System & Network Defense

Fencing and barricades are the most common physical controls and usually the outermost, most visible layer. A top guard such as barbed or concertina wire adds deterrence and delay, though an attacker can defeat it with a blanket or mattress. Fences need regular inspection: animals burrow under them and earth washes out. Never park vehicles near a security fence.

Biometrics identify people by physiological or behavioural characteristics. Systems can measure the face, fingerprint, hand geometry, iris, retina, signature and voice. Factors when choosing one include accuracy, speed or throughput, acceptability to users, uniqueness, resistance to counterfeiting, reliability, data storage requirements, enrolment time and intrusiveness of the scan. The most important is accuracy, expressed in error types and rates.

The most common metric for a biometric system's overall accuracy is the Crossover Error Rate (CER). It is the point where the false accept rate equals the false reject rate. Lower is better: a lower CER means the system makes fewer errors of either type.

• —Access badge — a card reader reads a number from the badge, sends it to a computer, which makes the access decision from the credential and logs the transaction for later retrieval.
• —Security guards — adapt and respond instantly, and can tell conditions apart and decide on the spot. They cost more, cannot monitor and record high volumes of traffic, and add the risk of human error.
• —Video and electronic surveillance — monitors when no one is present, records for long periods, links to motion detection, and is cheaper for a whole perimeter. Place at entrances, exits, loading bays, stairwells and refuse areas.
• —RFID asset tags — track assets leaving a secure area. Readers can sit hidden in door frames, read many tags at once and need no line of sight or visible tag, unlike barcodes.

Input validation controls the data entering a database. Attacks insert malformed data to confuse or crash an application or make it reveal too much. A validation rule checks that data falls within the limits the database designer set, which keeps it complete, accurate and consistent.

An integrity check performs a hash function to take a snapshot of data, then uses that snapshot to confirm the data has not changed. A checksum is a simple hash: it converts each piece of information to a value and sums them. The receiver repeats the calculation, and equal sums mean the data is valid. Common hash functions are MD5, SHA-1, SHA-256 and SHA-512. Related practices: version control (two users cannot update the same object at once), accurate backups, and authorisation on a need-to-know basis, such as read-only file permissions.

Criminals use vulnerable network services to attack a device or use it in an attack. A port scanner sends a message to each port and waits for a response, showing which ports are open. Defenders use it to expose only the necessary ports, and criminals use the same tool.

Segmentation divides a network into smaller parts to improve performance and security.

A VLAN groups devices on a LAN and on individual switches. VLANs are logical connections, while LANs are physical ones. Ports on a switch are assigned to a VLAN, and trunk ports carry the traffic of several VLANs between switches. An administrator can segment by function, project team or application. Devices in a VLAN act as if they were on their own network, so a VLAN can separate sensitive data from the rest and limit broadcast traffic. VLANs can still be attacked, so monitor them, use advanced configuration and patch.

A DMZ (demilitarised zone) is a small network between the trusted private network and the Internet. Web and mail servers usually sit there, so outside users can reach them without reaching the internal network.

Firewalls manage east-west traffic (between servers inside the data centre) and north-south traffic (into and out of the organisation's network). The Zero Trust model does not automatically trust users and endpoints inside the organisation, because trusted users can move around the network to reach data. It monitors every user constantly, whatever their status or role.

Wireless devices are open to theft, hacking, unauthorised remote access, sniffing, man-in-the-middle attacks and attacks on performance and availability. The best protection is authentication plus encryption.

WPS uses a PIN to join devices, and the PIN can be found by brute force. Do not use it; disable it.

The original 802.11 standard has two authentication types. Open system lets any wireless device connect. Shared key provides mechanisms to authenticate and encrypt data between a client and the access point or router. The best option is WPA2 with EAP, because each user gets their own credentials and a leaver's access ends by deleting their account.

EAP (Extensible Authentication Protocol) is an authentication framework. The user asks to connect through an access point, the access point asks for the identity and passes it to an authentication server, the server asks for proof, the user supplies the password, and the server confirms it to the access point and the user.

A rogue access point is an unauthorised access point that imitates a real one. Users connect, and the attacker can copy their data in a man-in-the-middle attack that is hard to detect. Mutual authentication is two-way: both ends authenticate each other before connecting, so the client can detect a rogue access point.

