Network security architecture is the planning and design of the camp.pdf
Network security architecture is the planning and design of the campus network to reduce security risks in accordance with the institution’s risk analysis and security policies. It focuses on reduc-ing security risks and enforcing policy through the design and con-figuration of firewalls, routers, and other network equipment. Network security is important because it is one of the means to enforce the policies and procedures developed by the institution to protect information. It is often referred to as the “front door” in broader discussions of IT security. To the extent that you can block network access to a computer, you “lock” the door and provide bet-ter protection for that computer and its contents. Traditional network design has focused on creating a secure net-work perimeter around the organization and strategically placing a firewall at the point where the network is connected to the Inter-net. For higher education, this traditional design is problematic; our constituents need access from off campus to a large number of machines and services on campus. In addition, because we have many computers on our campus that we cannot implicitly trust, we also must be concerned about security threats from inside the perimeter protected by a traditional firewall. These design issues require a different approach to network security. Although it is impossible to do justice to the topic of network design in a few pages, there are some best practices that I feel universities should focus on in terms of network design. Step 1: Eliminate Network Components That Still UseShared Ethernet Shared Ethernet switches (or hubs) were developed more than a decade ago to interconnect multiple computers and networks. These hubs retransmit all network traffic to all computers connected to that hub. The security implication is that if one computer has its security compromised it can be used to monitor network traffic com-ing from any other computer that shares the same hub. This could expose passwords and other sensitive information. Today, switched Ethernet, which isolates traffic intended for one computer from the view of others on the same switch, is very inexpensive and, hence, it is worth the cost of replacing older hubs. Step 2: Embrace and Implement the Concept of Defense and Use Multiple Firewalls Within Your Network Commercial and Linux-based firewalls are inexpensive enough that you can deploy these in multiple locations as needed. It is still bene-ficial to have a firewall separating your institutional network from the connection to the Internet. This firewall, called a border firewall, will provide a minimal level of protection for all computers on your net-work. The major benefit of this firewall is that it allows your network and security staff to quickly block external access should a threat arise, such as when the “SQL worm” was launched in January 2003 In addition to the border firewall, consider adding internal firewalls to protect areas that requi.
Related slideshows
More Related Content
Similar to Network security architecture is the planning and design of the camp.pdf
Similar to Network security architecture is the planning and design of the camp.pdf (20)
More from aquazac
More from aquazac (20)
Recently uploaded
Recently uploaded (20)
Network security architecture is the planning and design of the camp.pdf
- 1. Network security architecture is the planning and design of the campus network to reduce security risks in accordance with the institution’s risk analysis and security policies. It focuses on reduc-ing security risks and enforcing policy through the design and con-figuration of firewalls, routers, and other network equipment. Network security is important because it is one of the means to enforce the policies and procedures developed by the institution to protect information. It is often referred to as the “front door” in broader discussions of IT security. To the extent that you can block network access to a computer, you “lock” the door and provide bet-ter protection for that computer and its contents. Traditional network design has focused on creating a secure net-work perimeter around the organization and strategically placing a firewall at the point where the network is connected to the Inter-net. For higher education, this traditional design is problematic; our constituents need access from off campus to a large number of machines and services on campus. In addition, because we have many computers on our campus that we cannot implicitly trust, we also must be concerned about security threats from inside the perimeter protected by a traditional firewall. These design issues require a different approach to network security. Although it is impossible to do justice to the topic of network design in a few pages, there are some best practices that I feel universities should focus on in terms of network design. Step 1: Eliminate Network Components That Still UseShared Ethernet Shared Ethernet switches (or hubs) were developed more than a decade ago to interconnect multiple computers and networks. These hubs retransmit all network traffic to all computers connected to that hub. The security implication is that if one computer has its security compromised it can be used to monitor network traffic com-ing from any other computer that shares the same hub. This could expose passwords and other sensitive information. Today, switched Ethernet, which isolates traffic intended for one computer from the view of others on the same switch, is very inexpensive and, hence, it is worth the cost of replacing older hubs. Step 2: Embrace and Implement the Concept of Defense and Use Multiple Firewalls Within Your Network Commercial and Linux-based firewalls are inexpensive enough that you can deploy these in multiple locations as needed. It is still bene-ficial to have a firewall separating your institutional network from the connection to the Internet. This firewall, called a border firewall, will provide a minimal level of protection for all computers on your net-work. The major benefit of this firewall is that it allows your network and security staff to quickly block external access should a threat arise, such as when the “SQL worm” was launched in January 2003 In addition to the border firewall, consider adding internal firewalls to protect areas that require different levels of
