How Secure are we ???

[Kuldeep singh]

Hello Experts,

One Question spinning in my mind from beginning.

I am administrating whole windows Systems and Network

devices ( router, Switch, Proxy Server, ASA Firewall) and uses

tools like Ethereal, Solarwind, Opmanager, etc) from last 5 years.

If i talk about Windows servers or application, then I know that

i am safe because i am using 128 bit SSL certificates, bcoz

it provide encryption.

But if i talk about Network / WAN / Unauthorised user from Outside,

How do I know that I am safe. How can i check through Cisco Router

or ASA firewall or else that Somebody else trying to hack or access

my network from outside. Plz explain with commands or best examples.

is there any need to buy other devices like IDS / IPS or

IT Security tools, if any, then plz suggest me tool and

also tell me that how can we check unauthorised activity

through tool ?

KS

[Edison Ortiz]

For starter, take a look at this URL for hardening your device

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml

After doing so, we can continue on available options for traffic monitoring, logging features and security in general.

Regards,

[Kuldeep singh]

Hi Edison

Here i am talking about only for Monitoring........

How can we check or monitor unauthorised

person or ip address doing vulnerability

activity (spoofing, hacking, cracking) from outside ?

FYI, I do not have any kind of Configuration like

AAA, TACAS+, Radius,etc as given in URL

referred by you.  How can trace or Monitor

unauthorised person or ip without using these

configuration or is it necessary to configure???

If i am buying such kind of security devices then

so i should know how it protects......

KS

[danielciscoswart]

You need "Manage Engine Firewall Analyzer" for what you want to do.

HTH

Daniel

[Edison Ortiz]

It's necessary to configure those services (you need to add IOS Intrusion Prevention System, as well).

For monitoring, the ASA offers a nice GUI interface while Cisco IOS routers, you will need to get familiar with the command line interface unless you purchase some 3rd party GUI tool where logs are sent to for monitoring purposes.

[Milan Rai]

Hey Kuldeep

At first i am not professional .............n not a member tooo.....but just want so share my knowledge with you......if you dont mind....

There are lots of option on this part....as u are focusing on monitoring the inbound n oubound......connection.....one of the best option could be TMG ( microsoft)....where you need to created the policy which will let you know from which ip what services is being used........If any IP is seems to be doing nasty things then it can be completely blocked.........

You can have a rule set created for this purpose....what set of IP can access what resources inside the network.......

Like that another option would be the Checkpoint (firewall) which have all kinds of monitoring tools inside it.......

Just want to share my ideas if you dont like it then plz ignore it....

Thank You

[Kuldeep singh]

Hello Experts,

Still have not found a justified answer

[John Blakley · Accepted solution]

Kuldeep,

I'm not sure what you're expecting to gain from this discussion, but some answers have already been provided. I'll throw in my suggestions in hopes that it helps. As you said in your OP, you feel "safe" because you're using ssl. In reality, any software isn't safe and there are vulnerabilities out there for MITM attacks if someone can spoof a certificate. In reality, there's nothing that's safe per se. Defense-in-depth is the only way to protect yourself better than just a "here and there" approach. Your whole security model needs to start from the top down. As far as your network equipment goes, unless you're planning on putting an IDS/IPS in front of your router (which some people do) you won't catch people trying to compromise your routers, firewalls, etc. You should have your router and firewall logging to syslog servers all login attempts. Unfortunately, when you have equipment directly on the internet like routers and firewalls, there is absolutely nothing that will keep you from being attacked. It's going to happen and the more popular the site, the more attacks that you're going to have.

From a basic standpoint, if you really want to be secure, don't enable any lines on the outside interfaces of your routers. Have all login requests sent to a radius server so you can log those requests. If you're offering services, such as Web, make sure that you software on the server is patched. A lot of people think that they're "secure" because they have a firewall but what they don't remember is the port still has to be open for the service to be accessible which means your server is now the point of attack and not your firewall. Lock down your firewalls and routers to only a certain address that can manage it. In other words, if you have a workstation in a data center and 2 admins have access to it, lock down your routers/firewalls to only be managed by that workstation and no where else. Configure control plane policing for your routers to help with ddos attacks that could be directed at your router.

There is no magic bullet that anyone on this board can tell you. It all depends on the amount of experience that you have in securing your network, but in reality it also depends on the type of industry you're in. If you're in the banking or healthcare industry, in the US we have legislations that we have to abide by and they (SOX, HIPAA, GLBA) tell the company what security requirements need to be in place. If you're a small, privately-owned video store, then obviously you don't need to lock your site down according to CIA guidelines. Take security seriously, but also make sure that it makes sense.

HTH,
John

*** Please rate all useful posts ***

[johnlloyd_13]

Amen John B!!! +5

Sent from Cisco Technical Support iPad App

[John Blakley]

Thanks John

[Kuldeep singh]

Hi John,

Thanks for appreciated reply...

KS

[paul driver]

Hello John,

Very nice explaination!

res

Paul

Please don't forget to rate this post if it has been helpful.