Designing Cisco Network Service Architectures - Free Books

Step 2 CP Hotels Security• The topic of security and managing risk is large. Although only a portion of security topicsare specifically covered in this course, security considerations and analysis need to bebroad.• This case study assumes that there is no hidden external connectivity, including any formsof remote (server, network, telephone) administrative access. Specifically, the followingparts of the CP Hotels network connect to external entities via the data centers:— All HQ buildings— Call Centers• A network audit should be used to confirm the validity of this assumption.• The web DMZ is well secured with firewalls inside the Collocation Facilities.• There is remote support access to the mainframe, but it is powered off when not needed.• The Corporate Internet access uses firewalls.• The Partner module uses firewalls to secure all partner connectivity, and only allows accessto specific servers.• Hotels and the hotel module do connect to the Internet. The Hotels Module Internet edgetraffic could be secured with firewalls, however, only IKE and IPsec traffic is allowed intothe edge routers. There may be a philosophical debate lurking here, as to exactly how andwhy firewalls are better than routers with access lists.• The IPS units should be placed inside external firewalls (or routers) to detect suspect ormalicious traffic that makes it through the outermost level of security. A suitable number ofMARS units for monitoring should be located in one or both data centers. All of thisrequires staffing and training to allow for the necessary level of monitoring and rulesmaintenance.• An anomaly detection and a Distributed Denial of Service (DDoS) mitigation plan isrecommended for the E-Commerce site. This might be provided by either CP Hotels or bythe Collocation Provider.• Internal security and governance are a growing concern. Further discussions with CPHotels are recommended concerning firewalls or other isolation techniques to create secureserver zones, protecting key servers from attack via other servers. Integrating NAC rolebasedsubnets to allow control over which internal users can send traffic of any kind to keyservers is recommended. This will prevent a generic staffer from using hacker tools to tryto find and exercise a server exploit, at least on critical groups of servers.• The remaining major risk is the 2000 hotels. With 2000 routers, each with 3 access lists(outside interface, GRE tunnel interface, office LAN interface), there is a high likelihood oferror. Having a configuration auditing capability is recommended, to detect situationswhere the access list deviates from policy, or where an access list is not currently applied toan interface. (This does really happen!)• In addition, there is the whole topic of audit and accountability trail on access listexceptions. Who granted each one, why was it needed, who is the point of contact, whenwas the information last verified, etc. Otherwise, access lists just get longer and longer,with many entries that nobody can explain. The form should be capable of emitting a list ofauthorized exceptions per-site, to allow for some form of automated access list checking.• Routing security and Control Plane Policing might also be considered for CP Hotels. Thesetopics can be considered lower priority than the other items above.© 2007 Cisco Systems, Inc. Lab Guide 55