Network Security Management Tools

Objectives
Upon completion of this chapter, you will be able to:
Describe security vulnerability testing, detection, and auditing tools useful in the Cisco network security environment

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-2

Integrity Testing Tools

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-3

Managing the Secure XYZ Network

Web Surfer Dialup Client PSTN/ ISDN Remote Branch

Internet

Network Access Server

Dialup

Perimeter Router

Firewall Sales Engineering

Bastion Host: Web Server FTP Server

Campus
CiscoSecure ACS Server TACACS+, RADIUS Token Server

Campus Client

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-4

Scanners
ISS SafeSuite (UNIX and NT)
Top commercial scanner Suite of several scanners with GUI

SATAN (UNIX)
Security Administrators Tool for Analyzing Networks

Scans remote hosts for most known security holes

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-5

Scanners (cont.)
NSS (UNIX)

Strobe (UNIX)
Jackal (UNIX)

IdentTCPScan (UNIX)
CONNECT (UNIX)

FSPScan (Windows, OS/2)

XSCAN (UNIX)
Copyright 1998, Cisco Systems, Inc.
MCNSNetwork Security Management Tools17-6

Sniffers
Network General Sniffer Network General XRay Gobbler (DOS/Windows) ETHLOAD Netman suite (Etherman)

Esniff.c
Network Monitor (Microsoft)
Copyright 1998, Cisco Systems, Inc.
MCNSNetwork Security Management Tools17-7

Password Crackers/Checkers
Passwd+ Crack (UNIX)
CrackerJack (UNIX) PaceCrack95 (Windows 95) Qcrack (DOS/Windows) Pcrack (UNIX Perl script) Hades (UNIX) Star Cracker (DOS)

John the Ripper (UNIX)

Killer Cracker (UNIX, others)

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-8

Network Utilities (UNIX)

host traceroute

rusers
finger/sfingerd showmount WHOIS smrsh ssh
Copyright 1998, Cisco Systems, Inc.
MCNSNetwork Security Management Tools17-9

Logging Tools
TCP_Wrapper
swatch trimlog logdaemon (UNIX)

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-10

Tool Suites

Merlin by CIAC (UNIX) Tiger (TAMU)

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-11

File/System Integrity Checkers

Used to guard against Trojan horses: MD5 COPS (UNIX) Tripwire ATP (Anti-Tampering Program)

Hobgoblin
Copyright 1998, Cisco Systems, Inc.
MCNSNetwork Security Management Tools17-12

System Monitors
Windows/NT
Cinco NeTXray for Win 95 and NT UltraScan v1.2 Port Scanner for NT Kane Security Analyst for NT

Microsoft EP Dump for NT

MicrosoftC2CERT

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-13

Windows 95 Tools

NetScan Tools Network Toolbox

TCP/IP Surveyor

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-14

Macintosh Tools

MacTCP Watcher

Query It!
WhatRoute

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-15

Cisco IOS Software Commands

traceroute show ip route

debug ip packet
rmon show ip ?

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-16

Chapter References
The following sites contain security tools:
ftp://ciac.llnl.gov/pub/ciac/sectools/unix/ ftp://coast.cs.purdue.edu/pub/tools/ ftp://ftp.cert.org/pub/tools/ ftp://ftp.win.tue.nl/pub/security/

ftp://ftp.funet.fi/pub/unix/security/
http://www.rootshell.com/ http://filepile.com/

http://www.iss.net/
Copyright 1998, Cisco Systems, Inc.
MCNSNetwork Security Management Tools17-17

Summary
Scanners automatically detect security weaknesses

ISS and SATAN are two of the most popular scanners

Sniffers capture packet traffic for later analysis Password crackers and checkers can be used to detect weak passwords, improving password security UNIX is the most powerful operating system for network security, because it has many network utilities Network logging tools are useful for detecting intrusions

Network security tools are also available for Windows NT and 95, DOS, Macintosh, and OS/2
Cisco IOS software has commands useful for security

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-18

Review Questions
Q1. Which network security tool for the Windows NT platform would be useful for automatically detecting security weaknesses as part of managing network security?
A) ISS Safesuite

Q2. What is the Cisco IOS software command that can substitute for a packet sniffer?
A) debug ip packet

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-19

Review Questions (Contd)

Q3. How can password crackers and checkers be used in managing network security?
A) Password crackers and checkers can be used to detect weak passwords, improving password security

Q4. Which operating system has the largest selection of network security utilities?
A) UNIX is the most powerful operating system for network security, because it has many network utilities

Copyright 1998, Cisco Systems, Inc.

MCNSNetwork Security Management Tools17-20