Infrastructure Security

Infrastructure security deals with the most basic aspects of how information flows and how work occurs in your network and systems. An infrastructure is simply the basis for all of the work occurring in your organization. When discussing infrastructures, bear in mind that this includes servers, networks, network devices, workstations, and the processes in place to facilitate work.

To evaluate the security of your infrastructure, you must examine the hardware and its characteristics, and also examine the software and its characteristics. Each time you add a device, change configurations, or switch technologies, you are potentially altering the fundamental security capabilities of your network.

Networks are tied together using the Internet and other network technologies, thereby making them vulnerable to attack in any number of manners. The job of a security professional is to eliminate the obvious threats, to anticipate how the next creative assault on your infrastructure might occur, and to neutralize it before it happens.

The following sections deal with the hardware and software components that make up a network.

Hardware Components

Hardware components include physical devices, such as routers, servers, and firewalls. Figure 3.1 depicts a typical network infrastructure and some of the common hardware components in the environment. From a security perspective, this infrastructure is more than the sum of all of its parts. You must evaluate your network from the perspective of each device in it. The complexity of most networks makes securing them extremely complicated. In order to provide reasonable security, every device must be evaluated to determine its strengths and weaknesses.

Figure 3.1: A typical network infrastructure

Notice in this figure that the network we will be evaluating has Internet connections. Internet connections expose your network to the highest number of external threats. These threats can come from virtually any location worldwide. The network includes routers, firewalls, switches, servers, and workstations. Each of these devices has its own unique vulnerabilities and strengths. These devices are covered in more detail later in this chapter. As you can see from Figure 3.1, your infrastructure is complicated and dynamic.

Software Components

Hardware exists to run software. Most of the devices that we use today have a certain amount of artificial intelligence. This intelligence makes them easy to configure, easy to support, and to a certain extent, easy to bypass. The network infrastructure illustrated in Figure 3.1 includes servers, workstations running operating systems, routers, firewalls (which may run as applications on servers), and dedicated devices that have their own communications and control programs.

This situation leaves networks open to attacks and security problems because many of these systems work independently. Many larger organizations have built a single area for network monitoring and administrative control of systems. This centralization allows a larger overall picture of the network to be seen, and it allows actions to be taken on multiple systems or network resources if an attack is underway. These centralized areas are called a Network Operations Center (NOC). Using a NOC makes it easier to see how an attack develops and easier to provide counter measures. Unfortunately, a NOC is beyond the means of most businesses. They are expensive and require a great deal of support.

ATT Wireless NOCs

ATT Wireless maintains a huge NOC for each of the cell centers they manage. These centers provide 24/7 real-time monitoring of all devices in the cellular and computer network that they support. The operators in the NOC have the ability to literally reach out and touch any device in the network to configure, repair, and troubleshoot. A single NOC has dozens of people working around the clock to keep on top of the network. When an ATT Wireless center goes down, it effectively takes down the entire cell-phone service for an entire region. As you can imagine, this is horrendously expensive and they do not let it happen very often. There are several NOC facilities in the United States, and one region can support or take over operations for another region if that center becomes inoperable.

Supporting an infrastructure in a large corporation can be a horrendously expensive proposition, and it requires literally years of development to create an effective NOC.