Mobile devices communicate by Wi-Fi, Bluetooth, NFC (contactless), IR (short range through an IR receiver) and USB. USB is the only wired one. A device issued by the organisation may be corporate-owned or COPE (corporate-owned, personally enabled). With BYOD the user brings their own device. Either way it can hold personal and organisational data, so security and data protection policies apply.

Threats include theft, loss, unauthorised access, and operating system, application and network risks. Three ways of bypassing a device's limits are risky:

Tools can detect a jailbroken or rooted device; it is then marked noncompliant and denied access. Safeguards: screen locks (password, PIN or pattern), biometric authentication, context-aware authentication (machine learning judges normal behaviour), remote wipe and full device encryption.

High availability describes systems designed to avoid downtime as far as possible. Such systems rest on three principles.

1. 1.Eliminate single points of failure — identify every device or component whose failure causes system-wide failure; use hot stand-by devices, redundant components and multiple paths.
2. 2.Provide reliable crossover — redundant power supplies, backup power and backup communications.
3. 3.Detect failures as they occur — active monitoring, which may trigger the backup system.

A single point of failure is any part whose failure means complete failure of the whole system. It can be hardware, a process, a piece of data, an essential utility or even a skilled staff member. The fix is to stop relying on any one element or to build redundant components to take over.

Five nines is a popular goal: 99.999% availability, meaning downtime under 5.26 minutes a year. Steps toward it are standardised systems (same components, easy swapping), clustering (several devices appear as one) and shared component systems (a whole system can stand in for a failed one).

N+1 redundancy means the N components that are needed have at least one backup (+1). A car has four tyres (N) and a spare (+1). It still is not a fully redundant system.

RAID spreads data that would sit on one disk across several drives. Except for RAID 0, if one disk is lost the data can be recovered from the others, and multiple drives can retrieve data faster than one. Hardware RAID needs a specialised controller; software RAID is run by utility software in the OS. There are three building blocks.

Mirroring

Stores data, then duplicates it on a second drive.

Striping

Writes data across several drives so consecutive segments sit on different drives.

Parity

Striping with parity: after striping, checksums are generated to check for errors and stored on a third drive.

Fault tolerance lets a system keep operating if components fail; data mirroring is an example. System resiliency is keeping data and services available despite attacks or disruptive events. For application resilience, three solutions rise in complexity and cost with availability: fault tolerant hardware (multiples of every critical component in one computer), cluster architecture (servers acting as a single system) and backup and restore.

Resilience also covers power and cooling. Put data centres on a different power supply from the rest of the building, use redundant feeds, power conditioning, backup power and a UPS to shut systems down gracefully. HVAC keeps the facility's temperature, humidity and airflow safe for people and equipment.

• —SCADA and ICS run manufacturing, energy and communications. The Stuxnet worm targeted SCADA systems. Prevent this by segregating the SCADA network from the organisation's LAN.
• —IoT devices greatly expand the attack surface and have been used in some of the largest DDoS attacks. Before connecting one, make sure it can update firmware and change default credentials. Also secure the wireless network and know what is on it.
• —Embedded systems (smart TVs, HVAC controls, medical devices, cars) are open to timing attacks: attackers study how long the system takes to respond. This is a side-channel attack, which uses information from the implementation, such as timing, power use, electromagnetic leaks or sound.
• —VoIP security is only as good as the underlying network. Encrypt voice packets, use SSH on gateways and switches, change default passwords, use an IDS to catch ARP poisoning, use strong authentication against registration spoofing, proxy impersonation and call hijacking, and use VoIP-aware firewalls.
• —Special-purpose systems: medical (pacemakers, insulin pumps: patient safety, record leaks, a network foothold); automotive (tracking, jamming, spoofing: secure design, encrypted controller traffic, firewall); aviation (hard-coded logins, insecure protocols, backdoors) and drones (hijacking, GPS spoofing, jamming, deauthentication).

Deception technologies add a fake layer to the infrastructure to distract attackers from the production network, to learn their methods and to warn of attacks. A honeypot is a decoy that attracts and records attackers. A DNS sinkhole is the other common tactic.