uCertify Articles » CIW Certified Security Analyst http://www.ucertify.com/article Just another WordPress weblog Wed, 04 Nov 2009 00:00:00 +0000 http://wordpress.org/?v=2.8.4 en hourly 1 What is OSPF? http://www.ucertify.com/article/what-is-ospf.html http://www.ucertify.com/article/what-is-ospf.html#comments Sun, 01 Nov 2009 00:00:00 +0000 uCertify 2101094

Open Shortest Path First (OSPF) is a routing protocol that is used in large networks. Internet Engineering Task Force (IETF) designates OSPF as one of the Interior Gateway Protocols. A host uses OSPF to obtain a change in the routing table and to immediately multicast updated information to all the other hosts in the network.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-ospf.html/feed 0 Secure Internetwork Communication By Using Packet Filtering http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html#comments Thu, 29 Oct 2009 00:00:00 +0000 uCertify 1401369

The Windows Server 2003 operating system is designed to work on a network. It receives traffic from other computers over the network. Based on the request made, it takes a decision to route packets to use its services, and processes the request sent by the client. Any computer, when accessible for communication, is also a security risk, if it is accessible from the Internet too. A server accessible from the Internet is open to all clients that can connect to it. An unauthorized user can attempt to access the system for many destructive purposes. The most common of them are listed below:

  • Accessing confidential data.

  • Implementing software of its own.

  • Preventing others from using the server.

The most used technique to prevent such intrusions is to use packet filtering.

Packet Filtering

Packet filtering is a method that allows or restricts the flow of specific types of packets to provide security. It analyzes the incoming and outgoing packets and lets them pass or stops them based on the IP addresses of the source and destination. Packet filtering provides a way to define precisely which type of IP traffic is allowed to cross the firewall of an intranet. IP packet filtering is important when users from private intranets connect to public networks, such as the Internet.

A server implementing the filter examines each packet as it arrives and determines whether it meets the criteria for fulfilling its request. Packets that do not meet the criteria are discarded. For example, if an administrator is configuring a server that will be used as an e-mail server, he should create a filter to allow packets that are addressed to port number 25 and port number 110. This is because e-mail servers use the Simple Mail Transfer Protocol (SMTP) and the Post Office Protocol 3 (POP3). The SMTP and POP3 protocols use ports 25 and 110 respectively for communication. If a suspected intruder tries to attack the server, the server will examine the packets sent by him and discard the packets that are not addressed to use ports 25 and 110.

Ports and Protocols

Some of the important applications and the port numbers they use are summarized in the table below:

Application Protocol Port Number
File Transfer Protocol (Control) TCP 21
Telnet TCP 23
Simple Mail Transfer Protocol TCP 25
Domain Name Service TCP/UDP 53
Dynamic Host Configuration Protocol (Server) UDP 67
Dynamic Host Configuration Protocol (Client) UDP 68
World Wide Web HTTP TCP 80
Post Office Protocol 3 TCP 110
Simple Network Management Protocol UDP 161

Note: The listed port numbers in the above table are also called well-known ports. The complete and updated list of well-known port numbers is available at http://www.iana.org/assignments/port-numbers.

Packet filtering is mostly configured on routers or firewalls that connect a private network to the public network such as the Internet. However, it can be configured inside the network to protect a server with confidential information from being accessed by other users on the network.

Packet Filtering Criteria

Administrators can configure packet filtering inclusively or exclusively:

  • Start with a network connection that is completely blocked and use filters to specify that the traffic can pass through.

  • Start with a completely open connection and specify the types of traffic to be blocked.

The criteria used for packet filtering are as follows:

  • Port Numbers: This is the most common type of packet filtering criteria. Port numbers can be used to block or allow packets using certain ports.

  • Protocol Identifiers: Protocol identifiers can be used to filter packets based on an entire protocol. Administrators can use this filter to block packets that are intended to use certain protocols. For example, an administrator can block all UDP and ICMP traffic. This prevents attackers from using applications that are based on these protocols.

  • IP Address: IP address filtering is used by administrators to limit network access to specific computers. IP address filtering is useful for protecting a part of a private network from users on another part of the network. It should be noted that IP address filtering is not considered to be a very secure method for securing a network. Intruders can get into the network using a technique called spoofing.

