Network Security 2l4o1q

Name: Alireza Yassi TP 025044

{UC2F1201IT,(NC)}

Ehsan Afsharinia TP 026851 {UC2F1201IT,(NC)} Parham Mosavi TP 026486 {UC2F1201IT,(BIS)} Kavita A/P Gnanapregash TP 028201 {UC2F1201IT,(BIS)}

Subject: Network Security (CT037-3.5-2) Project Title: group assignment Date Assigned: 1/9/2012 Date Completed: 24/10/2012

Asia Pacific University of Technology & Innovation (A.P.U)

Contents Marking table ................................................................................................................................................ 3 Gantt chart .................................................................................................................................................... 4 Detailed Work Breakdown Structure ............................................................................................................ 5 Introduction .................................................................................................................................................. 6 Chapters / sections ....................................................................................................................................... 7 Network description ..................................................................................................................................... 8 Device description......................................................................................................................................... 9 Internal router........................................................................................................................................... 9 Demilitarized zone (DMZ) ......................................................................................................................... 9 Recommendations ...................................................................................................................................... 11 Chapter 1................................................................................................................................................. 11 Configuration of the time range ......................................................................................................... 13 Chapter 2................................................................................................................................................. 14 Chapter 3................................................................................................................................................. 16 Email Servers ....................................................................................................................................... 16 Chapter 4................................................................................................................................................. 18 Transmission Control Protocol ............................................................................................................ 18 Chapter 5................................................................................................................................................. 21 Chapter6 ................................................................................................................................................. 24 VLAN.................................................................................................................................................... 24 hip by port ........................................................................................................................... 24 hip by MAC address ............................................................................................................. 25 hip by protocol type ............................................................................................................ 25 hip by IP subnet address ..................................................................................................... 25 VPLS..................................................................................................................................................... 25 Chapter 7................................................................................................................................................. 26 General switch operation.................................................................................................................... 26 VLANs .................................................................................................................................................. 26 Network Attacks.................................................................................................................................. 26 CAM Table Overflow ........................................................................................................................... 26 VLAN Hopping ..................................................................................................................................... 27 Newark Security (CT037-3.5-2)

Page 1

Asia Pacific University of Technology & Innovation (A.P.U)

Spanning tree Protocol Manipulation ................................................................................................. 27 MAC Spoofing Attack .......................................................................................................................... 28 Private VLAN Attacks........................................................................................................................... 28 Proxy attack......................................................................................................................................... 28 DH Starvation .................................................................................................................................. 29 Chapter 8................................................................................................................................................. 30 Chapter 9................................................................................................................................................. 40 Virtual Private Network ...................................................................................................................... 40 VPN Tunneling Protocols..................................................................................................................... 40 Point-to-Point Tunneling Protocol (PPTP) ........................................................................................... 40 Layer Two Tunneling Protocol (L2TP) ................................................................................................. 40 Internet Protocol Security (IPsec) ....................................................................................................... 40 Chapter 10............................................................................................................................................... 42 Chapter 11............................................................................................................................................... 44 .................................................................................................................................................... 44 Secure FTP ........................................................................................................................................... 44 FTPS ..................................................................................................................................................... 44 SFTP ..................................................................................................................................................... 45 Chapter 12............................................................................................................................................... 46 Placement of IDS and IPS .................................................................................................................... 46 Network configurations and configured devices ........................................................................................ 48 Conclusion ................................................................................................................................................... 49 Appendices.................................................................................................................................................. 50 Bibliography ................................................................................................................................................ 51

Newark Security (CT037-3.5-2)

Page 2

Asia Pacific University of Technology & Innovation (A.P.U)

Marking table

1

Alireza Yassi {UC2F1201IT,(NC)}

2

Ehsan Afsharina {UC2F1201IT,(NC)}

3

Parham Mosavi {UC2F1201IT,(BIS)}

4

Kavita A/P Gnanapregash {UC2F1201IT,(BIS)}

Newark Security (CT037-3.5-2)

Grand Total (100)

Presentations (10)

Configurations (10)

Analytical (20)

Diagram/Figures (10)

Research and Investigation (10)

Referencing (10)

Documentation (10)

Names and Intakes

Critical Thinking and Applicability (20)

Individual (60%)

Group (40%)

Page 3

Asia Pacific University of Technology & Innovation (A.P.U)

Gantt chart

Newark Security (CT037-3.5-2)

Page 4

Asia Pacific University of Technology & Innovation (A.P.U)

Detailed Work Breakdown Structure

Name Alireza Yassi Ehsan Afsharinia Parham mosavi Kavita A/P Gnanapreg ash

introduction

chapters

Network System Conclusion configuration Refrences implemantation and device

1/5/10/ 11 6/7/8/9 2/3/4 12

Newark Security (CT037-3.5-2)

Page 5

Asia Pacific University of Technology & Innovation (A.P.U)

Introduction

This assignment is about creating a protected linking between the enterprise offices placed at Malaysia and Singapore separately and to put some configuration on the network devices for instance router and others indeed. The network design is contain of connection among the two companies and this network will wanted to be design in to net software named CISCO Packet Tracer where it is network virtual reality program which permits the s to trial thru network behavior. Wire shark would be used in this project which it is open source packet analyzer software would be used for network troubleshooting as well as analysis. The core aim of this project is to guard the internal router plus demilitarized zone (DMZ) hosts from threats outdoor of enterprise. Team of security experts formed up in order to make and proposes some security answers to protect these devices just for company A. This task also gave a chance to apply on what they have educated in the module to create a complete network linking among the two companies and learn more sincerely on network security and it is present technologies as well.

Newark Security (CT037-3.5-2)

Page 6

Asia Pacific University of Technology & Innovation (A.P.U)

Chapters / sections

No

Chapters Sales workstations, engineering workstations and finance workstations must be able to

1

access the web server at the DMZ over HTTP and HTTPS. Clients should also be able to put and get files via FTP to the same server

2 3 4

5

6 7 8

9

10 11

Engineering and sales workstations must be able to access the Internet over HTTP and HTTPS. No other protocol access is allowed to the Internet. Client workstations must be able to check their e-mail on the e-mail server at the DMZ The web server should be reachable from outside Internet clients over HTTP and HTTPS only The e-mail server should be able to receive e-mail from external hosts over the simple mail transfer protocol (SMTP) No client from sales, engineering and finance department is able to access clients in the other departments Layer two securities is a requirement in the company-A LAN Bastion host works as an application proxy, you are required to install and do the basic configurations for the proxy What is the best solution for the connectivity between company-A in Kuala Lumpur and company-B in Singapore? Analyze five different packets that have been exchanged between the firewall and the router using a network monitoring software The company requires implementing intrusion detection systems (IDS

