ITSY2401 Tarleton State University Network Design and Plan Purpose Project PROJECT: NETWORK DESIGN AND PLAN PURPOSE This project provides you an opportuni

ITSY2401 Tarleton State University Network Design and Plan Purpose Project PROJECT: NETWORK DESIGN AND PLAN
PURPOSE

This project provides you an opportunity to solve a comprehensive problem in firewall and VPN implementation at various levels. You will play the role of an employee participating in the network security update planning process in a specific business situation.

REQUIRED SOURCE INFORMATION AND TOOLS

The following tools and resources will be needed to complete this project:

A Web browser and access to the Internet to perform research for the project
Access to the NetWitness Investigator application
Packet trace files, vulnerability scans, and associated reports (provided by your instructor)
general_comm.pcap
encrypted_comm.pcap
nmap_scan.xml
topology_fisheye_chart.pdf
nessus_report.html
LEARNING OBJECTIVES AND OUTCOMES
You will be able to apply core competencies learned throughout the course to a single project.
You will be able to analyze and apply knowledge of firewalls, VPNs, network diagrams, and defense measures.
You will be able to demonstrate logical reasoning and decision-making skills.
DELIVERABLES

The project is divided into two smaller assignments and one major assignment. Details for each deliverable can be found in this document. Refer to the Course Calendar for submission dates.

Project Part 1: Network Survey
Project Part 2: Network Design
Final Project: Network Security Plan
PROJECT PART 1: NETWORK SURVEY
INTRODUCTION

Network defenses rely first on understanding the current configuration of hosts, services, and protocols in use within the organization. Before it is possible to plan to change anything, you must first understand what is present and where it is located within the network. The initial phase of any network security realignment process involves identifying existing resources.

SCENARIO

You have been working as a technology associate in the information systems department at Corporation Techs. The Corporation Techs’ management is concerned that they are losing business to a competitor whose bids are too accurately just under the bids offered by Corporation Techs––by an exact amount. A security firm was contracted to conduct a review of Corporation Techs’ systems, identifying unauthorized access to the Web server as a potential source of compromise due to the shared reporting and public Web site functions. The packet trace and vulnerability scans gathered during this review are available for your use.

The Web server provides public access to the organization’s static Web site for contact information, while sales team members in the field transfer contract and bid documents using a site secured with a logon and password. Corporation Techs has budgeted for new networking hardware but does not want to add additional servers due to cooling issues. Your manager has asked you to create a security plan that will prevent unauthorized access, while making sure that both public and secured Web access remain available.

TASKS

The data and information you need to complete this part of the project are provided to you. (See the Required Source Information and Tools section at the beginning of this document.) In this part of the project, you need to conduct a survey of the existing hosts, services, and protocols within Corporation Techs’ network. Specifically, you need to:

Access the PCAP data using NetWitness Investigator.
Identify hosts within the Corporation Techs’ network.
Identify protocols in use within the Corporation Techs’ network.
Develop a list of hosts and services provided by each.
Create a professional report detailing the information above as the initial document for development of the network security plan.

