Computer Network Defense

  • Home
  • Computer Network Defense

Computer Network Defense

image

A CDN or Content Delivery Network is a global network of servers that serves web content to end-users more quickly by storing copies of files such as images in locations that are geographically closer to the users requesting that content. By using a CDN, websites reduce the load on their origin servers, which can enable them to serve more users without fear of overloading their servers. CDNs improve user experience by contributing to faster website load times, and also improve the security of websites by enabling them to mitigate the impacts of distributed denial of service (DDoS) attacks, and by giving them the ability to install additional security proxies through the content delivery network.

Benefits of CDNs

Some of the benefits of using a Content Delivery Network include:

i. Decrease webpage and application load time: By caching copies of static files and delivering them from servers that are closer in distance to end-users, website load times are reduced. This improves user experience and has other benefits, such as increasing search engine optimization, as search engines take website performance into account when ranking pages.

ii. Protect against DDoS and other attacks: CDNs protect a website’s origin server from DDoS attacks and other threats by enabling sites to handle increased traffic. Additionally, other security tools such as firewalls can be installed on the CDN and sit between a malicious user and a website.

iii. Improve scalability: Content Delivery Networks allow websites and applications to scale up quickly, as CDNs can handle traffic spikes without websites needing to increase their origin server capacity significantly.

iv. Reduced bandwidth and hosting costs: As CDNs cache certain web content, they reduce the amount of bandwidth needed at the origin or host server. Bandwidth expenses vary based on the hosting provider, but can be costly and unpredictable, so utilizing a CDN can save on hosting costs.

v. Minimizes website downtime: Having high uptime is critical for businesses that rely on their website or application to generate revenue, such as Software as Service applications and eCommerce sites. CDNs protect against downtime through the security measures mentioned above, and can even sometimes deliver a cached version of the site if the origin server is down.

There are a few different types of CDN in operation today, including CDNs operated by telecommunication companies and private CDNs, which are purpose-built for one company. Netflix and Facebook are examples of companies that have built their own Content Delivery Networks due to their large global presence and the huge amount of content they deliver each day. However, most businesses and individuals today looking for a CDN will use a commercial Content Delivery Network, such as Akamai, Cloudflare, or Fastly. While each CDN provider has some unique features, all CDNs work using the same basic principles.

How CDNs cache content

At the heart of Content Delivery Networks, also sometimes referred to as edge networks, is a set of Points of Presence or PoPs, which are groups of servers in multiple locations around the world. The servers hosted in each PoP are known as edge servers, as they are unique to the origin server which hosts the full version of a website or software, and are located at the “edge” of a network closest to the end-user. CDNs vary in the number of PoPs they include, with some networks having thousands of PoPs in all continents, and others focusing their PoPs in key areas they serve.

Edge servers serve multiple purposes, including hosting cached files to improve performance and protecting the origin server by directing traffic to the CDN instead of directly to the origin. CDNs can host a variety of software tools that help with performance and security as edge servers act as reverse proxies, which intercept web traffic and handle it through a set of rules based on the software installed on your edge server. While CDNs are most known for caching content, they can also host threat detection software, image resizing tools, and much more. Below we outline two of the most common use cases for CDNs–caching content and protecting websites from attack.


This type of caching is called server-side caching, and can also be set up without the use of a Content Delivery Network through programs such as Varnish Cache which sit in front of the origin server. However, by using server-side caching in conjunction with a CDN, websites can deliver even more optimal performance. The other commonly known caching method is client-side or browser-caching, in which copies of files are stored in a user’s local browser. Browser-caching means that if a visitor repeatedly visits a webpage, certain objects on that page, such as logo files, will be stored in their browser cache and so are delivered even more quickly. Most websites use a combination of browser caching and server-side caching, usually through a CDN, to realize the fastest website speeds possible.

To ensure the cached files served from a CDN are up-to-date, websites enter information that tells the caching mechanism when the files expire. If a CDN discovers that a file has expired, it will re-fetch that file from the origin the first time it is requested. This is known as a “cache pull,” and is beneficial as this method means the CDN only requests files when they are needed. Another caching technique is known as “cache push,” when a website proactively tells the cache to update its files. This method can be used for larger files, or when a website updates most of its content and wants to ensure the cache has the updated content.


How CDNs improve website security


In addition to improving the performance of a website, Content Delivery Networks also improve the security of websites by detecting threats, blocking malicious traffic, and protecting the origin server from attacks. By utilizing a CDN rather than sending traffic directly to an origin server, the origin server is protected from Distributed Denial of Service attacks, in which attackers attempt to take down websites by sending a huge amount of traffic to a website at once. CDNs both distribute the traffic among multiple PoPs, enabling it to withstand the additional traffic, and can include tools that go a step further in protecting from DDoS and other security threats.

