General Design Considerations for Secure Networks

Chapter Description

At the beginning of any secure network design project, many best practices apply more or less uniformly to all areas of the design. This article by Sean Convery presents these practices in a single location.

References

• Arkin, O. "ICMP Usage in Scanning." http://www.sys-security.com/archive/papers/ICMP_Scanning_v2.5.pdf

• arpwatch. http://www-nrg.ee.lbl.gov/

• Baker, F., and R. Atkinson. RFC 2082, "RIP-2 MD5 Authentication." http://www.ietf.org/rfc/rfc2082.txt

• Cisco ACL Fragmentation Issues. http://www.cisco.com/warp/public/105/acl_wp.html

• Cisco Documentation: ARP Inspection.

• Cisco Documentation: DHCP Snooping. http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/12_1_13/config/dhcp.htm

• Cisco Documentation: PIX Static Command. http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/s.htm#1026694

• Cisco Documentation: Port Security. http://cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_5_4/config/sec_port.htm

• Cisco Documentation: Private VLANs.

• Cisco Documentation: TCP Intercept. http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/ftrafwl/scfdenl.htm

• Cisco Documentation: Unicast RPF. http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/fothersf/scfrpf.htm

• Convery, S. "Hacking Layer 2: Fun with Ethernet Switches." http://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf

• DHCP DoS. http://packetstormsecurity.org/DoS/DHCP_Gobbler.tar.gz

• dsniff. http://monkey.org/~dugsong/dsniff/

• Ferguson, P., and D. Senie. RFC 2827, "Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing." http://www.ietf.org/rfc/rfc2827.txt

• Greene, B., C. Morrow, and B. Gemberling. "ISP Security—Real World Techniques." http://www.nanog.org/mtg-0110/greene.html

• Heffernan, A. RFC 2385, "Protection of BGP Sessions via the TCP MD5 Signature Option." http://www.ietf.org/rfc/rfc2385.txt

• IANA IPv4 Address Allocation. http://www.iana.org/assignments/ipv4-address-space

• Kuhn, M. and R. Anderson. "Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations." http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf

• Kuhn, Markus G. "Optical Time-Domain Eavesdropping Risks of CRT Displays." http://www.cl.cam.ac.uk/~mgk25/ieee02-optical.pdf

• Malkin, G. RFC 1723, "RIP Version 2 Carrying Additional Information." http://www.ietf.org/rfc/rfc1723.txt

• Morrow, C., and B. Gemberling. "Backscatter DDoS Traceback." http://www.secsup.org/Tracking/

• Morrow, C., and B. Gemberling. "Enabling Black Hole Filtering for Customers." http://www.secsup.org/CustomerBlackHole/

• Moy, J. RFC 2328, "OSPF Version 2." http://www.ietf.org/rfc/rfc2328.txt

• Neil Jr. "Spy Agency Taps into Undersea Cable." Wall Street Journal. http://zdnet.com.com/2100-11-529826.html

• Ping of Death. http://www.insecure.org/sploits/ping-o-death.html

• Portable Keystroke Logger. http://www.thinkgeek.com/stuff/gadgets/5a05.shtml

• Rekhter, Y., B. Moskowitz, D. Karrenberg, G. J. de Groot, and E. Lear. RFC 1918, "Address Allocation for Private Internets." http://www.ietf.org/rfc/rfc1918.txt

• SYN Cookies. http://cr.yp.to/syncookies.html

• Taylor, David. "Are There Vulnerabilities in VLAN Implementations?" http://www.sans.org/resources/idfaq/vlan.php

• Thomas, Rob. "Bogon List." http://www.cymru.com/Documents/bogon-list.html

• Thomas, Rob. "ICMP Filtering Guidelines." http://www.cymru.com/Documents/icmp-messages.html

• VLAN 1 Considerations. http://www.cisco.com/warp/public/473/103.html

• van Eck, Wim. "Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk?" http://www.shmoo.com/tempest/emr.pdf