SlideShare a Scribd company logo

Network Security v1.0 - Module 1.pptx

•Download as PPTX, PDF•
•
S
SamatarHussein

The document provides an overview of network security topics including the current security landscape, network topologies, and objectives. It describes how networks are routinely under attack and reasons it is important to secure networks. It also outlines how different network types like campus area networks, small office/home networks, wide area networks, and data centers need security measures at various layers to protect the network, data, and resources. Physical security for data centers is also highlighted as critical to protect equipment and sensitive data stored in these facilities.

Related slideshows

Wifi Security
Wifi SecurityWifi Security
Wifi Security
 
Network Security ppt
Network Security pptNetwork Security ppt
Network Security ppt
 
Wireless Network security
Wireless Network securityWireless Network security
Wireless Network security
 
1 of 14
Module 1: Securing Networks Networking Security v1.0 (NETSEC)
2 © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Module Objectives Module Title: Securing Networks Module Objective: Explain network security. Topic Title Topic Objective Current State of Affairs Describe the current network security landscape. Network Topology Overview Describe how all types of networks need to be protected.
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1.1 Current State of Affairs 3
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Networks Are Targets Networks are routinely under attack. A quick internet search for network attacks will return many articles about them. Kapersky maintains the interactive Cyberthreat Real-Time Map display of current network attacks. The attack data is submitted from Kapersky network security products that are deployed worldwide. 4
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Reasons for Network Security Network security breaches can disrupt e-commerce, cause the loss of business data, threaten people’s privacy, and compromise the integrity of information. The Cisco Talos Intelligence Group website provides comprehensive security and threat intelligence. The Cisco Product Security Incident Response Team (PSIRT), is responsible for investigating and mitigating potential vulnerabilities in Cisco products. 5
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Vectors of Network Attacks An attack vector is a path by which a threat actor can gain access to a server, host, or network. Attack vectors originate from inside or outside the corporate network. Threat actors may target a network through the internet, to disrupt network operations and create a denial of service (DoS) attack.) 6
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Data Loss Term Definition Email/Social Networking The most common vector for data loss includes instant messaging software and social media sites. For instance, intercepted email or IMs could be captured and confidential information revealed. Unencrypted Devices A stolen corporate laptop typically contains confidential organizational data. If the data is not stored using an encryption algorithm, the thief can retrieve valuable confidential data. Cloud Storage Devices Saving data to the cloud has many potential benefits. However, sensitive data can be lost if access to the cloud is compromised due to weak security settings. Removable Media One risk is that an employee could perform an unauthorized transfer of data to a USB drive. Another risk is that a USB drive containing valuable corporate data could be lost. Hard Copy Sensitive data should be disposed of thoroughly. For example, confidential data should be shredded when no longer required. Otherwise, a thief could retrieve discarded reports and gain valuable information. Improper Access Control Passwords are the first line of defense. Stolen passwords or weak passwords which have been compromised can provide an attacker easy access to data. 7
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Video - Anatomy of an Attack 8
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1.2 Network Topology Overview 9
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Topology Overview Campus Area Networks Term Definition VPN The Cisco ISR is secured. It protects data in motion that is flowing from the CAN to the outside world by establishing Virtual Private Networks (VPNs). VPNs ensure data confidentiality and integrity from authenticated sources. ASA Firewall A Cisco Adaptive Security Appliance (ASA) firewall performs stateful packet filtering to filter return traffic from the outside network into the campus network. IPS A Cisco Intrusion Prevention System (IPS) device continuously monitors incoming and outgoing network traffic for malicious activity. It logs information about the activity and attempts to block and report it. Layer 3 Switches These distribution layer switches are secured and provide secure redundant trunk connections to the Layer 2 switches. Several different security features can be implemented, such as ACLs, DHCP snooping, Dynamic ARP Inspection (DAI), and IP source guard. Layer 2 Switches These access layer switches are secured and connect user-facing ports to the network. Several different security features can be implemented, such as port security, DHCP snooping, and 802.1X user authentication. AAA Server An authentication, authorization, and accounting (AAA) server authenticates users, authorizes what they are allowed to do, and tracks what they are doing. Hosts End points are secured using various features including antivirus and antimalware software, Host Intrusion Protection System features, and 802.1X authentication features. 10
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Topology Overview Small Office and Home Office Networks The figure displays a sample SOHO secured with a consumer-grade wireless router which provides integrated firewall features and secure wireless connections. The Layer 2 Switch is an access layer switch that is hardened with various security measures. It connects user-facing ports that use port security to the SOHO network. Wireless hosts connect to the wireless network using WPA2 data encryption technology. Hosts typically have antivirus and antimalware software installed. Combined, these security measures provide comprehensive defense at different layers of the network. 11
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Topology Overview Wide Area Networks Wide Area Networks (WANs) span a wide geographical area, often over the public internet. Organizations must ensure secure transport for the data in motion as it travels between sites over the public network. Network security professionals must use secure devices on the edge of the network. In the figure, the main site is protected by an Adaptive Security Appliance (ASA), which provides stateful firewall features and establishes secure Virtual Private Network (VPN) tunnels to various destinations. 12
© 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Topology Overview Data Center Networks Data center networks are typically housed in an off-site facility to store sensitive or proprietary data. These sites are connected to corporate sites using VPN technology with ASA devices and integrated data center switches. Because they store such vast quantities of sensitive, business-critical information, physical security is critical to their operation. Physical security not only protects access to the facility but also protects people and equipment. For example, fire alarms, sprinklers, seismically- braced server racks, redundant heating, ventilation, and air conditioning (HVAC), and UPS systems are in place to protect people, equipment, and data. Data center physical security can be divided into two areas: • Outside perimeter security - This can include on-premise security officers, fences, gates, continuous video surveillance, and security breach alarms. • Inside perimeter security - This can include continuous video surveillance, electronic motion detectors, security traps, and biometric access and exit sensors. 13
Network Security v1.0 - Module 1.pptx

