Untangle Network Security

Secure your network against threats and vulnerabilities using the unparalleled Untangle NGFW
1. Auflage 2025
ISBN: 978-1-84951-773-7
Verlag: De Gruyter
Format: PDF
Kopierschutz: Adobe DRM (»Systemvoraussetzungen)

E-Book, Englisch, 368 Seiten

If you are a security engineer or a system administrator and want to secure your server infrastructure with the feature-rich Untangle, this book is for you. For individuals who want to start their career in the network security field, this book would serve as a perfect companion to learn the basics of network security and how to implement it using Untangle NGFW.

Fachgebiete

• Mathematik | Informatik EDV | Informatik Computerkommunikation & -vernetzung

Leseproben

An overview on information security

If you have a public IP, you and your company may be the next victim of the cybercrime business. 75 percent of Internet traffic is malicious (https://wiki.cac.washington.edu/download/attachments/7479159/White_Paper_6-Feb26-round2-AS-BE+DRAFT.doc) and the cybercrime business value equals 105 USD billion, which surpasses the value of the illegal drug trade worldwide. In addition, most of the cybercrime attacks are determined, not just opportunistic, and they include the theft of IDs, trade secrets, research and development, and so on. So, you must be ready.

The CIA triad

Your role as a security administrator is to protect the information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability. The CIA triad is explained as follows:

• Confidentiality: Ensuring that the data or an information system is accessed by only an authorized person
• Integrity: This means protecting data from modification or deletion by unauthorized parties
• Availability: Ensuring that data and information systems are available when required

Types of attacks

The attacker's target is to compromise one or more attributes of the CIA triad, which will allow him to gain access to confidential data and steal it. He may be interested in manipulating data by deleting or modifying some parts of it. Also, his target may be to reduce or interrupt the availability of your services, which could highly impact your reputation. Common methods and attacks that are used by attackers are as follows:

• Malware: This is a short name for malicious software. This is used or created to disrupt computer operations, gather sensitive information, or gain access to private computer systems. Some malware types are as follows:
  • Virus: This attaches itself to legitimate applications. Viruses can be used to cause direct damage such as prevent the computer from booting or to open some ports and services, which can be used by the attacker to gain access or steal data. They can replicate themselves and spread from one computer to another.
  • Worm: This is a standalone malware program that has the same damage properties of the viruses. However, unlike viruses, it does not need to attach itself to an existing program.
  • Rootkit: This is a program or a set of programs that usually have kernel level access and effectively can hide from antivirus programs.
  • Spyware: This collects information about what the user is doing and what data is on the user's computer and feeds it to the remote party, which could take advantage of this information. The spyware programs usually change the default search engine and the default home page.
  • Keylogger: This records the key stroke entered by the user. This can be used by the attacker to capture the user's login credentials.
  • Backdoor: This allows the attacker to bypass normal authentication and get remote control of the victim's computer, while attempting to remain undetected.
  • Trojan horses: This type of malware masquerades as a legitimate file or helpful program but the real purpose is to grant unauthorized access to a computer to the hacker. For example, you may download and install a screensaver that will install backdoors to your system.
  • Botnet: This is a collection of Internet-connected computers whose security defenses have been breached and controlled by a malicious party. The set of breached computers could be used to initiate huge attacks.
  • Adware: This is a software installed on the user's computer that will periodically pop up an advertisement that encourage users to buy some products, which is considered to be an annoying and disturbing action.
• Phishing: The act of attempting to acquire information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an e-communication. For example, you may receive a fake e-mail (which looks like it was from your bank) informing you that your password has expired and asking you to change it by logging to the bank using a link that will redirect you to a malicious website (which also looks like as the original bank website). The fake website will capture your login credentials.
• Spear-phishing: This is a phishing attempt directed at specific individuals or companies.
• Whaling: This is a phishing attempt directed to a company's executives.
• Spam: This is an unwanted e-mail that usually includes advertisements, malicious attachments with malware, and phishing links.
• Denial of Service (DoS) attack: The attacker tries to make the server unable to respond to customer requests by overloading the server with many requests. The same is also true for applications/services hosted by this server as the attacker may be interested in disabling certain application not the whole server. For example, attacking an Apache HTTP server that's hosting the web service.
• Distributed Denial of Service (DDoS) attack: This is the incitation of a DoS attack from multiple computers instead of only one machine. The DDoS attack usually includes the usage of a botnet.
• Smurf attack: An example of a smurf attack is when the attacker sends a broadcast ping request to your network. If the attacker did address spoofing, your network devices will send the ping replies to the spoofed address, which will lead to a DDoS attack.
• Man-in-the-middle attack: In this attack, traffic between two devices is passed through a rouge device controlled by the attacker. Thus, the attacker can get the original traffic and read the data if the communication is unencrypted, even he may inject malware to the traffic.
• Privileges escalation: The attacker will use vulnerability in the operating system or applications to get higher access privileges (for example, root access).
• Xmas attack: This is used to get more information from the network scan. So instead of the normal ping and port scans, the xmas attack can analyze the TCP response of the target systems and get more detailed information such as the operating system version and the services running.
• Typo squatting / URL hijacking: As a result of typing an error, a user may go to a malicious website. For example, the user may type instead of .

Types of controls

The following are three different types of controls we need to implement to keep our network and systems safe:

• Technical: This includes the use of technology (that is, software and devices) to reduce vulnerabilities; common technical controls include the usage of security software and devices, access control systems, authentication systems, and encryption.
• Management: This is also known as administrative controls. This includes the assessment of risks and vulnerabilities, planning, and writing a security policy.
• Operational: This deals with day-to-day procedures and policies that the users should follow. An example of operational controls is change management.

  Note

  
  

  A list of 20 critical security controls can be found at http://www.sans.org/critical-security-controls/.

Defense in depth

We should use the defense in depth concept in which multiple layers of security controls (defenses) are placed through our network. Some of defense in depth techniques are as follows:

• Layered defense: This sets your defense at multiple stages (such as network edge and individual PCs) instead of using only one layer of defense. If that one layer of defense fails, you will be an easy victim for attackers. So, use an antivirus at network edge to protect against downloaded threats and a desktop antivirus to mainly protect against threats coming through the internal network.
• Multiple tools: These make the attacker's job harder by using firewalls, antivirus programs, intrusion detection systems, intrusion prevention...

Über Autor(innen)

El Monem A Mohamed El Bawab Abd :

Abd El-Monem A. El-Bawab is a systems engineer with a passion for security. He has about 3 years of experience in the IT field. He is MCITP 2008 Server Administrator, MCSA 2012, MCSE Server Infrastructure, MCSE Private Cloud, and ITIL certified. He has considerable experience in Untangle's Firewall, TMG, McAfee Sidewinder, Trend Micro Worry-Free Business Security Services, Symantec Endpoint Protection, Symantec Backup Exec, Hyper-V, System Center Suite, ESXi, Citrix XenServer, VDI, Windows Servers, Active Directory, Exchange Server, Office 365, and SMART Service Desk. You can follow him on Twitter at @Eng_Monem and visit his blog at amagsmb.wordpress.com.