Newark Security (CT037-3.5-2)

Page 7

Asia Pacific University of Technology & Innovation (A.P.U)

Network description

A group of security expert was given to coming up with security answer for the internal router as well as demilitarized zone (DMZ) hosts. The device’s targeted to be secure from external threats as they play a significant part in the phase of ing and receiving the data and info from one device to another. (Mitchell, 2010) Based on the network graph assumed by company A, it contain of a simple network design where three kinds of client workplaces are linked to the access switch then linked to a distributed switch and then to internal router respectively . Now the router is linked to outer interface of Bastian host and then and there linked to the firewall. The firewall now extends linking to two portions, first is outer interface which is to Internet and the other one which is third interface linked to DMZ which links to 2 servers which are WEB/ FTP as well as email. The internal router is linked to distributed switch and Bastian host in the meantime the DMZ is linked to firewall and e-mail server as well as WEB/FTP server indeed. Now on, we can get that these two devices’ shows main role for the ing among the lower half of the net connection which are among workstations and access switches as well as distributed switch linking to the upper half of network which are to Bastian host and firewall as well as Internet indeed. Now let’s look into aspect on the device’s which we are going to deliver safety on in order for us to comprehend and implement correct security answers. (Mitchell, 2010)

Newark Security (CT037-3.5-2)

Page 8

Asia Pacific University of Technology & Innovation (A.P.U)

Device description Internal router

A router is a hose or node by further than one interface to net. Router functions in a net layer in the OSI layer. In a simple usage, router takings packets sent to one link or interface sets its target IP address and also sends it to target if it is openly reachable, sends it to one more router if the new router can on the packet to other target or falls the packets if no data about target or IP address is available indeed. (Bradley, 2010) A router makes two chief functions which can be packet forwarding and routing which is sharing routing data. Also, it has some elementary functions which are to packet filtering, network address translation (NAT), ing, proxy, link monitoring/statistics gathering protocol translation/tunneling and packet encryption or decryption or virtual private networks (VPN’s). An internal router has the open short path first (OSPF) neighbor relations with interface or platform in the comparable area as well. In other term, internal router has wholly the interfaces established in a single area and it does not link at any other area indeed. (OSPF) has rare kinds of routers then internal router is one of open short path first router. (Bradley, 2010)

Demilitarized zone (DMZ)

The demilitarized zone (DMZ) can be initiate in workstation networks. It is clear as a workstation host or small net inserted as a firewall among official private’s network and outside public net. It limits outsiders from getting straight access to a server which has enterprise information. When a DMZ is generated in a business, it belongs and organized by the organization. It is an inaccessible network that distinct from our corporate LAN or else the internal network as well. The DMZ uses IP address is appropriate to dissimilar network ID. Newark Security (CT037-3.5-2)

Page 9

Asia Pacific University of Technology & Innovation (A.P.U)

Let’s talk about the network allocates internal network as the trusted net and external public net which is the Internet by way of the un-trusted net. Then the DMZ could be taken as the semi-trusted zone but it is not as protected as LAN network but because of the firewall backing behind it, it would be as non-secure as Internet is. The DMZ could also be looked as which is capable to link by both the Internet and the LAN though it is placed among those two networks. (Kizza, 2009) The design can be seen below:

Figure 1(DMZ located among hostile network and internal corporate network ) (Contributor, 2008)

Newark Security (CT037-3.5-2)

Page 10

Asia Pacific University of Technology & Innovation (A.P.U)

Recommendations Chapter 1

In the first chapter requirement is almost talk about client terminals containing of sales and engineering as well as finance requisite to be able entree the web server at the DMZ above the HTTPs as well as HTTP which is the Internet and clients would be capable to put files thru FTP to the unchanged server indeed. It means the entire client terminals requirement to access to the web server in excess of Internet via going through the DMZ indeed. At this time let’s look at the process of demilitarized zone (DMZ) whereby it is essentially a firewall formation for make safe a local area network (LAN). For instance, this network construction of enterprise A which is a local area network indeed. Talking about DMZ configuration, workstations in local area network works behind a firewall linked to public net such as Internet in the meantime few workstations works outside the firewall which is in DMZ as well. The workstations external of the firewall blocks traffic and explores requirements for the local area network where it performances as an extra layer of shield for workstation behind the firewall indeed. The DMZ permits workstations behind the firewall to initiate needs outbound to the DMZ while workstations in the DMZ in turn reply, onward or re-issues needs out the net or else to other public network as what proxy server organize. On the other hand, the local area network firewall stops workstations in the DMZ from starting inbound requirements. (Kizza, 2009) As a security clarification for this project, the security experts recommend on usage of access control list (ACL) which is the best solution for this part. ACL is a technique of observance in check of Internet traffic that efforts to flow over the firewall rapidly. It is repeatedly accomplished via making list identifying the IP address and ports from which allowable traffic can come to network. The device meanings to end any traffic from IP address as well as ports not are appropriate to access control list indeed.

Newark Security (CT037-3.5-2)

Page 11

Asia Pacific University of Technology & Innovation (A.P.U)

The expert’s team recommended on implementing the Cisco ASA 5520 series firewall where it this firewall, the access control lists have extraordinary features where the DMZ server access will be controlled with time based ACL indeed. (Neylon, 2007) In below it is shown the Cisco ASA 5520:

Figure 2(Cisco ASA 5520) (Neylon, 2007)

The preparation can be completed when a specific ACL entry is activated which is a particular access list statement will endure disabled till a particular time range is extended. This explanation is suitable in cases where needs to permit traffic access to sure servers for particular time periods. (Stuvart, 2012) As an instance, let’s look at an instance of when the lets access to a DMZ FTP server thru working hours as shown in figure 3:

Figure 3(lets access to a DMZ FTP server) (Stuvart, 2012)

Newark Security (CT037-3.5-2)

Page 12

Asia Pacific University of Technology & Innovation (A.P.U)

Configuration of the time range

The configuration of time range will be as follow: 1) ASA(config)#time-range name 2) ASA(config-tim-range)#periodic days-of-the-week to [days-of-the-week] time The parameter “days-of-the-week” can take the following values: 1)

Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday

2)

weekdays

3)

daily

4)

weekend

example of the configuration below: ASA(config)# time-range working-hours ASA(config-time-range)# periodic weekdays 9:00 to 17:00 ASA(config)# access-list FTP-ACCESS extended permit t any host 199.1.1.1 eq ftp time-range working-hours ASA(config)# access-group FTP-ACCESS in interface outside ASA(config)# static (DMZ,outside) 199.1.1.1 10.0.0.1 netmask 255.255.255.255 (Cisco, 2012)

Newark Security (CT037-3.5-2)

