The Network As Target

There are some problems for which there is currently no easy solution. When the entry points into your network are saturated with an overload of network traffic, there's not much you can do about it. The best actic you can use when such an attack occurs is to try to block out the address ranges from which the attack is coming. But when your network is being singled out by several hundred other compromised computers, it's rather difficult to quickly program routers to block all of these network addresses. The fact that many large Internet sites have been taken down during the past few years by these kinds of attacks should be indicative of how serious this attack can be. What can you do? Gather all the information you can, and, when the attack is over, try to backtrack to find out where the attack initiated. At this time it might not be possible to do this because one computer can set off others to do the dirty work for them. If you don't have access to the actual computers that perform a distributed denial-of-service attack, you can use the information on those other systems to further research the problem.

So for now, the best solution is to hope that this doesn't happen to you and to use an Internet service provider that has a good technical team that can respond quickly to help block sites that are generating this type of attack. And by all means, if you are targeted, get the authorities involved.

Protecting Host Computers Encryption and Virus-Protection Software

After an intruder gets past a router, it's usually pretty easy to intrude further by gaining access to host computers on the network. Again, it is so easy to simply put up a router and firewall configuration and assume that your network is safe. However, even if these methods do protect you from outsiders you still must worry about users who are allowed on the network. A disgruntled employee can do more damage (and probably do a good job of hiding the evidence) than many network intruders. Host security is a very important topic.

You should first start by becoming intimately familiar with the resource-protection and user- authentication schemes used by your computers. For example, many Unix variants provide for a shadow password file that is not easily accessible. When someone breaks into a Unix server, it's a simple matter to download the contents of the / etc / passwd file and spend a few minutes or hours using an automated program to encrypt words in a dictionary, check to see whether they match the encrypted password in the stolen file, and then simply log back into your Unix box using a valid password!

The applications you run on servers or workstations can also make the host computer an easy target. For example, if you are using older versions of FTP or Telnet, you're sending usernames and passwords about your network in clear, easy-to-read ASC text. A network sniffer (which can be something as simple as a Trojan horse program planted somewhere in your network) can watch for these and transmit them back to the intruder. Because secure versions of these and other related utilities are available, you should always be sure to use the secure versions, even if it means purchasing additional software that already comes with your operating system.

If you have an important server that is absolutely critical to your business operations, you might want to consider keeping a "hot spare" around. That is, create another server that is virtually a clone of the important server. If the original server is compromised, place the hot spare into service. This might involve a little time if you have data that needs to be restored to the hot spare before it can be used. However, for servers that contain data that doesn't change often, such as some Web servers, you can have an exact duplicate sitting around just waiting to be used in case the operational Web server becomes compromised.

Firewall Problems

If you have installed a router/switch device between your network and a broadband Internet connection, be sure to read the manual thoroughly and understand how the device should be configured. Many come with default settings, but you need to fill in some information, such as the address of the broadband lint, if your service provider gives you a static address. In most cases, the provider will be
using DHCP also, so you won't have to make any changes. If you do have to make changes, write them down and keep the information handy for later troubleshooting efforts.

It's not a good idea to mix computers you use for play with those you use for business on the same network. If you do, you are just asking for trouble. If you play Internet games—those that allow you to interact with other users playing the same game on the Internet—you might be instructed to change the port settings on a small switch/router that also functions as a firewall. If you start playing around with opening, disabling, or forwarding ports, keep track of the changes you make. If something stops working after you've made a change, undo the modification and see whether the changes you've made have caused the problem.

Some users prefer to use the demilitarized zone (DMZ) option as an alternative to fiddling around with router settings to make online gaming possible.

Remember that the firewall capabilities of a small switch/router are minimal and are designed to protect you from simple attacks from the Internet. It might be that the default settings are very stringent and if you end up making changes that relax the firewall settings, you might also be opening a door that can allow bad things into your small LAN.

Keeping Your Network Healthy

Another good reason to keep your entertainment computers separate from your business LAN is that you don't want to be surfing the Web, find a neat program, and download a virus or some other bad program that will start to eat up things in your network. This is yet another reason other people shouldn't be using your business computer to access the Internet. Additionally, if you have children who want to use the Internet, you might want to buy them their own computer and provide a separate Internet connection. The shorthand is like this: Play games on your play computers; do business on your business computers. If at all possible, it's not a bad idea to adopt this policy. With computer prices falling and the fact that many people keep older computers after upgrades, this may be more feasible than ever.

And, of course, because business is business, back up your files on a regular basis. Above all, it's worth the cost to buy a good antivirus software package and keep it updated. The cost is a tax deduction and it will save you a lot of grief if something bad does get loose in your network.