Other security tools which are offered with many CDNs include firewalls and advanced threat detection software which will stop harmful traffic from getting through to the origin server. Firewalls monitor traffic and block certain traffic from entering a website based on a set of rules, such as IP address, and more advanced firewalls may examine the contents of a data packet or create smart rules to identify threats. CDNs may also include tools that mitigate the impact of harmful bots, secure APIs and manage the TLS/SSL certificates of websites, ensuring that traffic is encrypted. All of these security tools can ensure websites stay online, threats are quickly dealt with, and there is no threat to brand reputation based on security leaks.

How to choose a CDN

There are many CDN solutions available, and every business or individual using a CDN may have different needs and priorities. When considering what Content Delivery Network to utilize, consider these factors:


CDN use case: Depending on the function that your website or application serves, you may be serving different types of content. If you are planning to cache mostly static content such as images, most CDNs will be able to fulfill your needs, but if you want to cache dynamic content or personalized assets you should ensure your CDN will be able to handle those use cases.

PoP Network: CDNs are intended primarily to deliver content to end-users more quickly, so the location of the Points of Presence is critical when determining what CDN to use. If a majority of your traffic comes from one region, ensure that the CDN you choose has a PoP or multiple PoPs in that location. If your traffic is globally distributed, choose a CDN with many PoPs around the globe.

Available features: Content Delivery Networks can include hundreds of different products for website security, performance, and scalability. These range from basic caching tools to image optimization, advanced firewalls, and more. When determining what CDN to utilize, examine the products they offer compared to your priorities - for example, if website security is your greatest concern, choose a CDN with a robust set of security tools.

User experience: While Content Delivery Networks are a commonly used tool, the user experience can vary based on the CDN. Some CDNs may have limited or complex user interfaces, while others have intuitive dashboards and APIs that can be easily managed using existing workflows. Certain CDNs may also offer fully managed services that take setup and management off of your plate.

Price: The cost and pricing model of a CDN is important to factor into your purchasing decision. While some CDNs offer free or low-cost tiers for websites with basic caching and security needs, enterprise-level solutions can cost thousands of dollars a month. Many CDNs charge based on both the tools you utilize and the traffic that runs through the CDN, so make sure to include all of the functions you will be using and estimate how much costs will go up if your traffic increases.

Support and documentation: As with other cloud solutions and software tools, the support offered by a CDN provider can range from user-generated forums to email support, to dedicated representatives. When determining what CDN to utilize, consider if you feel comfortable troubleshooting any issues yourself, or if you’d like more frequent access to support representatives. Look at the quality of documentation and level of support provided, along with any added cost for premium support.

Compatibility: Certain CDNs may be better suited to different content management systems or software architectures. For example, some CDNs have plugins that are built to easily work with website builders. Before you choose your CDN, examine how it will work with your current application setup and the other tools you use.