Page 13

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 2 In second case, the workstations in engineering and sales should be able to access the Internet over HTTP and HTTPS which no other protocol access is allowed to access Internet. This means workstations in sales and engineering have to send access requests to DMZ and then after that to firewall before connecting to the internet. Therefore, the access control list figures out which requests is allowed or denied in the firewall. There are two types of ACLs which are standard ACL and extended ACL. The standard ACL is the oldest form of ACL which is used to control traffic by the comparison of the source address of the IP packets to the addresses configured in the ACL. (Wilson, 2012) The command syntax for standard ACL will be: access-list access-list-number {permit|deny} {host|source source-wildcard|any}

In the meantime, extended ACL compares of the source and destination addresses of the IP packets to the addresses configured in the ACL to control the traffic. The command syntax format of extended ACL’s written below: For IP:

access-list access-list-number [dynamic dynamic-name [timeout minutes]] {deny|permit} protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [log|log-input] [time-range time-range-name]

There are some rules that need to be applied which are permit and deny command with the aim of controlling the traffic flow of the network right after ACL is used in DMZ. Example of permit and deny command is shown below: Standard ACL’s:

interface Ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip access-group 1 in access-list 1 permit 10.1.1.0 0.0.0.255

Extended ACL’s:

interface Ethernet0/1 ip address 172.16.1.2 255.255.255.0

Newark Security (CT037-3.5-2)

Page 14

Asia Pacific University of Technology & Innovation (A.P.U)

ip access-group 101 in access-list 101 deny icmp any 10.1.1.00.0.0.255 echo access-list 101 permit ip any 10.1.1.0 0.0.0.255

When workstations’ clients send their requests to access to Internet both at the same time, ACLs in firewall interface have to ensure and confirm that the IP addresses of both workstations are given access to Internet by firewall. When firewall grants access to requests from both workstations access, (the commands are exactly as same as the configuration rules of ACL) the request will be carried forward to Internet through firewall. ACL will block access to any ports when any other protocols or packets that tries to get through the Internet. The ACL will try to first synchronize the requests from the client before denying if it is different from the requirements of the configurations. The denied request will then be removed or delivered to the next statement condition in ACL. (Wilson, 2012)

Newark Security (CT037-3.5-2)

Page 15

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 3 In the third case workstations in sales, engineering and finance should be able to check their email on the e-mail server at the DMZ. Let’s look at this design:

Figure 4(Design of our company)

The design shows that the client workstations will send requests to email server to check their mail. The requests will have to go through firewall and DMZ to get to email server and the requests will go through the DMZ and firewall to send packets to client workstations.

Email Servers

These facilities are frequently the most overlooked when it move toward to securing a network since it is email that remote and mobile workers want access to the best and it is regularly easier to just send appropriate ports straight to an internal mail server on the trusted network than it is to correctly secure them with a DMZ security zone indeed. When you deliberate the type of info that is kept in an email server, the practice of sending ports should quite correctly be avoided and suitable email front-ends and opposite proxy services Newark Security (CT037-3.5-2)

Page 16

Asia Pacific University of Technology & Innovation (A.P.U)

should be working to confirm that the primary email server is never straightly exposed to external networks indeed. Incoming email must main be directed to an email service exist in the DMZ security zone, handled and scanned for threats as well as SPAM and then and there communicated into the email server residing in the right-hand network. Such as web mail as well as other web based email access is pleasant ever more general these days, the same can be supposed for these sorts of email services indeed. A solid reverse proxy configuration must be executed to confirm that the web based services are never exposed straight to an untrusted network then still permit authenticated workers to simply access the services they want to keep in touch. (McKeag, 2004) The DMZ needs to be secured by applying extended ACL configuration to ensure a secured and protected gateway. There should be certain rules allocated in the firewall so when the client workstations send their requests to check their email, the email server which by now is configured, will allow access and accept the return request from email server back to client’s workstations. There are five steps to configure the email server: 1. Enter the Web server and E-mail server IP address in the firewall interface in order for firewall to allow access when request sent in. 2. Perform the ACL command prompt coding in the firewall interface. 3. Add multiple entries in the ACL since many clients will be checking their e-mails and apply specific protocol which is simple mail transfer protocol (SMTP) protocol to packets which will be sending to client computer and email server. 4. Set the source and destination address of the port. 5. Packet filtration whether to permit or deny on matching with protocol, port, source and destination address of packet which is set. (Byrd, 2009)

Newark Security (CT037-3.5-2)

Page 17

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 4 The fourth case is about the web server reaching from outside Internet clients over HTTP and HTTPS. This means when a connection is established and sends request from web server and go through Internet and it goes to an exact location and brings back the requests. Packets will enter through Internet to go to web server again. We can resolve this case will be by applying the transmission control protocol (T) in the firewall directly.

Transmission Control Protocol

T (Transmission Control Protocol) is a fixed rule (protocol) that would be use along thru the Internet Protocol (IP) to send information in the formula of message units among workstations over the Internet indeed. Despite the fact IP takes care of handling the actual delivery of the information, T takes care of observance track of the separate units of information known as packets that a message is separated into for effectual routing over the Internet indeed. For instance, once an HTML file is sent to the computer from a Web server, the T program layer in that server separate the data’s into one or more packets or maybe amounts the packets and after that forwards them separately to the IP program layer indeed. Though each packet has the same target IP address, it may get routed in a different way over the network. At the client program in your workstation, T reconvenes the separate packets and waits till they have arrived to forward the data to you as a single file indeed. T is recognized as a connection-oriented protocol, which incomes that a linking is proven and keeps upping till such time as the message or maybe messages to be switched via the application programs at each end have been swapped. T is in control for make sure that a message is separated into the packets that IP manages and for reconvening the packets back into the whole message at the other end station indeed. In (OSI) Open Systems Interconnection communication model, T is in layer 4, the Transport Layer. (Rouse, 2006) Newark Security (CT037-3.5-2)

Page 18

Asia Pacific University of Technology & Innovation (A.P.U)

Figure 5(T/IP layer) (Rouse, 2006)

T protocol is the most reliable protocol and there are some mechanisms to prove this selection: 

All the T segments transmits a checksum, which is used by the receiver to detect errors with either the T header or data



T keeps track of bytes received in order to remove identical copies of data that has already been received as it is possible for packets to be duplicated in public switched network



T implements re-transmission structures for data that may be lost or damaged so that there will be guarantee delivery of data. The approach of positive notification by receiver to sender confirms successful receptions of data and negative notification combined with timeout period calls for retransmissions.



T arranges the segments it receives so that it can deliver the byte stream data to an application in ordered form as it is possible for packets to be delivered out of order in packet switched networks.



