UNIT-V System (NMS).

This commonly shared database

Basic Concept of SNMP: between the Agent and the Manager is called
Simple Network Management Protocol (SNMP): Management Information Base (MIB).
SNMP is used to check all the network devices, one Typically these MIB contains standard set of
by one every day, are working properly or not. If an statistical and control values defined for hardware
organization has 1000 of devices then is a hectic task. nodes on a network.
To ease these up, Simple Network Management In short, MIB files are the set of questions that a
Protocol (SNMP) is used. SNMP Manager can ask the agent. Agent collects
Simple Network Management Protocol (SNMP) – these data locally and stores it, as defined in the MIB.
SNMP is an application layer protocol which uses So, the SNMP Manager should be aware of these
UDP port number 161/162.SNMP is used to monitor standard and private questions for every type of agent.
the network, detect network faults and sometimes
even used to configure remote devices.
What is SNMP?
Simple Network Management Protocol (SNMP) is an
application–layer protocol defined by the Internet
Architecture Board (IAB) in RFC1157 for exchanging
management information between network devices. It
is a part of Transmission Control Protocol/ Internet
Protocol (TCP⁄IP) protocol suite.
Fig 5.1 Architecture of SNMP
SNMP is one of the widely accepted protocols to
SNMP messages –
manage and monitor network elements. Most of the
Different variables are:
professional–grade network elements come with
Get: SNMP manager sends this message to request
bundled SNMP agent. These agents have to be
data from SNMP agent. It is simply used to retrieve
enabled and configured to communicate with the
data from SNMP agent. In response to this, SNMP
network management system (NMS).
agent responds with requested value through response
message.
SNMP components –
GetNext: This message can be sent to discover what
There are 3 components of SNMP:
data is available on a SNMP agent. The SNMP
SNMP Manager: It is a centralized system used to
manager can request for data continuously until no
monitor network. It is also known as Network
more data is left. In this way, SNMP manager can take
Management Station (NMS)
knowledge of all the available data on SNMP agent.
GetBulk: This message is used to retrieve large data
SNMP agent: It is a software management software
at once by the SNMP manager from SNMP agent. It is
module installed on a managed device.
introduced in SNMPv2c.
Managed devices can be network devices like PC,
router, switches, servers etc.
Set: It is used by SNMP manager to set the value of
Managed Devices: A managed device or the network
an object instance on the SNMP agent.
element is a part of the network that requires some
form of monitoring and management e.g. routers,
Response:It is a message send from agent upon a
switches, servers, workstations, printers, UPSs, etc...
request from manager. When sent in response to Get
messages, it will contain the data requested. When
Management Information Baseman consists of
sent in response to Set message, it will contain the
information of resources that are to be managed.
newly set value as confirmation that the value has
These information is organized hierarchically. It
been set.
consists of objects instances which are essentially
Trap:These are the message send by the agent
variables.
without being requested by the manager. It is sent
Every SNMP agent maintains an information database
when a fault has occurred.
describing the managed device parameters. The
Inform: It was introduced in SNMPv2c, used to
SNMP manager uses this database to request the agent
identify if the trap message has been received by the
for specific information and further translates the
manager or not. The agents can be configured to set
information as needed for the Network Management
This study source was downloaded by 100000861573692 from CourseHero.com on 12-09-2024 23:50:14 GMT -06:00

https://www.coursehero.com/file/144231838/IS-UNIT-Vpdf/
 trap continuously until it receives an Inform message. facilitates remote configuration of the SNMP entities.
It is same as trap but adds an acknowledgement that It is defined by RFC 1905, RFC 1906, RFC 3411,
trap doesn’t provide. RFC 3412, RFC 3414, RFC 3415.

