satellite or radio, to Coordinated Universal Time (UTC). However, if network administrators do not want to implement their own master clocks because of cost or other reasons, clock sources are available for synchronization via the Internet. The current version of NTP is version 4. The latest version defined by an RFC is version 3, which is recommended from a security perspective. An attacker could attempt a DoS attack on a network by sending bogus NTP data across the Internet in an attempt to change the clocks on network devices in such a manner that digital certificates are considered invalid. An attacker could also attempt to confuse a network administrator during an attack by disrupting the clocks on network devices. This scenario makes it difficult for the network administrator to determine the order of syslog events on multiple devices.
Content 5.3 Network Attacks Using Intelligence 5.3.5 Management Protocol Best Practices Figure summarizes best practices to be followed when implementing a secure management solution. These are recommendations for the correct use of SNMP tools: When possible, the following management practices are advised: The following are recommendations to follow when using NTP:
Content 5.3 Network Attacks Using Intelligence 5.3.6 Determining Vulnerabilities and Threats You can use several tools and techniques to find vulnerabilities in your network. Once you identify the vulnerabilities, you can consider and implement mitigation steps as appropriate. Use these tools listed in Figure to determine vulnerabilities: Note
As of June, 2006, Ethereal is now known as Wireshark. Blue’s Port Scanner and Wireshark
Figure shows screen captures from Blue’s Port Scanner and Wireshark. The window on the left illustrates a TCP host scan and a resulting list of open TCP ports produced by Blue’s Port Scanner. Blue’s Port Scanner has been used in this example to scan a single host with the address 10.1.1.2. The TCP scan shows that SMTP, HTTP, FTP, HTTPS, EPMAP, and NETBIOS-SSN are open on that host. The image on the right shows an example of a packet capture using Wireshark. Wireshark allows you to specify various options, such as which adapter is used for sniffing and which packet filters to apply to the capture. In the figure, you see a number of packets of different protocols, each of which can be individually investigated in detail. Caution
Limit the scope of the testing when using Port Scanner or Wireshark so that you do not cause a DoS attack against your network. Microsoft Baseline Security Analyzer
Figure illustrates the results of a host vulnerability scan using the MBSA. MBSA is an easy-to-use tool that identifies security vulnerabilities of hosts that are running Microsoft operating systems. This tool allows you to scan the local host, on which MBSA is running, or any remote systems. The program provides a list of found vulnerabilities that can be sorted using different criteria. The tool provides a description of each detected vulnerability and recommends methods to fix the vulnerability. Web Links Blue’s Port Scanner
http://www.bluebitter.de/portscn2.htm Wireshark
http://www.wireshark.org/ Microsoft Baseline Security Analyzer
http://www.microsoft.com/technet/security/tools/
mbsahome.mspx Nmap
http://insecure.org/nmap/
Content 5.4 Disabling Unused Cisco Router Network Services and Interfaces 5.4.1 Vulnerable Router Services and Interfaces Medium size and large networks typically use a firewall appliance behind the perimeter router, which adds security features and performs user authentication and more advanced packet filtering. Firewall installations also facilitate the creation of Demilitarized Zones (DMZs) where the firewall places hosts that are commonly accessed from the Internet. Cisco IOS software offers an alternative to a firewall appliance by incorporating many firewall features in the perimeter router. Although this option does not provide the same performance and security features that a Cisco PIX