passphrase that contains at least 20 characters. You can increase the strength by adding a few
numbers somewhere. This will then become a very easy password to remember but a very difficult
one to crack.
General rules:
Use passphrases, not passwords. Choose four easily remembered words along with a few
numbers, but don’t choose a common phrase such as “to be or not to be.”
Don’t use the same passphrase everywhere. Instead, create a general passphrase that you
customize. For example, count the number of times the letter “a” appears in the website URL
and add that number to the end of your usual passphrase to create a unique passphrase just for
that site.
Always choose a unique passphrase for every high-risk site, such as your bank.
Gaining access to an account can be based on something you know, something you have, or
something you are.
Passwords
The most common approach is something you know, usually a password. Before users can log in, they
need to enter a password. Unfortunately, passwords are often poorly chosen, enabling intruders to guess
them and gain access. Some organizations have moved to passphrases which, as the name suggests, are
a series of words separated by spaces. Management Focus 11-7 offers some suggestions on how to create a
strong password that is easy to remember.


Password managers such as Dashlane and LastPass are becoming more common, but are still not
widely adopted. A password manager is a browser add-in or app that stores website passwords. When you
create an account on a new website, the password manager asks if you want to store the password. When
you return to a website whose password is stored, a button appears next to the password box that you can
click and the password manager fills in the userid and password.
All the passwords are stored on the password manager website, not on any device, so it is simple to install
the add-in or app on any device. All passwords are protected by a master password that you must enter
before you can use the password manager, although you can have the password manager “trust” a device
for several days at a time, so you do not have to login every day. If a device is stolen, you can easily login to
the password manager website and change your master password, which then requires any trusted device
to login again.
Two-Factor Authentication
Requiring passwords provides, at best, midlevel security (much like locking your doors when you leave the
house); it won’t stop the professional intruder, but it will slow amateurs. Nonetheless, most organizations
today use only passwords. About a third of organizations go beyond this and are requiring users to enter a
password in conjunction with something they have, which is called two-factor authentication because
the password is the first factor and the object is the second. For example, an automated teller machine
(ATM) uses two-factor authentication by requiring you have your ATM card and know your PIN.
Two-factor authentication commonly employs the user’s mobile phone. The user installs an app on his or
her mobile phone (Duo is a common one) and adds this app information to his or her account. When the


user logs in, the software sends an alert to the app, which asks the user to confirm or deny the login (see
Figure 11-18). This greatly increases security, because an attacker must physically have the user’s mobile
phone and be able to login to it, as well and knowing the user’s password.
Another approach is one-time passwords. The user connects into his or her account as usual, and after
the user’s password is accepted, the system generates a one-time password (sometimes called an access
code), which is emailed or texted to the user using information that is stored in the user’s account. The
user must enter this password to gain access, otherwise the login is blocked. This is sometimes used when
a user logs in from a computer that he or she has not used before to ensure that someone else is not trying
to access the user’s account with a stolen password.
With any of these two-factor authentication systems, an attacker must know the user’s account name and
password and have access to a second item that belongs to the user, whether it is a physical item like a
phone or a logical item such as an email account.


FIGURE 11-18 Two-factor authentication with the Duo app for mobile phones
Biometrics


In high-security applications, a user may be required to present something he or she is, such as a finger,
hand, or the retina of the eye for scanning by the system. These biometric systems scan the user to
ensure that the user is the sole individual authorized to access the network account. About 15% of
organizations now use biometrics. Although most biometric systems are developed for high-security
users, several low-cost biometric systems are now on the market. Many mobile phones use fingerprints to
unlock them.
Central Authentication
One long-standing problem has been that users are often assigned user profiles and passwords on several
different computers. Each time a user wants to access a new server, he or she must supply his or her
password. This is cumbersome for the users and even worse for the network manager who must manage
all the separate accounts for all the users.
More and more organizations are adopting central authentication (also called network
authentication, single sign-on, or directory services), in which a log-in server is used to authenticate the
user. Instead of logging into a file server or application server, the user logs into the authentication
server. This server checks the user ID and password against its database and, if the user is an authorized
user, issues a certificate (also called credentials). Whenever the user attempts to access a restricted
service or resource that requires a user ID and password, the user is challenged, and his or her software
presents the certificate to the authentication server (which is revalidated by the authentication server at
the time). If the authentication server validates the certificate, then the service or resource lets the user in.
In this way, the user no longer needs to enter his or her password to be authenticated to each new
resource or service he or she uses. This also ensures that the user does not accidentally give out his or her


password to an unauthorized service—it provides mutual authentication of both the user and the service
or resource. The most commonly used authentication protocol is Kerberos, developed at MIT (see
web.mit.edu/kerberos/www).
Although many systems use only one authentication server, it is possible to establish a series of
authentication servers for different parts of the organization. Each server authenticates clients in its
domain but can also pass authentication credentials to authentication servers in other domains.
11.4.6 Preventing Social Engineering
One of the most common ways for attackers to break into a system, even master hackers, is through social
engineering, which refers to breaking security simply by asking. For example, attackers routinely phone
unsuspecting users and, imitating someone such as a technician or senior manager, ask for a password.
Unfortunately, too many users want to be helpful and simply provide the requested information. At first,
it seems ridiculous to believe that someone would give his or her password to a complete stranger, but a
skilled social engineer is like a good con artist: he—and most social engineers are men—can manipulate
people.
Most security experts no longer test for social engineering attacks; they know from experience that social
engineering will eventually succeed in any organization and therefore assume that attackers can gain
access at will to normal user accounts. Training end users not to divulge passwords may not eliminate
social engineering attacks, but it may reduce their effectiveness so that hackers give up and move on to
easier targets. Acting out social engineering skits in front of users often works very well; when employees
see how they can be manipulated into giving out private information, it becomes more memorable and
they tend to become much more careful.
Phishing is a very common type of social engineering. The attacker simply sends an email to millions of
users telling them that their bank account has been shut down due to an unauthorized access attempt and


users telling them that their bank account has been shut down due to an unauthorized access attempt and
that they need to reactivate it by logging in. The email contains a link that directs the user to a fake
website that appears to be the bank’s website. After the user logs into the fake site, the attacker has the
user’s user ID and password and can break into his or her account at will. Clever variants on this include
an email informing you that a new user has been added to your PayPal account, stating that the IRS has
issued you a refund and you need to verify your social security number, or offering a mortgage at very low
rate for which you need to provide your social security number and credit card number.


TECHNICAL FOCUS 11-6
Inside Kerberos
Kerberos, the most commonly used central authentication protocol, uses symmetric encryption
(usually DES). Kerberos is used by a variety of central authentication services, including Windows
active directory services. When you log in to a Kerberos-based system, you provide your user ID and
password to the Kerberos software on your computer. This software sends a request containing the
user ID but not the password to the Kerberos authentication server (called the Key Distribution
Center [KDC]).
The KDC checks its database for the user ID, and if it finds it, then it accepts the log-in and does two
things. First, it generates a service ticket (ST) for the KDC that contains information about the KDC,
a time stamp, and, most importantly, a unique session key (SK1), which will be used to encrypt all
further communication between the client computer and the KDC until the user logs off. SK1 is
generated separately for each user and is different every time the user logs in. Now, here’s the clever
part: The ST is encrypted using a key based on the password that matches the user ID. The client
computer can only decrypt the ST if it knows the password that matches the user ID used to log in. If
the user enters an incorrect password, the Kerberos software on the client can’t decrypt the ST and
asks the user to enter a new password. This way, the password is never sent over the network.
Second, the KDC creates a Ticket-Granting Ticket (TGT). The TGT includes information about the
client computer and a time stamp that is encrypted using a secret key known only to the KDC and
other validated servers. The KDC sends the TGT to the client computer encrypted with SK1, because


all communications between the client and the server are encrypted with SK1 (so no one else can
read the TGT). The client decrypts the transmission to receive the TGT, but because the client does
not know the KDC’s secret key, it cannot decrypt the contents of the TGT. From now until the user
logs off, the user does not need to provide his or her password again; the Kerberos client software
will use the TGT to gain access to all servers that require a password.
The first time a user attempts to use a server that requires a password, that server directs the user’s
Kerberos software to obtain a ST for it from the KDC. The user’s Kerberos software sends the TGT to
the KDC along with information about which server the user wants to access (remember that all
communications between the client and the KDC are encrypted with SK1). The KDC checks to make
sure that the user has not logged off, and if the TGT is validated, the KDC sends the client an ST for
the desired server and a new session key (SK2) that the client will use to communicate with that
server, both of which have been encrypted using SK1. The ST contains authentication information
and SK2, both of which have been encrypted using the secret key known only to the KDC and the
server.
The client presents a log-in request (which specifies the user ID, a time and date stamp, and other
information) that has been encrypted with SK2 and the ST to the server. The server decrypts the ST
using the KDC’s secret key to find the authentication information and SK2. It uses the SK2 to decrypt
the log-in request. If the log-in request is valid after decrypting with SK2, the server accepts the log-


in and sends the client a packet that contains information about the server that has been encrypted
with SK2. This process authenticates the client to the server and also authenticates the server to the
client. Both now communicate using SK2. Notice that the server never learns the user’s password.
11.4.7 Intrusion Prevention Systems
Intrusion prevention systems (IPSs) are designed to detect an intrusion and take action to stop it.
There are two general types of IPS, and many network managers choose to install both. The first type is a
network-based IPS. With a network-based IPS, an IPS sensor is placed on key network circuits. An
IPS sensor is simply a device running a special operating system that monitors all network packets on that
circuit and reports intrusions to an IPS management console. The second type of IPS is the host-
based IPS, which, as the name suggests, is a software package installed on a host or server. The host-
based IPS monitors activity on the server and reports intrusions to the IPS management console.