Write the network survey results as detailed in the instructions ab

files for the project

https://drive.google.com/drive/folders/1VDSVdjeidT…

https://drive.google.com/file/d/1Wa-IkwOrR4rx2yjSp…

https://my.tccd.edu/bbcswebdav/pid-8303094-dt-cont… Host IP Address
172.30.0.8
Protocols Username Password
IP/TCP/IC
MP/UDP student
iss316security
Device Type
OS ID
Server
Microsoft
Windows
Server 2003
BASE-LABService Pack 2 TG01
172.30.0.3
Microsoft
Windows XP
Service Pack 1
172.30.0.1
Lunux Kernel
2.6 on Debian
6.0
172.30.0.4
RPC/Telne
t/SSH
root
password
Gereral Purpose
Linux Kernel
2.6 on Ubuntu
10.04 (lucid)
Host Name
172.30.0.2
172.30.0.200
172.30.0.9
DCE/RPC
service is
running.
SSL/Termi
nal
Services
File/Print
Sharing
Service
root
password
Web Server
Microsoft
windows 2003
Server Service
Pack 2
Base-lab
General Purpose
Lunux Kernel
2.6 on Debian
6.0
Workstation
Linux Kernel
2.6 on Ubuntu
10.04 (lucid)
Comments
Password Comments
The remote host is running Microsoft Windows operating
system or Samba, a CIFS/SMB server for Unix. It was
possible to log into it using one of the following
account :
– NULL session
– Guest account
– Given Credentials
Weak encryption
The remote version of Windows contains a flaw
A security vulnerability exists in the Messenger Service
in the function
that could allow
RemoteActivation() in its RPC interface which
arbitrary code execution on an affected system. An
may allow an attacker to
attacker who successfully
execute arbitrary code on the remote host with
exploited this vulnerability could be able to run code with the SYSTEM privileges.
Local System
A series of worms (Blaster) are known to exploit
privileges on an affected system or could cause the
this vulnerability in the
Messenger Service to fail.
wild
Disabling the Messenger Service will prevent the
The remote host is vulnerable to denial of
possibility of attack.
service.
The remote host has multiple bugs in its RPC/DCOM
Arbitrary code can be executed on the remote
implementation. An attacker may exploit one of these
host due to a flaw in the
flaws to execute arbitrary code
Spooler service.
on the remote system. Microsoft has released a set of
Arbitrary code can be executed on the remote
patches for Windows NT, 2000, XP and
host due to a flaw in the
2003 : Crirical
SMB implementation.
An ONC RPC portmapper is running on port 111 – If you
expose this service to the internet, everybody can query
this information without having to authenticate. It can be
useful to attackers to know what you have running.Also,
the RPC service has a history of security vulnerabilities. So
don’t expose it to the world unless you have to.
A web server is running on the remote host.
Weak password using default password of
“password”. An attacker may use it to gain
further privileges of this system. Set strong
password for this account or disable it. Critical
The remote web server uses a version of PHP
that is affected by
multiple vulnerabilities.
The version of Apache 2.2 installed on the
remote host is older than 2.2.18. Such versions
are affected by a
denial of service vulnerability.
Terminal Services Encryption Level is not FIPS-140
Compliant. Disable Terminal Services if you do not use it,
and do not allow this
service to run across the Internet.
Identified as a Web Server.
An ONC RPC portmapper is running on port 111 – If you
expose this service to the internet, everybody can query
this information without having to authenticate. It can be
useful to attackers to know what you have running.Also,
the RPC service has a history of security vulnerabilities. So
don’t expose it to the world unless you have to.
Weak password using default password of
“password”. An attacker may use it to gain
further privileges of this system. Set strong
password for this account or disable it. Critical
Protocol Comments
The SSL certificate for this service is signed by
an unknown
certificate authority.
Arbitrary code can be executed on the
remote host due to a flaw in the
‘Server’ service.
The remote Windows host has an ASN.1
library that could allow an
attacker to execute arbitrary code on this
host.
Disable Telnet service if you do not use it.
Transmitting traffic in cleartext. Running over
an unencrypted channel. Not recommended
as logins, passwords and commands are
transferred in cleartext. Attacker may
eavesdrop on a Telnet session and obtain
credentials or other sensitive information.
Replace with SSH.
MAC
Address
Make sure security patches are in place for
DCE/RPC .
SSL certificate for service is signed by an
unknown certificate authority. Anyone could
establish a man in the middle attack against
the remote host. Purchase or generate a
ea:14:27:
proper certificate. Medium.
a9:7d:5a
Disable Telnet service if you do not use it.
Transmitting traffic in cleartext. Running over
an unencrypted channel. Not recommended
as logins, passwords and commands are
transferred in cleartext. Attacker may
eavesdrop on a Telnet session and obtain
credentials or other sensitive information.
Replace with SSH.
ITSY 2401
Network Security
TeetersSP19
Project: Network Design and Plan
Purpose
This project provides you an opportunity to solve a comprehensive problem in firewall and VPN
implementation at various levels. You will play the role of an employee participating in the network
security update planning process in a specific business situation.
Required Source Information and Tools
The following tools and resources will be needed to complete this project:
•
A Web browser and access to the Internet to perform research for the project
•
Access to the NetWitness Investigator application
•
Packet trace files, vulnerability scans, and associated reports (provided by your instructor)
o
general_comm.pcap
o
encrypted_comm.pcap
o
nmap_scan.xml
o
topology_fisheye_chart.pdf
o
nessus_report.html
Learning Objectives and Outcomes
•
You will be able to apply core competencies learned throughout the course to a single project.
•
You will be able to analyze and apply knowledge of firewalls, VPNs, network diagrams, and
defense measures.
•
You will be able to demonstrate logical reasoning and decision-making skills.
Deliverables
