Authentication, Authorization and Accounting (AAA)

It refers to a security architecture for distributed systems, which enables control over which users are allowed access to which services, and how much of the resources they have used.


Authentication
Authentication refers to the process where an entity's identity is authenticated, typically by providing evidence that it holds a specific digital identity such as an identifier and the corresponding credentials. Examples of types of credentials are passwords, one-time tokens, digital certificates, and phone numbers.


Authorization
The authorization function determines whether a particular entity is authorized to perform a given activity, typically inherited from authentication when logging on to an application or service. Authorization may be determined based on a range of restrictions, for example time-of-day restrictions, or physical location restrictions, or restrictions against multiple access by the same entity or user. Typical authorization in everyday computer life is for example granting read access to a specific file for authenticated user. Examples of types of service include, but are not limited to: IP address filtering, address assignment, route assignment, quality of Service/differential services, bandwidth control/traffic management, compulsory tunneling to a specific endpoint, and encryption.


Accounting
Accounting refers to the tracking of network resource consumption by users for the purpose of capacity and trend analysis, cost allocation, billing. In addition, it may record events such as authentication and authorization failures, and include auditing functionality, which permits verifying the correctness of procedures carried out based on accounting data. Real-time accounting refers to accounting information that is delivered concurrently with the consumption of the resources. Batch accounting refers to accounting information that is saved until it is delivered at a later time. Typical information that is gathered in accounting is the identity of the user or other entity, the nature of the service delivered, when the service began, and when it ended, and if there is a status to report.

Context-Based Access Control

Context Based Access Control (CBAC) intelligently filters TCP and UDP packets based on application layer protocol session information and can be used for intranets, extranets and internets. CBAC can be configured to permit specified TCP and UDP traffic through a firewall only when the connection is initiated from within the network needing protection. (In other words, CBAC can inspect traffic for sessions that originate from the external network.) However, while this example discusses inspecting traffic for sessions that originate from the external network, CBAC can inspect traffic for sessions that originate from either side of the firewall. This is the basic function of a stateful inspection firewall.

Without CBAC, traffic filtering is limited to access list implementations that examine packets at the network layer, or at most, the transport layer. However, CBAC examines not only network layer and transport layer information but also examines the application-layer protocol information (such as FTP connection information) to learn about the state of the TCP or UDP session. This allows support of protocols that involve multiple channels created as a result of negotiations in the FTP control channel. Most of the multimedia protocols as well as some other protocols (such as FTP, RPC, and SQL*Net) involve multiple control channels.

CBAC inspects traffic that travels through the firewall to discover and manage state information for TCP and UDP sessions. This state information is used to create temporary openings in the firewall's access lists to allow return traffic and additional data connections for permissible sessions (sessions that originated from within the protected internal network).

CBAC does the deep packet inspection and hence it is termed to be a IOS Firewall.

Access Control Lists

An access control list (ACL) is a table that tells a computer operating system which access rights each user has to a particular system object, such as a file directory or individual file. 

There are two basic types of ACLs for cisco routers. The standard and extended routers.

The standard ACL filter IP packets based on the source address only while the extended ACL filter IP packets based on several attributes such as the protocol type, source and destination IP addresses, source and destination TCP/UDP ports or ICMP and IGMP message types. 

cisco router syntax for standard ACLs:

access-list access-list-number {deny | permit } source [source-wildcard]

Cisco router syntax for extended ACLs:

access-list access-list-number {deny | permit} {protocol-number | protocol-keyword}{source source-wildcard | any | host} {source-port} {destination destination-wildcard | any |host} {destination-port} [established] [log | log-input]

Access control lists can generally be configured to control both inbound and outbound traffic, and in this context they are similar to firewalls. Like Firewalls, ACLs are subject to security regulations and standards such as PCI DSS.

Secure Perimeter Routers & Disable Services & Logging

At the perimeter router, there should be a login banner and it should:

•          Specify what is “proper use”of the system

•          Specify that the system is being monitored

•          Specify that privacy should not be expected when using this system

•          Do not use the word “welcome”

•          Have legal department review the content of the message

Also use good password practices such as:

•          Avoid dictionary words, names, phone numbers, and dates.

•           Include at least one lowercase letter, uppercase letter, digit, and special character.

•           Make all passwords at least eight characters long.

•           Avoid more than four digits or same-case letters in a row.

•          Change passwords often.

Services that are not in used should be turned off or removed as each service may have their security vulnerabilities and by having them turn on, you are exposing yourself to more security risks.