There are two fundamental techniques that these types of IPSs can use to determine that an intrusion is in
progress; most IPSs use both techniques. The first technique is misuse detection, which compares
monitored activities with signatures of known attacks. Whenever an attack signature is recognized, the
IPS issues an alert and discards the suspicious packets. The problem, of course, is keeping the database of
attack signatures up to date as new attacks are invented.
MANAGEMENT FOCUS 11-8
Social Engineering Wins Again
Danny had collected all the information he needed to steal the plans for the new product. He knew
the project manager’s name (Bob Billings), phone number, department name, office number,
computer user ID, and employee number, as well as the project manager’s boss’s name. These had
come from the company website and a series of innocuous phone calls to helpful receptionists. He
had also tricked the project manager into giving him his password, but that hadn’t worked because
the company used one-time passwords using a time-based token system called Secure ID. So, after
getting the phone number of the computer operations room from another helpful receptionist, all he
needed was a snowstorm.
Late one Friday night, a huge storm hit and covered the roads with ice. The next morning, Danny
called the computer operations room:
Danny:
“Hi, this is Bob Billings in the Communications Group. I left my Secure ID in my desk and I need
it to do some work this weekend. There’s no way I can get into the office this morning. Could you
go down to my office and get it for me? And then read my code to me so I can log in?”
Operations:
“Sorry, I can’t leave the Operations Center.”
Danny:
“Do you have a Secure ID yourself?”
Operations:
“There’s one here we keep for emergencies.”


Operations:
“There’s one here we keep for emergencies.”
Danny:
“Listen. Can you do me a big favor? Could you let me borrow your Secure ID? Just until it’s safe to
drive in?”
Operations:
“Who are you again?”
Danny:
“Bob Billings. I work for Ed Trenton.”
Operations:
“Yeah, I know him.”
Danny:
“My office is on the second floor (2202B). Next to Roy Tucker. It’d be easier if you could just get
my Secure ID out of my desk. I think it’s in the upper left drawer.” (Danny knew the guy wouldn’t
want to walk to a distant part of the building and search someone else’s office.)


Operations:
“I’ll have to talk to my boss.”
After a pause, the operations technician came back on and asked Danny to call his manager on his
cell phone. After talking with the manager and providing some basic information to “prove” he was
Bob Billings, Danny kept asking about having the operations technician go to “his” office.
Finally, the manager decided to let Danny use the Secure ID in the Operations Center. The manager
called the technician and gave permission for him to tell “Bob” the one-time password displayed on
their Secure ID any time he called that weekend. Danny was in.
Source: Adapted from Kevin Mitnick and William Simon, The Art of Deception, John Wiley and Sons, 2002.
The second fundamental technique is anomaly detection, which works well in stable networks by
comparing monitored activities with the “normal” set of activities. When a major deviation is detected
(e.g., a sudden flood of ICMP ping packets, an unusual number of failed log-ins to the network manager’s
account), the IPS issues an alert and discards the suspicious packets. The problem, of course, is false
alarms when situations occur that produce valid network traffic that is different from normal (e.g., on a
heavy trading day on Wall Street, e-trade receives a larger than normal volume of messages).
FIGURE 11-19 Intrusion prevention system (IPS). DMZ = demilitarized zone; DNS = Domain Name
Service; NAT = network address translation
Intrusion prevention systems are often used in conjunction with other security tools such as firewalls
(Figure 11-19). In fact, some firewalls are now including IPS functions. One problem is that the IPS and its
sensors and management console are a prime target for attackers. Whatever IPS is used, it must be very


secure against attack. Some organizations deploy redundant IPSs from different vendors (e.g., a network-
based IPS from one vendor and a host-based IPS from another) to decrease the chance that the IPS can be


hacked.
Although IPS monitoring is important, it has little value unless there is a clear plan for responding to a
security breach in progress. Every organization should have a clear response planned if a break-in is
discovered. Many large organizations have emergency response “SWAT” teams ready to be called into
action if a problem is discovered. The best example is CERT, which is the Internet’s emergency response
team. CERT has helped many organizations establish such teams.
Responding to an intrusion can be more complicated than it at first seems. For example, suppose the IPS
detects a DoS attack from a certain IP address. The immediate reaction could be to discard all packets
from that IP address; however, in the age of IP spoofing, the attacker could fake the address of your best
customer and trick you into discarding packets from it.
11.4.8 Intrusion Recovery
Once an intrusion has been detected, the first step is to identify how the intruder gained unauthorized
access and prevent others from breaking in the same way. Some organizations will simply choose to close
the door on the attacker and fix the security problem. About 30% of organizations take a more aggressive
response by logging the intruder’s activities and working with police to catch the individuals involved.
Once identified, the attacker will be charged with criminal activities and/or sued in civil court. Several
states and provinces have introduced laws requiring organizations to report intrusions and theft of
customer data, so the percentage of intrusions reported and prosecuted will increase.
A whole new area called computer forensics has recently opened up. Computer forensics is the use of
computer analysis techniques to gather evidence for criminal and/or civil trials. The basic steps of
computer forensics are similar to those of traditional forensics, but the techniques are different. First,
identify potential evidence. Second, preserve evidence by making backup copies and use those copies for


identify potential evidence. Second, preserve evidence by making backup copies and use those copies for
all analysis. Third, analyze the evidence. Finally, prepare a detailed legal report for use in prosecutions.
Although companies are sometimes tempted to launch counterattacks (or counterhacks) against
intruders, this is illegal.
Some organizations have taken their own steps to snare intruders by using entrapment techniques. The
objective is to divert the attacker’s attention from the real network to an attractive server that contains
only fake information. This server is often called a honey pot. The honey pot server contains highly
interesting, fake information available only through illegal intrusion to “bait” the intruder. The honey pot
server has sophisticated tracking software to monitor access to this information that allows the
organization and law enforcement officials to trace and legally document the intruder’s actions.
Possession of this information then becomes final legal proof of the intrusion.
11.5 BEST PRACTICE RECOMMENDATIONS
This chapter provides numerous suggestions on business continuity planning and intrusion prevention.
Good security starts with a clear disaster recovery plan and a solid security policy. Probably the best
security investment is user training: training individual users on data recovery and ways to defeat social
engineering. But this doesn’t mean that technologies aren’t needed either.
Figure 11-20 shows the most commonly used security controls. In the coming years, we expect two-factor
authentication and encryption to become much more popular.
Even so, rarely does a week pass without a new warning of a major vulnerability. Leave a server
unattended for two weeks, and you may find that you have five critical patches to install.


FIGURE 11-20 Commonly used security controls
People are now asking, “Will it end?” Is (in)security just a permanent part of the information systems
landscape? In a way, yes. The growth of information systems, along with the new and dangerous ability to
reach into them from around the world, has created new opportunities for criminals. Mix the possibilities
of stealing valuable, marketable information with the low possibilities for getting caught and punished,
and we would expect increasing numbers of attacks.
Perhaps the question should be: Does it have to be this bad? Unquestionably, we could be protecting
ourselves better. We could better enforce security policies and restrict access. But all of this has a cost.
Attackers are writing and distributing a new generation of attack tools right before us—tools that are very
powerful, more difficult to detect, and very easy to use. Usually, such tools are much easier to use than
their defensive countermeasures.
The attackers have another advantage, too. Whereas the defenders have to protect all vulnerable points all
the time to be safe, the attacker just has to break into one place one time to be successful.
So what may we expect in the future in “secure” organizational environments? We would expect to see
strong desktop management, including the use of thin clients. Centralized desktop management, in
which individual users are not permitted to change the settings on their computers, may become common,
along with regular reimaging of computers to prevent Trojans and viruses and to install the most recent
security patches. All external software downloads will likely be prohibited.
A Day in the Life: Network Security Manager
“Managing security is a combination of detective work and prognostication about the future.”
A network security manager spends much of his or her time doing three major things. First, much
time is spent looking outside the organization by reading and researching potential security holes


time is spent looking outside the organization by reading and researching potential security holes
and new attacks because the technology and attack opportunities change so fast. It is important to
understand new attack threats, new scripting tools used to create viruses, remote access Trojans and


other harmful software, and the general direction in which the hacking community is moving. Much
important information is contained at websites such as those maintained by CERT (www.cert.org)
and SANS (www.sans.org). This information is used to create new versions of standard computer
images that are more robust in defeating attacks and to develop recommendations for the
installation of application security patches. It also means that he or she must update the
organization’s written security policies and inform users of any changes.
Second, the network security manager looks inward toward the networks he or she is responsible for.
He or she must check the vulnerability of those networks by thinking like a hacker to understand
how the networks may be susceptible to attack, which often means scanning for open ports and
unguarded parts of the networks and looking for computers that have not been updated with the
latest security patches. It also means looking for symptoms of compromised machines such as new
patterns of network activity or unknown services that have been recently opened on a computer.
Third, the network security manager must respond to security incidents. This usually means
“firefighting”—quickly responding to any security breach, identifying the cause, collecting forensic
evidence for use in court, and fixing the computer or software application that has been
compromised.
Source: With thanks to Kenn Crook.
Continuous content filtering, in which all incoming packets (e.g., Web, email) are scanned, may become
common, thus significantly slowing down the network. All server files and communications with client
computers would be encrypted, further slowing down transmissions.
Finally, all written security policies would be rigorously enforced. Violations of security policies might
even become a “capital offense” (i.e., meaning one violation and you are fired).
We may look forlornly back to the early days of the Internet when we could “do anything” as its Golden
Days.