There are four main parts to

the SNMPv3 architecture.
The interaction between these systems to provide the
necessary data requested is depicted in the following
figure:
Figure 1. The primary parts of the SNMPv3
architecture

Fig 5.2 Protocol context of SNMP

SNMP security levels –
It defines the type of security algorithm performed on
SNMP packets. These are used in only SNMPv3.
There are 3 security levels namely: This illustration shows and example of
1. noAuthNoPriv – the SNMPv3 architecture. The DPI2 subagent, smux
This (no authentication, no privacy) security peer, SNMP manager, and SNMP agent are shown. In
level uses community string for authentication addition, how they communicate with each other is
and no encryption for privacy. shown.
2. authNopriv – This security level • SNMP agent
(authentication, no privacy) uses HMAC with The SNMP agent receives requests from, and makes
Md5 for authentication and no encryption is responses to, the SNMP manager.
used for privacy. • DPI2 subagents
3. authPriv – This security level (authentication, A DPI2 subagent, such as hostmibd, communicates
privacy) uses HMAC with Md5 or SHA for with the DPI2 agent, which, in SNMPv3, is part of the
authentication and encryption uses DES-56 SNMP agent.
algorithm. • SMUX peers
A SNMP Multiplexing (SMUX) peer, such as gated,
SNMP versions – when started, will establish the connection
There are 3 versions of SNMP: to TCP 199 and will initialize the SMUX association.
1. SNMPv1 – • SNMP manager
It uses community strings for authentication and The SNMP manager runs clsnmp, which is
use UDP only. compatible with SNMPv1, SNMPv2c, and SNMPv3.
2. SNMPv2c – • MIB variables
It uses community strings for authentication. It Information on MIB variables can be found in the
uses UDP but can be configured to use TCP. following locations.
3. SNMPv3 –
It uses Hash based MAC with MD5 or SHA for Intruders:
authentication and DES-56 for privacy. This The objective of the intruder is to gain access to a
version uses TCP. Therefore, conclusion is the system or to increase the range of privileges
higher the version of SNMP, more secure it will accessible on a system. Most initial attacks use system
be. or software vulnerabilities that allow a user to execute
SNMPv1 Community facility and SNMPv3 code that opens a back door into the system.
SNMP is the newest version of SNMP. Its primary The intruder attempts to acquire information that
feature is enhanced security. SNMPv3 defines the should have been protected. In some cases, this
secure version of the SNMP. SNMPv3 protocol also information is in the form of a user password. With
This study source was downloaded by 100000861573692 from CourseHero.com on 12-09-2024 23:50:14 GMT -06:00

https://www.coursehero.com/file/144231838/IS-UNIT-Vpdf/
 knowledge of some other user’s password, an intruder unrelated to its advertised purpose, and without
can log in to a system and all information available on the user's knowledge.
system. • For example, the user may think that the program
Intruder attacks range from the benign to the serious. is a game. While it is printing messages about
At the benign end of the scale, there are many people initializing databases and asking questions like
who simply wish to explore internets and see what is "What do you want to name your player?" and
out there. At the serious end are individuals who are "What level of difficulty do you want to play?" the
attempting to read privileged data, perform program may actually be deleting files,
unauthorized modifications to data, or disrupt the reformatting a disk, or otherwise altering
system information.
There are three classes of intruders:
Masquerader: An individual who is not authorized to Viruses and related threats:
use the computer and who penetrates a system’s A virus is a piece of software that can “infect” other
access controls to exploit a legitimate user’s account. programs by modifying them.
The masquerader is likely to be an outsider. The modification includes a copy of the virus
Misfeasor: A legitimate user who accesses data, program, which then can go to infect other programs.
programs, or resources for which such access is not A virus can do anything that other programs do. The
authorized, or who is authorized for such access but only difference is that it attaches itself to another
misuses his or her privileges. The misfeasor generally program and executes secretly when the host program
is an insider. is run.
Clandestine user: An individual who seizes Once a virus is executing, it can perform any function
supervisory control of the system and uses this control such as erasing files and programs.
to evade auditing and access controls or to suppress Most viruses carry out their work in a manner that is
audit collection. The clandestine user can be either an specific to a particular operating system and in some
outsider or an insider. cases specific to a particular hardware platform. Thus
Following are some examples of intrusion: they are designed to take advantage of the details and
Performing a remote root compromise of an e-mail weaknesses of particular systems.
server A virus can be prepended or post pended to an
Defacing a Web server executable program, or it can be embedded in some
Guessing and cracking passwords other fashion. The key to its operation is that the
Copying a database containing credit card numbers infected program, when invoked, will first execute the
Viewing sensitive data, including payroll records and virus code and then execute the original code of the
medical information, without authorization program.
1) Logic Bombs During its lifetime a typical virus goes through
• Logic bombs are programmed threats that lie following 4 phases:
dormant in commonly used software for an Dominant Phase: The virus is idle. The virus will
extended period of time until they are triggered; at eventually be activated by some event, such as a date,
this point, they perform a function that is not the the presence of another program or file, or the
intended function of the program in which they are capacity of the disk exceeding some limit.
contained. Propagation Phase: The virus places an identical
• Logic bombs usually are embedded in programs copy of itself into other programs or into certain
by software developers who have legitimate system areas on the disk.
access to the system. Triggering Phase: The virus is activated to perform
• Conditions required to trigger a logic bomb the function for which it was intended.
include the presence or absence of certain files, a Execution Phase: The function is performed. The
particular day of the week, or a particular user function may be harmless of damaging.
running the application.
2) Trojan Horses
• Trojan horses resemble a program that the user
wishes to run - a game, a spreadsheet, or an editor.
While the program appears to be doing what the
user wants, it actually is doing something else Types of viruses:
This study source was downloaded by 100000861573692 from CourseHero.com on 12-09-2024 23:50:14 GMT -06:00