  • Hardware addresses: Filtering can be done through hardware addresses. Each network interface adapter at the factory is coded with the media access control (MAC) address known as hardware address. It works in the same way as IP address filtering. However, it is more difficult to spoof a hardware address than an IP address.

Packet Filtering in Windows Server 2003

Windows Server 2003 uses two packet filtering options:

  • TCP/IP Packet Filtering: In Windows Server 2003, take the following steps to implement TCP/IP filtering:
    1. Run Network Connections from Start Menu > Settings > Network Connections.

    2. In the Network Connections folder, right-click the Local Area Connection icon, and click Properties.

    3. In the Local Area Connection Properties dialog box, select Internet Protocol (TCP/IP), and click the Properties button.

    4. In the Internet Protocol (TCP/IP) Properties dialog box, click the Advanced button.

    5. In the Advanced TCP/IP Settings dialog box, click the Options tab. On the Options tab page, select TCP/IP filtering, and click the Properties button.

    6. In the TCP/IP Filtering dialog box, click the Enable TCP/IP Filtering (All adapters) check box. Click the appropriate Permit Only radio button to specify the port, and click the Add button.

    7. In the Add Filter dialog box, specify the port number in the TCP Port section, and click the OK button.

    8. In the TCP/IP Filtering dialog box, click the OK button.

  • Routing and Remote Access Service Packet Filtering: This option is more capable than TCP/IP packet filtering. However, administrators can use this type of filtering only when a server running Windows Server 2003 is configured as a router. By using this filter, you can use many criteria that TCP/IP filtering does not have. Some of the important capabilities of this type of filtering are as follows:
    • It can create filters based on the IP addresses, protocols, and port numbers of a packet’s source or destination.

    • It can create inclusive or exclusive filters.

    • It can create filters for ICMP messages, specified by the message type and code values.

    • It can create multiple filters of the same type.

Although packet filters can prevent a network from unauthorized intrusion, this technique cannot be used for safe and secure communications.

Share/Bookmark]]> http://www.ucertify.com/article/secure-internetwork-communication-by-using-packet-filtering.html/feed 0 What is AutoFill? http://www.ucertify.com/article/what-is-autofill-2.html http://www.ucertify.com/article/what-is-autofill-2.html#comments Tue, 29 Sep 2009 00:00:00 +0000 uCertify 3601182

The AutoFill feature of a browser automatically fills the text in the text box as the user types. It does not suggest any options as done by the AutoComplete feature. The AutoFill feature can be set by the user of the browser and not by the author of the Web site.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-autofill-2.html/feed 0 What is 4NF? http://www.ucertify.com/article/what-is-4nf-2.html http://www.ucertify.com/article/what-is-4nf-2.html#comments Fri, 25 Sep 2009 00:00:00 +0000 uCertify 3501049

The fourth normal form states that the database must be in BCNF and all the multivalued dependencies in the table are also functional dependencies whose determinant is a candidate key. Symbolically, if A -> > B|C, then A -> B and A -> C. Here, A, B, and C are attributes.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-4nf-2.html/feed 0 What is 1NF (Normal Form)? http://www.ucertify.com/article/what-is-1nf-normal-form-2.html http://www.ucertify.com/article/what-is-1nf-normal-form-2.html#comments Thu, 24 Sep 2009 00:00:00 +0000 uCertify 3501033

The 1NF is a normalization form in which each column in a row contains a single value, i.e., each attribute of the entity is single valued. Single valued attributes are also known as atomic attributes, as they cannot be decomposed into smaller units. There are mainly three kinds of attributes that prevent a table from being in the first normal form. They are as follows:

  • Composite attributes
  • Plural attributes (attributes that have more than one value)
  • Attributes with complex data types

The table below is in 1 NF, as all the columns in each row contain a single value.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-1nf-normal-form-2.html/feed 0 What is Network Load Balancing? http://www.ucertify.com/article/what-is-network-load-balancing-2.html http://www.ucertify.com/article/what-is-network-load-balancing-2.html#comments Wed, 16 Sep 2009 00:00:00 +0000 uCertify 2500291