Days.
11.6 IMPLICATIONS FOR YOUR CYBER SECURITY
Cyber security was once an esoteric field of interest to only a few dedicated professionals. Today, it is the
fastest-growing area in information systems.
The good news is there are plenty of job opportunities. Experts estimate that by 2020 there will be one
million unfilled jobs because companies won’t be able to hire enough people to meet their needs. Many of
these jobs will require advanced training and years of experience, but about a third of them will be entry
level positions.
The bad news is that you as a user will have to be more concerned with security than ever before, not only
in your professional life but also in your personal life. We have several recommendations to help you
manage your personal cyber security.
Subscribe to an automatic backup service to ensure you never lose data. We recommend Mozy and
Carbonite.
Ensure your computer’s operating system and antivirus software are set to automatic update. Same for
your mobile phone and any smart devices like smart TVs.
Use passphrases rather than short passwords, and sign-up for two-factor authentication on any important
website that offers it, such as your bank. Install and use a password manager.
Put a passphrase on your laptop and a pin or fingerprint on your phone. Statistics show that an average
person will lose (or have stolen) two to three phones and laptops over their working life. Put an app on
your phone that enables it to be wiped or disabled remotely, because access to your data is worth far more
than the cost of the phone. For example, do you have a banking or payment app on your phone?
Never click on a link in an email, no matter who sent it. More than 90% of emails containing links are


phishing attacks, so if an email has a link, it is a strong indicator that it is an attack. Instead, ignore the
email or use Google to find the URL you want.


Never click on a pop-up warning that appears on a website (especially if it says something scary like your
computer has a virus). It is trying to trick you into letting the website install malware (a virus or
ransomware); any button you click will install the malware, regardless of what the button says. Instead,
close the browser or turn off your computer.
Never give out your passphrase to anyone. More than 99% of people who ask for your passphrase are
attackers. Hang up the phone immediately; don’t bother to say bye. If they are in your home or office, ask
them to step outside while you make a personal call and then lock the door and call the company IT help
desk. Real IT support staff will avert their eyes when you type your passphrase so they can’t see what you
type.
SUMMARY
Types of Security Threats In general, network security threats can be classified into one of two
categories: (1) business continuity and (2) intrusions. Business continuity can be interrupted by
disruptions that are minor and temporary, but some may also result in the destruction of data.
Natural (or human-made) disasters may occur that destroy host computers or large sections of the
network. Intrusion refers to intruders (external attackers or organizational employees) gaining
unauthorized access to files. The intruder may gain knowledge, change files to commit fraud or theft,
or destroy information to injure the organization.
Risk Assessment Developing a secure network means developing controls that reduce or eliminate
threats to the network. Controls prevent, detect, and correct whatever might happen to the
organization when its computer-based systems are threatened. The first step in developing a secure
network is to conduct a risk assessment. This is done by identifying the key assets and threats and
comparing the nature of the threats to the controls designed to protect the assets. A company can pick


one of several risk assessment frameworks that are considered to be industry standards.
Business Continuity The major threats to business continuity are viruses, theft, DOS attacks,
device failure, and disasters. Installing and regularly updating antivirus software is one of the most
important and commonly used security controls. Protecting against DOS attacks is challenging and
often requires special hardware. Theft is one of the most often overlooked threats and can be
prevented by good physical security, especially the physical security of laptop computers. Devices fail,
so the best way to prevent network outages is to ensure that the network has redundant circuits and
devices (e.g., switches and routers) on mission-critical network segments (e.g., the Internet
connection and core backbone). Avoiding disasters can take a few commonsense steps, but no
disaster can be completely avoided; most organizations focus on ensuring important data are backed
up off-site and having a good, tested disaster recovery plan.
Intrusion Prevention Intruders can be organization employees or external hackers who steal data
(e.g., customer credit card numbers) or destroy important records. A security policy defines the key
stakeholders and their roles, including what users can and cannot do. Firewalls often stop intruders
at the network perimeter by permitting only authorized packets into the network, by examining
application layer packets for known attacks, and/or by hiding the organization’s private IP addresses
from the public Internet. Physical and dial-up security are also useful perimeter security controls.
Patching security holes—known bugs in an operating system or application software package—is
important to prevent intruders from using these to break in. Single key or public key encryption can
protect data in transit or data stored on servers. User authentication ensures only authorized users
can enter the network and can be based on something you know (passwords), something you have


can enter the network and can be based on something you know (passwords), something you have
(two-factor authentication), or something you are (biometrics). Preventing social engineering, where
hackers trick users into revealing their passwords, is very difficult. Intrusion prevention systems are
tools that detect known attacks and unusual activity and enable network managers to stop an
intrusion in progress. Intrusion recovery involves correcting any damaged data, reporting the
intrusion to the authorities, and taking steps to prevent the other intruders from gaining access the
same way.
KEY TERMS


accept
access control list (ACL)
account
Advanced Encryption Standard (AES)
adware
algorithm
anomaly detection
antivirus software
application-level firewall
asset
asymmetric encryption
authentication server
authentication
availability
backup control
biometric system
brute-force attack
business continuity
central authentication
certificate authority (CA)
certificate
ciphertext
computer forensics
confidentiality
continuous data protection (CDP)
controls
corrective control
cracker
Data Encryption Standard (DES)
DDoS agent
DDoS handler
decryption
defer
denial-of-service (DoS) attack
desktop management
detective control
disaster recovery drill
disaster recovery firm
disaster recovery plan


disk mirroring
distributed denial-of-service (DDoS) attack
eavesdropping
encryption
entrapment
fault-tolerant server
financial
financial impact
firewall
hacker
honey pot
host-based IPS
impact score
information warfare
integrity
Internet Key Exchange (IKE)
intrusion prevention systems (IPSs)
IP Security Protocol (IPSec)
IP spoofing
IPS management console
IPS sensor
IPSec transport mode
IPSec tunnel mode
Kerberos
key management
key
legal
malware
mission-critical application
misuse detection
mitigate
NAT firewall
network address translation (NAT)
network-based IPS
one-time password
online backup
packet-level firewall
passphrase
password manager


password
patch
phishing
physical security
plaintext
Pretty Good Privacy (PGP)
preventive control
Preventing unauthorized access
private key
productivity
public key encryption
public key infrastructure (PKI)
public key
ransomware
RC4
recovery control
redundancy
redundant array of independent disks (RAID)
reputation
risk assessment frameworks
risk assessment
risk control strategy
risk mitigation
risk score
rootkit
RSA
safety
Secure Sockets Layer (SSL)
secure switch
security hole
security policy
share
sniffer program
social engineering
something you are
something you have
something you know
spyware
symmetric encryption


threat scenario
threat
traffic analysis
traffic anomaly analyzer
traffic anomaly detector
traffic filtering
traffic limiting
triple DES (3DES)
Trojan horse
two-factor authentication
uninterruptible power supply (UPS)
user authentication
user profile
virus
worm
zero-day attack
QUESTIONS
1. What factors have brought an increased emphasis on network security?
2. Briefly outline the steps required to complete a risk assessment.
3. Name and describe the main impact areas. Who should be responsible for assessing what is meant by
low/medium/high impact for each of the impact areas? Explain your answer.
4. What are some of the criteria that can be used to rank security risks?
5. What are the most common security threats? What are the most critical? Why?
6. Explain the purpose of threat scenarios. What are the steps in preparing threat scenarios?
7. What is the purpose of the risk score, and how is it calculated?
8. What are the possible risk control strategies? How do we pick which one to use?
9. Why is it important to identify improvements that are needed to mitigate risks?
10. What is the purpose of a disaster recovery plan? What are the five major elements of a typical disaster
recovery plan?
11. What is a computer virus? What is ransomware?
12. Explain how a denial-of-service attack works.
13. How does a denial-of-service attack differ from a distributed denial-of-service attack?
14. What is a disaster recovery firm? When and why would you establish a contract with them?
15. What is online backup?
16. People who attempt intrusion can be classified into several different categories. Describe them.
17. There are many components in a typical security policy. Describe three important components.
18. What are the major aspects of intrusion prevention?


18. What are the major aspects of intrusion prevention?
19. How do you secure the network perimeter?
20. What is physical security, and why is it important?


