Information Security Threats Mitigation

By
Francis Nsofwa Mubanga
Keller Graduate School of Management
Devry University

Professor Sandra Kirkland
SE572
July 14th, 2011

Table of Contents Introduction 1 Steps 1 Denial-of-Service attacks (DoS) 1 Distributed Denial-of-Service attacks (DDoS) 1 Masquerading and IP Spoofing attacks 2 Smurf attacks 2 Land .c attacks 2 Man-in-the-Middle attacks 3 Conclusion 3 References 4

Introduction

Our company faces the largest information security threat and we need to take steps to mitigate the risks associated with each one of them. Steps

Denial-of-Service attacks (DoS)

We will analyze the attack as best as we can and implement the correct defense. We will ask ourselves if there are any common packet signatures that are easy to filter against. We will ask ourselves if all attackers hitting a single target if they can be sacrificed. We will also need to find out as to which network the attack is coming from, and if we can verify it (remember that spoofed packets can come from anywhere, including our own network). Once we’ve found a reasonable match for the attack, pass the filters to our upstream provider(s) and seek their help getting them propagated outwards. We will need to make sure we filter or redirect traffic with a minimum amount of actual downtime (Kaeo, 2004).
Distributed Denial-of-Service attacks (DDoS)

CluB: a Cluster-Based architecture is the method we will use to prevent DDoS attacks proactively. In CluB, the network consists of a set of clusters —in the Internet, these can be e.g. Autonomous Systems (AS), or neighborhoods of AS. Packets need permissions to exit, enter, or pass-by different clusters. We can build on earlier work and improve on distribution of control aspects, a proactive method, using CluB, we will mitigate DDoS attacks. The method must balance the effectiveness-overhead tradeoff by addressing the issue of granularity of control in the network. We can use CluB to collaborate with different routing policies in the network and also use contemporary datagram options (Fu, 2010).
Masquerading and IP Spoofing attacks

We will use the Unicast Reverse Path Forwarding (uRPF) feature a security tool that helps mitigate source IP address spoofing by discarding IP packets that lack a verifiable IP source address in the IP routing table. An uRPF is also a common technique used to mitigate source address spoofing. When we use uRPF, the source address of IP packets is checked to ensure that the route back to the source uses the same interface that the packet arrived on. The input interface might be feasible but if not the path to the source network, the packet will be dropped. There are two types of uRPF implementation namely Strict Mode complying with RFC 2827 filters on Network Ingress Edge and Best Current Practices (BCP 38) and Loose Mode for ISP to ISP Edge, for RTBH filtering (Cisco Systems, 2011).
Smurf attacks

We will need to disable IP-directed broadcast functionality on every router. Generally this functionality will not be missed. The attacker may still be able to launch a Smurf attack from inside our LAN, in which even if we disable IP broadcast functionality at the router their will be no effect. To protect against such an attack, our operating systems must be set to prevent computers from responding to IP-directed broadcast requests.
Land .c attacks

We will need to patch the operating systems to prevent the attacks. If we prevent traffic coming into the network that has a source address that we are using, we will have prevented Land .c attacks.
Man-in-the-Middle attacks

First, static IP and MAC addresses could be mapped to prevent unauthorized changes. Second, ARP monitoring tools could be used to alert of any unauthorized ARP activities. Third, network switch port security could be turned on to prevent users (and attackers) from changing their MAC addresses or require authorization.
Conclusion

Having explained the steps to mitigate the above threats for our company, we will stay alert every time in order to prevent internal and external attacks.

References Cisco Systems (2011) Cisco IOS Security Configuration Guide, Release 12.4; Configuring Unicast Reverse Path Forwarding Retrieved on July 12, 2011 from http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_cfg_unicast_rpf_ps6350_TSD_Products_Configuration_Guide_Chapter.html Fu, Z (2010) Mitigating Distributed Denial-of-Service Attacks: Application-defense and Network-defense Methods Retrieved on July 12th, 2011 from http://www.cse.chalmers.se/~zhafu/Lic-thesis.pdf ZHang Fu 2010
Gregory, H. P. (2010). All in One Certified Information Systems Auditor. New York: McGraw- Hill
Kaeo, M. (2004). Designing Network Security. Indianapolis: Cisco Press
Ramachandran, J. (2002). Designing Security Architecture Solutions. New York: John Wiley & Sons, Inc.