Network Management Strategies for the CIO
An IT administrator can deafen his staff to the powerful temptation to use automated assessment technology by showing that performing security assessments using freely available network analysis tools can be instructive, effective and -- admittedly, in a nerdy way -- fun.
Ignore the sirens
Many of today's sophisticated security and network products have their origins in command line applications and scripts that innovative IT administrators developed to monitor, collect, analyze and respond to security-related events
Requires Free Membership to View
before anyone thought to introduce commercial solutions that automate these processes. Variants and descendants of these applications are readily available as open source software, freeware or shareware. Preparing a toolkit composed of feature-rich traffic generation, capture and analysis tools is simple and inexpensive.
A starter kit for security assessments
Consider some of the security assessment activities you can perform using free or inexpensive network analysis tools:
- Verify firewall forwarding policy configuration. Use a traffic-generating tool such as ping to verify that firewall rules allow or block traffic between your internal (trusted) networks and external networks, according to the security policy you intend to enforce.
- Verify egress traffic policy configuration. Place a test system outside your firewall. On the test system, run an application such as Port Listener. Use a port scanner such as nmap, and attempt to connect to the test system at every listening port you configure in order to confirm that your firewall allows access to services you intend to make generally accessible (Web) and restricts the services that users connected to your trusted networks may access according to your Acceptable Use Policy (AUP).
- Learn who's probing your networks, and from where. Open a firewall log and select a traffic source that is either probing or attempting to attack your network. Use a route analysis program (traceroute, tracert, visualroute) to identify the path over which the attack traffic is forwarded, the service providers along the path, the IP addresses along the way, and the network where the attack traffic originates. Use utilities such as dig, whois, and nslookup to perform reverse DNS lookups (IN-ADDR.ARPA) and whois queries. In real-life situations – your Web site is the target of a distributed denial of service (DDOS) attack, for example – use the information from address registries and domain name registries to contact technical support at ISPs and the administrators of the networks where the attack traffic originates and work cooperatively to isolate and disable the attack source.
- Take stock of your network. A LAN traffic capture and analysis program such as Ethereal provides a wealth of information about your network. By observing the types of applications in use, you can identify hosts that provide unauthorized services (e.g., an employee running a personal Web site). You can also determine whether employees are complying with AUPs, whether rootkits and other malicious code are establishing back-channel connections to an attacker's computer, and whether your network is hosting a spam bot.
A strategy for improving your organization's assessment skills
Nurturing assessment skills among your IT staff can begin with simple exercises and gradually become more challenging. A popular introductory exercise is to have staff learn the information-gathering techniques attackers use. Have your staff begin by performing ping scans and port scans using nmap. As they become familiar with nmap, encourage them to try such advanced techniques as OS and service fingerprinting. Encourage them to share their experiences. Schedule a bag lunch conference where staff can discuss the methodologies and speculate how information gathering might be exploited on your network. Have them assess whether current security measures provide adequate defense.
What's the ROI?
An important outcome of encouraging such activities is that expertise becomes a core competency and core value in your organization. The organization is also less likely to become so dependent on automation that it cannot isolate and remedy problems for which automated response is not provided.
Automated assessment improves with each generation of analysis technology developed, and though many may argue that automation is necessary, it is still not sufficient to protect an organization from all threats, known and as-yet unforeseen. Developing security expertise by employing basic network analysis tools complements automated assessments and enhances your organization's ability to analyze, anticipate and respond to security problems.
Learn more about open source network security tools
About the contributor: David M. Piscitello is president of Core Competence Inc. He has been involved in internetworking technology for 30 years and is an internationally recognized leader in internetworking and fast packet technology. Dave is currently serving as a Security and Stability Advisory Committee fellow for ICANN (Internet Corporation for Assigned Names and Numbers).
This was first published in August 2007
Join the conversationComment
Share
Comments
Results
Contribute to the conversation