Module 13: Endpoint

Security

Networking Security v1.0

(NETSEC)
Module Objectives
Module Title: Endpoint Security

Module Objective: Explain endpoint vulnerabilities and protection methods.

Topic Title Topic Objective

Endpoint Security Overview Describe endpoint security and the enabling technologies.
802.1X Authentication Explain the functions of 802.1x components.

2
13.1 Endpoint Security
Overview

3
Endpoint Security Overview
LAN Elements Security

Various network security devices are required to

protect the network perimeter from outside access.
As shown in the figure, these devices could include a
hardened ISR that is providing VPN services, an ASA
firewall appliance, an IPS, and a AAA server.

Because many attacks originate from inside the

network, securing an internal LAN is just as
important as securing the outside network perimeter.

Specifically, there are two internal LAN elements to

secure:
• Endpoints
• Network infrastructure
4
Endpoint Security Overview
Traditional Endpoint Security

Historically, employee endpoints were company-issued computers which resided within a clearly
defined LAN perimeter. These hosts were protected by firewalls and IPS devices which worked
well with hosts that were connected to the LAN and behind the firewall.

The endpoints also used traditional host-based security measures:

• Antivirus/Antimalware Software

• Host-based IPS

• Host-based firewall

5
Endpoint Security Overview
The Borderless Network

The new bring-your-own-device (BYOD) needs of workers have a required a different

way of approaching endpoint security.

In many networks, the network-based devices are disparate and typically do not
share information among themselves. Additionally, new endpoint devices are not
good candidates for the traditional host-based endpoint security solutions because of
the variety of devices and the variety of operating systems available on those
devices.

6
Endpoint Security Overview
Security for Endpoints in the Borderless Network

Organizations must also protect their endpoints from new threats and provide the protection
measures that are outlined in the table below:

Measure Purpose
antimalware software Protect endpoints from malware.
spam filtering Prevent spam emails from reaching endpoints.
blocklisting Prevent endpoints from connecting to websites with bad reputations by immediately blocking connections
based on the latest reputation intelligence.
data loss prevention (DLP) Prevent sensitive information from being lost or stolen.

7
Endpoint Security Overview
Network-Based Malware Protection

Protecting endpoints in a borderless

network can be accomplished using
network-based, as well as host-based
techniques, as shown in the figure.

The following are examples of devices and

techniques that implement host protections
at the network level:

• Advanced Malware Protection

(AMP)
• Email Security Appliance (ESA)
• Web Security Appliance (WSA)
• Network Admission Control (NAC)

8
Endpoint Security Overview
Hardware and Software Encryption of Local Data

Endpoints are also susceptible to data theft. For instance, if a corporate laptop
is lost or stolen, a thief could scour the hard drive for sensitive information,
contact information, personal information, and more.

The solution is to locally encrypt the disk drive with a strong encryption
algorithm such as 256-bit AES encryption. The encryption protects the
confidential data from unauthorized access. The encrypted disk volumes can
only be mounted for normal read/write access with the authorized password.

9
Endpoint Security Overview
Network Access Control
The purpose of network access control (NAC) is to allow only authorized and compliant
systems, whether managed or unmanaged, to access the network. It unifies endpoint security
technologies with user or device authentication and network security policy enforcement.

NAC systems can have the following capabilities:

• Profiling and visibility – This recognizes and users and their devices before malicious
code can cause damage.
• Guest network access – This manages guests through a customizable, self-service
portal that includes guest registration, guest authentication, guest sponsoring, and a
guest management portal.
• Security posture checking – This evaluates security-policy compliance by user type,
device type, and operating system.
• Incident response - Mitigating network threats by enforcing security policies that block,
isolate, and repair noncompliant machines without administrator attention.
10
Endpoint Security Overview
NAC Functions

The goal of NAC systems is to ensure

that only hosts that are authenticated
and have had their security posture
examined and approved are permitted
onto the network.

Network access devices can function

as the enforcement layer, as shown in
the figure. They force the clients to
query a RADIUS server for
authentication and authorization. The
RADIUS server can query other
devices, such as an antivirus server,
and reply to the network enforcers.
11
13.2 802.1X Authentication

12
802.1X Authentication
Security Using 802.1X Port-Based Authentication
The IEEE 802.1X standard defines a port-based access control and authentication protocol that restricts
unauthorized workstations from connecting to a LAN through publicly accessible switch ports. The
authentication server authenticates each workstation that is connected to a switch port before making available
any services offered by the switch or the LAN.

The figure shows that with 802.1X port-based authentication, the devices in the network have specific roles.

