Module - 3 - Device Configuration ISM.ppt

Device Configuration ISM

1. BCSE354E: Information
Security Management
Device Configuration
A. Avinash, Ph.D.
School of Computer Science and Engineering
Vellore Institute of Technology (VIT), Chennai

2. Common issues in installing or
configuring information security devices
Installing and configuring information security devices can be a complex task,
and various issues may arise during the process. Here are some common
issues and methods to resolve them, along with examples:
Common Issues:
•Device Compatibility:
–Issue: Incompatibility between the security device and existing
infrastructure.
–Example: The firewall being installed is not compatible with certain
network protocols in use.
•Incomplete Installation:
–Issue: Missing components or incomplete installation of the security
device.
–Example: Some modules of an intrusion detection system (IDS) are not
installed or configured properly.

3. Common issues in installing or
configuring information security devices
•Incorrect Configuration:
–Issue: Misconfigurations in settings or policies leading to ineffective
security.
–Example: Misconfigured firewall rules allowing unintended traffic.
•Integration Challenges:
–Issue: Difficulties integrating the security device with other security
solutions.
–Example: Issues integrating an identity management system with a
network access control (NAC) solution.
•Firmware/Software Updates:
–Issue: Failure to update firmware or software to the latest version.
–Example: Not applying critical security patches to a next-gen firewall.

4. Common issues in installing or
configuring information security devices
•Performance Issues:
–Issue: Degraded network performance after deploying the security
device.
–Example: Insufficient bandwidth allocation for a web application
firewall (WAF) causing latency.
•Lack of Training:
–Issue: Personnel not adequately trained to configure or manage the
security device.
–Example: Security administrators are not familiar with advanced
features of an intrusion prevention system (IPS).

5. Methods to Resolve Issues
•Thorough Pre-Deployment Planning:
–Method: Conduct a comprehensive assessment of the existing infrastructure and
ensure compatibility before deployment.
–Example: Perform a network audit to identify potential compatibility issues with a
new firewall.
•Follow Installation Guides and Documentation:
–Method: Adhere strictly to the installation guides and documentation provided by
the device vendor.
–Example: Refer to the step-by-step installation guide when deploying a new
antivirus solution.
•Configuration Audits:
–Method: Regularly conduct configuration audits to identify and rectify
misconfigurations.
–Example: Use a security configuration management tool to scan and identify any
insecure configurations in firewalls.

6. Methods to Resolve Issues
•Interoperability Testing:
–Method: Test the interoperability of the security device with existing systems
before full deployment.
–Example: Verify that a new encryption device works seamlessly with other
network security devices.
•Regular Updates and Patch Management:
–Method: Establish a routine for applying firmware and software updates.
–Example: Implement an automated patch management system for a network
firewall to ensure timely updates.
•Performance Tuning:
–Method: Fine-tune the device settings to balance security with optimal
performance.
–Example: Adjust the configuration of a load balancer to optimize traffic flow
without compromising security.

7. Methods to Resolve Issues
•Training and Skill Development:
–Method: Invest in training programs for IT personnel responsible for
managing security devices.
–Example: Provide cybersecurity training for administrators responsible
for configuring and maintaining an intrusion detection system.
•Engage Vendor Support:
–Method: Contact the vendor's support team for assistance in
troubleshooting and resolving issues.
–Example: Open a support ticket with the firewall vendor when
encountering difficulties in configuring advanced features.

8. Troubleshoot Firewall Problems
1) Ping a PC near the device
2) Ping the device
3) Telnet and/or browse to the device
4) Confirm the port configuration of the device
5) Confirm that important IP addresses are not
blocked
6) Trace the route to the device

9. Troubleshoot Firewall Problems
1) Ping a PC near the device
•A simple ICMP ping to a PC near the device is a good
initial test to determine connectivity status and network
performance issues.
•ICMP ping is an IP-based signal sent from one device
to another.
•If the target device receives the "ping" from the source
device, it will (if configured to do so) respond to
confirm that is active and connected to the network.
•It's a simple way of confirming that a device is online.