Image Feb 5, 2023

Network Security Checklist, Protect your Business

We have compiled a network security checklist for SMBs providing actions that should be taken to secure your business network against internal and external threats.A Network Security Checklist for SMBsAttacks can come from all angles and as your network grows and you add more devices, increase the number of users, and use new applications, the threat surface rapidly grows, and your network becomes more complicated to defend. The purpose of this network security checklist is to provide you with tips on the key areas of network security you should be focusing on.The best place to start is to develop a series of policies that describe the actions that are permitted and not permitted by your employees. If you do not explain how systems must be used and train users on best practices, risky behaviors are likely to continue that will undermine the hard work you put into defending your network.Develop Policies that Dictate What is and is Not AllowedYou should develop an acceptable use policy covering all systems, an internet access policy stating how the internet can be used, and the websites and content that should not be accessed. Policies are required for an email stating how email must be used and data that is not permitted to be sent via mail. You will no doubt have some workers who access your network remotely. A policy is required covering secure remote access and the use of VPNs. If you allow the use of personal devices, a BYOD policy is a must. You should clearly state the sanctions for violating policies and must ensure that policies are enforced, ideally using automated technical measures.Secure Servers and WorkstationsAll servers and workstations must be properly secured. Create a checklist for deploying new servers and workstations to ensure that each is properly secured before being used.Create a list of all servers and workstations on the network including their name, purpose, IP address, service dates and tag, location, and person responsible for each.Ensure all devices are running the latest software and are patched as soon as patches are released. Antivirus software should be used on all devices.Ensure a firewall is used to prevent unauthorized external access and make sure the default username and password are changed and a strong unique password is set. Use Deny All for internal and external access and ensure all rules added to the firewall are fully documented. Disable any permissive firewall rules. Consider also using an internal/software/application firewall for added security.Decide on a remote access solution and only use one.Purchase a UPS for your servers and ensure the agent on the UPS will safely shut down servers in the event of a power outage.Monitor server logs for unauthorized access and suspicious activityEnsure servers are routinely backed upSecure Network Equipment and DevicesYou must ensure your network is secured, along with any devices allowed to connect to the network.You should only purchase network equipment from authorized resellers and should implement physical security controls to prevent unauthorized access to network equipment.Ensure all firmware is kept up to date and firmware upgrades are only downloaded from official sources.Maintain a network hardware list detailing the device name and type, location, serial number, service tag, and party responsible for the device.For ease of management and consistency, use standard configurations for each network deviceConfigure networking equipment to use the most secure configuration possible. Ensure wireless devices are using WPA2, use SSH version 2 and disable telnet and SSH1Make sure very strong passwords are set for remote access.Disable all inactive ports to prevent external devices from accessing your internal network. Also set up a guest network to ensure visitors cannot access your internal resources.Use network segmentation to allow parts of the network to be isolated in the event of an attack and to hamper lateral movement attempts.Use a remote management solution to allow the authentication of authorized users.If you need to use SNMP, use SNMPv3. Change default community strings and set authorized management stations. If you are not using SNMP then ensure it is switched off.User Account ManagementYou should adopt the principle of least privilege and only give access rights to users that need to access resources for routine, legitimate purposes. Restrict the use of admin credentials as far as is possible. Admin accounts should only be used for admin purposes. Log out of admin accounts when administration tasks have been performed and use a different account with lower privileges for routine work.Ensure that each user has a unique account and password and make sure accounts are de-provisioned promptly when employees leave the company. Create a password policy and enforce the use of strong passwords. Consider using a password manager to help your employees remember their secure passwords.Email SecurityEmail is the most common attack vector used to gain access to business networks. Phishing is used in 90% of cyberattacks and email is a common source of malware infections. You should use an email security solution that scans inbound and outbound email to protect your network from attack and avoid reputation damage should email accounts be compromised and used to attack your business contacts.Your email security solution should provide protection against the full range of email threats, including email impersonation attacks, phishing/spear phishing, and malware and ransomware. The solution should also be configured to prevent directory harvesting attempts.Web SecurityThe internet is a common source of malware infections and phishing attacks usually have a web-based component. You should implement a web filtering solution such as a DNS filter to provide secure internet access, which should protect users on and off the network. Your filtering solution should be capable of decrypting, scanning, and re-encrypting HTTPS traffic and should scan for malware including file downloads, streaming media, and malicious scripts on web pages. Use port blocking to block unauthorized outbound traffic and attempts to bypass your internet controls.Traffic and Log MonitoringYou should be regularly reviewing access and traffic logs to identify suspicious activity that could indicate an attack in progress. Make sure logging is enabled and logs are regularly reviewed. If you only have a handful of servers you could do this manually, but ideally, you should have a security information and event management (SIEM) solution to provide real-time analysis of security alerts generated by your endpoints and network equipment.Security Awareness TrainingIf you follow this network security checklist and implement all of the above protections, your network will be well secured, but even robust network security defenses can be undone if your employees engage in risky behaviors and are not aware of security best practices. Employees should be provided with security awareness training to teach cybersecurity best practices and how to identify threats such as phishing. Security awareness training should be provided regularly, and you should keep employees up to date on the latest threats.

