TCP/IP Tutorial and Technical Overview - IBM Redbooks

22.1 Security exposures and solutions
This section gives an overview of some of the most common attacks on
computer security, and it presents viable solutions to those exposures and lists
actual implementations thereof.
22.1.1 Common attacks against security
For thousands of years, people have been guarding the gates to where they
store their treasures and assets. Failure to do so usually resulted in being
robbed, victimized by society, or even killed. Though things are usually not as
dramatic anymore, they can still become very bad. Modern day IT managers
have realized that it is equally important to protect their communications
networks against intruders and saboteurs from both inside and outside. One
does not have to be overly paranoid to find some good reasons as to why this is
the case:
► Packet sniffing: To gain access to cleartext network data and passwords
► Impersonation: To gain unauthorized access to data or to create unauthorized
e-mails by impersonating an authorized entity
► Denial-of-service: To render network resources non-functional
► Replay of messages: To gain access to information and change it in transit
► Password cracking: To gain access to information and services that would
normally be denied (dictionary attack)
► Guessing of keys: To gain access to encrypted data and passwords
(brute-force attack)
► Viruses: To destroy data
► Port scanning: To discover potential available attack points
Though these attacks are not exclusively specific to TCP/IP networks, they must
be considered potential threats to anyone who is going to base their network on
TCP/IP, which is the most prevalent protocol used. TCP/IP is an open protocol,
and therefore, hackers find easy prey by exploiting vulnerabilities using the
previous methods.
22.1.2 Solutions to network security problems
Network owners need to try to protect themselves with the same zealousness
that intruders use to search for a way to get into the network. To that end, we
provide some solutions to effectively defend a network from an attack,
specifically against the attacks mentioned earlier. It has to be noted that any of
772 TCP/IP Tutorial and Technical Overview