https://www.coursehero.com/file/144231838/IS-UNIT-Vpdf/
 Parasitic Virus: The traditional and still most • Network worm programs use network connections
common form of virus. A parasitic virus attaches itself to spread from system to system. Once active
to executable and replicates when the infected within a system, a network worm can behave as a
program is executed. computer virus or bacteria, or it could implant
Memory resident Virus: Lodges in main memory as Trojan horse programs or perform any number of
part of a resident system program. From that point on, disruptive or destructive actions.
the virus infects every program that executes.
Boot-Sector Virus: Infects a master boot record or Firewall:
boot record and spreads when a system is booted from Firewall is a security barrier between two networks
the disk containing the virus. that screens traffic coming in and out of the gate of
Stealth Virus: A form of virus explicitly designed to one network to accept or reject connections and
hide itself from detection by antivirus software. services according to a set of rules.
Polymorphic Virus: A virus that mutates with every A firewall is like a secretary for a network which
infection, making detection by the “signature” of the examines requests for access to the network. It
virus impossible. decides whether they pass a reasonableness test. If
Metamorphic Virus: A metamorphic virus mutates they pass it they are allowed through and if not they
with every infection. The difference is that a are refused.
metamorphic virus rewrites itself completely at each 1. There are essentially three types of firewalls.
iteration, increasing the difficulty of detection. Each type of firewall filters packets by
Metamorphic viruses may change their behaviour as examining the data up to a particular layer of
well as their appearance. the network protocol stack.
Macro Virus The firewalls are:
Macro viruses infect files that are created using i. A packet filter is a firewall that operates at the
certain applications or programs that contain macros. network layer.
These mini-programs make it possible to automate
series of operations so that they are performed as a
single action, thereby saving the user from having to
carry them out one by one.
Examples of macro viruses: Relax, Melissa.A,
Bablas, O97M/Y2K.
E-Mail viruses:
A more recent development in malicious software is
the e-mail virus. The first rapidly spreading e-mail
viruses such as Melissa, made use of a Microsoft word
ii. A stateful packet filter is a firewall that lives at the
macro embedded in an attachment. If the recipient
transport layer.
opens the e-mail attachment, the word macro is
iii. An application proxy is a firewall that operates at
activated. Then,
the application layer where it functions as a proxy.
• The e-mail virus sends itself to everyone on the
mailing list in the user’s email package.
• The virus does local damage.
Worms:
• A worm is a program that can replicate itself and
send copies from computer to computer across
network connections. Upon arrival, the worm may
be activated to replicate and propagate again.
• In addition to propagation, the worm usually
performs some unwanted function. An e-mail Circuit-levelgateway:
virus has some of the characteristics, of a worm, A circuit-level gateway is a firewall that provides
because it propagates itself from system to system. User Datagram Protocol (UDP) and Transmission
A worm actively seeks out more machines Control Protocol (TCP) connection security, and
launching pad for attacks on other machines. works between an Open Systems Interconnection
This study source was downloaded by 100000861573692 from CourseHero.com on 12-09-2024 23:50:14 GMT -06:00

