Hello, and welcome back.
It's often great to be reminded about things,
like such as birthdays, reminding
ourselves to exercise, to eat right, to be kind to everybody.
Well, it's also important to be reminded occasionally
about those things that we should
be both considering and doing for secure management
of our network.
And that's what I'd like to do in this video
is take a nice look at a laundry list of elements
that we should be doing to manage our network securely.
So let's use this network as a backdrop
as we talk about secure network management. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as we talk about secure network management.
And one of the first things we had to consider
is OOB, out-of-band management.
So if we have user VLANs and user networks,
we might want to carve out either physically or logically
separate management networks.
And that helps us isolate our management traffic
from the user traffic.
It also helps keep our management network traffic
separate from where a hacker or an attacker
might try to compromise us.
So out-of-band versus in-band management of our networks
is a good thing to consider. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is a good thing to consider.
Also, if the data network goes down,
we have auxiliary or redundant out-of-band management systems.
So we can still get to our stuff and see what's going on,
which is really critical if parts of the network
are failing.
Another element that we want to always use when possible
are secure protocols.
And secure protocols would include
options such as secure copy protocol, SCP,
as opposed to FTP or TFTP, or secure FTP or HTTPS,
using SSL/TLS.
And with the SNMP, we'd want to use version three. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And with the SNMP, we'd want to use version three.
And as part of SNMP version three,
we'd want to make sure we're using the authentication
and encryption services that are available in that management
protocol.
And if we are using a protocol, and it's not
being protected well enough, we could always
tuck that into some type of a virtual private network
to make sure that data plane traffic is safe
as it crosses the network.
And with the VPN, we could be leveraging HTTPS,
or we could be leveraging IPSEC, depending
on the implementation.
And also, there's security measures
that we often do on our networks that
aren't directly related to the management of the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
aren't directly related to the management of the network.
But any time we can help prevent the network from being
compromised, it's a great idea.
So some of those security measures
would be DHCP snooping, which is going to do
a couple of things for us.
One, it's going to help prevent a rogue or bogus DHCP
server from being successful.
It's also going to build a database of our clients
in their layer three layer two mappings
that we can use with ARP inspection.
We can also implement port security
to verify that only specific layer two addresses
or quantities of layer two addresses show up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or quantities of layer two addresses show up
on our switch ports.
And we have separate sets of videos
on each of these aspects in detail,
including the configuration of them.
And for switches, many companies are not
going to run DTP, dynamic trunk protocol.
I'll put a big no there.
And they're going to take all their unused ports
and place them as access ports in an unused VLAN.
And that way, if an attacker or someone even
accidentally connects to a port they're not supposed to be on,
they're not going to get very far because the port basically
goes to an unused VLAN that has no access anywhere else
in the network.
And that would include no DHCP services or any layer three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that would include no DHCP services or any layer three
routing services or anything else.
And also for our devices, we'd want
to go ahead and do some hardening.
And I've got separate sets of videos regarding hardening,
both the control plane and the management plane and the data
plane.
So check out those sets of videos as well regarding
hardening our network devices.
All right, so back to management.
If we are logging into these devices,
whether it's us at a PC logging in directly
to these devices with a secure protocol, like SSH--
I'll add that up there as well-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'll add that up there as well--
or if we're connecting to a controller,
and the controller is connected to those devices,
we'd want to make sure we're using AAA.
So authentication, who the heck are you?
Authorization, what are you allowed to do?
And then accounting, what did you do?
So with ISE as a AAA server, we could leverage TACACS.
And that way we could control what the admin one or admin two
or admin three, whatever those usernames are,
we can control specifically what they're allowed to access
and what commands they're allowed to implement.
And then log all of that.
Also, as far as the logging, it would WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Also, as far as the logging, it would
be really important to have a copy of those logs sent over
to a server that does not allow admin access to that server.
So perhaps we have a syslog server here
that's general purpose.
And we have a replica of that syslog server,
a copy of that data over here on another server.
So that way, if we need to go back and do an audit,
we can see exactly what happened.
And the admin, like a rogue admin, can't go to the server
or start changing it because he doesn't have access
to this replica or to this copy.
And as far as authenticating, if we can, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And as far as authenticating, if we can,
it'd be great to use MFA, or sometimes called 2FA.
So that's multi-factor authentication
or two-factor authentication.
We've got a separate set of videos just on that.
But that way, we can really make sure that Bob the admin really
is Bob.
And even if we're not using elaborate setups
with ISE and TACACS to control who can do what,
even locally on the devices, we can use parser views
to give subsets of commands and options
to an individual user based on their log in.
And so in a large environment, we'd
want centralized administration with a AAA server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
want centralized administration with a AAA server.
But even in smaller organizations,
we could use parser views or custom privilege levels
to give subsets of functionality based
on the user who is connecting to and managing that device.
For our firewalls, this could be a Firepower Device,
or maybe it's one of the older ASAs.
We'd want to leverage the features that
brings to the table, including on the ASA
there's this option called NSEL, which stands for NetFlow Secure
Event Logging. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Event Logging.
So I spent about a decade or so with the ASA.
It's like an old friend.
These days, we're using Firepower with advanced threat
detection and all that stuff.
But on the ASA, if you're still using one,
you can use NetFlow Secure Event Logging.
And what it does, it combines the benefits of NetFlow
to collect and report over to a collector information that's
happening on the ASA.
So it leverages NetFlow version nine.
And it can track a flow creation when initial session
is going out to the internet for stateful
filtering to allow the reply traffic coming back.
We can record the flow tear-down and also flow-denied. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can record the flow tear-down and also flow-denied.
So the benefit of having this all working with NetFlow
is that if we have a NetFlow collector that's
giving us nice beautiful graphics and reporting,
it's an easy way to see large volumes of information
with a NetFlow collector.
And on the ASA, what we used to do
to implement that type of thing was an MPF, the modular policy
framework, which is basically class maps which
identify the traffic.
Policy maps, which say what we're
going to do with the traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to do with the traffic.
And that's what we'd want to include a flow export
event in that policy map.
And to apply it, we'd use a service policy command.
So here's the kicker.
If we already have the collector in place,
and we're using NetFlow with our other devices,
and we have an ASA, we could also
leverage NSEL, the NetFlow Secure Event Logging,
to include the ASA information in our collector.
Man, this screen is crowded.
Let me clear it up off here.
And in the world of software-defined networking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in the world of software-defined networking
where we sit here, this is us, and then we
talk to some type of a controller.
And that the controllers and interacting
with our network devices.
We could be managing next generation firewalls,
next generation IPS, infrastructure devices
like routers and switches.
And the key is we want to make sure we have security
all the way across.
So if there's multi-factor authentication for us
to log on, that's great.
We want to use secure protocols between the controller
and those devices.
And again, if we can manage those out-of-band
with a separate either physical or logical network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with a separate either physical or logical network
for that management function, that's ideal.
Another element, too, and I'll go ahead and use
a separate video, regarding change control,
is to make sure that we have backups of our configurations.
So that if something bad happens to this router right here,
and we need to replace it, if there's
no fault tolerance in place, and it goes out,
we need to replace it.
It should be not a matter of oh no, what was that config?
We should have configuration management
that's storing all of our configurations securely
encrypted so that we can restore them
when needed after we replace the hardware that's failed. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
when needed after we replace the hardware that's failed.
In this video, we've taken a look at a high level view
at some techniques that we can use
for better management and more secure management
of our network.
And in the next video, I'd like to dive a little bit deeper
into the world of syslog.
So I'll see you in that video in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.