subnets.

• Reviewing client’s incident response actions to authorized access by malicious individuals.