https://www.coursehero.com/file/144231838/IS-UNIT-Vpdf/
 (OSI) network model’s transport and application may support a modern pool that provides dial-in
layers such as the session layer. Unlike application capability for traveling employees and telecommuters.
gateways, circuit-level gateways monitor TCP data ii. The firewall does not protect against internal
packet handshaking and session fulfillment of firewall threats, such as a disgruntled employee or an
rules and policies. employee who unwittingly cooperates with an
external attacker.
iii. The firewall cannot protect against the transfer of
virus-infected programs or files. Because of the
variety of operating systems and applications
supported inside the perimeter it would be impractical
and impossible for the firewall to scan all incoming
files for viruses.

Trusted system: (trusted computer system or trusted

operating system)
A trusted system is a system that is relied upon to a
FirewallDesign Principles: specified extent to enforce a specified security policy.
i. All traffic from inside to outside and vice versa (Or)
must pass through the firewall. This is achieved by The extent to which someone who relies on a system
physically blocking all access to the local network can have confidence that the system meets its
except via the firewall. The configurations used for specifications (degree of assurance).
this are screened Host Firewall (Single and Dual) and
Screened Subnet Firewall. Initially Trusted system was based on the reference
ii. Only authorized traffic as defined by the local monitor concept, depicted in below Figure. The
security policy will be allowed to pass. Various types reference monitor is a controlling element in the
of firewalls that can be used are Packet-Filters, hardware and operating system of a computer that
Stateful Filters and Application Proxy Filters. regulates the access of subjects to objects on the basis
iii. The firewall itself is immune to penetration. This of security parameters of the subject and object
implies that use of a trusted system with a secure
operating system.

Techniques for Control:

Four general techniques that firewalls use to control
access and enforce security policy are as follows
i. Service Control- This determines the types of
internet services that can be accessed inbound or
outbound.
ii. Direction Control: This determines the direction in
which particular service requests may be initiated and
allowed to flow through the firewall.
iii. User Control: Control access to a service
according to which user is attempting to access it.
This feature is typically applied to users inside the
firewall perimeter.
iv. Behavior Control: Controls how particular services Fig 5.5 the reference monitor concept
are used.

Limitations of Firewalls:
i. The firewall cannot protect against attacks that
bypass the firewall. Internal systems may have dial-
out capability to connect to an ISP. An internal LAN
This study source was downloaded by 100000861573692 from CourseHero.com on 12-09-2024 23:50:14 GMT -06:00

https://www.coursehero.com/file/144231838/IS-UNIT-Vpdf/
 Intrusion detection systems (IDS): Weaknesses: Host-based systems require installation
Intrusion Detection System (IDS) defined as a Device on the particular device that you wish to protect.
or software application which monitors the network or Hybrid Intrusion Detection System: - combines one
system activities and finds if there is any malicious or more approaches. Host agent data is combined with
activity occur. Outstanding growth and usage of network information to form a comprehensive view of
internet raises concerns about how to communicate the network. An example of a Hybrid IDS is Prelude.
and protect the digital information safely.
In a number of cases, absolute protection is not
feasible, but it is practical to detect security attacks. INTRUDERS
For example, there are intrusion detection systems
designed to detect the presence of unauthorized One of the most publicized attacks to security is the
individuals logged onto a system.An IDS is a set of intruder, generally referred to as hacker or cracker.
automated tools designed to detect unauthorized Three classes of intruders are as follows:
access to a host system and Will be notified abnormal
traffic if detected. Masquerader – an individual who is not authorized to
use the computer and who penetrates a system’s access
controls to exploit a legitimate user’s account.

Misfeasor – a legitimate user who accesses data,

programs, or resources for which such access is not
authorized, or who is authorized for such access but
misuse his or her privileges.