More Related Content

Network Security v1.0 - Module 1.pptx

  • 1. Module 1: Securing Networks Networking Security v1.0 (NETSEC)
  • 2. 2 © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Module Objectives Module Title: Securing Networks Module Objective: Explain network security. Topic Title Topic Objective Current State of Affairs Describe the current network security landscape. Network Topology Overview Describe how all types of networks need to be protected.
  • 3. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1.1 Current State of Affairs 3
  • 4. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Networks Are Targets Networks are routinely under attack. A quick internet search for network attacks will return many articles about them. Kapersky maintains the interactive Cyberthreat Real-Time Map display of current network attacks. The attack data is submitted from Kapersky network security products that are deployed worldwide. 4
  • 5. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Reasons for Network Security Network security breaches can disrupt e-commerce, cause the loss of business data, threaten people’s privacy, and compromise the integrity of information. The Cisco Talos Intelligence Group website provides comprehensive security and threat intelligence. The Cisco Product Security Incident Response Team (PSIRT), is responsible for investigating and mitigating potential vulnerabilities in Cisco products. 5
  • 6. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Vectors of Network Attacks An attack vector is a path by which a threat actor can gain access to a server, host, or network. Attack vectors originate from inside or outside the corporate network. Threat actors may target a network through the internet, to disrupt network operations and create a denial of service (DoS) attack.) 6
  • 7. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Data Loss Term Definition Email/Social Networking The most common vector for data loss includes instant messaging software and social media sites. For instance, intercepted email or IMs could be captured and confidential information revealed. Unencrypted Devices A stolen corporate laptop typically contains confidential organizational data. If the data is not stored using an encryption algorithm, the thief can retrieve valuable confidential data. Cloud Storage Devices Saving data to the cloud has many potential benefits. However, sensitive data can be lost if access to the cloud is compromised due to weak security settings. Removable Media One risk is that an employee could perform an unauthorized transfer of data to a USB drive. Another risk is that a USB drive containing valuable corporate data could be lost. Hard Copy Sensitive data should be disposed of thoroughly. For example, confidential data should be shredded when no longer required. Otherwise, a thief could retrieve discarded reports and gain valuable information. Improper Access Control Passwords are the first line of defense. Stolen passwords or weak passwords which have been compromised can provide an attacker easy access to data. 7
  • 8. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Current State of Affairs Video - Anatomy of an Attack 8
  • 9. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1.2 Network Topology Overview 9
  • 10. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Topology Overview Campus Area Networks Term Definition VPN The Cisco ISR is secured. It protects data in motion that is flowing from the CAN to the outside world by establishing Virtual Private Networks (VPNs). VPNs ensure data confidentiality and integrity from authenticated sources. ASA Firewall A Cisco Adaptive Security Appliance (ASA) firewall performs stateful packet filtering to filter return traffic from the outside network into the campus network. IPS A Cisco Intrusion Prevention System (IPS) device continuously monitors incoming and outgoing network traffic for malicious activity. It logs information about the activity and attempts to block and report it. Layer 3 Switches These distribution layer switches are secured and provide secure redundant trunk connections to the Layer 2 switches. Several different security features can be implemented, such as ACLs, DHCP snooping, Dynamic ARP Inspection (DAI), and IP source guard. Layer 2 Switches These access layer switches are secured and connect user-facing ports to the network. Several different security features can be implemented, such as port security, DHCP snooping, and 802.1X user authentication. AAA Server An authentication, authorization, and accounting (AAA) server authenticates users, authorizes what they are allowed to do, and tracks what they are doing. Hosts End points are secured using various features including antivirus and antimalware software, Host Intrusion Protection System features, and 802.1X authentication features. 10
  • 11. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Topology Overview Small Office and Home Office Networks The figure displays a sample SOHO secured with a consumer-grade wireless router which provides integrated firewall features and secure wireless connections. The Layer 2 Switch is an access layer switch that is hardened with various security measures. It connects user-facing ports that use port security to the SOHO network. Wireless hosts connect to the wireless network using WPA2 data encryption technology. Hosts typically have antivirus and antimalware software installed. Combined, these security measures provide comprehensive defense at different layers of the network. 11
  • 12. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Topology Overview Wide Area Networks Wide Area Networks (WANs) span a wide geographical area, often over the public internet. Organizations must ensure secure transport for the data in motion as it travels between sites over the public network. Network security professionals must use secure devices on the edge of the network. In the figure, the main site is protected by an Adaptive Security Appliance (ASA), which provides stateful firewall features and establishes secure Virtual Private Network (VPN) tunnels to various destinations. 12
  • 13. © 2021 Cisco and/or its affiliates. All rights reserved. Cisco Confidential Network Topology Overview Data Center Networks Data center networks are typically housed in an off-site facility to store sensitive or proprietary data. These sites are connected to corporate sites using VPN technology with ASA devices and integrated data center switches. Because they store such vast quantities of sensitive, business-critical information, physical security is critical to their operation. Physical security not only protects access to the facility but also protects people and equipment. For example, fire alarms, sprinklers, seismically- braced server racks, redundant heating, ventilation, and air conditioning (HVAC), and UPS systems are in place to protect people, equipment, and data. Data center physical security can be divided into two areas: • Outside perimeter security - This can include on-premise security officers, fences, gates, continuous video surveillance, and security breach alarms. • Inside perimeter security - This can include continuous video surveillance, electronic motion detectors, security traps, and biometric access and exit sensors. 13