CISSP - Certified Information Systems Security Professional Study Guide, 2nd Edition (2004)

Virtual Private Network (VPN)

101

them in packets of another protocol. The encapsulation is what creates the logical illusion of a communications tunnel over the untrusted intermediary network. This virtual path exists between the encapsulation and the deencapsulation entities located at the ends of the communication.

In fact, sending a letter to your grandmother involves the use of a tunneling system. You create the personal letter (the primary content protocol packet) and place it in an envelope (the tunneling protocol). The envelope is delivered through the postal service (the untrusted intermediary network) to its intended recipient.

The Need for Tunneling

Tunneling can be used in many situations, such as when you’re bypassing firewalls, gateways, proxies, or other traffic control devices. The bypass is achieved by encapsulating the restricted content inside packets that are authorized for transmission. The tunneling process prevents the traffic control devices from blocking or dropping the communication because such devices don’t know what the packets actually contain.

Tunneling is often used to enable communications between otherwise disconnected systems. If two systems are separated by a lack of network connectivity, a communication link can be established by a modem dial-up link or other remote access or wide area network (WAN) networking service. The actual LAN traffic is encapsulated in whatever communication protocol is used by the temporary connection, such as Point-to-Point Protocol (PPP) in the case of modem dial-up. If two networks are connected by a network employing a different protocol, the protocol of the separated networks can often be encapsulated within the intermediary network’s protocol to provide a communication pathway.

Regardless of the actual situation, tunneling protects the contents of the inner protocol and traffic packets by encasing, or wrapping, it in an authorized protocol used by the intermediary network or connection. Tunneling can be used if the primary protocol is not routable and to keep the total number of protocols supported on the network to a minimum.

If the act of encapsulating a protocol involves encryption, tunneling can provide a means to transport sensitive data across untrusted intermediary networks without fear of losing confidentiality and integrity.

Tunneling Drawbacks

Tunneling is not without its problems. It is generally an inefficient means of communicating because all protocols include their own error detection, error handling, acknowledgment, and session management features, so using more than one protocol at a time compounds the overhead required to communicate a single message. Furthermore, tunneling creates either larger packets or more numerous packets that in turn consume additional network bandwidth. Tunneling can quickly saturate a network if sufficient bandwidth is not available. In addition, tunneling is a point-to-point communication mechanism and is not designed to handle broadcast traffic.

How VPNs Work

Now that you understand the basics of tunneling, let’s discuss the details of VPNs. A VPN link can be established over any other network communication connection. This could be a typical

102 Chapter 4 Communications Security and Countermeasures

LAN cable connection, a wireless LAN connection, a remote access dial-up connection, a WAN link, or even a client using an Internet connection for access to an office LAN. A VPN link acts just like a typical direct LAN cable connection; the only possible difference would be speed based on the intermediary network and on the connection types between the client system and the server system. Over a VPN link, a client can perform the exact same activities and access the same resources they could if they were directly connected via a LAN cable.

VPNs can be used to connect two individual systems or two entire networks. The only difference is that the transmitted data is protected only while it is within the VPN tunnel. Remote access servers or firewalls on the network’s border act as the start points and endpoints for VPNs. Thus, traffic is unprotected within the source LAN, protected between the border VPN servers, and then unprotected again once it reaches the destination LAN.

VPN links through the Internet for connecting to distant networks are often inexpensive alternatives to direct links or leased lines. The cost of two high-speed Internet links to local ISPs to support a VPN is often significantly less than the cost of any other connection means available.

Implementing VPNs

VPNs can be implemented using software or hardware solutions. In either case, there are four common VPN protocols: PPTP, L2F, L2TP, and IPSec. PPTP, L2F, and L2TP operate at the Data Link layer (layer 2) of the OSI model. PPTP and IPSec are limited for use on IP networks, whereas L2F and L2TP can be used to encapsulate any LAN protocol.

