Protecting Your Network with IDS

There is little excuse for not installing an IDS (Intrusion Detection System) on your Network, even the usual culprit of budget doesn’t apply.  In fact one of the leading IDS systems called Snort is actually available completely free of charge and is sufficient for all but the most very complex network infrastructures.    It is virtually impossible to effectively monitor and control your network, particularly if it’s connected to the internet, without some sort of IDS in place.

There are certain questions about the day to day operation of your network that you should be able to answer.  Questions like the following will help you determine if you really have control over your network and it’s hardware =

  • Can you tag and determine how much traffic on  your network is associated with malware or unauthorised software.
  • Are you able to determine which of your clients do not have the latest client build?
  • Can you determine which websites are most popularly requested.  Are these requests from legitimate users or as a result of malware activity.
  • Can you determine which users are the top web surfers (and is it justified).
  • How much mail are your SMTP server’s processing?

It is surprising how many network professionals simply wouldn’t have a clue about obtaining this information from their network however, it’s impossible to ensure that the network is efficient without it.  For example a few high intensive web users can create much more traffic than the majority of ordinary business users.   Imagine two or three users in a small department who used a working BBC VPN to stream TV to their computer 8 hours a day.   The traffic that would generate would be huge and could easily swamp an important network segment.

All security professionals should ensure that they have the tools and reporting capacity to answer simple questions like this about network usage.   Knowing the answers to these questions, will help control and adapt your network to meet it’s users needs.   Of course a simple IDS won’t provide the complete solution but it will help keep control in your network.  Malware can sit and operate for many weeks in a network which is not monitored properly.  This will heavily impact performance and can enable it to spread to other devices and eventually other networks.  In network environments where performance is important, then being aware of the sorts of situations can make a huge difference.

John Williams

Network Professional and Broadcaster on author of BBC News Streaming.

Using Proxies for Virtual Locations

For many people, travel is becoming much easier and as a species our geographical horizons are perhaps wider than ever.  Inexpensive air travel and soft borders like the European Union means that instead of just looking to work in another city or town, another country is just as viable.  The internet of course enables this somewhat, many corporations have installed infrastructure to allow remote or home working which means many people can work from wherever they wish.   Instead of sitting in cubicles in vast expensive office space, the reality is that people can work together just as easily using high speed internet connections from home.

Unfortunately there are some issues from this digital utopia, of which most are self inflicted.  Instead of being a vast unfettered global communications medium, the internet in some senses has begun to shrink somewhat.  Not so much in size but rather an increasing number of restrictions, filters and blocks being applied to web servers across the planet.  For instance the company I work for has two main bases one in the UK and the other in Poland, which means there is quite a bit of travel between the two countries.  Not surprisingly employees who are working away from home for some time, use the internet to keep in touch with their homelife, yet this can be frustrating.

A common issue is the fact that many websites are not really accessible globally, they are locked to specific regions.  Take for example the main Polish TV channel – TVN, it has a fantastic website and a media player by which you can watch all their shows.  However a Polish citizen who tries to watch the local News from Warsaw from a hotel in the UK will find themselves blocked, the content is only available to those physically located in Poland.  It’s no one off either, this behaviour is shared by pretty much every large media company on the web who block access depending on your location.

There is a solution and for our employees it’s actually quite simple, all they need to do is fire up their VPN client and remotely connect back to their home server in Poland.  The instant they do this, their connection looks like it’s based in Poland and all the Polish TV channels will work perfectly.  There’s a post about something similar here – using a Polish proxy to watch TVN and some other channels although this one is through a commercial service designed to hide your location.  It’s a practice that is becoming increasingly necessary, the more we travel the more we find our online access is determined by our physical location.

The use of proxies and more recently VPNs allows you to break out of these artificial intranets which companies are creating by blocking access from other countries.  The idea is that if you have the ability to switch to various VPNs across the world you can effectively take back control and access whatever website you need. Your physical location becomes unimportant again, by taking control of your virtual location you have an huge advantage over other internet users by choosing the location you wish to appear from.  There are even some other options now take a look at this UK DNS proxy which does something fairly similar and can be used to watch the BBC and Netflix from outside the UK.

John Hammond

Author of – Does BBC Iplayer Work in Ireland 

SSL Tunneling Protocol for Proxies

In these times when security is becoming ever more important the SSL Tunneling Protocol is extremely important, it allows a web proxy server to act as a tunnel for SSL enhanced protocols. The protocol is used when any connected client makes a HTTP request to the proxy server and asks for a SSL tunnel to be initiated.  On the HTTP protocol level, the handshake required to initiate the SSL tunneling connection is simple.  There is little difference to an ordinary HTTP request except that a new ‘Connect’ method is used and the parameter passed is not a full URL but instead a destination port number and hostname separated by a colon.

The port number is always required with ‘CONNECT’ requests because the tunneling method is generic and there is no protocol specified, hence default port numbers cannot be used reliably.  The general syntax for the request is as below ;

CONNECT  <host>:<port> HTTP/1.0

HTTP Request Headers

Empty Line

The successful response would be a connection established message, followed by another empty line. After the successful response the connection will then pass all the data transparently to the destination server and pass through any replies from the server. In practice what is happening is the proxy is validating the initial request, establishes the connection and then takes a step back. After this initial stage the proxy merely forwards data back and forth between the client and the server. If either side closes the connection then the proxy will cause both connections to be closed and no mor tunneling will take place until a new connection is established between the server and client.

The proxy does have the ability to respond to error messages within the SSL tunnel. If this error is generated in the initial stages then the connection will not be established, if it is already connected then the proxy will close the connection after the error response has been sent. However it is important to remember especially where security is important that this SSL tunneling protocol is not specific to SSL and therefore has no in depth security. The tunnelling mechanism used in this instance is a generic one and can in fact be used for any protocol. This means that there is no requirement either for the proxy to support SSL either as the server is merely establishing a connection and then forwarding data without any processing.

Further Reading

BBC Iplayer Ireland – Here’s How you Can Watch

http://www.iplayerabroad.com/bbc-iplayer-ireland/