Network Load Balancing is a Windows Server 2003 clustering technology. It runs as a driver in Microsoft Windows and distributes incoming requests across each node included in the cluster. Its primary purpose is to load-balance by distributing TCP/IP traffic among the server nodes in a cluster. For load balancing-aware applications, such as Exchange Server 2003, when one of the nodes fails or becomes offline, the load is automatically distributed to other nodes in the cluster. A cluster using Network Load Balancing can have 2 to 32 nodes. Administrators can configure it through the Network Load Balancing Manager, which is located in the Administrative Tools program menu.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-network-load-balancing-2.html/feed 0 What is IP masquerading? http://www.ucertify.com/article/what-is-ip-masquerading-2.html http://www.ucertify.com/article/what-is-ip-masquerading-2.html#comments Mon, 07 Sep 2009 00:00:00 +0000 uCertify 2101074

IP masquerading is a form of network address translation that is generally employed by firewalls and routers. Through this method, a Linux computer with a valid IP address can act as a gateway for other computers in the LAN, which do not have a valid IP address. The computers without a valid IP address can then access the Internet through this gateway. The computers on the LAN, having no valid IP address can use their private addresses to connect to the configured gateway. When the gateway receives a packet from such a computer, it assigns it a new source port number and inserts its own IP address into the header of the packet. This packet is then sent to the Internet as if it came from the gateway. When the gateway receives an incoming packet, it searches if the port number is one of those that it assigned previously to such a computer. If a match occurs, the gateway retrieves the original port number and private IP address of the corresponding computer and inserts them into the packet header. This packet is then sent to the destined computer.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-ip-masquerading-2.html/feed 0 What is FINGER command? http://www.ucertify.com/article/what-is-finger-command-2.html http://www.ucertify.com/article/what-is-finger-command-2.html#comments Mon, 07 Sep 2009 00:00:00 +0000 uCertify 2101082

The FINGER command is used in Unix systems. Basically, this command is used to find out whether or not a user is logged on to a specific computer. Depending upon the version of Unix being used, more detailed information about a user can also be obtained through this command. This command can also be used for reading the contents of a user’s .plan and .project files (if these exist with appropriate permissions).

Share/Bookmark]]> http://www.ucertify.com/article/what-is-finger-command-2.html/feed 0 What is inline scripting? http://www.ucertify.com/article/what-is-inline-scripting-2.html http://www.ucertify.com/article/what-is-inline-scripting-2.html#comments Sun, 06 Sep 2009 00:00:00 +0000 uCertify 1901002

Inline scripting is a method of scripting in which the script is embedded within the HTML tags of a Web page. It provides control to a Web page when events, such as button click, text entry, form submission etc., occur. Inline scripting is also used to provide information to a Web page from the Web server.

The following is an example of an inline script, for the onfocus and onblur events, embedded in an HTML tag :

<INPUT name=”NAME” onblur=”this.style.backgroundColor=’#ffffff’” onfocus=”this.style.backgroundColor=’#ffff00′”>

Share/Bookmark]]> http://www.ucertify.com/article/what-is-inline-scripting-2.html/feed 0 What is Diffie-Hellman encryption? http://www.ucertify.com/article/what-is-diffie-hellman-encryption-2.html http://www.ucertify.com/article/what-is-diffie-hellman-encryption-2.html#comments Fri, 28 Aug 2009 00:00:00 +0000 uCertify 1401388

The Diffie-Hellman encryption was developed by Diffie and Hellman in 1976 and published in the paper named “New Directions in Cryptography.” It is a key agreement protocol (also called exponential key agreement) that allows two users to exchange a secret key over an insecure medium (such as the Internet) without any prior secrets. The original protocol had two system parameters, p and g. They are both public and may be used by all the users in a system. The Diffie-Hellman key exchange was vulnerable to a man-in-the-middle attack, as Diffie-Hellman key exchange does not authenticate the participants.

The current form of the Diffie-Hellman protocol (also known as authenticated Diffie-Hellman key agreement protocol, or Station-to-Station (STS) protocol), was developed by Diffie, Van Oorschot, and Wiener in 1992 to overcome the man-in-the-middle attack. This is achieved by allowing the two parties to authenticate themselves to each other by the use of digital signatures and public-key certificates. The Diffie-Hellman protocol is an example of a much more general cryptographic technique, the common element being the derivation of a shared secret value (that is, key) from one party’s public key and another party’s private key. The parties’ key pairs may be generated anew at each run of the protocol as in the original Diffie-Hellman protocol. The public keys may be certified so that the parties can be authenticated and there may be a combination of these attributes.

Share/Bookmark]]> http://www.ucertify.com/article/what-is-diffie-hellman-encryption-2.html/feed 0