Point-to-Point Tunneling Protocol (PPTP) is an encapsulation protocol developed from the dial-up protocol Point-to-Point Protocol (PPP). PPTP creates a point-to-point tunnel between two systems and encapsulates PPP packets. PPTP offers protection for authentication traffic through the same authentication protocols supported by PPP; namely, Microsoft Challenge Handshake Authentication Protocol (MS-CHAP), Challenge Handshake Authentication Protocol (CHAP), Password Authentication Protocol (PAP), Extensible Authentication Protocol (EAP), and Shiva Password Authentication Protocol (SPAP). The initial tunnel negotiation process used by PPTP is not encrypted. Thus, the session establishment packets that include the IP address of the sender and receiver—and can include usernames and hashed passwords—could be intercepted by a third party.

Cisco developed its own VPN protocol called Layer 2 Forwarding (L2F), which is a mutual authentication tunneling mechanism. However, L2F does not offer encryption. L2F was not widely deployed and was soon replaced by L2TP.

Layer 2 Tunneling Protocol (L2TP) was derived by combining elements from both PPTP and L2F. L2TP creates a point-to-point tunnel between communication endpoints. It lacks a builtin encryption scheme, but it typically relies upon IPSec as its security mechanism. L2TP also supports TACACS+ and RADIUS, whereas PPTP does not.

The most commonly used VPN protocol is now IPSec. IP Security (IPSec) is both a standalone VPN protocol and the security mechanism for L2TP, and it can only be used for IP traffic. IPSec provides for secured authentication as well as encrypted data transmission. It operates at the Network layer (layer 3) and can be used in transport mode or tunnel mode. In transport mode, the IP packet data is encrypted but the header of the packet is not. In tunnel mode, the entire IP packet is encrypted and a new header is added to the packet to govern transmission through the tunnel.

Network Address Translation

103

Network Address Translation

Hiding the identity of internal clients, masking the design of your private network, and keeping public IP address leasing costs to a minimum is made simple through the use of NAT. Network Address Translation (NAT) is a mechanism for converting the internal IP addresses found in packet headers into public IP addresses for transmission over the Internet. NAT offers numerous benefits, such as being able to connect an entire network to the Internet using only a single (or just a few) leased public IP addresses. NAT allows you to use the private IP addresses defined in RFC 1918 in a private network while still being able to communicate with the Internet. NAT protects a network by hiding the IP addressing scheme and network topography from the Internet. It also provides protection by restricting connections so that only connections originating from the internal protected network are allowed back into the network from the Internet. Thus, most intrusion attacks are automatically repelled.

NAT can be found in a number of hardware devices and software products, including firewalls, routers, gateways, and proxies. It can only be used on IP networks and operates at the Network layer (layer 3).

Private IP Addresses

The use of NAT has proliferated recently due to the increased scarcity of public IP addresses and security concerns. With only roughly four billion addresses (2^32) available in IPv4, the world has simply deployed more devices using IP than there are unique IP addresses available. Fortunately, the early designers of the Internet and the TCP/IP protocol had good foresight and put aside a few blocks of addresses for private unrestricted use. These IP addresses, commonly called the private IP addresses, are defined in RFC 1918. They are as follows:

10.0.0.0–10.255.255.255 (a full Class A range)

172.16.0.0–172.31.255.255 (16 Class B ranges)

192.168.0.0–192.168.255.255 (255 Class C ranges)

All routers and traffic-directing devices are configured by default not to forward traffic to or from these IP addresses. In other words, the private IP addresses are not routed by default. Thus, they cannot be directly used to communicate over the Internet. However, they can be easily used on private networks where routers are not employed or where slight modifications to router configurations are made. The use of the private IP addresses in conjunction with NAT greatly reduces the cost of connecting to the Internet by allowing fewer public IP addresses to be leased from an ISP.

Stateful NAT

NAT operates by maintaining a mapping between requests made by internal clients, a client’s internal IP address, and the IP address of the Internet service contacted. When a request packet is received by NAT from a client, it changes the source address in the packet from the client’s

104 Chapter 4 Communications Security and Countermeasures

to the NAT server’s. This change is recorded in the NAT mapping database along with the destination address. Once a reply is received from the Internet server, NAT matches the reply’s source address to an address stored in its mapping database and then uses the linked client address to redirect the response packet to its intended destination. This process is known as stateful NAT because it maintains information about the communication sessions between clients and external systems.

