IDS-Concepts

Size: px

Start display at page:

Download "IDS-Concepts"

肖寄方
5 years ago
Views:

3 !!! :

4 (Internet) : Attacker

5 (802.11) AP AP: Access Point, AP

6 AP

8 Drive by Hacking NoteBook 12 AP / 12 AP Personnel Records Trade Secrets Financials WiFi (802.11)

9 LAN

10 MAC Address : AP MAC Address : WEP ( ) MAC MAC Address

11 (Close Network): Service Set ID(SSID) : SSID, AP SSID AP SSID SSID SSID

802.11 WEP (Wired Equivalent Privacy) 802.

12 WEP (Wired Equivalent Privacy) RC ( ) bit key : AP Key Code 1 4M Frame Key( )

13 : & AP : AP scanner, Net Stumbler War driving : Airsnort, Airopeek (DoS) : MAC Address AP: (Man in Middle attack)

14 AP Scanner

15 War Driving Scan

16 : default, linksys

17 Network Stumbler

18 AiroPeek IP Addresses Clear Text Passwords Company Data

19 AP War Driving

20 AP AP AP

21 AP AP AP

23 : AP AP Radius, VPN AP AP

24 AP (Handover)? IP QoS(Quality of service)??? AP?

25 (Authentication) (Authorization) (Privacy), : : PDA Scanner :

26 : : Web ( FTP) ( : ) Guest / Visitor

27 Wi-Fi WEP(Wired Equivalent Privacy) 802.1x (PEAP, Cisco-LEAP, TLS, TTLS, MD5) Key Exchange Wi-Fi Protected Access (WPA) 802.1x key Wi-Fi Alliance Pre i ( IEEE ) /, i AES (2004 ), VPN (IPSec),

28 WLAN BlueSecure Intrusion Protection System & Bluesocket Wireless Gateway RF WLAN

29 WLAN Gateways: Authentication, Encryption, Policy Management, Secure Mobility PPTP Executive IPsec Finance access point 802.1x Admin Clear Visitor access point access point X access point Enterprise LAN ACS LDAP Radius NT Domain

30 Bluesocket Wireless Gateway Authentication, Encryption, Policy Management, Secure Mobility Open, Standards-based Interoperability for Multi-vendor Networks PPTP Executive IPsec Finance access point Bluesocket Wireless Gateway 802.1x Admin Clear Visitor access point access point X access point Enterprise LAN ACS LDAP Radius NT Domain

31 RF (Unauthorized Access) (Eavesdrop) AP (Malicious AP) AP (Rogue AP) User Wireless Link Enterprise LAN Eavesdropper Rogue Access Point Malicious Access Point Enterprise Access Point

32 802.11i?

33 , AP Switch Airespace, Aruba, Cisco, Proxim, Symbol, Trapeze

34 Bluesocket Your Secure WLAN Develop Wireless Policy 5. RF Intrusion Protection continuous real-time monitoring of the airwaves 4. Network-based Virus Detection, Worm Protection 3. Policy Enforcement, Bandwidth Management 2. Strong Encryption 1. Universal Authentication Plan for Protection

35 (Probe Attack): AP : AP: Man in middle Attack (DoS): Storms : Worm

36 BlueSecure RF Sensor AP WLAN AP BlueSecure Server a/b/g

37 BlueSecure Server BlueSecure RF Sensors AP Rogue AP Alert Windows

39 BlueSecure IPS Deployed RF Monitoring System for: Rogue Detection Vulnerability Assessment Intrusion Detection Usage Auditing Troubleshooting Performance Management Usage Planning Make sure your WLANs are hack-proof Security Operations Ensure the service levels of your WLANs Network Operations

40 BlueSecure WLAN : BlueSecure Intrusion Protection System: RF Policy Bluesocket Wireless Gateway: RF Monitoring Sensor : Multi-Method, Correlated, RapidScan : Plug-n-Play (Total Cost of Ownership), (ROI)

41 Bluesocket Wireless Gateway Plug-n-Play Enterprise WLAN Security/Control Mobile Devices: NIC or Built-In Access Points: b, g, a/b, etc. Bluesocket Wireless Gateway Authentication Servers: LDAP, Radius, NT Domain Server

42 Bluesocket WG: / Smart Card Token Local (LDAP RADIUS NT Domain) Role-based VPN PPTP L2TP IPSec

43 Bluesocket WG: (Secure Mobility TM) Web-base QoS (Quality of Service)

44 Secure Mobility TM Matrix 12 Mobile Devices + Off-the-shelf APs + Wireless Gateways + Unchanged Legacy Network R&D/Engineering Wiring Closet Internet Wiring Closet Finance and IT AP AP AP AP AP Wired Network Sales and Marketing AP Wiring Closet Corporate Network Wiring Closet AP Operations AP Radius, LDAP, Active Directory, NT Domain Server Corporate Servers AP AP AP

45 Bluesocket WG: WLAN (role) QoS AP

46 Many Components = High Operational Expense Authentication Encryption Firewall Mobility Single Component, Multiple Functions QOS/ BWM Policy Interoperability Bandwidth Mgt

47 Bluesocket WG WG-5000 High WG-2100 Data Density Medium Low WG-1100-SOE WG Users 1-20 APs Medium Users APs Large Up to 1000 Users Hundreds of APs Very large 1-15 Users 1-3 APs 100 Mbps Clear 15 Mbps 3DES Small 100 Mbps Clear 30 Mbps 3DES Performance 400 Mbps Clear 150 Mbps 3DES 1 Gbps Clear 400 Mbps 3DES

48 Multi-Layered Security Enterprise User WEP Keyed Access IPSec Security Corporate Wired Network Industrial User MAC ACL Entry RADIUS/ LDAP Authentication VPN Certificate PKI Credentials Internet / Web Services Intruder FW Session Controls Virus Controls/ IDP

49 Bluesocket Wireless Gateway 4.0 Cisco Cisco 802.1x EAP-FAST ( LEAP, PEAP, TLS, TTLS) Voice over WLAN WLAN Load Sharing HP OpenView

50 Zero-Day Attack OS

51 Bluesocket WLAN Zero-Day : Name of User signature Attacking or Infected Ports being used in WLAN attack/worm exploit IDS State (ex: Blocked or Monitored )

52 Cisco Cisco AP-Base Cisco 802.1x EAP-FAST ( LEAP, PEAP, TLS, TTLS) Cisco Cisco APs AP Cisco Firmware AP Name, Location and MAC Cisco CDP Which user is on the AP What Cisco Model and Firmware

53 Bluesocket WLAN WLAN WLAN WLAN : (AP,,, )

54 Education Healthcare Government Enterprise

55 Singapore Polytechnic

57 : : VPN ,

58 Thank You!

untitled

untitled Ruckus Wireless XXXX... 3 1... 3 XXXX... 4 21... 4 22... 4 23... 4 24... 5 25... 5 Ruckus... 6 31 Ruckus... 6 311 Ruckus... 6 312... 7 313 BeamFlex 802.11n... 8 32 Ruckus... 9 321 ZoneDirector 3000...