Read More
Image Dec 9, 2022

Top Network Security Certifications and How to Choose the Right One for You

Network security is an organization’s first line of defense against hackers and other cyber threats. Thanks to projections that cybercrime is expected to inflict $6 trillion worth of damage around the world in 2021, we can see why network security has risen in prominence. However, just like there are many different forms of cyberattacks, there are a dizzying array of cybersecurity certifications to choose from.Although having so many cybersecurity choices is arguably a good thing, the sheer number and variety also pose a challenge. It’s easy to get overwhelmed by the number of choices, sometimes to the point of not making a choice at all. What are the top network security certifications? Which one(s) are right for you and your organization? Are any of the top cyber security certifications universally applicable?In this article, we are going to shine the spotlight on various topics, including:What is network security?The need for network securityVarious types of network securityNetwork security jobs and salariesBest network security certificationsWhat is Network Security?Most experts define network security as the policies and practices of taking protective measures for protecting network infrastructure from trespassing, illegal access, modification, abuse, change, destruction, or the unauthorized gathering and release of data. The full process requires a combination of hardware devices, security software, and user awareness of security procedures and techniques.The latter element can range from employees getting briefed on proper security practices, to professionals who have taken network security training. Why is Network Security Needed?So many aspects of our lives have migrated to the digital world. We use the internet to conduct financial transactions, communicate with family and colleagues, make purchases, seek entertainment, and engage in research. So much of our personal information resides online, everything from birth dates, Social Security (or other identification numbers), health history, credit history, bank accounts, utility bills, and a host of other things.All that data and all those transactions are vulnerable to hackers and cybercriminals. The more of our lives we commit to the internet, the higher the risk of compromise. Moreover, the continuing importance of the Internet of Things (IoT) means even more reliance on wireless networks, which only increases the threat landscape, giving criminals more avenues and opportunities to perpetrate fraud. There is too much at stake in our personal and commercial lives to let network security slip. So, what types of network security are there?What Are the Types of Network Security?There is a whole arsenal of network security tools, methods, and practices available for cybersecurity professionals. Here’s a high-level overview:SoftwareSecurity software resources include anti-virus, anti-malware, and anti-spyware. These tools are available as suites or as subscriptions, updated continuously by the hosting vendor to keep up with the latest threats. These applications monitor your network, blocking intruders, malware, and viruses.As an aside, it’s extremely wise to opt for a security subscription as opposed to getting a suite and loading it in-house. Subscription providers/vendors are in a better position to deal with the constant changes to the cyber security landscape. There seems to be a new cyber threat or virus emerging every day, and your software won’t defend against threats it doesn’t yet know exist. That’s why it’s better to leave that heavy lifting to the subscription provider.Password ProtectionThis is such a simple measure but is extremely important. Strong passwords are an inexpensive yet effective way of keeping systems, applications, and networks safe, and you don’t have to be a seasoned cybersecurity professional to put strong passwords into practice. And when we say “strong” passwords, we don’t mean ridiculous ones like “password” or “99999”.FirewallsIf you picture your network as an exclusive nightclub, then the firewall would be the bouncer, working the door and keeping out undesirables. They filter traffic (incoming and outgoing), based on predetermined policies, preventing unauthorized users from coming in. Anyone who’s tried to work remotely but was locked out of their company’s main systems due to not having the right authorization, has experienced first-hand the effectiveness of a firewall.Email Security SoftwareEmail is a very vulnerable point in any network. Cybercriminals love to send bogus emails that look like correspondence from legitimate companies and financial institutions. But just one click of a link embedded in these fraudulent emails could be enough to compromise your system. To that end, email security software can not only filter out incoming threats, but it can also even prevent certain kinds of data from being transmitted.Segmented NetworksThis process sorts and divides traffic based on specific established criteria. Segmented networks are especially useful for limiting users to just one area, specifically the one they need to do their work while keeping these users out of the data that’s outside of their wheelhouse. Restricting users like this helps decrease the overall network’s weak spots.Which are the Best Network Security Certifications?Before you can make big bucks in the network security field, you need to learn the tools and skills. That’s where network security training comes in. Network security certification courses not only give you the essential knowledge for these positions, but they also give you that valuable certificate that shows prospective employers that you have the required qualifications.Let’s dig into some of the major network security certifications.1. CEH: Certified Ethical HackerAlso known as “white hat hackers,” these are IT security professionals whose job is to try and penetrate systems and find vulnerabilities. Businesses and organizations hire them to find weaknesses in the system and figure out how to fix them. When you consider how important cybersecurity has become, it’s unsurprising that this certification is such a sought-after commodity.2. CISSP: Certified Information Systems Security ProfessionalThis certification is for experienced security professionals who are responsible for the development and management of their organization’s security procedures, policies, and standards. It is perfect for IT security professionals who want to take their careers to the next level.3. CISM: Certified Information Security ManagerThis certification is a critical resource for IT professionals who have enterprise-level security management responsibilities. They manage, develop, and oversee security systems and develop organizational best practices.4. CCSP: Certified Cloud Security ProfessionalThis certification has become highly sought after thanks to many organizations increasingly migrating to the cloud. The course focuses on IS and IT professionals who apply best practices to cloud security architecture, design, operations, and service orchestration. If you work with cloud platforms, this is a must.5. CISA: Certified Information Systems AuditorThis certification target IS professionals who focus primarily on audit control, assurance, and security. It provides you with the skills required to govern and control enterprise IT and perform an effective security audit. 

Read More