10. Troubleshoot Firewall Problems
•Check for firewalls and firewall configurations,
especially those that block UDP, SNMP, pings, or
ports 161 or 162.
•Some networks block all ping traffic as a security
measure.
2) Ping the device
–Next, send another simple ICMP ping to the device
to determine connectivity.
–If pings to the PC in Step 1 were successful, but
pings sent to the device fail, the problem is almost
certainly with your SNMP device.

11. Troubleshoot Firewall Problems
3) Telnet and/or browse to the device
–If the SNMP device are testing supports Telnet
connections or Web access, should attempt to connect
using one of these methods.
–If pings succeed but Telnet and/or browsing is blocked,
this is indication that you have a firewall issue.

12. Troubleshoot Firewall Problems
4) Confirm the port configuration of the device
–For additional security, some SNMP devices may use
non-standard ports to obstruct unauthorized SNMP
traffic. If so, make sure that these ports are not blocked
by a firewall and are accepted by the manager.
–Another potential solution is to reconfigure the device to
use standard ports.
5) Confirm that important IP addresses are not blocked
–A firewall may simply be blocking the IP address of your
device and/or manager.
–Confirm that these or any other needed IP addresses are
not being blocked.

13. Troubleshoot Firewall Problems
6) Trace the route to the device
–Tracing the "hops" that network traffic is following to reach
the device can allow you to pinpoint a tricky firewall issue.
A simple trace can be performed from the Command
Prompt of Windows XP:
•Open a Command Prompt in Windows XP.
•Type "tracert", a single space, and the IP address of the
device you are trying to reach (i.e. "tracert
192.168.230.143")
•Press return to start the trace.
•Show the output to IT department to identify potential
firewall problems.

14. Troubleshooting Routers
•Basic Faults
- Physical Layer Stuff
- Check the Interfaces
- Ping
- Check the Routing Table
- Is there a Firewall on the Computer?
- Any Access Lists?
- Is the VPN Up?
- Do the Protocols Match?
- Check for Human Error
- Verify Settings

15. Common Router problems
•Physical Layer Stuff:
–Check power issues. Look for power lights, check plugs,
and circuit breakers.
•Check the Interfaces:
–show ip interface brief or show ipv6 interface brief
•Ping:
–Use the ping and trace commands to check for
connectivity.
•Check the Routing Table:
–show ip route or show ipv6 route

16. Common Router problems
•Is there a Firewall on the Computer?
–If the problem involves a computer, check to ensure that
its firewall is not blocking packets.
•Any Access Lists?
–check for access-control lists that block traffic.
•Is the VPN Up?
–If a VPN is part of the connection, check to ensure that it
is up.
•Do the Protocols Match?
–If you are trying to gain remote access to a server, ensure
that it supports the protocol you’re attempting to use.

17. Common Router problems
•Check for Human Error:
–Check to ensure that correct usernames and passwords
are being used,
–same network addresses and matching subnet masks.
•Verify Settings:
–Do not make assumptions. Verify everything!

18. Router solutions
1.Correct Wi-Fi Security Settings
2.Update Hardware or Firmware
3.Fix Overheating or Overloading
4.Remove MAC Address Restrictions
5.Check Wireless Signal Limitations

19. Router solutions
1.Correct your Wi-Fi Security Settings
–Network Mode: 
The router must be allowed to accommodate
all Wi-Fi models used by network clients. For example,
routers designed to run in 802.11g mode only will not support
802.11n or old 802.11b devices. Adjust the router to run in
mixed mode to remedy this kind of network failure.
–Security mode: 
Most Wi-Fi devices support several network
security protocols
 (typically different variations of WPA and
WEP). All Wi-Fi devices, including routers belonging to the
same local network, shall use the same protection mode.
–Security key:
 Wi-Fi security keys are phrases or sequences of
letters and digits. All devices that enter the network must be
configured to use the Wi-Fi key recognized by the router (or
wireless access point).

20. Router solutions
2. Update your Hardware or Firmware
–The reason for this step is twofold. You can take benefit
of any additional features and improvements of the new
version of the firmware. Also, your router will normally
receive any critical security updates.
–Typically, you will have the choice of checking,
evaluating, downloading, and installing the latest
firmware on your router's administration tab. The exact
steps depend on the make and model of your router, so
check the specifics of the router manufacturer's support
site.

21. Router solutions
3. Fix Overheating or Overloading
–You can set up a different
 Wi-Fi router or allow the
"Guest Network" option for your router.
–You can also set up a separate SSID and password for
your host network to avoid issues with your main
network.
–This segregation would also work with your smart
appliances and secure your key devices from attacks on
the Internet of Things.
–You can also use QoS (Quality of Service). QoS is a
feature on some routers that lets you prioritize traffic
according to the type of data being transmitted.

22. Router solutions
4. Remove MAC Address Restrictions
–A number of network routers support a function called
MAC address filtering.
–While disabled by default, router administrators can turn
this function on and limit connections to only those
devices by their MAC address number.
–Check the router to ensure that either the MAC address
filtering is off or the MAC address of the computer is
included in the list of allowed connections.

23. Router solutions
5. Check Wireless Signal Limitations
–If you have a newer router, check if it supports the 5GHz
band. Newer routers typically have dual-band
capabilities.
–By allowing dual bands, you could hold older devices
that only support slower G specification on the 2.4GHz
band and newer devices on the beefier and faster 5GHz
band.
–Essentially, this is like having two routers in one.

24. Methods of testing installed/configured
information security devices
•Penetration Testing:
–Method: Simulate a real-world cyberattack to identify vulnerabilities.
–Example: A penetration tester attempts to exploit weaknesses in a
firewall's configurations by probing for unauthorized access points.
•Vulnerability Scanning:
–Method: Use automated tools to scan the network for known
vulnerabilities.
–Example: Employing a vulnerability scanner to identify unpatched
software versions on a network firewall.
•Traffic Analysis:
–Method: Monitor network traffic for anomalies and patterns.
–Example: Analyzing network logs to detect unusual spikes in traffic that
might indicate a potential Distributed Denial of Service (DDoS) attack.

25. Methods of testing installed/configured
information security devices
•Protocol Testing:
–Method: Test the device's handling of various network protocols.
–Example: Verifying that an Intrusion Detection System (IDS) correctly
interprets and responds to different network protocols.
•Firewall Rule Review:
–Method: Audit and review firewall rules for effectiveness.
–Example: Examining firewall rules to ensure that only necessary ports are
open and that rules follow the principle of least privilege.
•IDS/IPS Testing:
–Method: Simulate attacks to assess IDS/IPS detection and prevention
capabilities.
–Example: Testing an Intrusion Prevention System by attempting to exploit
vulnerabilities and assessing the device's ability to block malicious activities.

26. Methods of testing installed/configured
information security devices
•Log Analysis:
–Method: Analyze logs for security events and anomalies.
–Example: Reviewing firewall logs to identify and investigate any unusual
outbound connections or potential security incidents.
•Red Team vs. Blue Team Exercises:
–Method: Simulate adversarial attacks (Red Team) to evaluate defensive
responses (Blue Team).
–Example: Conducting a red team exercise to simulate a phishing attack and
observing how the security team responds and mitigates the threat.
•Encryption and Decryption Testing:
–Method: Verify the correct functioning of encryption and decryption
processes.
–Example: Testing a Virtual Private Network (VPN) to ensure that encrypted
traffic is transmitted securely and decrypted accurately.

27. Methods of testing installed/configured
information security devices
•Load Testing:
–Method: Subject the device to heavy loads to assess performance under
stress.
–Example: Conducting load testing on a firewall to evaluate its performance
during peak traffic periods.
•Update and Patch Testing:
–Method: Apply updates or patches and assess their impact on functionality.
–Example: Updating antivirus definitions on endpoint protection devices
and verifying that the updates do not interfere with normal operations.
•User Authentication Testing:
–Method: Verify the effectiveness of user authentication mechanisms.
–Example: Testing multi-factor authentication to ensure that only authorized
individuals can access critical systems.