Reduce vulnerability by limiting network reach
Tuesday, January 17, 2006 01:46 PM
In the past, black hats have used large blocks of networks to take advantage of zero-day exploits to steal financial data. Attackers manipulated an exploit to transmit an individual's financial information to a country with a poor record of tracking and prosecuting Internet criminals.
Of course, these networks are often beyond the law enforcement boundaries of most civilized nations. So how do you prevent hackers from performing such an attack on your organization's network?
You can regain control of your network by answering a few questions about the purpose of your organization's network:
- Do we have a global business?
- Is our business local or regional?
- Do our internal users need access to every network on the planet?
Answering these questions can greatly limit your company's exposure to attacks beyond the reach of law enforcement in your country. If your business is local or regional, you only need to worry about who else is in your area of the world.
Do your research
The Internet is a big place, and one organization runs it: the Internet Assigned Numbers
Authority (IANA). It divides all public IP addresses among the Regional
Internet Registries (RIRs) to distribute blocks of IP addresses.
There are four RIRs:
- Asia Pacific Network Information Centre (APNIC) for Asia and the Pacific region
- American Registry for Internet Numbers (ARIN) for North America, parts of the Caribbean, and sub-equatorial Africa
- Latin American and Caribbean Internet Addresses Registry (LACNIC) for Latin America and parts of the Caribbean
- RIPE Network Coordination Centre (RIPE NCC) for Europe, the Middle East, Central Asia, and African countries above the equator
By performing a little bit of detective work at each site, you can determine which IP addresses originate from each country or region.
By combining this information with your answers to the questions about the purpose of your organization's network, you can begin to diminish your vulnerability to hostile networks and concentrate on serving your organization's target communities.
Limit network exposure
Let's look at an example. If a business network serves only the European
community, then you could block every IP address at the network boundary that
doesn't originate from this area. For example, you would block everything
except the following networks.
62.0.0.0 - 62.255.255.255 80.0.0.0 - 80.255.255.255 81.0.0.0 - 81.255.255.255 82.0.0.0 - 82.255.255.255 83.0.0.0 - 83.255.255.255 84.0.0.0 - 84.255.255.255 85.0.0.0 - 85.255.255.255 86.0.0.0 - 86.255.255.255 87.0.0.0 - 87.255.255.255 88.0.0.0 - 88.255.255.255 193.0.0.0 - 193.255.255.255 194.0.0.0 - 194.255.255.255 195.0.0.0 - 195.255.255.255 196.200.0.0 - 196.207.255.255 212.0.0.0 - 212.255.255.255 213.0.0.0 - 213.255.255.255 217.0.0.0 - 217.255.255.255
Apply this block or access list to both inbound and outbound traffic. In addition, integrate this strategy into any existing blocks or filters for services you already have in place.
This simple strategy defines the business area of your network, and it reduces your organization's exposure to hostile attacks.
There are currently no comments for this post.