The project is divided into two smaller assignments and one major assignment. Details for each
deliverable can be found in this document. Refer to the Course Calendar for submission dates.
1
ITSY 2401
Network Security
•
Project Part 1: Network Survey
•
Project Part 2: Network Design
•
Final Project: Network Security Plan
TeetersSP19
Project Part 1: Network Survey
Introduction
Network defenses rely first on understanding the current configuration of hosts, services, and protocols
in use within the organization. Before it is possible to plan to change anything, you must first understand
what is present and where it is located within the network. The initial phase of any network security
realignment process involves identifying existing resources.
Scenario
You have been working as a technology associate in the information systems department at Corporation
Techs. The Corporation Techs’ management is concerned that they are losing business to a competitor
whose bids are too accurately just under the bids offered by Corporation Techs––by an exact amount. A
security firm was contracted to conduct a review of Corporation Techs’ systems, identifying
unauthorized access to the Web server as a potential source of compromise due to the shared reporting
and public Web site functions. The packet trace and vulnerability scans gathered during this review are
available for your use.
The Web server provides public access to the organization’s static Web site for contact information,
while sales team members in the field transfer contract and bid documents using a site secured with a
logon and password. Corporation Techs has budgeted for new networking hardware but does not want
to add additional servers due to cooling issues. Your manager has asked you to create a security plan
that will prevent unauthorized access, while making sure that both public and secured Web access
remain available.
Tasks
2
ITSY 2401
Network Security
TeetersSP19
The data and information you need to complete this part of the project are provided to you. (See the
Required Source Information and Tools section at the beginning of this document.) In this part of the
project, you need to conduct a survey of the existing hosts, services, and protocols within Corporation
Techs’ network. Specifically, you need to:
1
Access the PCAP data using NetWitness Investigator.
2
Identify hosts within the Corporation Techs’ network.
3
Identify protocols in use within the Corporation Techs’ network.
4
Develop a list of hosts and services provided by each.
5
Create a professional report detailing the information above as the initial document for
development of the network security plan.
Write the network survey results as detailed in the instructions above.
Evaluation Criteria and Rubrics
Evaluation Parameters
Percentage
Weight
Did the student demonstrate an understanding of the competencies covered to date?
30
Did the student include all hosts identified within the provided packet trace?
30
Did the student include all services and protocols identified within the provided packet
30
trace and align them with the proper host?
Did the student create a professional, well-developed draft with proper grammar,
10
spelling, and punctuation?
Total
100%
3
ITSY 2401
Network Security
TeetersSP19
Project Part 2: Network Design
Introduction
As discussed so far in this course, the configuration of a network affects the options available for
security and network defense. Using the network survey produced during the first part of this project,
together with host vulnerability assessments and access requirements, you need to design an updated
network structure.
Scenario
You have been working as a technology associate the information systems department at Corporation
Techs for a while now. You have discovered so far that all of Corporation Techs’ computer systems share
the same Class C public IP address range, including workstations along with servers providing
authentication, e-mail, and both secure and public Web sites.
Your next task in this project is to construct a basic network design. An important requirement for the
network design is to reduce the number of public addresses needed as the subnet lease results in very
high ISP costs.
Tasks
Construct a basic network design, separating private and public services within the Corporation Techs’
network. To do so, you must:
1
Access the PCAP files using NetWitness Investigator, and browse the Nmap scan (XML format),
topology fisheye chart (PDF format), and Nessus report (HTML format).
2
Identify vulnerabilities and clear-text information transfer.
3
Conduct research and determine the best network design to ensure security of internal access
while retaining public Web site availability.
4
Identify any opportunities for reduced ISP costs through port redirection or address translation.
5
Design a network configuration, identifying network gateways, port or address redirection
systems, and the location of hosts within private and protected network segments.
4
ITSY 2401
6
Network Security
TeetersSP19
Create a professional report detailing the information above as supportive documentation for
the network security plan.
7
Create a report that includes a basic network diagram and research results.
Evaluation Criteria and Rubrics
Evaluation Parameters
Did the student demonstrate an understanding of the competencies covered to
Percentage
Weight
30
date?
Did the student identify all vulnerabilities identified in the packet trace and host
30
vulnerability scans?
Did the student produce a network design that will fulfill the stated requirements,
40
separating private network resources and protected DMZ bastion hosts?
Total
100%
5
ITSY 2401
Network Security
TeetersSP19
Final Project: Network Security Plan
Scenario
You have been working as a technology associate in the information systems department at Corporation
Techs for three months now. You have conducted a network survey and developed a basic network
design intended to provide security for private network resources and publicly exposed Web services.
Your manager specified that all information transferred between the sales team in the field and the
