Implementing Cisco IOS Network Security (IINS)

Cover......Page 1
Contents......Page 9
  The Need for Network Security......Page 22
  Network Security Objectives......Page 27
  Data Classification......Page 30
  Security Controls......Page 33
  Response to a Security Breach......Page 37
  Laws and Ethics......Page 38
  Adversaries, Motivations, and Classes of Attack......Page 43
  Classes of Attack and Methodology......Page 47
 The Principles of Defense in Depth......Page 49
  IP Spoofing Attacks......Page 53
  Confidentiality Attacks......Page 59
  Integrity Attacks......Page 64
  Availability Attacks......Page 68
  Best Practices to Defeat Network Attacks......Page 75
  Secure Network Life Cycle Management......Page 76
  Principles of Operations Security......Page 79
  Network Security Testing......Page 82
  Disaster Recovery and Business Continuity Planning......Page 85
  Security Policy Overview......Page 88
  Security Policy Components......Page 89
  Standards, Guidelines, and Procedures......Page 93
  Security Policy Roles and Responsibilities......Page 94
  Risk Analysis and Management......Page 95
  Principles of Secure Network Design......Page 101
  Security Awareness......Page 106
  Changing Threats and Challenges......Page 110
  Building a Cisco Self-Defending Network......Page 112
  Cisco Integrated Security Portfolio......Page 118
  References......Page 120
 Review Questions......Page 122
  General Router Security Guidelines......Page 130
  Introduction to the Cisco Integrated Services Router Family......Page 132
  Configuring Secure Administration Access......Page 135
  Configuring Multiple Privilege Levels......Page 143
  Configuring Role-Based Command-Line Interface Access......Page 145
 Securing the Cisco IOS Image and Configuration Files......Page 148
  Login Shutdown if DoS Attacks Are Suspected......Page 150
  Generation of System Logging Messages for Login Detection......Page 151
  Configuring Banner Messages......Page 153
  Supporting Cisco SDM and Cisco SDM Express......Page 155
  Launching Cisco SDM Express......Page 157
  Navigating the Cisco SDM Interface......Page 158
  Cisco SDM Wizards in Configure Mode......Page 160
  Authentication, Authorization, and Accounting......Page 163
  Introduction to AAA for Cisco Routers......Page 164
  Using Local Services to Authenticate Router Access......Page 165
 Configuring AAA on a Cisco Router to Use Cisco Secure ACS......Page 172
  Cisco Secure ACS Overview......Page 173
  TACACS+ and RADIUS Protocols......Page 178
  Configuring the Server......Page 181
  Configuring TACACS+ Support on a Cisco Router......Page 191
  Troubleshooting TACACS+......Page 201
  Planning Considerations for Secure Management and Reporting......Page 204
  Secure Management and Reporting Architecture......Page 205
  Using Syslog Logging for Network Security......Page 209
  Using SNMP to Manage Network Devices......Page 214
  Configuring an SSH Daemon for Secure Management and Reporting......Page 219
  Enabling Time Features......Page 223
  Vulnerable Router Services and Interfaces......Page 228
  Performing a Security Audit......Page 231
  Cisco AutoSecure......Page 237
  References......Page 239
 Review Questions......Page 241
 Firewall Fundamentals......Page 246
 Firewalls in a Layered Defense Strategy......Page 248
 Static Packet-Filtering Firewalls......Page 250
 Application Layer Gateways......Page 253
 Dynamic or Stateful Packet-Filtering Firewalls......Page 256
 Other Types of Firewalls......Page 259
 Cisco Family of Firewalls......Page 260
 Developing an Effective Firewall Policy......Page 265
 ACL Fundamentals......Page 266
 ACL Wildcard Masking......Page 273
 Using ACLs to Control Traffic......Page 276
 ACL Considerations......Page 283
 Configuring ACLs Using SDM......Page 285
 Using ACLs to Permit and Deny Network Services......Page 291
  Zone-Based Policy Firewall Overview......Page 297
  Configuring Zone-Based Policy Firewalls Using the Basic Firewall Wizard......Page 303
  Manually Configuring Zone-Based Policy Firewalls Using Cisco SDM......Page 309
  Monitoring a Zone-Based-Firewall......Page 316
  References......Page 318
 Review Questions......Page 319
  Cryptology Overview......Page 324
