BASIC SECURITY CONCEPTS

The same security concepts apply to networks, so it goes regardless of the platform you USE:

• Secure the edge with a good firewall/threat management gateway and intrusion detection/prevention system


• Use anti-virus and anti-malware software (including on non-Windows systems) and keep definitions updated


• Implement security auditing/monitoring to detect attempted breaches


• Harden systems by turning off unnecessary services


• Close unused ports


• Restrict physical access to the systems


• Restrict administrative/root access to those who really need it; on UNIX systems, restrict root access to secure terminals


• Implement file level permissions; on UNIX systems, partition the file system and use read-only partitions for storing files that don’t change often, and use ACLs (Access Control Lists) for complex permissions management


• limit the access processes have on the file system by using the chroot and ulimit interfaces


• Enforce strong password policies


• In high security environments, require two-factor authentication


• Use SSH (Secure Shell) for remote command line access


• Use encryption: to protect files on the drive, to protect data crossing the network, to protect the operating system from unauthorized access


• Implement a public key infrastructure to issue digital certificates

OSI Model

OSI Model encapsulation

One of the core networking concepts is the OSI Model.
This is a theoretical model that defines how the various networking protocols, which work at different layers of the model, work together to accomplish communication across a network (like the Internet).
Unlike most of the other concepts above, the OSI model isn't something that network admins use every day. The OSI model is for those seeking certifications like the Cisco CCNA or when taking some of the Microsoft networking certification tests.
OR, if you have an over-zealous interviewer who really wants to quiz you.

Here is the OSI model:

Application - layer 7 - any application using the network, examples include FTP and your web browser

Presentation - layer 6 - how the data sent is presented, examples include JPG graphics, ASCII, and XML

Session - layer 5 - for applications that keep track of sessions, examples are applications that use Remote Procedure Calls (RPC) like SQL and Exchange

Transport - layer 4 -provides reliable communication over the network to make sure that your data actually "gets there" with TCP being the most common transport layer protocol

Network - layer 3 -takes care of addressing on the network that helps to route the packets with IP being the most common network layer protocol. Routers function at Layer 3.

Data Link - layer 2 -transfers frames over the network using protocols like Ethernet and PPP. Switches function at layer 2.

Physical - layer 1 -controls the actual electrical signals sent over the network and includes cables, hubs, and actual network links.

Understanding how the OSI Model works is not only useful for taking certification exams, but also for real life scenarios.

Layer 1 - Physical

Physical layer defines the cable or physical medium itself, e.g., thinnet, thicknet, unshielded twisted pairs (UTP). All media are functionally equivalent. The main difference is in convenience and cost of installation and maintenance. Converters from one media to another operate at this level.

Layer 2 - Data Link

Data Link layer defines the format of data on the network. A network data frame, aka packet, includes checksum, source and destination address, and data. The largest packet that can be sent through a data link layer defines the Maximum Transmission Unit (MTU). The data link layer handles the physical and logical connections to the packet's destination, using a network interface. A host connected to an Ethernet would have an Ethernet interface to handle connections to the outside world, and a loopback interface to send packets to itself.
Ethernet addresses a host using a unique, 48-bit address called its Ethernet address or Media Access Control (MAC) address. MAC addresses are usually represented as six colon-separated pairs of hex digits, e.g., 8:0:20:11:ac:85. This number is unique and is associated with a particular Ethernet device. Hosts with multiple network interfaces should use the same MAC address on each. The data link layer's protocol-specific header specifies the MAC address of the packet's source and destination. When a packet is sent to all hosts (broadcast), a special MAC address (ff:ff:ff:ff:ff:ff) is used.

Layer 3 - Network

NFS uses Internetwork Protocol (IP) as its network layer interface. IP is responsible for routing, directing datagrams from one network to another. The network layer may have to break large datagrams, larger than MTU, into smaller packets and host receiving the packet will have to reassemble the fragmented datagram. The Internetwork Protocol identifies each host with a 32-bit IP address. IP addresses are written as four dot-separated decimal numbers between 0 and 255, e.g., 129.79.16.40. The leading 1-3 bytes of the IP identify the network and the remaining bytes identifies the host on that network. The network portion of the IP is assigned by InterNIC Registration Services, under the contract to the National Science Foundation, and the host portion of the IP is assigned by the local network administrators. For large sites, the first two bytes represents the network portion of the IP, and the third and fourth bytes identify the subnet and host respectively.
Even though IP packets are addressed using IP addresses, hardware addresses must be used to actually transport data from one host to another. The Address Resolution Protocol (ARP) is used to map the IP address to it hardware address.

Layer 4 - Transport

Transport layer subdivides user-buffer into network-buffer sized datagrams and enforces desired transmission control. Two transport protocols, Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), sits at the transport layer. Reliability and speed are the primary difference between these two protocols. TCP establishes connections between two hosts on the network through 'sockets' which are determined by the IP address and port number. TCP keeps track of the packet delivery order and the packets that must be resent. Maintaining this information for each connection makes TCP a stateful protocol. UDP on the other hand provides a low overhead transmission service, but with less error checking. NFS is built on top of UDP because of its speed and statelessness. Statelessness simplifies the crash recovery.

Layer 5 - Session

The session protocol defines the format of the data sent over the connections. The NFS uses the Remote Procedure Call (RPC) for its session protocol. RPC may be built on either TCP or UDP. Login sessions uses TCP whereas NFS and broadcast use UDP.

Layer 6 - Presentation

External Data Representation (XDR) sits at the presentation level. It converts local representation of data to its canonical form and vice versa. The canonical uses a standard byte ordering and structure packing convention, independent of the host.

Layer 7 - Application

Provides network services to the end-users. Mail, ftp, telnet, DNS, NIS, NFS are examples of network applications.

Review Questions :

Q—What are the layers of the OSI model?
A—Application, presentation, session, transport, network, data link, physical. Remember the sentence "All people seem to need data processing."
Q—Which layer determines path selection in an internetwork?
A—Layer 3, the network layer.
Q—What types of things are defined at the physical layer?
A—Voltage levels, time of voltage changes, physical data rates, maximum transmission distances, physical connectors, and type of media.
Q—What is one method of mapping network addresses to MAC addresses?
A—ARP, Hello, predictable.
Q—Which includes more overhead, connection-oriented or connectionless services?
A—Connection-oriented.