NAT can operate on a one-to-one basis with only a single internal client able to communicate over one of its leased public IP addresses at a time. This type of configuration can result in a bottleneck if more clients attempt Internet access than there are public IP addresses. For example, if there are only five leased public IP addresses, the sixth client must wait until an address is released before its communications can be transmitted out over the Internet. Other forms of NAT employ multiplexing techniques in which port numbers are used to allow the traffic from multiple internal clients to be managed on a single leased public IP address.

Switching Technologies

When two systems (individual computers or LANs) are connected over multiple intermediary networks, the task of transmitting data packets from one to the other is a complex process. To simplify this task, switching technologies were developed. The first switching technology is circuit switching.

Circuit Switching

Circuit switching was originally developed to manage telephone calls over the public switched telephone network. In circuit switching, a dedicated physical pathway is created between the two communicating parties. Once a call is established, the links between the two parties remain the same throughout the conversation. This provides for fixed or known transmission times, uniform level of quality, and little or no loss of signal or communication interruptions. Circuitswitching systems employ permanent, physical connections. However, the term permanent applies only to each communication session. The path is permanent throughout a single conversation. Once the path is disconnected, if the two parties communicate again, a different path may be assembled. During a single conversation, the same physical or electronic path is used throughout the communication and is used only for that one communication. Circuit switching grants exclusive use of a communication path to the current communication partners. Only after a session has been closed can a pathway be reused by another communication.

Packet Switching

Eventually, as computer communications increased as opposed to voice communications, a new form of switching was developed. Packet switching occurs when the message or communication

WAN Technologies 105

is broken up into small segments (usually fixed-length packets, depending on the protocols and technologies employed) and sent across the intermediary networks to the destination. Each segment of data has its own header that contains source and destination information. The header is read by each intermediary system and is used to route each packet to its intended destination. Each channel or communication path is reserved for use only while a packet is actually being transmitted over it. As soon as the packet is sent, the channel is made available for other communications. Packet switching does not enforce exclusivity of communication pathways. Packet switching can be seen as a logical transmission technology because addressing logic dictates how communications traverse intermediary networks between communication partners. Table 4.1 shows a comparison between circuit switching and packet switching.

T A B L E 4 . 1 Circuit Switching vs. Packet Switching

Circuit Switching	Packet Switching
Constant traffic	Bursty traffic
Fixed known delays	Variable delays
Connection oriented	Connectionless
Sensitive to connection loss	Sensitive to data loss
Used primarily for voice	Used for any type of traffic

Virtual Circuits

Within packet-switching systems are two types of communication paths, or virtual circuits. A virtual circuit is a logical pathway or circuit created over a packet-switched network between two specific endpoints. There are two types of virtual circuits: permanent virtual circuits (PVCs) and switched virtual circuits (SVCs). A PVC is like a dedicated leased line; the logical circuit always exists and is waiting for the customer to send data. An SVC is more like a dial-up connection because a virtual circuit has to be created before it can be used and then disassembled after the transmission is complete. In either type of virtual circuit, when a data packet enters point A of a virtual circuit connection, that packet is sent directly to point B or the other end of the virtual circuit. However, the actual path of one packet may be different than the path of another packet from the same transmission. In other words, multiple paths may exist between point A and point B as the ends of the virtual circuit, but any packet entering at point A will end up at point B.

WAN Technologies

WAN links and long-distance connection technologies can be divided into two primary categories: dedicated and nondedicated lines. A dedicated line is one that is indefinably and continually

106 Chapter 4 Communications Security and Countermeasures

reserved for use by a specific customer. A dedicated line is always on and waiting for traffic to be transmitted over it. The link between the customer’s LAN and the dedicated WAN link is always open and established. A dedicated line connects two specific endpoints and only those two endpoints together. A nondedicated line is one that requires a connection to be established before data transmission can occur. A nondedicated line can be used to connect with any remote system that uses the same type of nondedicated line.