21. What is eavesdropping in a computer security sense?
22. What is a sniffer?
23. What is a firewall?
24. How do the different types of firewalls work?
25. What is IP spoofing?
26. What is a NAT firewall, and how does it work?
27. What is a security hole, and how do you fix it?
28. Explain how a Trojan horse works.
29. Compare and contrast symmetric and asymmetric encryption.
30. Describe how symmetric encryption and decryption work.
31. Describe how asymmetric encryption and decryption work.
32. What is key management?
33. How does DES differ from 3DES? From AES?
34. Compare and contrast DES and public key encryption.
35. Explain how authentication works.
36. What is PKI, and why is it important?
37. What is CA?
38. How does PGP differ from SSL?
39. How does SSL differ from IPSec?
40. What are the three major ways of authenticating users? What are the pros and cons of each
approach?
41. What are the different types of two factor authentication methods and how do they work?
42. Explain how a biometric system can improve security. What are the problems with it?
43. Why is the management of user profiles an important aspect of a security policy?
44. What is social engineering? Why does it work so well?
45. What techniques can be used to reduce the chance that social engineering will be successful?
46. What is an IPS?
47. How does IPS anomaly detection differ from misuse detection?
48. What is computer forensics?
49. What is a honey pot?
50. A few security consultants have said that fast Internet and wireless technologies are their best friends.
Explain.


Explain.
51. Most hackers start their careers breaking into computer systems as teenagers. What can we as a
community of computer professionals do to reduce the temptation to become a hacker?
52. Some experts argue that CERT’s posting of security holes on its website causes more security break-
ins than it prevents and should be stopped. What are the pros and cons of both sides of this
argument? Do you think CERT should continue to post security holes?
53. What is one of the major risks of downloading unauthorized copies of music files from the Internet
(aside from the risk of fines and lawsuits)?
54. Although it is important to protect all servers, some servers are more important than others. What
server(s) are the most important to protect and why?


EXERCISES
A. Conduct a risk assessment of your organization’s networks. Some information may be confidential, so
report what you can.
B. Investigate and report on the activities of CERT (the Computer Emergency Response Team).
C. Investigate the capabilities and costs of a disaster recovery service.
D. Investigate the capabilities and costs of a firewall.
E. Investigate the capabilities and costs of an IPS.
F. Investigate the capabilities and costs of an encryption package.
G. Investigate the capabilities and costs of an online backup service.
H. Is the DMZ dead? Investigate the use of DMZ in organizations. What lessons can organizations learn
from the DMZ mechanism?
MINICASES
I. Belmont State Bank Belmont State Bank is a large bank with hundreds of branches that are
connected to a central computer system. Some branches are connected over dedicated circuits and
others use Multiprotocol Label Switching (MPLS). Each branch has a variety of client computers and
ATMs connected to a server. The server stores the branch’s daily transaction data and transmits it
several times during the day to the central computer system. Tellers at each branch use a four-digit
numeric password, and each teller’s computer is transaction-coded to accept only its authorized
transactions. Perform a risk assessment.
II. Western Bank Western Bank is a small, family-owned bank with six branches spread over the
county. It has decided to move onto the Internet with a website that permits customers to access their
accounts and pay bills. Design the key security hardware and software the bank should use.
III. Classic Catalog Company, Part 1 Classic Catalog Company runs a small but rapidly growing
catalog sales business. It outsourced its Web operations to a local ISP for several years, but as sales


over the Web have become a larger portion of its business, it has decided to move its website onto its
own internal computer systems. It has also decided to undertake a major upgrade of its own internal
networks. The company has two buildings, an office complex and a warehouse. The two-story office
building has 60 computers. The first floor has 40 computers, 30 of which are devoted to telephone
sales. The warehouse, located 400 feet across the company’s parking lot from the office building, has
about 100,000 square feet, all on one floor. The warehouse has 15 computers in the shipping
department located at one end of the warehouse. The company is about to experiment with using
wireless handheld computers to help employees more quickly locate and pick products for customer
orders. Based on traffic projections for the coming year, the company plans to use a T1 connection
from its office to its ISP. It has three servers: the main Web server, an email server, and an internal
application server for its application systems (e.g., orders, payroll). Perform a risk assessment.
IV. Classic Catalog Company, Part 2 Read MINICASES III above. Outline a brief business continuity
plan, including controls to reduce the risks in advance as well as a disaster recovery plan.
V. Classic Catalog Company, Part 3 Read MINICASES III above. Outline a brief security policy and
the controls you would implement to control unauthorized access.
VI. Classic Catalog Company, Part 4 Read MINICASES III above. What patching policy would you
recommend for Classic Catalog?
VII. Personal Password Storage and Protection To help us not forget our many passwords, there
are several companies that provide password managers. Find the top five password manager
programs, compare their features and costs, and make a presentation of your findings to your
classmates.


TECH UPDATES
In every chapter, we will offer a couple of ideas to investigate. Pick one of these topics to investigate.
Topic A: Black, White, and Grey Hat Hackers
There are many different types of hackers—some who illegally hack companies for financial gain, some
who the company hires to hack their own system (the “good guys”), and those in between. What are some
real examples of each case and why might a company hire a hacker to infiltrate their own system? Where
can you learn to hack? How lucrative is it? What kinds of different attacks may a hacker employ?
Topic B: Top Cybersecurity Programs and Certifications
There is a cybersecurity skill gap. Research suggests that in five years, there will be 3.5 million unfilled
cybersecurity jobs. This deficit of skills is likely to become a growing matter of public concern. Where can
you get an education? Or certification? What skills are needed? How much does it pay?
Deliverables
Your job will be to prepare a presentation/video (7–10 minutes long) that addresses the topic and
provides information on the following items:
1. Title Slide
2. Short description of the topic
3. Main players—these could be people, processes, software, hardware, etc.
4. How it works—use a lot of pictures and be as technical as possible; create this part as a tutorial so that
your audience can follow along
5. How does it relate to material covered in class so far (and in the future)
6. Additional material/books/links where to learn more about this topic
7. Credits
8. List of References
9. Memo addressed to your professor describing all of the above information
HANDS-ON ACTIVITY 11A
Securing Your Computer
This chapter has focused on security, including risk analysis, business continuity, and intrusion


This chapter has focused on security, including risk analysis, business continuity, and intrusion
prevention. At first glance, you may think security applies to corporate networks, not your network.
However, if you have a LAN at your house or apartment, or even if you just own a desktop or laptop
computer, security should be one of your concerns. There are so many potential threats to your business
continuity—which might be your education—and to intrusion into your computer(s) that you need to take
action.
You should perform your own risk analysis, but this section provides a brief summary of some simple
actions you should take that will greatly increase your security. Do this this week; don’t procrastinate. Our
focus is on Windows security, because most readers of this book use Windows computers, but the same
advice (but different commands) applies to Apple computers.
Business Continuity
If you run your own business, then ensuring business continuity should be a major focus of your efforts.
But even if you are “just” an employee or a student, business continuity is important. What would happen
if your hard disk failed just before the due date for a major report?
1. The first and most important security action you can take is to configure Windows to perform


automatic updates. This will ensure you have the latest patches and updates installed.
2. The second most important action is to buy and install antivirus software such as that from
Symantec. Be sure to configure it for regular updates too. If you perform just these two actions, you
will be relatively secure from viruses, but you should scan your system for viruses on a regular basis,
such as the first of every month, when you pay your rent or mortgage.
3. Spyware is another threat. You should buy and install antispyware software that provides the same
protection that antivirus software does for viruses. Spybot is a good package. Be sure to configure this
software for regular updates and scan your system on a regular basis.
4. One of the largest sources of viruses, spyware, and adware are free software and music/video files
downloaded from the Internet. Simply put, don’t download any file unless it is from a trusted vendor
or distributor of software and files.
5. Develop a disaster recovery plan. You should plan today for what you would do if your computer were
destroyed. What files would you need? If there are any important files that you wouldn’t want to lose
(e.g., reports you’re working on, key data, or precious photos), you should develop a backup and
recovery plan for them. The simplest is to copy the files to a shared directory on another computer on
your LAN. But this won’t enable you to recover the files if your apartment or house was destroyed by
fire, for example. A better plan is to subscribe to a free online backup service such as mozy.com or
carbonite.com (think CDP on the cheap). If you don’t use such a site, buy a large USB drive, copy your


files to it, and store it off-site in your office or at a friend’s house. A plan is only good if it is followed,
so your data should be regularly backed up, such as doing so the first of every month.
Deliverables
1. Perform risk analysis for your home network.
2. Prepare a disaster recovery plan for your home network.
3. Research antivirus and antispyware software that you can purchase for your home network.
HANDS-ON ACTIVITY 11B
How to Set Up Encryption on Your Computer
If you want to protect the data on your computer, you need to encrypt it. Encryption is widely used on the
Internet these days—when you are making a purchase on Amazon or another retailer, your computer
encrypts your credit card information before it gets transferred over the Internet.
Should you encrypt the data on your computer? The answer is yes. What if your computer gets stolen?
You might say that your computer is password protected. Well, breaking into a password-protected
computer is extremely easy. Should you then encrypt only your files, or should you encrypt the entire
drive? If you only encrypt your files, if your computer gets stolen, the criminal will not be able to read your
files but will still be able to install anything on your computer and see all the nonencrypted files. If you
encrypt the entire drive, it would make it extremely difficult for anybody even to boot your computer
without the password. However, if you ever forget your password or your drive gets corrupted, you
probably wouldn’t be able to retrieve your data files at all. That’s why it’s important to set up data recovery
features specific to your operating system such as your Microsoft account for Windows and iCloud for
Apple products.
Windows
1. Open your file explorer and navigate to your drives. From here, right-click on the drive that you


would like to encrypt and press Turn on BitLocker (Figure 11-21).