T sustains different static and dynamic timers on data sent. The T sender waits for the T receiver to respond with an acknowledgement within a certain period of time. If

Newark Security (CT037-3.5-2)

Page 19

Asia Pacific University of Technology & Innovation (A.P.U)

the timer expires before receiving an acknowledgement, the T sender then retransmits the segment. Therefore, the T will be used as the extended list protocol, which will be applied in the firewall. The firewall will be configured by inserting access rules that only allow the packets with T protocol to cooperate with the web server. (Stevens, 1995)

Newark Security (CT037-3.5-2)

Page 20

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 5

Next case is about the e-mail server which needs to receive e-mail from external hosts over the simple mail transfer protocol (SMTP). If the e-mail server wants to receive the e-mail from external host, it needs to go through the firewall and the DMZ and because there are interactions with firewall, NAT need to be introduced. Network Address Translation (NAT) is the method where network equipment, typically a firewall, allocates a public address to a workstation or group of workstations intimate a private network indeed. The chief use of NAT is to boundary the amount of public IP addresses a business or enterprise must use, for mutually economy as well as security determinations. The most usual form of network translation includes an enormous private network using addresses in a secluded range (10.0.0.0 to 10.255.255.255 or 172.16.0.0 to 172.31.255.255 or 192.168.0 0 to 192.168.255.255). The secluded addressing system works well for workstations that only have to ittance resources over the network, like terminals wanting access to file servers as well as printers indeed. Routers over the private network can route traffic among private addresses thru no concern or trouble. On the other hand, to ission resources outside the network similarly the Internet, these workstations need to have a public address in order for replies to their needs to return to them as well. This is where NAT needed. Internet needs that require NAT are quite difficult but happen so quickly that the end hardly recognizes it has happened. A terminal inside a network creates a request to a workstation on the Internet. Routers with the network identify that the demand is not for a resource inside the network, so they drive the request to the firewall indeed. The firewall gets the request from the workstation with the internal IP. It then creates the same demand to the Internet by its own public address, and returns the reply from the Internet resource to the workstation inside the isolated network. From the viewpoint of the resource on the net, it is transfer info to the address of the firewall. From the viewpoint of the terminal, it performs that communication is straight with the site on the net. Once NAT is used in this method, all s inside the isolated network access the Internet have the similar public IP address once they need to use the Internet. That deliver only one public addresses is required for amount of s that need to access the net. (Kessler, 2010) Newark Security (CT037-3.5-2)

Page 21

Asia Pacific University of Technology & Innovation (A.P.U)

Figure 6(Network Address Translation) (Kessler, 2010)

. Lots of modern firewalls are capable to set up the connection among the internal terminal and the Internet resource indeed. They are capable to keep track of the specific details of the connection, same as ports and packet order as well as the IP addresses involved. This is known as keeping track of state of connection. Thus, they are capable to keep track of the session collected of communication among the terminal and the firewall and then the firewall thru the Internet. Once the session finishes, the firewall discards all of the info about the connection indeed. There are other uses for NAT beyond basically permitting terminals thru internal IP addresses to ission the Internet. In enormous networks, certain servers may performance as Web servers and need ission from the Internet. These servers are allocated public IP addresses on the firewall, letting the public to access the servers just over that IP address indeed. But, as an extra layer of security, the firewall performances as the intermediary among the outside world plus the protected internal network as well. Extra rules can be additional; containing which ports can be retrieved at that IP address. By using NAT in this way permits network experts to more competently route internal network traffic to the similar resources, and permit access to additional ports, though limiting access at the firewall. It also permits detailed logging of communications among the network as well as the outside world. Newark Security (CT037-3.5-2)

Page 22

Asia Pacific University of Technology & Innovation (A.P.U)

Moreover, NAT could be used to permit choosy access to the outside of the network, as well. Terminals or other workstations wanting special access outside the network can be allocated particular external IPs using NAT, permitting them to connect with workstations and applications that need an exceptional public IP address. NAT is a very significant phase of firewall security. It keeps the amount of public addresses used within a union, and it permits for severer control of access to resources on in cooperation sides of the firewall. (Malik, 2003)

Newark Security (CT037-3.5-2)

Page 23

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter6 In this chapter of scenario, we are required to design the network in the way that clients from sales, engineering, and finance departments are restricted to access to other departments. In other language this means that all the workstations in these three departments should be disabled to access to other neighbor departments. The solution for this is implementing virtual local area network (VLAN). VLAN

We can say VLAN is simply a special type of broadcast domain which is defined logically on a switch ports instead of traditional physical boundaries. As far as we know if hosts from different broadcast domain wish to communicate, that’s impossible unless, a router gets involved. We should keep in mind that this same holds true about VLANs as well. However, if they wish to communicate to other hosts in the same VLAN if they are attached with to same wire or they are on the same switch there shouldn’t be any problem. This logical concept makes the design of network so flexible for management, bandwidth allocation and resource optimization. (DiNicolo, 2003) VLANs hips could be considered as four different types which are listed below:

hip by port

Here the ports of switch would be defined in the way that which port belongs to which VLAN. Then any workstation is connected to that particular port would be automatically assigned to that VLAN. One of the disadvantages of this method is, if a particular ’s station moves from one place to another and connects his/her pc to another port, the switch needs to be reconfigured. This method operation is on physical layer of OSI model. (Cisco, 2012)

Newark Security (CT037-3.5-2)

Page 24

Asia Pacific University of Technology & Innovation (A.P.U)

hip by MAC address

In this method the hip of the VLAN is based on workstations MAC addresses. A switch in this method would be configured to assign a VLAN to each workstation. When a workstation moves to another place the VLAN association based on MAC address could be automatically discovered by switch. This method works on layer 2 of OSI model. (Cisco, 2012) hip by protocol type

A layer two header contains a field which clarifies the protocol type. This information could be used to decide on the VLAN association. For example all IP traffic might be considered as VLAN 1 and all IPX traffic as VLAN2. (Cisco, 2012) hip by IP subnet address

This type of VLAN association works based on layer 3 headers which contain IP address. In this method we can specify that a range of IP belongs to one VLAN and another range should associate another VLAN. We should keep in mind that a VLAN switch does not do any routing based on IP addresses. (Cisco, 2012) VPLS

There is another technique which is Virtual Private LAN Services (VPLS). “VPLS is a class of VPN that s the connection of multiple sites in a single bridged domain over a managed IP/MPLS network”. (Cisco, 2012) An Ethernet interface is presented to customer in this method to simplify the LAN/WAN boundary. In this technology the service bandwidth is not tied to the physical interface. Hence, this would enable a rapid and flexible service provisioning for service providers and customers. All services in VPLs appear to be on the same LAN, regardless of location. (Cisco, 2012)

Newark Security (CT037-3.5-2)

Page 25

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 7 In this chapter we talk about layer 2 securities which are required to be implemented in a company’s local area network.

