Internet Security A Jumpstart for Systems Administrators and IT Managers Tim Speed Juanita Ellis Digital Press An imprint of Elsevier Science Amsterdam, Boston • London • New York o Oxford • Paris • San Diego San Francisco • Singapore • Sydney • Tokyo Digital Press is an imprint of Elsevier Science. Copyright © 2003, Elsevier Science (USA). All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Recognizing the importance of preserving what has been written, Elsevier Science prints its books on acid-free paper whenever possible. Library of Congress Cataloging-in-Publication Data ISBN 1-55558-298-2 British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. The publisher offers special discounts on bulk orders of this book. For information, please contact: Manager of Special Sales Elsevier Science 200 Wheeler Road Burlington, MA 01803 Tel: 781-313-4700 Fax: 781-313-4882 For information on all Digital Press publications available, contact our World Wide Web home page at: http://www.digitalpress.com or http://www.bh.com/digitalpress 1098765432 1 Printed in the United States of America To Linda Speed~my split apart. -T.S. To my dad, Charles Ellis. -J.E. This Page Intentionally Left Blank Contents Foreword ix Acknowledgments xi Introduction xiii The Internet and Security I. I The history of the Internet 2 1.2 TCP/IP: the nails of the Internet 13 2 The Security Review Process 39 2.1 Introduction 40 2.2 Review the state of the business 41 2.3 Analyze the technology being used 45 2.4 Risk analysis 49 2.5 Plans and policies 52 2.6 Implementation 61 Cryptography 67 3.1 The history 68 3.2 Key types 71 3.3 RSA: public and private key 74 3.4 PKI and business solutions 75 vi Contents 4 Secure Networks 89 4.1 TCP/IP and OSI 90 4.2 Denial-of-service attacks 92 4.3 Virtual private networks 95 4.4 Secure sockets layer 98 Protecting Your Intranet from the Extranet and Internet 107 5.1 So many choices! 108 5.2 Firewall product functional summaries 119 5.3 Firewall buyer's assessment form 124 5.4 Firewall vendors: Picking the products that are right for you 132 5.5 SSL network appliance overview 134 5.6 Secure access~SSL based extranet appliances 138 5.7 Understanding air gap-based filtering proxies and their benefits when used for deploying web applications 141 6 Authentication and Authorization 149 6. I The basics 150 6.2 Authentication 151 6.3 Authorization 158 6.4 Smart cards 166 7 E-Commerce: Public Key Infrastructure 169 7.1 PKI and you 170 7.2 X.509 172 7.3 Certificate authority 178 7.4 Certification practice statement 183 7.5 Certificate revocation list 187 7.6 Key recovery 189 7.7 Lightweight directory access protocol 190 7.8 Public key cryptography standards 194 7.9 Public key infrastructure (X.509) standards 195 8 Messaging Security 199 8.1 Safe communication: Messaging 200 8.2 Junk mail 207 8.3 Keep it running 214 Contents vii What Are We Doing Here? 231 9.1 Risk analysis 232 9.2 The threats 234 9.3 Technology security review 237 9.4 Control directory and environment risk table 241 9.5 Competitive asset 243 10 Disaster Recovery 253 10.1 Introduction 254 10.2 Incident handling requirements 256 10.3 Incident handling processes 257 10.4 Incident handling procedures 259 10.5 Incident handling team implementation 262 10.6 Disaster recovery and business continuity 263 Appendix I Security Tools 273 Appendix 2 The CERT Report 283 Glossary 313 References 321 Index 391 I Contents This Page Intentionally Left Blank Foreword Not too long ago it was thought that the only secure network was a net- work that was completely disconnected, or one that had no power. While that may still be true today, it does not help our local administrator deal with problems he or she never had to deal with in the past. Prior to the World Wide Web, most of our computer networks were islands unto themselves. Organizations may have exchanged e-mail, or hosted bulletin boards, but for the most part Company A's network was completely sepa- rate from Company B's network. The biggest problems an information technology professional may have had were someone, stealing floppy disks or hacking the company's telephony switch. With today's Internet, or net- work of networks, distributors or suppliers can look into their customers' inventory databases, employees can telecommute with broadband connec- tions, students can submit or receive homework without ever leaving home, and thousands of other things are possible that we could not do prior to the advent of http and the World Wide Web. These advances are great for changing the way we all live, work, play and learn; however, it begs the questions: Are my distributors looking past the databases for which they have authority? Is there someone other than my employees accessing my network without my knowledge? Who else is trying to communicate with my child over the Internet? For the above reasons and many others it becomes apparent that all