The following list includes some examples of dedicated lines (also called leased lines or point- to-point links):

Technology	Connection Type	Speed
Digital Signal Level 0 (DS-0)	partial T1	64Kbps up to 1.544Mbps
Digital Signal Level 1 (DS-1)	T1	1.544Mbps
Digital Signal Level 3 (DS-3)	T3	44.736Mbps
European digital transmission format 1	El	2.108Mbps
European digital transmission format 3	E3	34.368Mbps
Cable modem or cable routers		up to 1.544Mbps

Standard modems, DSL, and ISDN are examples of nondedicated lines. Digital subscriber line (DSL) is a technology that exploits the upgraded telephone network to grant consumers speeds from 144Kbps to 1.5Mbps. There are numerous formats of DSL, such as ADSL, xDSL, CDSL, HDSL, SDSL, RASDSL, IDSL, and VDSL. Each format varies as to the specific downstream and upstream bandwidth provided. The maximum distance a DSL line can be from a central office (i.e., a specific type of distribution node of the telephone network) is approximately 1,000 meters.

Integrated Services Digital Network (ISDN) is a fully digital telephone network that supports both voice and high-speed data communications. There are two standard classes or formats of ISDN service: BRI and PRI. Basic Rate Interface (BRI) offers customers a connection with 2 B channels and 1 D channel. The B channels support a throughput of 64Kbps and are used for data transmission. The D channel is used for call establishment, management, and teardown and has a bandwidth of 16Kbps. Even though the D channel was not designed to support data transmissions, a BRI ISDN is said to offer consumers 144Kbps of total throughput. Primary Rate Interface (PRI) offers consumers a connection with 2 to 23 64Kbps B channels and a single 64Kbps D channel. Thus, a PRI can be deployed with as little as 192Kbps throughput and up to 1.544Mbps throughput.

WAN Connection Technologies

There are numerous WAN connection technologies available to companies that need communication services between multiple locations and even external partners. These WAN technologies vary greatly in cost and throughput. However, most share the common feature of being transparent to the connected LANs or systems. A WAN switch, specialized router, or border connection device

WAN Technologies 107

provides all of the interfacing needed between the network carrier service and a company’s LAN. The border connection devices are called channel service unit/data service unit (CSU/DSU). They convert LAN signals into the format used by the WAN carrier network and vice versa. The CSU/ DSU contains data terminal equipment/data circuit-terminating equipment (DTE/DCE), which provides the actual connection point for the LAN’s router (the DTE) and the WAN carrier network’s switch (the DCE). The CSU/DSU acts as a translator, a store-and-forward device, and a link conditioner. A WAN switch is simply a specialized version of a LAN switch that is constructed with a built-in CSU/DSU for a specific type of carrier network. There are many types of carrier networks, or WAN connection technologies, such as X.25, Frame Relay, ATM, and SMDS:

X.25 WAN connections X.25 is a packet-switching technology that is widely used in Europe. It uses permanent virtual circuits to establish specific point-to-point connections between two systems or networks.

Frame Relay connections Like X.25, Frame Relay is a packet-switching technology that also uses PVCs. However, unlike X.25, Frame Relay supports multiple PVCs over a single WAN carrier service connection. A key concept related to Frame Relay is the Committed Information Rate (CIR). The CIR is the guaranteed minimum bandwidth a service provider grants to its customers. It is usually significantly less than the actual maximum capability of the provider network. Each customer may have a different CIR. The service network provider may allow customers to exceed their CIR over short intervals when additional bandwidth is available. Frame Relay operates at layer 2 (Data Link layer) of the OSI model. It is a connection-oriented packet-switching technology.