General switch operation

Unlike hubs, switches have the ability learn their ports. Therefore, network traffic would be reduced and packets are not broadcasted in the network. All data frames are sent by end systems and in the meantime switch learns their source and destination addresses. Switch stores the addresses in its lookup table in order to be able to track them later. If the destination address of the packet does not exist in the look up table of the switch, the switch would either broadcast or multicast the address which means the frame would be forwarded out all the ports. As far as the switches have the ability to isolate traffic they could be used to divide a physical network into multiple logical networks or virtual LANs through the use of layer two traffic segmentation. (Dubrawsky, 2010) VLANs

The company has preferred to apply VLAN technology to divided network segmentations. This technology makes the able to divide a physical network into a set of logical networks. In VLAN all the packets would be tagged with an identification header and these packets are restricted to be received just by those are parts of the VLAN. IEEE 802.1q tag and Cisco ISL tag are two most prevalent VLAN tagging techniques. (Dubrawsky, 2010) Network Attacks CAM Table Overflow

In a switch, CAM table contains information such as hosts MAC addresses as well as the associated VLAN parameters. It goes without saying that the memory allocated to this table is Newark Security (CT037-3.5-2)

Page 26

Asia Pacific University of Technology & Innovation (A.P.U)

limited. We already mentioned in pervious chapter if one host wish to communicate to another host, switch would explore this table and if the host address associated by any ports switch will send the request to there. Otherwise, the packet would be broadcasted in the network and switch waits for respond. Then the responder address will be added to this table for later requests. In 1999 for the first time, a tool was written which floods a switch with packets containing randomly generated source and destination IP and MAC addresses. When a switch receives these packets starts forwarding them to all its ports. Therefore, in a short period of time CAM table in the switch gets full and the switch is not able to accept any new entries. The CAM table overflow attack could be alleviated by configuring port security on the switch. This option could provide a specification of the number of MAC address could be learned by a switch port. (Dubrawsky, 2010) VLAN Hopping

In this kind of attack the end system sends packets defined for host which is on a different VLAN and could not be normally reached. This attack appears in two forms. On the first form the network attacker configure a system too spoof itself as a switch which makes the attacker able to be appear to be a switch with a trunk port and attacking system becomes a member of all VLANs. Another version of this network attack involves tagging and forwards the frame to wrong VLAN. Mitigating VLAN Hopping attacks require several configurations to the VLAN. One of the most important elements is to use dedicates VLAN IDs for all trunk ports as well as disabling all unused switch ports. (Dubrawsky, 2010) Spanning tree Protocol Manipulation

Another attack against switches involves intercepting traffic by attacking the spamming tree protocol. In an Ethernet network technology this protocol is used to prevent the creation of loops. By attacking this protocol the attacker wishes to spoof his/her system as the root bridge in the system. As a solution we use the root guard and the BPDU guard enhancement commands to enforce the placement of the root bridge in the network as well as enforce the domain borders related to spamming tree protocol. (Dubrawsky, 2010) Newark Security (CT037-3.5-2)

Page 27

Asia Pacific University of Technology & Innovation (A.P.U)

MAC Spoofing Attack

In this kind of attack a known MAC address of another host would be used by the attacker to make the target switch forward frames destined for the remote host to the network attacker. In this mechanism the attacker sends a single frame with the other host’s source Ethernet address and overwrites the CAM table entry so later the switch forwards the packets destined for the host to the attacker. One solution to this problem is using private VLANs to help mitigate such an attack. Use of DH snooping along with dynamic ARP inspection could be considered as another solution to such an attack. (Dubrawsky, 2010) Private VLAN Attacks

As far as we know, VLANs are a very common mechanism to restrict communication between systems on the same logical IP subnet. However, they are not a full-proof mechanism. One network attacker who has the ability to by network security of private VALNs would be able to by access restriction by the using of a proxy. (Dubrawsky, 2010) Proxy attack

In this kind of attack frames are forwarded to a host on the network connected to a port which is involved a wide range of different ports such as a router. The network attacker will send a packet with the source address of its own device and destination IP address of the target system, but a destination MAC address of the router. Therefore, the switch forwards the packet to the router’s switch port. The traffic would be routed by the router and the router rewrite the destination MAC address as that of the target, and sends back the packet. Now the packet got the proper format and is forwarded to the target system. As a solution access control lists on the router could be configured to mitigate private VLANs attacks. Virtual access control lists could also be used to help migrate the effects of private VLANs attacks. (Dubrawsky, 2010)

Newark Security (CT037-3.5-2)

Page 28

Asia Pacific University of Technology & Innovation (A.P.U)

DH Starvation

This attack works by broadcasting DH requests with spoofed MAC addresses. With sending too many requests the network attacker would become able to exhaust the address space available to the DH servers for a period of time and as a result the DH would not be able to respond to requests. In the meantime the attacker can setup a DH server on his/her system to answer DH requests in the network. In order to prevent such an attack we use the techniques that mitigate DH starvation by limiting the numbers of MAC addresses on a switch port. (Dubrawsky, 2010)

Newark Security (CT037-3.5-2)

Page 29

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 8 In this case, Bastian host works as an application proxy. Installation and performing basic configurations for the proxy server is required. We decided to configure Microsoft Internet Security and Acceleration (ISA) server. This operation is performed by first installing in Windows Server 2003 in the virtual machine; the Windows Server 2003 will be installed inside Oracle Virtual Box. The installation steps are shown below: (Grote, 2006) Step1:

Figure 7(ISA server 2006) (Grote, 2006)

Step2:

Figure 8(ISA server 2006) (Grote, 2006)

Step3:

Figure 9(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 30

Asia Pacific University of Technology & Innovation (A.P.U)

Step4:

Figure 10(ISA server 2006) (Grote, 2006)

Step5:

Figure 11(ISA server 2006) (Grote, 2006)

Step6:

Figure 12(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 31

Asia Pacific University of Technology & Innovation (A.P.U)

Step7:

Figure 13(ISA server 2006) (Grote, 2006)

Step8:

Figure 14(ISA server 2006) (Grote, 2006)

Step9: In this step we need to keep in mind that the network interface which is connected to the internal network (LAN) should be chosen.

Figure 15(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 32

Asia Pacific University of Technology & Innovation (A.P.U)

Step10:

Figure 16(ISA server 2006) (Grote, 2006)

Step11:

Figure 17(ISA server 2006) (Grote, 2006)

Step12:

Figure 18(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 33

Asia Pacific University of Technology & Innovation (A.P.U)

Step13:

Figure 19(ISA server 2006) (Grote, 2006)

One we are done by installing our ISA server, we need to configure this server by creating appropriate access rule. This scenario requires an appropriate access rule for bastion hosts access. Step1:

Figure 20(ISA server 2006) (Grote, 2006)

Step 2: creating a new access rule.

