Cisco Security Architectures - Held_ Gilbert.pdf - Cisco Security Architectures (1272) - superktos86

Cisco Security Architectures

Gilbert Held

Kent Hundley

States of America. Except as permitted under the United States Copyright Act of 1976, no part of

this publication may be reproduced or distributed in any form or by any means, or stored in a

database or retrieval system, without the prior written permission of the publisher.

1 2 3 4 5 6 7 8 9 0 AGM/AGM 9 0 4 3 2 1 0 9

ISBN: 0—07—134708—9

The sponsoring editor for this book was Steven Elliot, and the production supervisor was Clare

Printed and bound by Quebecor/Martinsburg

Throughout this book, trademarked names are used. Rather than put a trademark symbol after

every occurrence of a trademarked name, we used the names in an editorial fashion only, and to

the benefit of the trademark owner, with no intention of infringement of the trademark. Where such

designations appear in this book, they have been printed with initial caps.

Information contained in this work has been obtained by The McGraw-Hill Companies, Inc.

("McGraw-Hill") from sources believed to be reliable. However, neither McGraw-Hill nor its authors

guarantees the accuracy or completeness of any information published herein and neither McGraw-

Hill nor its authors shall be responsible for any errors, omissions, or damages arising out of use of

this information. This work is published with the understanding that McGraw-Hill and its authors are

supplying information but are not attempting to render engineering or other professional services. If

such services are required, the assistance of an appropriate professional should be sought.

Stanley. It was set by D&G Limited, LLC .

Preface

Overview

In the past, the strength of countries and organizations were measured in terms of production, with

tons of steel, barrels of oil, and similar metrics used to gauge their place among contemporaries.

Today, the strength of countries and organizations is more dependent upon their capacity to

transfer information. That information can range in scope from satellite images of terrorists' base

camps in a village in Afghanistan, which are used to wage retaliatory strikes by countries, to the

flow of financial information between organizations and the use of ATM machines by consumers. If

this information flow is disrupted or altered, the effect on countries, organizations, and individuals

can be severe or even disastrous. Just imagine if a person could intercept the flow of financial

information and reroute the flow of funds into an account in Switzerland or in the Bahamas.

Depending on whose account was diverted, countries, businesses, or individuals might become

candidates for national or Chapter 11 bankruptcy.

The key to securing networks is obtained through the use of appropriate equipment and policies

that govern the use of such equipment. When we talk about securing computer networks to include

Internet access, most people rightfully think of Cisco Systems, because that company provides

approximately 80 percent of the routers used to connect organizational networks to the Internet.

Thus, the focus of this book reflects its title and deals with Cisco Systems equipment, covering in

detail the operation and utilization of that company's routers and firewalls.

While the only network that is completely secure is the one that is truly isolated and is contained in

a locked laboratory or closet, information presented in this book was written to provide you with a

solid foundation concerning tools and techniques you can use to secure your Cisco Systems-

based network. By obtaining a detailed understanding of how to correctly configure access lists, as

well as enabling different firewall functions, you can avoid many common mistakes that result in

network vulnerability. When appropriate, we will include real-life examples obtained from several

decades of collective consulting experience. To avoid embarrassing previous and current clients,

we will use pseudonyms to hide the guilty. Because security is a learning process, you should note

errors and omissions—as well as techniques—that can result in potential security problems, to

ensure that such errors and omissions are avoided. Thus, by focusing on how to correctly

configure equipment, we will provide you with the information necessary to minimize the

vulnerability of your organization's network. While nobody can guarantee a perfectly secure net

work, the information contained in this book should assist you in your goal of obtaining the

foundation needed to minimize potential network vulnerabilities.

As professional authors, we highly value reader feedback. If you wish to share your thoughts

concerning the scope and depth of topics covered in this book, or if there are areas you would like

to see covered in a future edition, you can contact us either through our publisher or directly via e-

mail.

About the Authors

Gil Held is an award-winning lecturer and author. He is the author of over 40 books covering

computer and communications technology. A member of the adjunct faculty at Georgia College

and State University, Gil teaches courses in LAN Performance and was selected to represent the

United States at technical conferences in Moscow and Jerusalem.

Kent Hundley (CCNA) is a Senior Network Consultant for International Network Services, a global

provider of network integration and management services. He specializes in Cisco-centric security

issues for Fortune 500 companies.

Chapter 1: Introduction

Overview

In the preface to this book, we noted that the strength of countries, organizations, and individuals

in a modern society depends to a great extent upon the flow of information. That information flow

must be transported from source to destination in a reliable manner, such that the receiver can be

assured of the identity of the originator—as well as the fact that the received data was not altered.

In addition, some types of information should be excluded from recognition by other parties. Thus,

at a minimum, there are several security-related issues associated with the transmission of

information to include authentication and encryption.

When constructing data networks, authentication and encryption might only represent a portion of

security features and techniques you might wish to consider. To obtain an appreciation for the

variety of security features and techniques you might wish to consider, let's first examine the need

for security—along with some of the potential threats that result in the requirements to obtain

security-related equipment to protect the modern organizational network.

The Need for Security

Figure 1—1 illustrates an example of a corporate network that is connected to the Internet.

Although many people might be tempted to consider security equipment as a necessity to protect

the computers on the private network from people who can access the Internet, that might not be

the only networking boundary that requires a degree of protection. The private network, regardless

of its structure, might also require one or more security devices, techniques, and policies to protect

equipment on that network from inadvertent or intentional employee actions. Thus, in this section,

we will examine the need for security from both external and internal threats.

Figure 1—1: Public network threats

Public Network Threats

In this section, we will consider public network threats to represent potential or actual threats

originating on a public network. These threats are directed at an organization's private network but

are also connected to the public network. Because the Internet literally represents a network of

interconnected networks without a boundary, the organizational network becomes accessible to

the tens of millions of people who now access the Internet. Without a method to control access to

the segments shown behind the organizational router, each workstation and server operated by

the organization becomes vulnerable to intentional, malicious actions that could emanate from

anywhere on the globe. Such malicious actions could include an attempted break-in into a server

or the transmission of e-mail to a workstation user with an executable virus either embedded in the

e-mail as a macro or added as a file attachment.

A second area of concern with respect to the network configuration illustrated in Figure 1—1

involves two items: the transmission line that connects the organizational router to the Internet

Service Provider (ISP) router, and the ISP's connection to the Internet. Once data traffic leaves the

premises of the organization, ensuring that the transmission is not read nor modified becomes

more difficult. This occurs because physical security employed via building passes and employee

recognition can prevent a person from gaining access to a wire closet and using a protocol

analyzer to record traffic. Once data flows beyond the physical span of control of the organization,

Cisco Security Architectures - Held_ Gilbert.pdf

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: