Data Center Security Overview

Dr. Natheer Khasawneh

Ziad BashaBsheh
Data Center Security Overview
Provides an overview of the typical security issues that affect DCs and
presents the general guidelines to secure DC in a systematic manner that
helps maintain as adequate security level as the DC evolves.

The Importance of security policies, secure management, incident
response, and attack mitigation.

The Need for a Secure Data Center
Losing data and applications can impact the organizations ability to
conduct business.
The large volume of information and the criticality of the services housed
in DCs make them likely target.
Denial of Service, theft of confidential information, data alteration, and
data loss are some of the common security problems afflicting Data
Center Environments.
Data Center Security Overview (cont)
The Need for a Secure Data Center

Applications become more complex, there are more chances for
inconsistent installations.

Hackers use the openness of the internet to communicate and develop
automated tools the facilitate the identification and exploitation of those
vulnerabilities.

Many attacks tools are widely available on the internet and are designed
to execute highly sophisticated attacks using simple user interfaces.
Vulnerabilities & Common Attack
The following terms are important to define in the context of security in
data centers:
Threat An event that poses some harm to the data center or its
resources
Vulnerability A deficiency on a system or resources whose exploitation
leads to the materialization of the threats
Attack the actual exploitation of a vulnerability to make threat reality.
-----
Threats
The following are some of the most common threats to Data Center:
DoS.
Breach of Confidential Information.
Data theft or alteration.
Unauthorized use of Compute resources.
Identify theft.
Vulnerabilities & Common Attack (cont)
Vulnerabilities Most of Vulnerabilities found today originated in at least
one of the following areas:
Implementation Software and protocols flows, incorrect or faulty
software design, incomplete testing, etc.
Configuration - Elements not properly configured, use of default, and so
on.
Design ineffective or inadequate security design, lack of or
inappropriate implementation of redundancy mechanisms, etc.

common source Problems:
Exploitation of Out-of-Date software.
Exploitation of software default.


Vulnerabilities & Common Attack (cont)
Common attacks After talking about Threats and Vulnerabilities, we will
discuss how they are exploited by the most frequent attacks.
Scanning or Probing this activity precedes an attack to gain access by
discovering information about system or network.
- The term of probe refers to an individual attempts, whereas a scan
consists of a large number of probes by an automated tool.
DoS- the goal of DoS attack is to degrade service to the point that
legitimate users are unable to conduct their regular activities.
- Ex: SYN flood ( TCP ) , Smurf attack(ICMP), Ping of Death (ICMP).
DDoS Distributed denial of service attacks are a particular case of DoS
attacks where a large number of systems are compromised
-Ex-Tools: Trinoo, Tribe Flood Network (TFN), Stacheldraht.

Similarly to Dos attacks in Data Centers, DDoS attacks target servers
rather than the network infrastructure.


Vulnerabilities & Common Attack (cont)
Common attacks ( Continued)

Unauthorized access consists of gaining access to restricted resources by using
a valid account or a backdoor.
- Ex: network intrusion( external intruder gain access to internal network
resources), Backdoors, IP Spoofing.
Eavesdropping - is the unauthorized interception of information that travels on
the network, this information might contain confidential data such as username
and password. Another example is packet capturing.
Viruses & Worms both cases of malicious code, hidden in the system until the
damage is discovered.
The difference between viruses and worms is the way they auto-replicate, Worms
are also self-replicating programs that propagate without any human
intervention.
Viruses are also self-replicating programs but need kind of action.
- Ex: CodeRed, Nidma, SQL Slammer (are Examples to worms).


Vulnerabilities & Common Attack (cont)
Common attacks ( Continued)
Internet infrastructure attack target to internet infrastructure rather
than individual systems or networks.
-Ex: DNS attacks, Ping flood, all kinds of DDoS.
Trust Exploitation - these attacks exploit the trust relationships that
computer systems have to communicate.
- Communications in networked environments are always based on trust.
For example; when a web-server communicates with a back end database.
Session Hijacking consists of stealing a legitimate session established
between a target and trusted host.
-Ex: IP spoofing, TCP SYN/ACK.
Buffer overflow attacks occurs when a program allocates memory
buffer space beyond what it had reserved.


Vulnerabilities & Common Attack (cont)
Common attacks ( Continued)

Layer 2 attacks exploits the vulnerabilities of data link layer protocols
and their implementations on layer 2 switching platforms, one of the
characteristics of layer 2 attacks is that the attacker must be connected to
the same LAN as the victims.

-Ex: Address Resolution Protocol (ARP) Spoofing, MAC Flooding.


Network Security Infrastructure
The network security infrastructure includes the security tools used in the
Data Center to enforce security policies. The tools include packet-filtering
technologies such as ACLs and firewalls and intrusion detection systems
(IDSs) both network-based and host-based. The following sections discuss
these security tools.

ACLs are filtering mechanisms explicitly defined based on packet harder
information to permit or deny traffic on specific interfaces.

An ACL is typically set up as a list that is applied sequentially on the
packets until a match is found.



Network Security Infrastructure (cont)
FireWalls are a sophisticated filtering device that separates LAN
segments.

The considerations are as follows:
Performance,
Application support,

There are different types of firewalls based on their packet-processing
capabilities and their awareness of application-level information:
Packet-filtering firewalls.
Proxy firewalls.
Stateful firewalls.
Hybrid firewalls.



Network Security Infrastructure (cont)
IDSs are real time systems that can detect intruders and suspicious activities and
report them to a monitoring system.

IDSs have two fundamental components:
Sensors, Appliances and software agents that analyze the traffic on the network or the
resource usage on end systems to identify intrusions and suspicious activities. Sensors can
be network-based or host-based.
IDS management, Single- or multi-device system used to configure and administer sensors and to
additionally collect all the alarm information generated by the sensors

Typical IDS response Actions
Most IDSs are capable of responding to identified security incidents using specific
mechanisms:
IP session Login This response is the least aggressive response and consists of
logging the entire IP session that corresponds to a detected intrusion.
TCP rests- you can configure the IDS to generate TCP rests on behalf of a victim
system.
Shunning or blocking- The IDS can instruct a network device such as a router, switch,
or firewall to dynamically apply an ACL to block the traffic coming from an attacker.




Network Security Infrastructure (cont)
Layer 2 Security
components:
Port Security, is a feature that permits you to configure a switch port to only
accept packets coming with a trusted source MAC address.

ARP Inspection, is a feature that lets you specify the mapping between the
default gateway IP address and its MAC address, this process prevents ARP
spoofing attacks known as man-in-the-middle attacks.

Private VLANs permit the isolation of ports from one another within the
same VLAN.



Security Fundamentals
This section discusses fundamental security concepts such as
encryption, AAA ( Authentication, Authorization, and accounting;
and VPNs.
components:
Cryptography, is simply the science of encryption and decrypting information,
secure transactions from client to server, secure communication between a user and
managed device, and secure communication channel between two sites, and so on.

Cryptography is typically associated with :
Confidentiality.
Integrity.
Nonrepudiation.
Authentication.
Antireplay protection. - used at the IP packet level to ensure that packers
are not intercepted, modified, and inserted back in the communication
stream between client and server.




Security Fundamentals (cont)
Data Center security uses encryption with two primary purposes:
To protect the confidentiality of users data
To secure the communications over the management infrastructure

Encryption algorithms:
Symmetric encryption.






Security Fundamentals (cont)
Encryption algorithms:
Asymmetric encryption. For Confidentiality






Security Fundamentals (cont)
VPN Virtual Private Networks.
Described as a virtual link between two entities that allows them to communicate
securely over a public network like the internet.
VPN use tunneling technologies combined with encryption and authentication
services.

There are two main applications for VPN:
Site-to-Site- provides the communication between two distinct locations
using routers or VPN concentrators.

Remote access- allows remote users to access a central location via a secure
communication channel between end users and VPN router or VPN concentrator.





Security Fundamentals (cont)
AAA.
AAA is a framework that defines the control of access to network resources such
as those in Data Centers (routers, switches, firewalls, servers, and so on).

AAA provides three basic services:
Authentication proves that a user is who she or he claims to be.

Authorization- Defines what a user is allowed to do.

Accounting Consists of keeping records of user activity.





Data Center Security Framework
Data Center Security Framework.
This section explains the key components of a sound security framework from a
system-planning perspective. Because the details of applying these components
to the network are driven by the particular business needs of an organization

Security Policies - The security policy defines what activities are
considered acceptable or unacceptable by the organization.

Security Life Cycle is the constant evaluation cycle that refines
the state of security readiness and adapts the security policy to the
network architecture.






Data Center Security Framework (cont)
The following security life cycle is often quoted and well understood
in the security industry:
Assess
Design
Deploy
Maintain







Data Center Security Framework (cont)
Assessment The process of auditing, testing, and verifying the system
vulnerabilities through risk analysis.

Design - The process of applying the security policy and requirement resulting
from the assessment process to the security design.

Deployment - The process of the implementing the specific security design
recommendation into the network architecture.

Maintenance - The process of keeping the application of security policies
consistent through out the network by monitoring that the best practices and
recommendations, are in effect.







Data Center Security Framework (cont)
Secure Management Framework: The following steps help you for
more securing:

Isolating the Management infrastructure -

Encryption of Control Data

Strong Authentication for Access Control -