ATM Asynchronous transfer mode (ATM) is a cell-switching WAN communication technology. It fragments communications into fixed-length 53-byte cells. The use of fixed-length cells allows ATM to be very efficient and offer high throughputs. ATM can use either PVCs or SVCs. ATM providers can guarantee a minimum bandwidth and a specific level of quality to their leased services. Customers can often consume additional bandwidth as needed when available on the service network for an additional pay-as-you-go fee; this is known as bandwidth on demand. ATM is a connection-oriented packet-switching technology.

SMDS Switched Multimegabit Data Service (SMDS) is a packet-switching technology. Often, SMDS is used to connect multiple LANs to form a metropolitan area network (MAN) or a WAN. SMDS supports high-speed bursty traffic, is connectionless, and supports bandwidth on demand. SMDS has been mostly replaced by Frame Relay.

Some WAN connection technologies require additional specialized protocols to support various types of specialized systems or devices. Three of these protocols are SDLC, HDLC, and HSSI:

SDLC Synchronous Data Link Control (SDLC) is used on permanent physical connections of dedicated leased lines to provide connectivity for mainframes, such as IBM Systems Network Architecture (SNA) systems. SDLC uses polling and operates at OSI layer 2 (the Data Link layer).

HDLC High-Level Data Link Control (HDLC) is a refined version of SDLC designed specifically for serial synchronous connections. HDLC supports full-duplex communications and supports both point-to-point and multipoint connections. HDLC, like SDLC, uses polling and operates at OSI layer 2 (the Data Link layer).

108 Chapter 4 Communications Security and Countermeasures

HSSI High Speed Serial Interface (HSSI) is a DTE/DCE interface standard that defines how multiplexors and routers connect to high-speed network carrier services such as ATM or Frame Relay. A multiplexor is a device that transmits multiple communications or signals over a single cable or virtual circuit. HSSI defines the electrical and physical characteristics of the interfaces or connection points and thus operates at OSI layer 1 (the Physical layer).

Encapsulation Protocols

The Point-to-Point Protocol (PPP) is an encapsulation protocol designed to support the transmission of IP traffic over dial-up or point-to-point links. PPP allows for multivendor interoperability of WAN devices supporting serial links. All dial-up and most point-to-point connections are serial in nature (as opposed to parallel). PPP includes a wide range of communication services, including assignment and management of IP addresses, management of synchronous communications, standardized encapsulation, multiplexing, link configuration, link quality testing, error detection, and feature or option negotiation (such as compression). PPP was originally designed to support CHAP and PAP for authentication. However, recent versions of PPP also support MS-CHAP, EAP, and SPAP. PPP can also be used to support Internetwork Packet Exchange (IPX) and DECnet protocols. PPP is an Internet standard documented in RFC 1661. It replaced the Serial Line Internet Protocol (SLIP). SLIP offered no authentication, supported only half-duplex communications, had no error detection capabilities, and required manual link establishment and teardown.

Miscellaneous Security Control

Characteristics

When you’re selecting or deploying security controls for network communications, there are numerous characteristics that should be evaluated in light of your circumstances, capabilities, and security policy. These issues are discussed in the following sections.

Transparency

Just as the name implies, transparency is the characteristic of a service, security control, or access mechanism that ensures that it is unseen by users. Transparency is often a desirable feature for security controls. The more transparent a security mechanism is, the less likely a user will be able to circumvent it or even be aware that it exists. With transparency, there is a lack of direct evidence that a feature, service, or restriction exists, and its impact on performance is minimal.

In some cases, transparency may need to function more as a configurable feature rather than as a permanent aspect of operation, such as when an administrator is troubleshooting, evaluating, or tuning a system’s configurations.

Managing E-Mail Security

109

Verifying Integrity

To verify the integrity of a transmission, you can use a checksum called a hash total. A hash function is performed on a message or a packet before it is sent over the communication pathway. The hash total obtained is added to the end of the message and is called the message digest. Once the message is received, the hash function is performed by the destination system and the result is compared to the original hash total. If the two hash totals match, then there is a high level of certainty that the message has not been altered or corrupted during transmission. Hash totals are similar to cyclic redundancy checks (CRCs) in that they both act as integrity tools. In most secure transaction systems, hash functions are used to guarantee communication integrity.