organizational servers must be protected against snooping. The manager also wants the secured
reporting site to be available only through the organization’s private network so that an outsourced
network-based intrusion detection system (NIDS) service can log all connections.
Tasks
You need to recommend a network design and identify hardening strategies intended to meet the
requirements. To do so, you must:
1
Access the PCAP and other scan data for this project.
2
Conduct research and determine the best network design to meet the stated requirements.
3
Research hardening strategies and identify recommended mitigation strategies for identified
vulnerabilities.
4
Identify mechanisms for secure network access by remote users, both in terms of secure Web
access as well as reporting access conducted using the private network.
5
Develop a network security plan including network realignment, hardening practices, and
policies for remote resource access.
6
Identify expectations from recommended changes and provide justification for each
recommendation in simple language so that primary stakeholders are able to understand it.
7
Create a professional report detailing the information above, presented as a recommendation
for a network security realignment project for Corporation Techs. Include persuasive
justification and measurable expectations as part of this recommendation.
Write the network design results as detailed in the instructions above. Your plan should be made using a
standard word processor format compatible with Microsoft Word.
6
ITSY 2401
Network Security
TeetersSP19
Evaluation Criteria and Rubrics
Evaluation Parameters
Did the student demonstrate an understanding of the competencies covered in
Percentage
Weight
30
this course?
Did the student produce a network design that will fulfill the stated requirements,
20
including VPN and SSL access?
Did the student identify effective network hardening strategies for identified
20
vulnerabilities?
Did the student provide a persuasive justification and measurable expectations for
20
the recommended changes?
Did the student create a professional, well-developed report with proper grammar, 10
spelling, and punctuation?
Total
100%
7
Project Part 1
Techs’ network. Specifically, you need to:
1
Access the PCAP data using NetWitness Investigator.
2
Identify hosts within the Corporation Techs’ network.
3
Identify protocols in use within the Corporation Techs’ network.
4
Develop a list of hosts and services provided by each.
5
Create a professional report detailing the information above as the initial document for
development of the network security plan.
Write the network survey results as detailed in the instructions above.
Remember that you are addressing an administrator or manager, not another technician. This means
that you will need to use plain language. Start your report with your findings, explaining in layman’s
terms, what you observed. You may include your technical findings in an Excel sheet or table and
attach it as an appendix to the end of the report.
All three sections will be included in the final report. They will build on each other.
To begin your report, you will find the hosts and the protocols and services.
Look at the ports and see what services they are running. This is a clue as to what that role that
machine plays in the network.
From the Nessus_report and the Topology_fisheye chart we can see that there are 7 hosts and the IP
addresses.
Now let’s look at the Nessus report at each device and determine if it is a server, workstation, or
network device, what protocols and services are they running.
I’m going to create an Excel file to log the information.
Now I’m going to look at the Nessus Scan report to see what information I can add to my file.
First step is to open Lab 2. Click on the Connections folder on the desktop and click on the
TargetWindows02 machine to connect.
After you verify the Project files are there, close the Explorer window.
Open NetWitness by clicking on the RSA Icon in the taskbar at the bottom of the screen.
When NetWitness opens, click on the Collection tab at the top of the page and select New Local
Connection.
On the collection toolbar, click the New Local Collection icon.
1) Enter a unique name for the new collection in the New Local Collection dialog box.
2) Specify a location for the new collection if you want it saved other than the displayed folder by
checking the Override Default Location checkbox.
3) Check the Lock Collection checkbox if you want to prevent the collection from being deleted or
used for future capture/import.
4) Check the Auto Connect checkbox if you want the collection to open each time you open
Investigator.
Click on the newly created collection to make it active.
You can either select the Import Packets from the tool bar or right click the collection and choose
Import Packets.
1) Click on the Import Packets icon to bring up a Windows Explorer dialog and find the packet file(s)
you wish to import. Press “OK”.
2) You should now see a progress bar in the collection row indicating how far along Investigator is in
importing your packet files.
3) Once the import is finished and the collection is “Ready” you can begin interacting with the newly
imported packets.
Once all your packets are imported you can right click the connection and choose connect.
Your collection should read Ready. Then double click on the collection to open it.
You can go through this report and I like to open an Excel sheet to add to as I go along.
I will attach so you can see what I mean.
Now I’m going back to the Nessus Scan Report.
Double click the file and it will open in a Browser window.
I went through this report and added my findings to the Excel sheet.
I did not add everything as it is up to you to do a complete evaluation.
You may use this as a starting point if you would like.
Remember that in this part of the project, you are looking at the topology of the network and what
kind of protocols and services are running.
What are the weaknesses that you see?
Prepare your report.
You will be able to change this part if needed as you progress in the project.

Purchase answer to see full
attachment