Cisco 网络安全部署 PPT 内部员工培训材【培训课件】.ppt

Deploying Secure Networks Session 2502 What You Can Expect to Learn “Network security is a system” Detailed network attack methodology Threat mitigation options Network security design components Specific optimizations to existing infrastructure Deploying Secure Networks Security Threat Components Security Design—an Example Design Under Fire Threat Mitigation Design Optimizations Security Design—a Better Example Design Under Fire (2) Distributed Denial of Service (DDoS) Smurf Attack DDoS, How Does It Work? Stacheldraht Attack Stacheldraht Attack Stacheldraht Transport Details Root Kits Application Layer Attacks Port Redirection Attack Deploying Secure Networks Security Threat Components Security Design—an Example Design Under Fire Threat Mitigation Design Optimizations Security Design—a Better Example Design Under Fire (2) How Is Enterprise Security Deployed Today? Access Router ACL (no State Inbound s0) Firewall Rules Design Considerations Dual “firewall” configuration Inbound traffic limited to relevant services on DMZ SSH allowed for encrypted remote administration Open internal network Full outbound access allowed (no traditional FTP) Deploying Secure Networks Security Threat Components Security Design—an Example Design Under Fire Threat Mitigation Design Optimizations Security Design—a Better Example Design Under Fire (2) Bring on the Hackers! Network Recon “Own” a System Exploit Trust Get the Goods! “Own” the Network “Own” the Network Past the firewall No more security More recon Vulnerability exploits Hacker has a new playground! Crunchy on the Outside…Soft in the Middle Distributed Denial of Service Attack Phase 1: Setup Distribution Network Phase 2: Pick a Target and Attack Setup a Distribution Net Attack! Client coordinates attack Victim bandwidth is quickly eliminated Attack Review Network compromise was completely successful Firewall acted as configured Vulnerabilities started at the host level via an out of date system Network DDoS was completely