FIGURE 11-21 BitLocker
2. Choose the new encryption mode (Figure 11-22).


FIGURE 11-22 Selecting the encryption mode
3. Begin encryption (Figure 11-23)


FIGURE 11-23 Starting the encryption
Mac
1. Navigate to the Apple logo at the top right of your screen. Open the Apple menu and press System
Preferences (Figure 11-24).
2. Type FileVault at the search bar in the top right and click return (Figure 11-25).
3. Press Turn on FileVault and wait while the drive is encrypted (this may take a while, this is best to
leave and complete overnight) (Figure 11-26).


FIGURE 11-24 System Preferences for a Mac
Deliverable
Encrypt a folder on your home computer. Show a screenshot of the encrypted folder.
HANDS-ON ACTIVITY 11C
Encryption Lab
The purpose of this lab is to practice encrypting and decrypting email messages using a standard called
PGP (Pretty Good Privacy) that is implemented at https://8gwifi.org/pgpencdec.jsp (links to an external
site). You may generate your public keys here: https://www.igolder.com/pgp/generate-key/.
1. Open https://www.igolder.com/pgp/generate-key/ (links to an external site) and generate your PGP
key pair—your personal private and public keys (Figure 11-27). Save these in a note file; an example
with the password and private key removed is shown below:


FIGURE 11-25 Searching system preferences
FIGURE 11-26 Security & Privacy: FileVault


FIGURE 11-27 PGP key generator
2. Next, open https://8gwifi.org/pgpencdec.jsp (links to an external site) and create an encrypted
message with your public key (Figure 11-28). It should look something like this with the recipients
public key in the public key field:
3. If you were sent a message, you could decrypt it by clicking the decrypt radio button on the site and
putting in you private key and passphrase that you set up before (Figure 11-29).
Deliverables
Create your key pair. Post your public key to a folder/discussion board as specified by your professor.
Copy the public key of your professor. Send your instructor an encrypted message that contains
information about your favorite food, hobbies, places to travel, and so on (Figure 11-30).
Your professor will send you a response that will be encrypted. Decrypt the email and print its
content so that you can submit a hard copy in class.
HANDS-ON ACTIVITY 11D
Apollo Residence Network Design
Apollo is a luxury residence hall that will serve honors students at your university. We described the
residence in Hands-On Activities at the end of the previous chapters. The university is concerned about
cyber security and wants to ensure that the Apollo Residence had good business continuity and is well
protected against intrusion. It needs to ensure that the network design protects both its residence
operations and the students who live in Apollo. The university is well aware that half of all intrusion
attempts come from inside the organization, which in this case means its own students.


FIGURE 11-28 PGP encryption
Deliverable
Your team was hired to design the network security for the residence. Using the network design from the
previous chapters, decide what security hardware, software, and services you will buy. Figure 11-31
provides a list of possibilities.


FIGURE 11-29 PGP decryption


FIGURE 11-30 Selecting a recipient of an encrypted message


FIGURE 11-31 Security hardware, software, and services


CHAPTER 12
NETWORK MANAGEMENT
Network managers perform two key tasks: (1) designing new networks and network upgrades and (2)
managing the day-to-day operation of existing networks. The previous chapters have examined network
design, so this chapter focuses on day-to-day network management, discussing the things that must be
done to ensure that the network functions properly, although we do discuss some special-purpose
equipment designed to improve network performance. Our focus is on the network management
organization and the basic functions that a network manager must perform to operate a successful
network.
OBJECTIVES
Understand what is required to manage the day-to-day operation of networks
Be familiar with the network management organization
Understand configuration management
Understand performance and fault management
Be familiar with end-user support
Be familiar with cost management
OUTLINE
12.1 Introduction
12.2 Designing for Network Performance
12.2.1 Managed Networks
12.2.2 Managing Network Traffic
12.2.3 Reducing Network Traffic
12.3 Configuration Management
12.3.1 Configuring the Network and Client Computers
12.3.2 Documenting the Configuration
12.4 Performance and Fault Management
12.4.1 Network Monitoring
12.4.2 Failure Control Function
12.4.3 Performance and Failure Statistics
12.4.4 Improving Performance
12.5 End User Support
12.5.1 Resolving Problems
12.5.2 Providing End User Training
12.6 Cost Management
12.6.1 Sources of Costs
12.6.2 Reducing Costs
12.7 Implications for Cyber Security


Summary
12.1 INTRODUCTION
Network management is the process of operating, monitoring, and controlling the network to ensure it
works as intended and provides value to its users. The primary objective of the data communications
function is to move application-layer data from one location to another in a timely fashion and to provide
the resources that allow this transfer to occur. This transfer of information may take place within a single
department, between departments in an organization, or with entities outside the organization across
private networks or the Internet.
Without a well-planned, well-designed network and without a well-organized network management staff,
operating the network becomes extremely difficult. Unfortunately, many network managers spend most of
their time firefighting—dealing with breakdowns and immediate problems. If managers do not spend
enough time on planning and organizing the network and networking staff, which are needed to predict
and prevent problems, they are destined to be reactive rather than proactive in solving problems.
MANAGEMENT FOCUS 12-1
What Do Network Managers Do?
If you were to become a network manager, some of your responsibilities and tasks would be the
following:
Manage the day-to-day operations of the network.
Provide support to network users.
Ensure the network is operating reliably.
Evaluate and acquire network hardware, software, and services.
Manage the network technical staff.
Manage the network budget, with emphasis on controlling costs.
Develop a strategic (long-term) networking and voice communications plan to meet the
organization’s policies and goals.
Keep abreast of the latest technological developments in computers, data communications
devices, network software, and the Internet.
Keep abreast of the latest technological developments in telephone technologies and network
services.
Assist senior management in understanding the business implications of network decisions and
the role of the network in business operations.
12.2 DESIGNING FOR NETWORK PERFORMANCE


the role of the network in business operations.
12.2 DESIGNING FOR NETWORK PERFORMANCE
At the end of the previous chapters, we have discussed the best practice design for LANs, backbones,
WANs, and WLANs and examined how different technologies and services offered different effective data
rates at different costs. In the backbone and WAN chapters, we also examined different topologies and
contrasted the advantages and disadvantages of each. So at this point, you should have a good
understanding of the best choices for technologies and services and how to put them together into a good
network design. In this section, we examine several higher-level concepts used to design the network for
the best performance.
12.2.1 Managed Networks


The single most important element that contributes to the performance of a network is a managed
network that uses managed devices. Managed devices are standard devices, such as switches and
routers, that have small onboard computers to monitor the traffic that flows through the device as well as
the status of the device and other devices connected to it. You’ll recall that we discussed SDWAN
technology in Chapter 9. An SDWAN is one example of a managed network. Most network management
software provides SDWAN capabilities, but there is also dedicated SDWAN software that only manages
the WAN.
Managed devices perform their normal functions (e.g., routing, switching) and also provide three
additional capabilities. First, they record data on the traffic they process. These data are sent to the
network management console either every few seconds or when the device receives a special control
message requesting the data. These data enable the network manager to see which circuits are busy and
not busy, both for real-time management and longer-term network planning and design.
Second, managed devices monitor the status of other devices around them and can send an alarm
message to the network management console if they detect a critical situation such as a failing device or a
huge increase in traffic. These alarms are configurable so the network manager can define whatever
criteria he or she likes. The alarms can be sent from the management console to the manager’s mobile
phone or other devices, so no one has to be at the console to receive the alarms.
Third, managed devices and the management console software can be programed to take action when
certain events occurs. For example, a managed device can be configured to detect if a nearby device is no
longer responding, and if so, to send an alarm and automatically reroute around the failed device.
In this way, network problems can be detected and reported by the devices themselves before problems


In this way, network problems can be detected and reported by the devices themselves before problems
become serious. In the case of the failing network card, a managed device could record the increased
number of retransmissions required to successfully transmit messages and inform the network
management software of the problem. A managed switch is often able to detect the faulty transmissions
from a failing network card, disable the incoming circuit so that the card could not send any more
messages, and issue an alarm to the network manager. In either case, finding and fixing problems is much
simpler, requiring minutes, not hours.
Network Management Software
A managed network requires both hardware and software: managed devices (e.g., switches, routers, APs)
to monitor, collect, and transmit traffic reports and problem alerts; and network management software to
store, organize, and analyze these reports and alerts. Managed devices are more expensive than
unmanaged devices because they have a CPU and software built into them. When we build a managed
network, we normally buy all managed devices, rather than cutting costs by buying some managed devices
and some unmanaged devices, although some organizations do install a mix of managed and unmanaged
devices to cut costs. In this case, the managed devices are usually placed on the backbone and unmanaged
devices in the access layer. There are three fundamentally different types of network management
software.
Device management software (sometimes called point management software) is designed to provide
information about the specific devices on a network. It enables the network manager to monitor
important devices such as servers, routers, and switches to report configuration information, traffic
volumes, and error conditions for each device. Figure 12-1 shows a sample display from a device
management software package running at Indiana University. This figure shows the amount of traffic on