- 2. security. For example, placing a firewall between the network segments containing the computers that oper-ate the institutional business systems allows the institution to pro-vide more restrictive security for those computers. Other areas that firewalls can strengthen include residential networks and research labs. Each firewall can have different access controls, support dif-ferent security policies, and allow for distributed administration— all of which are essential to success in academia Step 3: Implement Intrusion Detection Systems at Key Points Within Your Network to Monitor Threats and Attacks Anintrusion detection system(IDS) looks at the incoming network traffic for patterns that can signify that a person is probing your net-work for vulnerable computers. The IDS can also look at traffic leaving your institution for patterns that might indicate that a com-puter’s security has been compromised. This probing from off cam-pus is usually the first step in attempting to compromise the security of a computer on your network. IDSs historically have produced daily reports showing what security vulnerabilities were being tar-geted the day before. Some vendors are now integrating the IDS with the firewall and renaming these intrusion prevention systems. When a threat is iden-tified, the IDS automatically works with the firewall to adjust the firewall rules to protect the computers on the network. IDS prod-ucts are broadly available through commercial vendors and the open-source community. Step 4: Implement a Virtual Private Network Concentrator for Off-Campus and Wireless Access A virtual private network (VPN) uses special software on each com-puter, called a VPN client, to encrypt network traffic from that computer to a VPN concentrator on the institution’s network. Using a VPN allows a member of your institution to securely con-nect to campus computers from an off-campus computer. The VPN will establish an encrypted connection that allows the off-campus computer to appear as if it were part of your internal campus net-work, thereby granting access to resources that may be blocked by a border firewall Solution Network security architecture is the planning and design of the campus network to reduce security risks in accordance with the institution’s risk analysis and security policies. It focuses on reduc-ing security risks and enforcing policy through the design and con-figuration of firewalls, routers, and other network equipment. Network security is important because it is one of the means to enforce the policies and procedures developed by the institution to protect information. It is often referred to as the “front door” in broader discussions of IT security. To the extent that you can block network access to a
- 3. computer, you “lock” the door and provide bet-ter protection for that computer and its contents. Traditional network design has focused on creating a secure net-work perimeter around the organization and strategically placing a firewall at the point where the network is connected to the Inter-net. For higher education, this traditional design is problematic; our constituents need access from off campus to a large number of machines and services on campus. In addition, because we have many computers on our campus that we cannot implicitly trust, we also must be concerned about security threats from inside the perimeter protected by a traditional firewall. These design issues require a different approach to network security. Although it is impossible to do justice to the topic of network design in a few pages, there are some best practices that I feel universities should focus on in terms of network design. Step 1: Eliminate Network Components That Still UseShared Ethernet Shared Ethernet switches (or hubs) were developed more than a decade ago to interconnect multiple computers and networks. These hubs retransmit all network traffic to all computers connected to that hub. The security implication is that if one computer has its security compromised it can be used to monitor network traffic com-ing from any other computer that shares the same hub. This could expose passwords and other sensitive information. Today, switched Ethernet, which isolates traffic intended for one computer from the view of others on the same switch, is very inexpensive and, hence, it is worth the cost of replacing older hubs. Step 2: Embrace and Implement the Concept of Defense and Use Multiple Firewalls Within Your Network Commercial and Linux-based firewalls are inexpensive enough that you can deploy these in multiple locations as needed. It is still bene-ficial to have a firewall separating your institutional network from the connection to the Internet. This firewall, called a border firewall, will provide a minimal level of protection for all computers on your net-work. The major benefit of this firewall is that it allows your network and security staff to quickly block external access should a threat arise, such as when the “SQL worm” was launched in January 2003 In addition to the border firewall, consider adding internal firewalls to protect areas that require different levels of security. For example, placing a firewall between the network segments containing the computers that oper-ate the institutional business systems allows the institution to pro-vide more restrictive security for those computers. Other areas that firewalls can strengthen include residential networks and research labs. Each firewall can have different access controls, support dif-ferent security policies, and allow for distributed administration— all of which are essential to success in academia Step 3: Implement Intrusion Detection Systems at Key Points Within Your Network to Monitor Threats and Attacks Anintrusion detection system(IDS) looks at the incoming network traffic for patterns that can
- 4. signify that a person is probing your net-work for vulnerable computers. The IDS can also look at traffic leaving your institution for patterns that might indicate that a com-puter’s security has been compromised. This probing from off cam-pus is usually the first step in attempting to compromise the security of a computer on your network. IDSs historically have produced daily reports showing what security vulnerabilities were being tar-geted the day before. Some vendors are now integrating the IDS with the firewall and renaming these intrusion prevention systems. When a threat is iden-tified, the IDS automatically works with the firewall to adjust the firewall rules to protect the computers on the network. IDS prod-ucts are broadly available through commercial vendors and the open-source community. Step 4: Implement a Virtual Private Network Concentrator for Off-Campus and Wireless Access A virtual private network (VPN) uses special software on each com-puter, called a VPN client, to encrypt network traffic from that computer to a VPN concentrator on the institution’s network. Using a VPN allows a member of your institution to securely con-nect to campus computers from an off-campus computer. The VPN will establish an encrypted connection that allows the off-campus computer to appear as if it were part of your internal campus net-work, thereby granting access to resources that may be blocked by a border firewall