Figure 21(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 34

Asia Pacific University of Technology & Innovation (A.P.U)

Step 3: Type of rule specifies here to clarify that the rule should either allow the connection or deny.

Figure 22(ISA server 2006) (Grote, 2006)

Step 4: In this part we specify the protocols should be covered by this rule.

Figure 23(ISA server 2006) (Grote, 2006)

Figure 24(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 35

Asia Pacific University of Technology & Innovation (A.P.U)

. Figure 25(ISA server 2006) (Grote, 2006)

Step 5: In this step we need to make sure that we choose the right interface which the rule should be applied on.

Figure 26(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 36

Asia Pacific University of Technology & Innovation (A.P.U)

Figure 27(ISA server 2006) (Grote, 2006)

Step 6: Here we can specify this rule applies when the chosen interface wish to communicate with whom.

Figure 28(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 37

Asia Pacific University of Technology & Innovation (A.P.U)

Figure 29(ISA server 2006) (Grote, 2006)

Step 7: In this step we can tell this rule should be applied to which s (we have chosen all s).

Figure 30(ISA server 2006) (Grote, 2006)

Step8:

Figure 31(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 38

Asia Pacific University of Technology & Innovation (A.P.U)

Step 9: We should always keep in mind that after writing a rule we should apply the rule to make it operational.

Figure 32(ISA server 2006) (Grote, 2006)

Step 10:

Figure 33(ISA server 2006) (Grote, 2006)

Newark Security (CT037-3.5-2)

Page 39

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 9 In this chapter our team is required to come up with a solution which provides a connection between company A and company B. In this scenario these two companies are located to two different countries. As a result the best solution which is safe and affordable is using internet as our media to connect these two companies. Virtual Private Network VPN technology is based on an idea which is called tunneling. This technology involves establishing and maintaining a logical network connection. On such a connection simply packets are encapsulated within some base protocol standards and then transmitted between clients and servers, and finally de-encapsulated on the receiving side. (Mitchell, 2012) VPN Tunneling Protocols There are several different protocols have been implemented for these VPN tunnels which each one is appropriate for different industries. Generally these protocols are not compatible with each other. Based on the security level requirement they will be chosen. The list below explains a brief introduction to three common protocols have been using in VPN tunneling technology. Point-to-Point Tunneling Protocol (PPTP) This protocol is commonly known by people as associated protocol with Microsoft product. Although many experts believe that this protocol in the sense of security is weak, it’s been using by many vendors as a compatible protocol. (Mitchell, 2012) Layer Two Tunneling Protocol (L2TP) L2F was the original competitor to PPTP in VPN tunneling technology, a protocol implemented primarily in Cisco products. In order to improve on L2F, the best features of it and PPTP were combined and as the result L2TP protocol is created. Same as PPTP, L2TP exists at the data link layer (Layer Two) in the OSI model. (Mitchell, 2012) Internet Protocol Security (IPsec) In fact IPsec is a collection of multiple related protocols. It could be used as either a complete VPN protocol solution or simply as the encryption scheme within L2TP or PPTP. IPsec exists at the network layer (Layer Three) of the OSI model. Newark Security (CT037-3.5-2)

Page 40

Asia Pacific University of Technology & Innovation (A.P.U)

In order for of the company to decide what protocol should be used to implement VPV tunneling and connect two remote branches, he/she needs to know how important and critical the information transmitted in the network is. Also there is other kind of protocol with higher level of security available which could be considered as solution to this problem. However, higher level of security means higher process as well as more complexity in configuration. Thus, choosing this protocol is directly depended on company’s requirement in the level of security as well as their equipment specification and s. (Mitchell, 2012)

Newark Security (CT037-3.5-2)

Page 41

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 10 In this chapter our team is required to give a solution for data transmitted over the network must be kept disguised and only intended recipient can read it.in term of security we already implemented VLAN and HTTPS as well as IP range which comes with a of security in our system and data can be transmitted over the network that makes it limited access for the s and just recipient can read it. By overcoming of these parts, we are going throw these methods one by one. The logic of VLAN is separate the computers logically. Reasonably, VLAN are treated as an unconnected physical network. A device cannot link to another network deprived of the aid of a routing device, be it a layer 3 switch that is routing for the VLAN. Better still, in this project we can make private VLANs, which stop devices on the VLAN from speaking to each other, and just to the default gateway port on the VLAN indeed. A good aim to do this is on a DMZ. If a machine in the DMZ is cooperated, it is still not capable to speak to other machines on the DMZ, and just the default gateway port on the VLAN. Besides, lots of switches that VLANs similarly MAC Address based security and other types to further shield your VLAN in the case of security. (Cisco, 2010) Hypertext Transfer Protocol Secure (HTTPS) is a generally used communications protocol for protected communication over a workstation network, with particularly wide placement on the Internet. Officially, it is not a protocol in itself; reasonably, it is the consequence of basically layering the HTTP on best of the SSL/TLS protocol, consequently adding the safety abilities of SSL/TLS to standard HTTP communications indeed. In its general placement on the internet, HTTPS delivers authentication of the web site and related web server that one is collaborating with, which defends against attacks. Furthermore, it delivers bidirectional encryption of communications among a client as well as server, which defends against eavesdropping as well as tampering with forging the subjects of the communication. (Kyrnin, 2011)

Newark Security (CT037-3.5-2)

Page 42

Asia Pacific University of Technology & Innovation (A.P.U)

In case of having more secure networking we go throw the encryption method witch make the network more secure and more protected. Network encryption or network level encryption is a network safekeeping method that relates crypto facilities at the network transfer layer overhead the data link level, then under the application level indeed. Network transfer layers are layers 3 and 4 of the OSI reference model, the layers in control for connectivity and routing among two end workstations. Using the present network facilities and application software, network encryption is imperceptible to the end and operates individualistically of any other encryption procedures used. Data is encoded only while in transportation, current as plaintext on the creating and receiving hosts indeed. (Zhou, 2008)

Newark Security (CT037-3.5-2)

Page 43

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 11 In this chapter of project the company requires implementing FTP with and is essential for each transaction. File Transfer Protocol (FTP) is a network protocol used to transfer information’s from 1 host or to a different host in excess of a T based network, like the Internet. FTP is put up on a client server design and uses distinct control as well as data connections among the client and the server. File Transfer Protocol s might confirm themselves using a clear text sign in protocol, usually in the method of a name and , but can link namelessly if the server is configured to permit it. For protected transmission that encrypts the name and , and also encrypts the content, FTP is frequently protected with SSL/TLS ("FTPS") indeed. SSH File Transfer Protocol ("SFTP") is sometimes also used as an alternative.