  Symmetric and Asymmetric Encryption Algorithms......Page 336
  Block and Stream Ciphers......Page 339
  Encryption Algorithm Selection......Page 340
  Cryptographic Hashes......Page 341
  Key Management......Page 342
  Introducing SSL VPNs......Page 345
  Symmetric Encryption Overview......Page 346
  DES: Features and Functions......Page 348
  3DES: Features and Functions......Page 351
  AES: Features and Functions......Page 352
  SEAL: Features and Functions......Page 353
  Overview of Hash Algorithms......Page 354
  Overview of Hashed Message Authentication Codes......Page 356
  SHA-1: Features and Functions......Page 359
  Overview of Digital Signatures......Page 360
  DSS: Features and Functions......Page 364
  Asymmetric Encryption Overview......Page 365
  RSA: Features and Functions......Page 367
  DH: Features and Functions......Page 370
  PKI Definitions and Algorithms......Page 371
  PKI Standards......Page 377
  Certificate Authorities......Page 379
  References......Page 385
 Review Questions......Page 386
 VPN Overview......Page 390
  VPN Types......Page 392
  Cisco VPN Product Family......Page 395
 Introducing IPsec......Page 401
  Diffie-Hellman Exchange......Page 403
  Authentication......Page 404
  IPsec Advantages......Page 405
 IPsec Protocol Framework......Page 406
  Authentication Header......Page 407
  Tunnel Mode Versus Transport Mode......Page 409
  IPsec Framework......Page 411
 IKE Protocol......Page 413
  IKE Phase 1......Page 414
  IKE Phase 1: Example......Page 415
  IKE Phase 2......Page 417
  Site-to-Site IPsec VPN Operations......Page 419
  Configuring IPsec......Page 420
  Verifying the IPsec Configuration......Page 433
  Site-to-Site VPN Components......Page 437
  Using the Cisco SDM Wizards to Configure Site-to-Site VPNs......Page 439
  Completing the Configuration......Page 447
  References......Page 451
 Review Questions......Page 452
 Introducing IDS and IPS......Page 456
  Types of IDS and IPS Systems......Page 461
  IPS Actions......Page 464
  Event Monitoring and Management......Page 465
  Cisco Security Monitoring, Analysis, and Response System......Page 467
  Cisco Security Manager......Page 468
  Cisco IPS Device Manager......Page 469
  Host-Based IPS......Page 470
  Network-Based IPS......Page 472
  Comparing HIPS and Network IPS......Page 474
  Cisco IPS 4200 Series Sensors......Page 476
  Cisco ASA AIP SSM......Page 477
  Cisco Catalyst 6500 Series IDSM-2......Page 478
  Cisco IPS AIM......Page 479
  Examining Signature Micro-Engines......Page 481
  Signature Alarms......Page 483
 IPS Best Practices......Page 485
  Cisco IOS IPS Features......Page 487
  Configuring Cisco IOS IPS Using Cisco SDM......Page 489
  Configuring Cisco IOS IPS Using CLI......Page 495
  Configuring IPS Signatures......Page 496
  Monitoring IOS IPS......Page 500
 Verifying IPS Operation......Page 502
  References......Page 506
 Review Questions......Page 508
 Examining Endpoint Security......Page 512
  Operating System Vulnerabilities......Page 513
  Buffer Overflows......Page 515
  IronPort......Page 522
  Cisco NAC Products......Page 526
  Cisco Security Agent......Page 529
  Endpoint Security Best Practices......Page 534
  Defining SANs......Page 535
  SAN Fundamentals......Page 536
  SAN Security Scope......Page 540
  VoIP Fundamentals......Page 542
  Voice Security Threats......Page 547
  Defending Against VoIP Hacking......Page 549
  Basic Switch Operation......Page 553
  Mitigating VLAN Attacks......Page 554
  Preventing Spanning Tree Protocol Manipulation......Page 557
  CAM Table Overflow Attacks......Page 564
  MAC Address Spoofing Attacks......Page 566
  Using Port Security......Page 567
  Additional Switch Security Features......Page 574
  Layer 2 Best Practices......Page 580
  References......Page 581
 Review Questions......Page 583
Appendix: Answers to Chapter Review Questions......Page 588
 A......Page 593
 B......Page 595
 C......Page 596
 D......Page 602
 E......Page 603
 F......Page 604
 H......Page 605
 I......Page 606
 L......Page 608
 M......Page 609
 O......Page 610
 P......Page 611
 R......Page 612
 S......Page 613
 U......Page 617
 V......Page 618
 X-Y-Z......Page 619