management software package running at Indiana University. This figure shows the amount of traffic on
the university’s core backbone network. This chart is in color, which is hard to see in a black-and-white
book. The chart shows that traffic is generally under control, with most circuits running at 10% or less of
capacity. A few circuits are running at between 20% and 50% of capacity (e.g., the circuits between
br2.ictc and br2.bldc). You can see that all circuits are full duplex because there are different traffic
amounts in each direction.
System management software (sometimes called enterprise management software or a network
management framework) provides the same configuration, traffic, and error information as device
management systems but can analyze the device information to diagnose patterns, not just display
individual device problems. This is important when a critical device fails (e.g., a router into a high-traffic
building). With device management software, all of the devices that depend on the failed device will


attempt to send warning messages to the network administrator. One failure often generates several
dozen problem reports, called an alarm storm, making it difficult to pinpoint the true source of the
problem quickly. The dozens of error messages are symptoms that mask the root cause. System
management software tools correlate the individual error messages into a pattern to find the true cause,
which is called root cause analysis, and then report the pattern to the network manager. Rather than
first seeing pages and pages of error messages, the network manager instead is informed of the root cause
of the problem.
Application management software also builds on the device management software, but instead of
monitoring systems, it monitors applications. In many organizations, there are mission-critical
applications that should get priority over other network traffic. For example, real-time order-entry
systems used by telephone operators need priority over email. Application management systems track
delays and problems with application layer packets and inform the network manager if problems occur.
FIGURE 12-1 Device management software used on Indiana University’s core backbone network
Network Management Standards
One important problem is ensuring that hardware devices from different vendors can understand and
respond to the messages sent by the network management software of other vendors. By this point in the
book, the solution should be obvious: standards. A number of formal and de facto standards have been
developed for network management. These standards are application layer protocols that define the type
of information collected by network devices and the format of control messages that the devices
understand.
The most commonly used network management protocol is Simple Network Management Protocol
(SNMP). Each SNMP device (e.g., router, switch, server) has an agent that collects information about
itself and the messages it processes and stores that information in a database called the management


information base (MIB). The network manager’s management station that runs the network
management software has access to the MIB. Using this software, the network manager can send
control messages to individual devices or groups of devices asking them to report the information stored
in their MIB.
Most SNMP devices have the ability for remote monitoring (RMON). Most first-generation SNMP
tools reported all network monitoring information to one central network management database. Each
device would transmit updates to its MIB on the server every few minutes, greatly increasing network
traffic. RMON SNMP software enables MIB information to be stored on the device itself or on distributed
RMON probes that store MIB information closer to the devices that generate it. The data are not
transmitted to the central server until the network manager requests, thus reducing network traffic
(Figure 12-2).
FIGURE 12-2 Network management with Simple Network Management Protocol (SNMP). MIB =
management information base
Network information is recorded based on the data link layer protocols, network layer protocols, and
application layer protocols so that network managers can get a very clear picture of the exact types of
network traffic. Statistics are also collected based on network addresses so the network manager can see
how much network traffic any particular computer is sending and receiving. A wide variety of alarms can
be defined, such as instructing a device to send a warning message if certain items in the MIB exceed
certain values (e.g., if circuit utilization exceeds 50%).
As the name suggests, SNMP is a simple protocol with a limited number of functions. One problem with
SNMP is that many vendors have defined their own extensions to it. So the network devices sold by a


vendor may be SNMP compliant, but the MIBs they produce contain additional information that can be
used only by network management software produced by the same vendor. Therefore, although SNMP
was designed to make it easier to manage devices from different vendors, in practice, this is not always the
case.
MANAGEMENT FOCUS 12-2
Network Management at ZF Lenksysteme
ZF Lenksysteme manufactures steering systems for cars and trucks. It is headquartered in southern
Germany but has offices and plants in France, England, the United States, Brazil, India, China, and
Malaysia. Its network has about 300 servers and 600 devices (e.g., routers, switches).
ZF Lenksysteme had a network management system, but when a problem occurred with one device,
nearby devices also issued their own alarms. The network management software did not recognize
the interactions among the devices, and the resulting alarm storm meant that it took longer to
diagnose the root cause of the problem.
The new HP network management system monitors and controls the global network from one
central location with only three staff. All devices and servers are part of the system, and
interdependencies are well defined, so alarm storms are a thing of the past. The new system has cut
costs by 50% and also has extended network management into the production line. The robots on
the production line now use TCP/IP networking, so they can be monitored like any other device.
Sources: ZF Lenksysteme, HP Case studies, hp.com.
12.2.2 Managing Network Traffic
Most approaches to improving network performance attempt to maximize network speed. Another
approach is to manage where and how we route traffic to improve network performance. This section
examines two tools designed to better manage traffic with the ultimate goal of improving network
performance.
Load Balancing


performance.
Load Balancing
As we mentioned in Chapter 7 on the design of the data center, servers are typically placed together in
server farms or clusters, which sometimes have hundreds of servers that perform the same task. In
this case, it is important to ensure that when a request arrives at the server farm, it is immediately
forwarded to a server that is not busy—or is the least busy.
A special device called a load balancer or virtual server acts as a traffic manager at the front of the
server farm (Figure 12-3). All requests are directed to the load balancer at its IP address. When a request
hits the load balancer, it forwards it to one specific server using the server’s IP address. Sometimes a
simple round-robin formula is used (requests go to each server one after the other in turn); in other cases,
more complex formulas track how busy each server actually is. If a server crashes, the load balancer stops
sending requests to it, and the network continues to operate without the failed server. Load balancing
makes it simple to add servers (or remove servers) without affecting users. You simply add or remove the
server(s) and change the software configuration in the load balancer; no one is aware of the change.
Policy-Based Management
With policy-based management (sometimes called application shaping or traffic shaping), the
network manager uses special software to set priority policies for network traffic that take effect when the
network becomes busy. For example, the network manager might say that order processing and
videoconferencing get the highest priority (order processing because it is the lifeblood of the company and
videoconferencing because poor response time will have the greatest impact on it).
The policy management is usually implemented as a combination of hardware and software. A special
device called a traffic shaper is installed at a key point (usually between a building backbone and the


campus backbone). The software to manage this device also configures the network devices behind it
using the quality of service (QoS) capabilities in TCP/IP and/or VLANs to give certain applications the
highest priority when the devices become busy. Policy-based management requires managed devices that
support QoS.
FIGURE 12-3 Network with load balancer
12.2.3 Reducing Network Traffic
A more radical approach to improving performance is to reduce the amount of traffic on the network. This
may seem quite difficult at first glance—after all, how can we reduce the number of Web pages people
request? We can’t reduce all types of network traffic, but if we limit high-capacity users and move the
most commonly used data closer to the users who need it, we can reduce traffic enough to have an impact
on network performance. This section discusses three different tools that can be used.
Capacity Management
Capacity management devices, sometimes called bandwidth limiter or bandwidth shapers,
monitor traffic and can slow down traffic from users who consume a lot of network capacity. Capacity
management is related to policy-based management but is simpler in that it only looks at the source of the
traffic (i.e., the source IP address) rather than the nature of the traffic (e.g., videoconferencing, email,
Web pages). These devices are installed at key points in the network, such as between a backbone and the
core network. Figure 12-4 shows the control panel for one device made by Net Equalizer.
Content Caching
The basic idea behind content caching is to store other people’s Web data closer to your users. With
content caching, you install a content engine (also called a cache engine) close to your Internet
connection and install special content management software on the router (Figure 12-5). The router


connection and install special content management software on the router (Figure 12-5). The router
directs all outgoing Web requests and the files that come back in response to those requests to the cache


engine. The content engine stores the request and the static files that are returned in response (e.g.,
graphics files, banners). The content engine also examines each outgoing Web request to see if it is
requesting static content that the content engine has already stored. If the request is for content already in
the content engine, it intercepts the request and responds directly itself with the stored file but makes it
appear as though the request came from the URL specified by the user. The user receives a response
almost instantaneously and is unaware that the content engine responded. The content engine is
transparent.
FIGURE 12-4 Capacity management software


FIGURE 12-5 Network with content engine
Although not all Web content will be in the content engine’s memory, content from many of the most
commonly accessed sites on the Internet will be, for example, yahoo.com, google.com, and amazon.com.
The contents of the content engine reflect the most common requests for each individual organization that
uses it and changes over time as the pattern of pages and files changes. Each page or file also has a limited
life in the cache before a new copy is retrieved from the original source so that pages that occasionally
change will be accurate.
By reducing outgoing traffic (and incoming traffic in response to requests), the content engine enables the
organization to purchase a smaller WAN circuit into the Internet. So not only does content caching
improve performance, but it can also reduce network costs if the organization produces a large volume of
network requests.
Content Delivery
Content delivery, pioneered by Akamai, is a special type of Internet service that works in the opposite
direction. Rather than storing other people’s Web files closer to their own internal users, a content
delivery provider stores Web files for its clients closer to their potential users. Akamai, for example,
operates almost 10,000 Web servers located near the busiest Internet IXPs and other key places around
the Internet. These servers contain the most commonly requested Web information for some of the
busiest sites on the Internet (e.g., yahoo.com, monster.com, ticketmaster.com).
When someone accesses a Web page of one of Akamai’s customers, special software on the client’s Web
server determines if there is an Akamai server containing any static parts of the requested information
(e.g., graphics, advertisements, banners) closer to the user. If so, the customer’s Web server redirects
portions of the request to the Akamai server nearest the user.


