Network Security Planning
By: Marticia Goodwin
CIS 532 / Professor Danielle Babb
August 19, 2012
Strayer University

SAFE is a reference architecture that network designers can use to simplify the complexity of a large internetwork in which the architecture lets you apply a modular approach to network design. Traditional point security tools are limited in their ability to support and securing a business transformation, either leaving critical new resources unprotected or preventing the deployment of new services as they do not secure new processes and protocols. At the same time, organizations are facing a host of new threats that target many of these new services and impact network and service availability (Lippis, 2012). With SAFE, you can analyze the functional, logical, and physical components of a network and thus simplify the process of designing an overall enterprise network, but CISCO SAFE architecture is especially concerned with security. SAFE takes a defense in-depth-approach in which multiple layers of protection are strategically located throughout the network and the layers are under unified strategy for protecting the entire network and the various components of the network, including individual network segments, infrastructure devices, network services, endpoints, and applications (Oppenheimer, 2011). SAFE architecture is comprised of the following major modules: core, data center, campus, management, WAN Edge, Internet Edge, branches, extranet, partner site, E-Commerce, teleworkers, and Cisco SensorBase. Each module is discussed as it stands alone and how it integrates with other modules which allows you to pick the module that best apply to your environment. Unlike most security whitepapers, SAFE provides a step-by-step instructions, screenshots, and configuration examples throughout. In fact, it includes just about every configuration necessary to build out the entire SAFE architecture from scratch by including this information, cisco SAFE drastically cuts down on the implementation and deployment time necessary to rollout a secure architecture. It also eliminates the guesswork of trying to figure out exactly what commands and features the guide was referencing or describing. The bottom line is that if you have any Cisco gear in your environment then SAFE should be reviewed. It shows how to best harden and secure devices and network environment. Like almost everything in security design, there is usually more than one way to accomplish the same thing. The SAFE guide was put together to show the best practices that Cisco recommends to secure a generic network. But remember, that doesn’t mean there are not viable alternatives that would work as good or better in each specific environment than the ones provided (Heary, 2009). There are limitations when it comes to SAFE though. . Generally, network infrastructure devices provide multiple access mechanisms, including console and remote access based on protocols such as Telnet, rlogin, HTTP, HTTPS, and SSH. The hardening of these devices is critical to avoid unauthorized access and compromise. Best practices include the use of secure protocols, disabling unused services, limiting access to necessary ports and protocols, and the enforcement of authentication, authorization and accounting (AAA). However, infrastructure devices are not all the same. It is fundamental to understand their unique characteristics and nature in order to properly secure them. The primary purpose of routers and switches is to provide connectivity; therefore, default configurations typically allow traffic without restrictions. In addition, the devices may have some of the services enabled by default which may not be required for a given environment. This presents an opportunity for exploitation and proper steps should be taken to disable the unnecessary service. In particular, routers’ responsibilities are to learn and propagate route information, and ultimately to forward packets through the most appropriate paths. Successful attacks against routers are those able to affect or disrupt one or more of those primary functions by compromising the router itself, its peering sessions, and/or the routing information. Because of their Layer-3 nature, routers can be targeted from remote networks. Best practices to secure routers include device hardening, packet filtering, restricting routing-protocol membership, and controlling the propagation and learning of routing information. In contrast to routers, switches’ mission is to provide LAN connectivity; therefore, they are more vulnerable to Layer 2-based attacks, which are most commonly sourced inside the organization. Common attacks on switched environments include broadcast storms, MAC flooding, and attacks designed to use limitations on supporting protocols such as Address Resolution Protocol (ARP), Dynamic Host Configuration Protocol (DHCP), and Spanning Tree Protocol (STP). Best practices for securing switches include device hardening, restricting broadcast domains, SPT security, ARP inspection, anti-spoofing, disabling unused ports, and following VLAN best practices. Firewalls, load balancers, and in-line devices in general are also subject to unauthorized access and compromise; consequently, their hardening is critical. Like any other infrastructure devices, in-line devices have limited resources and capabilities and as a result they are potentially vulnerable to resource exhaustion attacks as well. This sort of attacks is designed to deplete the processing power or memory of the device. This may be achieved by overwhelming the device capacity in terms of connections per second, maximum number of connections, or number of packets per second. Attacks may also target protocol and packet-parsing with malformed packets or protocol manipulation. Security best practices vary depending on the nature of the in-line device (Cisco SAFE Reference Guide, 2010).

References
Oppenheimer, P. (2011). Top-down network design (3rd ed.). Indianapolis, IN: Pearson

Education, Cisco Press

Lippis, N. 2012. Cisco SAFE: A Security Reference Architecture The Changing Network and Security Landscape. The Lippis Report; Resources for Business & IT Leaders. Lippis Enterprises. http://lippisreport.com/2009/07/cisco-safe-a-security-reference-architecture-the- changing-network-and-security-landscape-2/

Heary, J. 2009. Cisco Releases refreshed Security Best Practices Guide – SAFE. Network World. Network World, Inc. http://www.networkworld.com/community/node/41686

2009. Cisco SAFE Reference Guide. San Jose, CA. Cisco Systems, Inc