For the safety of your network, a good antivirus program should be used to scan all disks on all computers on your LAN on a very frequent basis—such as nightly when you are asleep. A good antivirus program should also download updates (new virus definitions) frequently. Daily updates are recommended. If you hear of a new virus outbreak, you should immediately check for updates manually.

Keep in mind that if you don't keep your virus definitions up-to-date, then when one gets loose in even a large network, much less a small one, it can wreak havoc as it quickly spreads.

Lastly, a good antivirus program should detect malicious attachments when you are sending and receiving email, and should check removable media (such as a floppy disk) and block you from copying files if the removable media contains a virus or some other threatening program.

Unless your antivirus program was part of a security suite, you might not have anti-spyware software. Make sure you obtain and use two or more anti-spyware programs. Unlike antivirus programs, which can conflict with each other, it's okay to install more than one anti-spyware program.

From Bridges to Routers continue...

Using a Router to Segment the Network

Like bridges, routers can be used to isolate traffic between network segments. Unlike bridges, routers further reduce network bandwidth use because they do not pass broadcast messages from one segment to another unless programmed to do so. A router also does not have to take time to learn which nodes are connected to each segment. The information it needs is configured in advance—the administrator assigns protocols and addresses to each port. Routing protocols also use various methods to update each other about network topology as it changes.

One very important reason why routers are used to help organize a network into segments is that routers enable you to connect many network segments. Whereas bridges are limited to a few thousand nodes, depending on the topology used, routers can enable the LAN to be connected to an infinitely larger WAN, such as the Internet.

The internal processing that routers must perform make them slower than bridges (although that might not be the case with most high-end routers being manufactured today), which need to examine only a small amount of data in the packet header. Although this performance difference will not be noticed on network segments with only moderate traffic use, you might find that you need to place routers at only strategic locations throughout the network, retaining switches for connecting other computers or network segments. Remember that you can connect individual computers to a switch port or use the port to connect to other switches.

The method you use will depend on the usage patterns that can be monitored for each segment and the cost of the links used to connect different segments. Another thing to consider is that many of the high-end routers available today operate at what is called "wire speed." That means they can route packets at virtually the same speed as the network medium, with just the very slightest delay for processing time.

Connecting to a Larger WAN or the Internet

When connecting the LAN to a WAN, a router is required. When connecting to the Internet, for example, you cannot use a bridge or a repeater. The Internet is composed of a hierarchical IP address space and a router is needed to participate in this hierarchy. Or you might plan to use a dedicated line of some sort to connect to a larger corporate network. In that case, placing a router between your LAN and the WAN hardware, such as an ATM switch connection, will help reduce the traffic that crosses the expensive dedicated connection by keeping local traffic confined to the local network segments.

Note

There are two situations in which a router is not needed to make an Internet connection. The first is if you have a modem- based dial-up connection. Although it's possible to set up routing tables in operating systems such as Windows and Unix/Linux, this isn't really a practical method for connecting a small office IAN to the Internet due to the very limited speed.

The other situation is when you use a broadband connection, such as a cable or DSL modem. In this case, you can connect the high-bandwidth modem to a single computer and then set up routing tables so that other computers can send and receive traffic through the computer, which operates as a router. However, there's a better idea in a Small Office/Home Office (SOHO) or Remote Office Branch Office (ROBO) environment or a home environment where everyone from the parents to the kids have their own computers: Purchase an inexpensive 4-6 port router (for less than $100 in mast cases) that you can connect to the cable/DSL modem. These types of routers require very little knowledge about computers and can usually be set up in less than a half-hour.

Although you'll certainly have to configure the ports that connect the local LAN and the WAN interface, you might have to reconfigure addressing information on clients. For example, if you're already using a valid TCP/IP network address, possibly a subnet of the corporate network address space, you'll need to configure only routers.

If your business has just been acquired by a larger concern, however, you might find that your LAN has been assigned a new subnet by the larger corporation. In such a case, you'll probably have to plan on downtime for end users in order to make changes to important servers, such as Domain Name System (DNS) servers. DHCP servers (which workstations can find themselves) are used to translate between user-friendly names and IP addresses. Although DHCP can dynamically assign configuration information to workstations, important servers, such as DNS servers or gateways to other networks (usually routers), must have a static (unchanging) address. This is because part of the configuration information that DHCP supplies to clients is those addresses! If the address of a DNS server changed with every reboot of the server, you would have to reconfigure the information on each workstation client—a tedious effort even in a small network!

By using DHCP, you can overcome client configuration headaches such as this. Just reconfigure the DHCP server with the address range for the new subnet, add in the DNS servers and default gateway, and reboot your client computers. This is a simple explanation of the information supplied by DHCP servers. Indeed, you can use DHCP to provide configuration information for many other network parameters.