Clandestine user – an individual who seizes

supervisory control of the system and uses this control
to evade auditing and access controls or to suppress
audit collection.
The masquerader is likely to be an outsider; the
misfeasor generally is an insider; and the clandestine
user can be either an outsider or an insider.

The following techniques are used for learning

passwords.
Types of Intrusion-Detection systems • Try default passwords used with standard
Network Intrusion Detection System: - identifies accounts. Many administrators do not bother to
intrusions by examining network traffic and monitors change these defaults.
multiple hosts. Network Intrusion Detection Systems • Exhaustively try all short passwords.
gain access to network traffic by connecting to a hub, • Try words in the system’s online dictionary or a list
network switch configured for port mirroring, or of likely passwords.
network tap. An example of a NIDS is Snort. • Collect information about users such as their full
Weaknesses: A network based IDS, on the other names, the name of their spouse and children,
hand, only examines network traffic on the segment to pictures in their office and books in their office that
which it is directly connected, but it cannot detect an are related to hobbies.
attack that travels through a different network • Try user’s phone number, social security numbers
segment. and try all legitimate license plate numbers.

Host-based Intrusion Detection System: - consists Principle countermeasures:

of an agent on a host which identifies intrusions by Detection – concerned with learning of an attack,
analyzing system calls, application logs, file-system either before or after its success.
modifications (binaries, password files, capability/acl Prevention – challenging security goal and an uphill
databases) and other host activities and state. bottle at all times.
This study source was downloaded by 100000861573692 from CourseHero.com on 12-09-2024 23:50:14 GMT -06:00

https://www.coursehero.com/file/144231838/IS-UNIT-Vpdf/
 Firewall Design Principles prohibits vulnerability and provides protection from
spoofing and routing attacks.
• Firewall is a security barrier between two ii. A firewall provides a location for monitoring
networks that screens traffic coming in and out security-related events. Audits and alarms can be
of the gate of one network to accept or reject implemented on the firewall system.
connections and services according to a set of
rules. iii. A firewall is a convenient platform for several
• For a firewall to be effective the design of the internet functions that are not security related which
firewalls should be efficient. The various include network address translator and a network
principles that should be adopted while management function.
designing a firewall are as follows: iv. A firewall can serve as the platform for IPsec.
Using the tunnel mode capability, the firewall can be
Firewall Characteristics: used to implement virtual private networks.
i. All traffic from inside to outside and vice versa
must pass through the firewall. This is achieved by Limitations of Firewalls:
physically blocking all access to the local network i. The firewall cannot protect against attacks that
except via the firewall. bypass the firewall. Internal systems may have dial-
ii. Only authorized traffic as defined by the local out capability to connect to an ISP. An internal LAN
security policy will be allowed to pass. Various types may support a modern pool that provides dial-in
of firewalls that can be used are Packet-Filters, capability for traveling employees and telecommuters.
Stateful Filters and Application Proxy Filters. ii. The firewall does not protect against internal
iii. The firewall itself is immune to penetration. This threats, such as a disgruntled employee or an
implies that use of a trusted system with a secure employee who unwittingly cooperates with an
operating system. external attacker.
iii. The firewall cannot protect against the transfer of
Techniques for Control: virus-infected programs or files. Because of the
Four general techniques that firewalls use to control variety of operating systems and applications
access and enforce security policy are as follows supported inside the perimeter it would be impractical
and impossible for the firewall to scan all incoming
i. Service Control- This determines the types of files for viruses.
internet services that can be accessed inbound or
outbound.
ii. Direction Control: This determines the direction in
which particular service requests may be initiated and
allowed to flow through the firewall.
iii. User Control: Control access to a service
according to which user is attempting to access it.
This feature is typically applied to users inside the
firewall perimeter.
iv. Behaviour Control: Controls how particular
services are used.

Capabilities of Firewalls: The expectations

from a firewall are as follows
i. A firewall defines a single choke point that keeps
unauthorized users out of the protected network,
This study source was downloaded by 100000861573692 from CourseHero.com on 12-09-2024 23:50:14 GMT -06:00

https://www.coursehero.com/file/144231838/IS-UNIT-Vpdf/
Powered by TCPDF (www.tcpdf.org)