When possible, the following practices are advised:

•          Encrypt Syslog traffic within an IPSec tunnel.

•          When allowing Syslog access from devices on the outside of a firewall, implement RFC 2827 filtering (Network Ingress Filtering: Defeating DoS Attacks) at the perimeter router.

•          ACLs should also be implemented on the firewall in order to allow Syslog data from only the managed devices themselves to reach the management hosts. 

Common Threats to Router and Switch Physical & Mitigation

Besides network threats and security threats to a network, there are also physical threats and they are equally important to take care off.

1. Hardware threats -- All threats that are associated with physical damage to the routers and switches are classified as hardware threats. You can mitigate hardware threats by providing controlled access to the facilities. You limit access to only network-related personnel into the main distribution facility (MDF), intermediate distribution facility (IDF), and network operations center (NOC). You can provide security by ensuring that there is no access to the facility via the ceiling, raised floors, AC ducts, or windows. You can also mitigate hardware threats by using security cameras and by logging entry attempts.

2. Environmental threats -- Threats associated with climatic conditions are environmental threats. To mitigate environmental threats, you need to ensure that there is adequate ventilation in the facility and that the temperature and humidity levels are maintained in accordance with the specifications defined in the equipment documentation. Once these parameters are in place, ensure that you have the ability to remotely manage and monitor temperature and humidity controls. Also make sure that the facility is free from electrostatic discharge (ESD) and magnetic interference.

3. Electrical threats -- Brown-outs, spikes, inadequate power supply, noise and power loss are typical examples of electrical threats. We highly recommend that your mission-critical devices are hooked up to an uninterrupted power supply (UPS). A UPS provides line conditioning and protects your network devices against irregularities in your power distribution system. Ensure that you have redundant power supplies in your network devices (if they support them) or some hot spares at the facility. This measure reduces the amount of downtime on your network. A generator can be an alternate source for power in case of a power outage if your environment is mission critical.

4. Maintenance threats -- Poor cabling, faulty labeling and electronic devices without adequate ESD deterrents are classified as maintenance threats. Make sure that the equipment cabling is labeled properly and that a proper labeling convention is followed. This measure helps in tracing cables in the facility and aids in quick troubleshooting as well. Ensure that cables have smooth bends when you go around the corner. You want no kinks on the cable, so you can guarantee the smooth flow of data.

Network / Port Address Translation

Network Address Translation (NAT) is the process of modifying IP address information in IP packet headers while in transit across a traffic routing device.

The simplest type of NAT provides a one to one translation of IP addresses. RFC 2663 refers to this type of NAT as basic NAT. It is often also referred to as one-to-one NAT. In this type of NAT only the IP addresses, IP header checksum and any higher level checksums that include the IP address need to be changed. The rest of the packet can be left untouched. Basic NATs can be used when there is a requirement to interconnect two IP networks with incompatible addressing.

However it is common to hide an entire IP address space, usually consisting of private IP addresses, behind a single IP address in another address space. To avoid ambiguity in the handling of returned packets, a one-to-many NAT must alter higher level information such as TCP/UDP ports in outgoing communications and must maintain a translation table so that return packets can be correctly translated back. RFC 2663 uses the term “Network Address and Port Translation” NAPT for this type of NAT. Other names include Port Address Translation PAT, IP masquerading, NAT Overload and many-to-one NAT. Since this is the most common type of NAT it is often referred to simply as NAT.

Perimeter Router, Internal Router and Firewall

The perimeter router is typically a standard router providing a serial connection to the outside world and a LAN connection to the internal network. The perimeter router should provide any filtering of outside traffic to implement basic security for the DMZ and preliminary filtering for the inside network. This device could be running the firewall feature set for additional security options.

A firewall can either be software-based or hardware-based and is used to help keep a network secure. Its primary objective is to control the incoming and outgoing traffic of network by analysing the data packets and determining whether it should be allowed through or not, based on a predetermined rule set. A network's firewall builds a brigade between an internal network that is assumed to be secure and trusted, and another network, usually an external (inter)network, such as the Internet, that is not assumed to be secure and trusted.

The internal router takes care of the internal network of the company such as NAT.

Such as network that has all 3 are more common in medium and large business where they would need greater protection and performance and well as greater routing options. The firewall is separated from the router and there is 1 router to take care of the external and internal network. The workload is split between different machines and therefore, they would be able to perform better and they have more computing resource to perform that function.