File Transfer Protocol uses a usual names and scheme for permitting access. name is referred to the server with the command, and then the is sent using the command as well. If the info delivered by the client is known by the server, the server will send a salutation to the client and the session will begin indeed. If the server funds it, s may without given that identifications, but the server may allow only partial access for such sessions indeed. Secure FTP There are some techniques of securely transferring files that have been named Secure FTP at one point or another as well. FTPS Explicit FTPS is an extension to the FTP standard that let s to call that the FTP session be encoded. This is completed by referring the "AUTH TLS" command. The server has the selection of permitting or denying links that do not request TLS. This protocol extension is Newark Security (CT037-3.5-2)

Page 44

Asia Pacific University of Technology & Innovation (A.P.U)

certain in the planned standard: RFC 4217. Implicit FTPS is a denounced standard for FTP that necessary needs the use of a SSL or TLS link. It was definite to use dissimilar ports than plain FTP.

Figure 34(FTPS protocol) (Archur, 2010)

SFTP SSH File Transfer Protocol (SFTP) is not associated to FTP but it too transfers files and has a comparable command set for workers. SFTP, or secure FTP, is a software package that uses Secure Shell (SSH) to transfer data’s. Different from standard FTP, it encrypts mutually commands as well as data, checking s and sensitive info from being ing on openly over the network indeed. It is functionally like to FTP, on the other hand, because it uses a dissimilar protocol, standard FTP clients could not be used to communicate to an SFTP server, nor can one link to an FTP server by a client that s only SFTP indeed.

Figure 35(SFTP) (Jones, 2011)

Newark Security (CT037-3.5-2)

Page 45

Asia Pacific University of Technology & Innovation (A.P.U)

Chapter 12

In this case, the company requires implementation of intrusion detection system (IDS) and the security specialist’s team have explained on the details of IDS as stated below. IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) is network monitoring tool which is used for monitoring network traffic. Both of them were implemented widely around the globe to protect computer networks. Although both of them are almost identical but there are slight difference between both in protecting the network. IDS basically analyses the network traffic and notifies the network about the suspicious activities it had been detected. The IDS is actually able to reset the T connection by sending special packet after an attack or threat is being detected. It can also communicate with the firewall to re-write the firewall rule-set. However, there is limitation for the IDS. The IDS cannot block the attack because it only perform packet sniffing, which means it can only can watch the network traffic as the packet es by the network. (Bradley, 2012) IPS does mostly the same thing as the IPS does but the differences between the IDS and the IPS is that the IPS is capable to block an attack or suspicious activity which had been detected. This is due to the packet flows through an IPS sensor but not by the IPS sensor like the IDS did, so that the IPS is able to drop out a packet which is suspicious. Due to the IPS need the network traffic to flows through it, hence, it only can be placed at the network choke point which referring to the network firewall or Internet where most of the attacker will come through this two location in the network. (Bradley, 2012) Placement of IDS and IPS

The placement of the sensor should be on the place where is most vulnerable to attack. The choke point of a network is the most exposed location to an attack due to there is a lot of traffic flows through it. The Internet and the Firewall is the good choke point for placing the sensor of IDS and the IPS. For the firewall there are two option for placing the either we can place it

Newark Security (CT037-3.5-2)

Page 46

Asia Pacific University of Technology & Innovation (A.P.U)

outside or inside the firewall. If we are placing outside the firewall it may be too noisy as it can sees everything in the network traffic. Assuming if we don’t want to know about every single attack outside the firewall, the solution is to place the sensor behind the firewall. If we place it behind the firewall, the firewall can act as an extra protection to filter out the traffic before send to the IDS and IPS hence it can improve the efficiency of the IDS and IPS. According to the scenario given, there are few locations that we can place the sensor to protect the company network from attacks. The first location will be the firewall, but at the firewall we are going place the sensor inside the rather than outside of the firewall. This is because we only want to detect the attack that come through and may reach the company protected server. Assuming if we don’t want to know about every single attack outside the firewall, the solution is to place the sensor behind the firewall. If we place it behind the firewall, the sensor can act as an extra protection to filter out the traffic before send to the IDS and IPS hence it can improve the efficiency of the IDS and IPS. In the diagram shown that the sensor 1 and 3 is placed behind the firewall to add in extra protection for the network if the attack penetrates through the firewall. The second location will be the De Militarized Zone (DMZ). Most of computers on the LAN run behind a firewall connected to the Internet. But there will be one or more computers which also run outside the firewall serve as the hosts that provide services to s outside of the local area network, such as e-mail, web servers host is the most vulnerable to attack. Due to this matter we shall place the sensor 2 that had shown in the diagram behind the DMZ to monitor for attack that may through the DMZ. (JeffSoh, 2008) Lastly, the last place is to place the IDS sensor will be before the internal router. The reason why we place sensor before an internal router is because an attack is not necessarily is coming from the internet but they also can be launch within the internal LAN. By placing the sensor before the internal router can detects the malicious traffic before it reaches the destination. In the diagram shows that the sensor 5, 6, 7 are placed between the different internal group of the network. (JeffSoh, 2008)

Newark Security (CT037-3.5-2)

Page 47

Asia Pacific University of Technology & Innovation (A.P.U)

Network configurations and configured devices

The network setup in Packet Tracer is an example of Virtual LAN. The client workstation in the local network can ping and send packet to each other through VLAN network created. The packet travels from the workstation towards its local switch and later to a distributed switch. Then it was transferred to internal router to get the location of the destination IP and is send to distributed switch which then later transferred to the switch where the destination IP belongs to. Clients will be able to receive from the Web and Mail server. They are not able to ping the Mail and Web server for security reason. Furthermore, clients from Singapore can ping each other in their workstation. IP addresses of each client workstation are set to a fixed range. The Sales Workstation IP address range from 192.168.3.2 – 192.168.3.6 with a subnet of 255.255.255.0 and a gateway of 192.168.3.1 on VLAN 10. The Engineering Workstation IP address range from 192.168.2.2 – 192.168.2.6 with a subnet of 255.255.255.0 and a gateway of 192.168.2.1 on VLAN 20. The Finance Workstation IP address range from 192.168.1.2 – 192.168.1.6 with a subnet of 255.255.255.0 and a gateway of 192.168.1.1 on VLAN 30. All the unused port in the Departmental Switches is set to a native VLAN to prevent network error.