portions of the request to the Akamai server nearest the user.
The user interacts with the customer’s website for dynamic content or HTML pages with the Akamai


server providing static content. In Figure 12-6, for example, when a user in Singapore requests a Web
page from yahoo.com, the main yahoo.com server farm responds with the dynamic HTML page. This page
contains several static graphic files. Rather than provide an address on the yahoo.com site, the Web page
is dynamically changed by the Akamai software on the yahoo.com site to pull the static content from the
Akamai server in Singapore. If you watch the bottom action bar closely on your Web browser while some
of your favorite sites are loading, you’ll see references to Akamai’s servers. On any given day, 15–20% of
all Web traffic worldwide comes from an Akamai server.
FIGURE 12-6 Network with content delivery
Akamai servers benefit both the users and the organizations that are Akamai’s clients, as well as many
ISPs and all Internet users not directly involved with the Web request. Because more
MANAGEMENT FOCUS 12-3
Content Delivery at Best Buy
Best Buy operates more than 1,150 retail electronic stores across the United States and Canada and
has an extensive online Web store offering more than 600,000 products. Its Web store hosts more
than 4,000 million visits a year, more than all of its 1,150 physical stores combined.
Best Buy wanted to improve its Web store to better customer experience and reduce operating costs.
Akamai’s extensive content delivery presence in North America enabled Best Buy to improve the
speed of its Web transactions by 80%, resulting in substantial increases in sales. The shift to content
delivery has also reduced the traffic to its own servers by more than 50%, reducing its operating


costs. How does Akamai do this? Check out this video for a brief explanation:
https://www.youtube.com/watch?
v=w6AcfTE5rVQ&list=PLYDvXrgDLAbUqIQXZtgFkBDRoiLGbs87X&index=8.
Source: Adapted from Akamai Helps Best Buy, Akamai case studies, akamai.com.
Web content is now processed by the Akamai server and not the client organization’s more distant Web
server, the user benefits from a much faster response time; in Figure 12-6, for example, more requests
never have to leave Singapore. The client organization benefits because it serves its users with less traffic
reaching its Web server; Yahoo!, for example, need not spend as much on its server farm or the Internet
connection into its server farm. In our example, the ISPs providing the circuits across the Pacific benefit
because now less traffic flows through their network—traffic that is not paid for because of Internet
peering agreements. Likewise, all other Internet users in Singapore (as well as users in the United States
accessing websites in Singapore) benefit because there is now less traffic across the Pacific, and response
times are faster.
12.3 CONFIGURATION MANAGEMENT
We now turn our attention to the four basic management tasks that comprise network management. The
first is configuration management. Configuration management means managing the network’s
hardware and software configuration, documenting it, and ensuring it is updated as the configuration
changes.
12.3.1 Configuring the Network and Client Computers
One of the most common configuration activities is adding and deleting user accounts. When new users
are added to the network, they are usually categorized as being a member of some group of users (e.g.,
faculty, students, accounting department, personnel department). Each user group has its own access


faculty, students, accounting department, personnel department). Each user group has its own access
privileges, which define what file servers, directories, and files they can access and provide a standard log-
in script. The log-in script specifies what commands are to be run when the user first logs in (e.g., setting
default directories, connecting to public disks, running menu programs).
Another common activity is updating the software on the client computers attached to the network. Every
time a new application system is developed or updated (or, for that matter, when a new version is
released), each client computer in the organization must be updated. Traditionally, this has meant that
someone from the networking staff has had to go to each client computer and manually install the
software, either from CDs or by downloading over the network. For a small organization, this is time
consuming but not a major problem. For a large organization with hundreds or thousands of client
computers (possibly with a mixture of Windows and Apples), this can be a nightmare.
Desktop management, sometimes called electronic software delivery or automated software delivery,
is one solution to the configuration problem. Desktop management enables network managers to install
software on client computers over the network without physically touching each client computer. Most
desktop management packages provide application-layer software for the network server and all client
computers. The server software communicates directly with the desktop management software on the
clients and can be instructed to download and install certain application packages on each client at some
predefined time (e.g., at midnight on a Saturday). Microsoft and many antivirus software vendors use this
approach to deliver updates and patches to their software.
Desktop management greatly reduces the cost of configuration management over the long term because it
eliminates the need to update each and every client computer manually. It also automatically produces
and maintains accurate documentation of all software installed on each client computer and enables


and maintains accurate documentation of all software installed on each client computer and enables
network managers to produce a variety of useful reports. However, desktop management increases cost in
the short term because it costs money (typically $25 per client computer) and requires network staff to
install it manually on each client computer. Desktop Management Interface (DMI) is the emerging
standard for desktop management.
12.3.2 Documenting the Configuration


Configuration documentation includes information about network hardware, network software, user and
application profiles, and network documentation. The most basic information about network
hardware is a set of network configuration diagrams that document the number, type, and placement of
network circuits (whether organization owned or leased from a common carrier), network servers,
network devices (e.g., hubs, routers), and client computers. For most organizations, this is a large set of
diagrams: one for each LAN, BN, and WAN. Figure 12-7 shows a diagram of network devices in one office
location.
These diagrams must be supplemented by documentation on each individual network component (e.g.,
circuit, hub, server). Documentation should include the type of device, serial number, vendor, date of
purchase, warranty information, repair history, telephone number for repairs, and any additional
information or comments the network manager wishes to add. For example, it would be useful to include
contact names and telephone numbers for the individual network managers responsible for each separate
LAN within the network and common carrier telephone contact information. (Whenever possible,
establish a national account with the common carrier rather than dealing with individual common
carriers in separate states and areas.)
A similar approach can be used for network software. This includes the network operating system and any
special-purpose network software. For example, it is important to record which network operating system
with which version or release date is installed on each network server. The same is true for application
software. Sharing software on networks can greatly reduce costs, although it is important to ensure that
the organization is not violating any software license rules.
FIGURE 12-7 Network configuration diagram


Software documentation can also help in negotiating site licenses for software. Many users buy software
on a copy-by-copy basis, paying the retail price for each copy. It may be cheaper to negotiate the payment
of one large fee for an unlimited-use license for widely used software packages instead of paying on a per-
copy basis.
The third type of documentation is the user and application profiles, which should be automatically
provided by the network operating system or additional vendor or third-party software agreements. These
should enable the network manager to easily identify the files and directories to which each user has
access and each user’s access rights (e.g., read-only, edit, delete). Equally important is the ability to access
this information in the “opposite” direction, that is, to be able to select a file or directory and obtain a list
of all authorized users and their access rights.
In addition, other documentation must be routinely developed and updated pertaining to the network.
This includes network hardware and software manuals, application software manuals, standards manuals,
operations manuals for network staff, vendor contracts and agreements, and licenses for software. The
documentation should include details about performance and fault management (e.g., preventive
maintenance guidelines and schedules, disaster recovery plan, and diagnostic techniques), end user
support (e.g., applications software manuals, vendor support telephone numbers), and cost management
(e.g., annual budgets, repair costs for each device). The documentation should also include any legal
requirements to comply with local or federal laws, control, or regulatory bodies.
Maintaining documentation is usually a major issue for most organizations. Have you written programs?
How well did you document them? Many technicians hate documentation because it is not “fun” and
doesn’t provide immediate value the same way that solving problems does. Therefore, it is often
overlooked, so when someone leaves the organization, the knowledge of the network leaves with him or
her.


her.
12.4 PERFORMANCE AND FAULT MANAGEMENT
Performance management means ensuring the network is operating as efficiently as possible,
whereas fault management means preventing, detecting, and correcting faults in the network circuits,
hardware, and software (e.g., a broken device or improperly installed software). Fault management and
performance management are closely related because any faults in the network reduce performance. Both
require network monitoring, which means keeping track of the operation of network circuits and
devices to ensure they are functioning properly and to determine how heavily they are used.
12.4.1 Network Monitoring
Most large organizations and many smaller ones use network management software to monitor and
control their networks. One function provided by these systems is to collect operational statistics from the
network devices. For small networks, network monitoring is often done by one person, aided by a few
simple tools.
In large networks, network monitoring becomes more important. Large networks that support
organizations operating 24 hours a day are often mission critical, which means a network problem can
have serious business consequences. For example, consider the impact of a network failure for a common
carrier such as AT&T or for the air traffic control system. These networks often have a dedicated network
operations center (NOC) that is responsible for monitoring and fixing problems. Such centers are
staffed by a set of skilled network technicians that use sophisticated network management software. When
a problem occurs, the software immediately detects the problems and sends an alarm to the NOC. Staff
members in the NOC diagnose the problem and can sometimes fix it from the NOC (e.g., restarting a
failed device). Other times, when a device or circuit fails, they must change routing tables to route traffic
away from the device and dispatch a technician to fix it.
A Day in the Life: Network Policy Manager


A Day in the Life: Network Policy Manager
All large organizations have formal policies for the use of their networks (e.g., wireless LAN access,


password, server space). Most large organizations have a special policy group devoted to the creation
of network policies, many of which are devoted to network security. The job of the policy officer is to
steer the policy through the policy-making process and ensure that all policies are in the best
interests of the organization as a whole. Although policies are focused inside the organization,
policies are influenced by events both inside and outside the organization. The policy manager
spends a significant amount of time working with outside organizations such as the U.S. Department
of Homeland Security, CIO and security officer groups, and industry security consortiums. The goal
is to make sure all policies (especially security policies) are up to date and provide a good balance
between costs and benefits.
A typical policy begins with networking staff writing a summary containing the key points of the
proposed policy. The policy manager takes the summary and uses it to develop a policy that fits the
structure required for organizational policies (e.g., date, rationale, scope, responsible individuals,
and procedures). This policy manager works with the originating staff to produce an initial draft of
the proposed policy. Once everyone in the originating department and the policy office are satisfied
with the policy, it is provided to an advisory committee of network users and network managers for
discussion. Their suggestions are then incorporated into the policy, or an explanation is provided as
to why the suggestions will not be incorporated in the policy.
After several iterations, a policy becomes a draft policy and is posted for comment from all users
within the organization. Comments are solicited from interested individuals, and the policy may be
revised. Once the draft is finalized, the policy is then presented to senior management for approval.
Once approved, the policy is formally published, and the organization charged with implementing
the policy begins to use it to guide its operations.
Source: With thanks to Mark Bruhn.