Record sequence checking is similar to a hash total check; however, instead of verifying content integrity, it verifies packet or message sequence integrity. Many communications services employ record sequence checking to verify that no portions of a message were lost and that all elements of the message are in their proper order.

Transmission Mechanisms

Transmission logging is a form of auditing focused on communications. Transmission logging records the particulars about source, destination, time stamps, identification codes, transmission status, number of packets, size of message, and so on. These pieces of information may be useful in troubleshooting problems and tracking down unauthorized communications or used against a system as a means to extract data about how it functions.

Transmission error correction is a capability built into connectionor session-oriented protocols and services. If it is determined that a message, in whole or in part, was corrupted, altered, or lost, a request can be made for the source to resend all or part of the message. Retransmission controls determine whether all or part of a message is retransmitted in the event that a transmission error correction system discovers a problem with a communication. Retransmission controls can also determine whether multiple copies of a hash total or CRC value are sent and whether multiple data paths or communication channels are employed.

Managing E-Mail Security

E-mail is one of the most widely and commonly used Internet services. The e-mail infrastructure employed on the Internet is primarily made up of e-mail servers using the Simple Mail Transfer Protocol (SMTP) to accept messages from clients, transport those messages to other servers, and deposit messages into a user’s server-based inbox. In addition to e-mail servers, the infrastructure includes e-mail clients. Clients retrieve e-mail from their server-based inboxes using the

Post Office Protocol, version 3 (POP3) or Internet Message Access Protocol (IMAP). Clients communicate with e-mail servers using SMTP.

Sendmail is the most common SMTP server for Unix systems, Exchange is the most common SMTP server for Microsoft systems, and GroupWise is the most common SMTP server for Novell systems. In addition to these three popular products, there are numerous alternatives, but they all share the same basic functionality and compliance with Internet e-mail standards.

110 Chapter 4 Communications Security and Countermeasures

E-Mail Security Goals

For e-mail, the basic mechanism in use on the Internet offers efficient delivery of messages but lacks controls to provide for confidentiality, integrity, or even availability. In other words, basic e-mail is not secure. However, there are many ways to add security to e-mail. Adding security to e-mail may satisfy one or more of the following objectives:

Provide for nonrepudiation

Restrict access to messages to their intended recipients

Maintain the integrity of messages

Authenticate and verify the source of messages

Verify the delivery of messages

Classify sensitive content within or attached to messages

As with any aspect of IT security, e-mail security begins in a security policy approved by upper management. Within the security policy, several issues must be addressed:

Acceptable use policies for e-mail

Access control

Privacy

E-mail management

E-mail backup and retention policies

Acceptable use policies define what activities can and cannot be performed over an organization’s e-mail infrastructure. It is often stipulated that professional, business-oriented e-mail and a limited amount of personal e-mail can be sent and received. Specific restrictions are usually placed on performing personal business (i.e., work for another organization, including selfemployment), illegal, immoral, or offensive communications, and any other activities that would have a detrimental effect on productivity, profitability, or public relations.

Access control over e-mail should be maintained so that users have access to only their specific inbox and e-mail archive databases. An extension of this rule implies that no other user, authorized or not, can gain access to an individual’s e-mail. Access control should provide for both legitimate access and some level of privacy, at least from peer employees and unauthorized intruders.

The mechanisms and processes used to implement, maintain, and administer e-mail for an organization should be clarified. End users may not need to know the specifics of how e-mail is managed, but they do need to know whether e-mail is or is not considered private communication. E-mail has recently been the focus of numerous court cases in which archived messages were used as evidence. Often, this was to the chagrin of the author or recipient of those messages. If e-mail is to be retained (i.e., backed up and stored in archives for future use), users need to be made aware of this. If e-mail is to be reviewed for violations by an auditor, users need to be informed of this as well. Some companies have elected to retain only the last three months of e-mail archives before they are destroyed, whereas others have opted to retain e-mail for up to seven years.