13
802.1X Authentication
Security Using 802.1X Port-Based Authentication (Cont.)
The 802.1x roles include:

• Supplicant (Client) - The device (workstation) that requests access to LAN and switch services and then
responds to requests from the switch. The workstation must be running 802.1X-compliant client software.
(The port that the client is attached to is the supplicant [client] in the IEEE 802.1X specification.)

• Authenticator (Switch) - Controls physical access to the network based on the authentication status of
the client. The switch acts as an intermediary (proxy) between the client (supplicant) and the
authentication server, requesting identifying information from the client, verifying that information with the
authentication server, and relaying a response to the client. The switch uses a RADIUS software agent,
which is responsible for encapsulating and de-encapsulating the EAP (Extensible Authentication Protocol)
frames and interacting with the authentication server.

• Authentication server - Performs the actual authentication of the client. The authentication server
validates the identity of the client and notifies the switch whether the client is authorized to access the
LAN and switch services. Because the switch acts as the proxy, the authentication service is transparent
to the client. The RADIUS security system with EAP extensions is the only supported authentication
server.
14
802.1X Authentication
Security Using 802.1X Port-Based Authentication (Cont.)
The figure shows the complete message exchange between the supplicant, authenticator, and the authentication server.
The encapsulation occurs as follows:

• Between the supplicant and the authenticator - EAP data is encapsulated in EAPOL frames.
• Between the authenticator and the authentication server - EAP data is encapsulated using RADIUS.

15
802.1X Authentication
Control the 802.1X Authorization State
It may be necessary to configure a switch port to override the 802.1X authentication process. To do this, use the
authentication port-control interface configuration command to control the port authorization state. The syntax
for the command and a description of the parameters are shown below.

Parameter Description
auto Enables 802.1X port-based authentication and causes the port to begin in the unauthorized
state. During this time only EAPOL, STP, and CDP frames are the only type of frames that can
be sent or received through the port until the client device has been authenticated.
force- The port sends and receives normal traffic without 802.1x-based authentication of the
authorized client. This is the default setting.
force- Causes the port to remain in the unauthorized state, ignoring all attempts by the client to
unauthorized authenticate. The switch cannot provide authentication services to the client through the
port.
16
802.1X Authentication
802.1X Configuration
802.1X Configuration requires a few basic steps:

Step 1. Enable AAA using the aaa new-model command.

Step 2. Designate the RADIUS server and configure its address and ports.

Step 3. Create an 802.1X port-based authentication method list using the aaa authentication dot1x
command.

17
802.1X Authentication
802.1X Configuration (Cont.)
Step 4. Globally enable 802.1X port-based authentication using the dot1x system-auth-control command.

Step 5. Enable port-based authentication on the interface using the authentication port-control auto
command.

Step 6. Enable 802.1X authentication on the interface using the dot1x pae command. The authenticator
options sets the Port Access Entity (PAE) type so the interface acts only as an authenticator and will not
respond to any messages meant for a supplicant.

18
13.3 Endpoint Security
Summary

19
Endpoint Security Summary
What Did I Learn in this Module?

• Many devices and technologies enhance host-based endpoint protections including email security
appliances, web security appliances, NAC, and the Cisco Identity Services Engine (ISE).
• Another way that endpoints can be protect from data loss is through the use of encryption using
software, such as BitLocker.
• Network Access Control is a system that can check whether endpoints that attempt to the network
comply with network security policies.
• Cisco ISE combines AAA and NAC and into a single system.
• 802.1X provides a means by which authenticator network access switch can act as an
intermediary between a client and an authentication server.
• The system uses EAP and EAPOL to carry authentication traffic between the switch and the
authenticator switch.
• 802.1X port-based authentication is configured by first globally activating AAA and by specifying
the RADIUS server name, address, and ports. After that the authenticator interface is configured
with 802.1X parameters.
20
Endpoint Security
New Terms and Commands
• Antivirus/Antimalware Software • Extensible Authentication Protocol (EAP)
• Host-based firewall • Extensible Authentication Protocol over LAN (EAPOL)
• spam filtering • authentication port-control {auto | force-authorized |
• blocklisting force-unauthorized}
• Advanced Malware Protection (AMP) • aaa authentication dot1x default group radius
• Email Security Appliance (ESA) • dot1x system-auth-control
• Web Security Appliance (WSA) • authentication port-control auto
• Network Admission Control (NAC) • dot1x pae authenticator
• security posture checking
• incident response
• 802.1X
• supplicant
• authenticator
• authentication server

21