Source: With thanks to Mark Bruhn.
MANAGEMENT FOCUS 12-4
Network Management Salaries
Network management is not easy, but it doesn’t pay too badly. Here are some typical jobs and their
respective annual salaries:
Network Vice President $150,000
Network Manager
90,000
Telecom Manager
77,000
LAN Administrator
70,000
WAN Administrator
75,000
Network Designer
80,000
Network Technician
60,000
Technical Support Staff
50,000
Trainer
50,000
Figure 12-8 shows part of the NOC at Indiana University (this is only about one-third of it). The NOC is
staffed 24 hours a day, 7 days a week to monitor the university’s networks. The NOC also has
responsibility for managing portions of several very-high-speed networks, including Internet2 (see
Management Focus Box 12-5).
Some types of management software operate passively, collecting the information, and reporting it back to
the central NOC. Others are active, in that they routinely send test messages to the servers or application
being monitored (e.g., an HTTP Web page request) and record the response times. The network
management software discussed in Section 12.2.2 is commonly used for network monitoring.


Performance tracking is important because it enables the network manager to be proactive and respond to
performance problems before users begin to complain. Poor network reporting leads to an organization
that is overburdened with current problems and lacks time to address future needs. Management requires
adequate reports if it is to address future needs.
FIGURE 12-8 Part of the Network Operations Center at Indiana University
12.4.2 Failure Control Function
Failure control requires developing a central control philosophy for problem reporting, whether the
problems are first identified by the NOC or by users calling into the NOC or a help desk. Whether problem
reporting is done by the NOC or the help desk, the organization should maintain a central telephone
number for network users to call when any problem occurs in the network. As a central troubleshooting
function, only this group or its designee should have the authority to call hardware or software vendors or
common carriers.
Many years ago, before the importance (and cost) of network management was widely recognized, most
networks ignored the importance of fault management. Network devices were “dumb” in that they did
only what they were designed to do (e.g., routing packets) but did not provide any network management
information.
For example, suppose a network interface card fails and begins to transmit garbage messages randomly.
Network performance immediately begins to deteriorate because these random messages destroy the
messages transmitted by other computers, which need to be retransmitted. Users notice a delay in
response time and complain to the network support group, which begins to search for the cause. Even if
the network support group suspects a failing network card (which is unlikely, unless such an event has
occurred before), locating the faulty card is very difficult and time consuming.
Most network managers today are installing managed devices that perform their functions (e.g., routing,


Most network managers today are installing managed devices that perform their functions (e.g., routing,
switching) and also record data on the messages they process (see Section 12.2.1). Finding and fixing the
fault is much simpler, requiring minutes, not hours.
MANAGEMENT FOCUS 12-5


Internet2 Weather Map
Internet2 is a high-performance backbone that connects about 400 Internet2 institutions in more
than 100 countries. The current network is primarily a 10 Gbps fiber-optic network.
The network is monitored 24 hours a day, 7 days a week from the network operations center (NOC)
located on the campus of Indiana University. The NOC oversees problem, configuration, and change
management; network security; performance and policy monitoring; reporting; quality assurance;
scheduling; and documentation. The center provides a structured environment that effectively
coordinates operational activities with all participants and vendors related to the function of the
network.
The NOC uses multiple network management software running across several platforms. One of the
tools used by the NOC that is available to the general public is the Internet2 Weather Map
(noc.net.internet2.edu). Each of the major circuits connecting the major Internet2 gigapops is shown
on the map. Each link has two parts, showing the utilization of the circuits to and from each pair.
Source: Adapted from Internet2 Network NOC (noc.net.internet2.edu).
Numerous software packages are available for recording fault information (Remedy is one of the most
popular ones). The reports they produce are known as trouble tickets. The software packages assist the
help desk personnel so they can type the trouble report immediately into a computerized failure analysis
program. They also automatically produce various statistical reports to track how many failures have
occurred for each piece of hardware, circuit, or software package. Automated trouble tickets are better
than paper because they allow management personnel to gather problem and vendor statistics. There are
four main reasons for trouble tickets: problem tracking, problem statistics, problem-solving methodology,
and management reports.
Problem tracking allows the network manager to determine who is responsible for correcting any


and management reports.
Problem tracking allows the network manager to determine who is responsible for correcting any
outstanding problems. This is important because some problems often are forgotten in the rush of a very
hectic day. In addition, anyone might request information on the status of a problem. The network
manager can determine whether the problem-solving mechanism is meeting predetermined schedules.
Finally, the manager can be assured that all problems are being addressed. Problem tracking also can
assist in problem resolution. Are problems being resolved in a timely manner? Are overdue problems
being flagged? Are all resources and information available for problem solving?
Problem statistics are important because they are a control device for the network managers as well as
for vendors. With this information, a manager can see how well the network is meeting the needs of end
users. These statistics also can be used to determine whether vendors are meeting their contractual
maintenance commitments. Finally, they help to determine whether problem-solving objectives are being
met.
Problem prioritizing helps ensure that critical problems get priority over less important ones. For
example, a network support staff member should not work on a problem on one client computer if an
entire circuit with dozens of computers is waiting for help. Moreover, a manager must know whether
problem-resolution objectives are being met. For example, how long is it taking to resolve critical
problems?
Management reports are required to determine network availability, product and vendor reliability
(mean time between failures), and vendor responsiveness. Without them, a manager has nothing more
than a “best guess” estimate for the effectiveness of either the network’s technicians or the vendor’s
technicians. Regardless of whether this information is typed immediately into an automated trouble ticket
package or recorded manually in a bound notebook-style trouble log, the objectives are the same.
The purposes of the trouble log are to record problems that must be corrected and to keep track of


The purposes of the trouble log are to record problems that must be corrected and to keep track of
statistics associated with these problems. For example, the log might reveal that there were 37 calls for
software problems (3 for one package, 4 for another package, and 30 for a third software package), 26
calls for cable modem problems evenly distributed among 2 vendors, 49 calls for client computers, and 2
calls to the common carrier that provides the network circuits. These data are valuable when the design
and analysis group begins redesigning the network to meet future requirements.


TECHNICAL FOCUS 12-1
Technical Reports
Technical reports that are helpful to network managers are those that provide summary information,
as well as details that enable the managers to improve the network. Technical details include the
following:
Circuit use
Usage rate of critical hardware such as host computers, front-end processors, and servers
File activity rates for database systems
Usage by various categories of client computers
Response time analysis per circuit or per computer
Voice versus data usage per circuit
Queue-length descriptions, whether in the host computer, in the front-end processor, or at
remote sites
Distribution of traffic by time of day, location, and type of application software
Failure rates for circuits, hardware, and software
Details of any network faults
12.4.3 Performance and Failure Statistics
Many different types of failure and recovery statistics can be collected. The most obvious performance
statistics are those discussed earlier: how many packets are being moved on what circuits and what the
response time is. Failure statistics also tell an important story.
One important failure statistic is availability, the percentage of time the network is available to users. It
is calculated as the number of hours per month the network is available divided by the total number of
hours per month (i.e., 24 hours per day × 30 days per month = 720 hours). The downtime includes
times when the network is unavailable because of faults and routine maintenance and network upgrades.
Most network managers strive for 99–99.5% availability, with downtime scheduled after normal working
hours.
The mean time between failures (MTBF) is the number of hours or days of continuous operation
before a component fails. Obviously, devices with higher MTBF are more reliable.
When faults occur, and devices or circuits go down, the mean time to repair (MTTR) is the average


number of minutes or hours until the failed device or circuit is operational again. The MTTR is composed
of these separate elements:
The mean time to diagnose (MTTD) is the average number of minutes until the root cause of the
failure is correctly diagnosed. This is an indicator of the efficiency of problem management personnel in
the NOC or help desk who receive the problem report.
The mean time to respond (MTTR) is the average number of minutes or hours until service personnel
arrive at the problem location to begin work on the problem. This is a valuable statistic because it
indicates how quickly vendors and internal groups respond to emergencies. Compilation of these figures
over time can lead to a change of vendors or internal management policies or, at the minimum, can exert
pressure on vendors who do not respond to problems promptly.
TECHNICAL FOCUS 12-2