Newark Security (CT037-3.5-2)

Page 48

Asia Pacific University of Technology & Innovation (A.P.U)

Conclusion

As a conclusion, this assignment enable the team to know how to set up a complete network in Packet Tracer, how to configure the network devices as well and learned out the available security technologies on the network. The assignment did fulfill the learning outcome of this module which enables them to analyze the interactions between the devices which forms a computer network as well as design, implement and manage network security equipment’s through this assignment.

Newark Security (CT037-3.5-2)

Page 49

Asia Pacific University of Technology & Innovation (A.P.U)

Appendices Mainly this scenario is implemented based on the company requirements and the explanation in the form. In order to improve the designed network, our team has come up with some ideas and offers the following improvements and implementation which could be considered as future plans. As far as the DNS server has installed on the same server as our webserver, we strongly recommend that the company installs an individual server in order for taking care of address translation purposes (DNS). This could reduce the traffic on webserver as well as improving the network performance and redundancy. Based on the company requirements some security features have been considered in the network design. However, if the company emphasizes on security we can install CA to generate certificates for many purposes such as secure web browsing, secure FTP, and general term for secure communications. In this scenario our FTP server is located on the same server as we server. We suggest company add another sever for this special purpose. This fileserver could hold huge amount of storage in case company needs to store more data. Implementing a layer 7 firewall is recommended for the company in order to control applications on layer 7 of OSI model (Application). This would make the able to have a detailed control on data transits on the network. This option even could be a software firewall such as Microsoft Treat management gateway (TMG 2010) installed on a windows server 2008. Then this could be used even for more services. In case that later the company needs to have access to resources located in remote areas, we can implement VPN for them and as far as we already mentioned installing CA server we would be able to make this VPN tunneling very safe for them. In this case they will be able to access to remote resources aware of any security risks. Our team is able to make the security as much safe as bank communication or even military security level.

Newark Security (CT037-3.5-2)

Page 50

Asia Pacific University of Technology & Innovation (A.P.U)

Bibliography Archur, J., 2010. Ftps Pictures Photo Gallery added by vinus. [Online] Available at: http://withfriendship.com//vinus/ftps.php [Accessed 15 October 2012]. Bradley, 2010. What Is the IP Address of a Router? [Online] Available at: http://compnetworking.about.com/od/workingwithipaddresses/f/getrouteripaddr.htm [Accessed 5 October 2012]. Bradley, T., 2012. Introduction to Intrusion Detection Systems (IDS). [Online] Available at: http://netsecurity.about.com/cs/hackertools/a/aa030504.htm [Accessed 2 October 2012]. Byrd, J., 2009. Five Critical Steps for Configuring an SMTP Mail Server. [Online] Available at: http://www.logicalhalf.com/2010/03/five-critical-steps-for-configuring.html [Accessed 1 October 2012]. Cisco, 2010. VLAN Security. [Online] Available at: http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a008013159f. shtml [Accessed 19 October 2012]. Cisco, 2012. Cisco Automated IOS Protection Configuration Guide. [Online] Available at: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps6538/ps6540/data_sheet_c07570311.html [Accessed 4 October 2012]. Cisco, 2012. Virtual Private LAN Services (VPLS). [Online] Available at: http://www.cisco.com/en/US/products/ps6648/products_ios_protocol_option_home.html [Accessed 11 October 2012]. Contributor, G., 2008. SolutionBase: Strengthen network defenses by using a DMZ. [Online] Available at: http://www.techrepublic.com/article/solutionbase-strengthen-network-defenses-by-using-z/5756029 [Accessed 1 September 2012]. DiNicolo, D., 2003. securitypronews. [Online] Available at: http://www.securitypronews.com/it/networksystems/spn-21-20030725IntroductiontoVLANs.html [Accessed 10 October 2012]. Dubrawsky, I., 2010. SAFE LAYER 2 SECURITY IN-DEPTH—. Cisco, I(10), pp.1-60. Grote, M., 2006. ISA Server 2006 Overview. [Online] Available at: http://www.isaserver.org/articles/isaserver-2006-overview.html [Accessed 16 October 2012]. JeffSoh, 2008. IDS\IPS Placement. [Online] Available at: http://jeffsoh.blogspot.com/2011/05/idsipsplacement.html [Accessed 12 October 2012].

Newark Security (CT037-3.5-2)

Page 51

Asia Pacific University of Technology & Innovation (A.P.U)

Jones, D., 2011. FTP-SFTP Conversion. [Online] Available at: http://www.ssh.com/manuals/connectsecure-/61/cosec-ftpsftp.html [Accessed 14 October 2012]. Kessler, G., 2010. An Overview of T/IP Protocols. [Online] Available at: http://www.garykessler.net/library/tip.html [Accessed 18 October 2012]. Kizza, J.M., 2009. Guide to Computer Network Security. First Edition ed. Chattanooga,USA: McGraw Hill. Kyrnin, J., 2011. What is HTTPS. [Online] Available at: http://webdesign.about.com/od/ecommerce/a/aa070407.htm [Accessed 20 October 2012]. Malik, S., 2003. Network Security Principles and Practices. First Edition ed. Indianapolis,USA: Cisco Press. McKeag, L., 2004. Building a security DMZ. [Online] Available at: http://howto.techworld.com/security/322/building-a-security-dmz/ [Accessed 24 September 2012]. Mitchell, B., 2010. DMZ - Demilitarized Zone. [Online] Available at: http://compnetworking.about.com/cs/networksecurity/g/bldef_dmz.htm [Accessed 3 October 2012]. Mitchell, B., 2012. VPN Tunneling. [Online] Available at: http://compnetworking.about.com/od/vpn/a/vpn_tunneling.htm [Accessed 16 October 2012]. Neylon, M., 2007. New Cisco Firewalls. [Online] Available at: http://blog.blacknight.com/new-ciscofirewalls.html [Accessed 1 October 2012]. Rouse, M., 2006. T (Transmission Control Protocol). [Online] Available at: http://searchnetworking.techtarget.com/definition/T [Accessed 2 October 2012]. Stevens, R., 1995. T/IP Illustrated: The Implementation, Volume 2. First Edition ed. Indianapolis,USA: BSD,Damons. Stuvart, J., 2012. Cornerstone Managed File Transfer - DMZedge Server Module. [Online] Available at: http://www.webdrive.com/products/cornerstone/dmzedge.html [Accessed 3 October 2012]. Wilson, T., 2012. Securing Networks Access List Implementation on Cisco Routers. [Online] Available at: http://www.trainsignal.com/blog/access-control-list-implementation-on-cisco-routers [Accessed 20 September 2012]. Zhou, J., 2008. Applied Cryptography and Network Security. First Edition ed. Newyork: Adams.

Newark Security (CT037-3.5-2)

Page 52