organizations need to have a plan for securing their assets, both physical and electronic. The corporate, or organizational, security policy is an administrator's strength in applying rules and policies about how the net- work is to be used. The technology that companies, schools, or other pri- vate and public institutions deploy is, by itself, not enough to prevent their x Foreword networks from being compromised. Once the policy is in place and a plan is set out to secure the network, it becomes apparent that security will never again be point product or niche solution. Instead, network security must become a process, one that is reviewed and updated with each change of the physical, or logical, network that it applies to. As one starts his or her journey down the path of security, it becomes apparent that network security can no longer be thought of as an after- thought, or a "bolt-on" solution. Security must become a fabric of the net- work that strikes the balance between security and usability. Policies, architectures, and processes need to be noninvasive to legitimate users, but impenetrable to would-be attackers. Craig Tiffany Network Security Consultant Cisco Systems, Inc. Craig Tiffany is a security specialist working in the field for Cisco Systems, Inc. for more than four years. Craig earned his CCIE certification for rout- ing and switching in March of 1998. Since then, he has worked with several Fortune 100 companies, and has consulted with hundreds of small to medium businesses, cities, counties, schools, universities, as well as other large enterprises. Prior to working for Cisco Systems, Inc., Craig was a technical marketing engineer for Intel Corporation in the Intel Architec- ture Labs. Craig also spent several years as a network engineer and technical operations lead at one of Intel Corporation's fabricating sites. Acknowledgments. Knowledge is based on many different facets what you know, knowing where information can be found, and who you know. The information in this book is a combination of all these facets. The data sources referenced in this book include references to people, URLs, and other books. But much of the knowledge that is in this book comes from very smart people. The people listed in this "acknowledgment" section did not necessarily partici- pate in the writing of this book, but have influenced and guided me in my life that has culminated in this work. First and foremost I need to thank my wife for helping me with the book and providing some of the editing throughout the various chapters. Next I want to thank Johnny Speed, a great son that not only provided his support but also edited various chap- ters in this book. I thank my daughter Katherine for tolerating me during the months that I worked on this book. Next I want to thank my mother, Lillian Speed, for teaching me to "think big." Thanks to Ed Speed for the inspiration to keep publishing. The authors thank CERT, via Sarah Strauss, for allowing us to repub- lish the Cert Reporting Guidelines. I am very grateful to Juanita Ellis for asking me to participate in writing this book. Special thanks to Julio G. Esperas~Production Editor and to Merrill Peterson and Aaron Downey. Thanks to Theron Shreve for publish- ing this book. Special thanks to Lotus/IBM (and ISSL), Mark Steinborn, and Jack Shoemaker for allowing me to coauthor this book. Thanks to John Kistler for reading this book before publishing. Many thanks to Katherine Spanbauer, for keeping me in the company security loop. xii Acknowledgements Thanks to the following content authors: • Sarah Z. Stanwyck (with Meade Eggleston)~Redline Networks • Ken Spinner~Neoteris Inc. • Joseph Steinberg~Whale Communications A brilliant artist~David DeGrand, provided the cartoons found at the beginning of each chapter. Now to talk about the really smart people~due to legal issues, the peo- ple listed below could not directly contribute to this book, but I have learned a lot from these people via work and their friendship: Kelly Brooks, Don Nadel, Gregg Smith, Steve Robinson, Brian Baker, Chip Emmet, Chris and Rodger Williams, Robert Nellis, Tony Ollivier, Thomas Hellegers, Will Witten, Rufus and Lisa Woody, Ted Niblett, Sean Murphy, Carol Worthy, Bud Calkins, Jason Erickson, Loren Pusey, Barry Heinz, Bill Kilduff, Kevin Mills, Matthew Henry, Boris Vishnevsky, Brad Schauf, Paul Culpepper, Scott Souder, Baan A1-Shibib, Andrea Waugh- Metzger, Rick Sizemore, Greg Prickril, Chuck Smith, (The brilliant) David Byrd, Glenn Druce, Catherine Yang, Katherine Rutledge, Shawn Scott, Stan Logan, Paul Raymond, Charles Carrington, Aaloak Jaswal, David Little, Ron DiBiase, Ann Marie Darrough, Larry Berthelsen, Ted Smith, Craig Levine, Daniel Suster, Chris Cotton, Mike Faccioli, Mark Harper, Jeff Pinkston, George Poirier, Jordi Riera, David Via, Heidi Wulkow, Dave Erickson, David Bell, Mark Leaser, Gary Wood, David Attardo, Charles J.