The visitor's laptop
A visitor plugs a laptop into a wall socket in the meeting room. It has no updates and a virus.
On a badly designed system that laptop is now inside, next to the servers. On a well designed one, it is held in a safe corner.
Five controls decide who and what gets in.
Key words
| Word | What it means |
|---|---|
| Authentication | Checking that a user is who they say they are. |
| Firewall | A gate that lets some traffic in or out and blocks the rest. |
| IDS | Intrusion detection system: watches traffic and raises an alert about a threat. |
| IPS | Intrusion prevention system: watches traffic and blocks a threat as it happens. |
| NAC | Network access control: checks users and devices against policy before they may join. |
| Quarantine | A safe, limited part of the network for devices that fail a check. |
| Port | A numbered door on a computer, used by one kind of service. |
| Network | Computers and devices linked so they can share data. |
| Malware | Software made to harm a computer or steal data. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can say what authentication, firewalls, an IDS, an IPS and NAC each do, and where they fit in a network design.
Starter: access models
Have a go
Starter: access models
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: authentication and firewalls
Authentication allows or refuses access once the system has checked the user. It is the first gate.
A firewall allows or blocks access to a defined set of services. A rule list says which ports and which addresses are allowed. Everything not listed is blocked.
The support series teaches how to write firewall rules. Here you place one in a design.
Run: a small firewall rule list
(iptables -N OFFICE 2>/dev/null; iptables -F OFFICE; iptables -A OFFICE -p tcp --dport 443 -j ACCEPT; iptables -A OFFICE -j DROP; iptables -L OFFICE -n)A command for the lesson’s lab terminal. It is shown here and not run.
What you should see
Note
Two rules in a chain called OFFICE. The first accepts web traffic on port 443. The last drops everything else. The chain is not attached to real traffic, so nothing in the lab is blocked. It shows the shape of a rule list.
Cycle 2: IDS and IPS
An IDS watches the traffic and the logs. When it sees a threat, it raises an alert. A person then decides. It detects, but it does not stop anything.
An IPS sits in the path. When it sees a threat, it blocks it at once. It prevents, but a wrong guess can block a real user.
Run: spot password guessing in a log
printf 'Failed password from 203.0.113.9\nFailed password from 203.0.113.9\nAccepted password from 198.51.100.4\nFailed password from 203.0.113.9\n' > /tmp/auth.log && grep Failed /tmp/auth.log | sort | uniq -cA command for the lesson’s lab terminal. It is shown here and not run.