security

The Open Systems Interconnection (OSI) Reference Model provides a layered network design framework that establishes a standard so that devices from different vendors work together.

Layer 2 (The Data-Link Layer)
Layer 2 switches operate using physical network addresses. Physical addresses, also known as link-layer, hardware, or MAC-layer addresses, identify individual devices. Most hardware devices are permanently assigned this number during the manufacturing process.

Switches operating at Layer 2 are very fast because they’re just sorting physical addresses, but they usually aren’t very smart.

Layer 3 (The Network Layer)
Layer 3 switches use network or IP addresses that identify locations on the network. Physical addresses identify devices; network addresses identify locations. A location can be a LAN workstation, a location in a computer’s memory, or even a packet of data traveling through a network.

Network addresses are hierarchical. The more details included, the more specific the address becomes and the easier it is to find.

Switches operating at Layer 3 are smarter than Layer 2 devices and incorporate routing functions to actively calculate the best way to send a packet to its destination. However, because Layer 3 Switches take the extra time to read more details of a network address, they are sometimes much slower than Layer 2 Switches.

Layer 4 (The Transport Layer)
Layer 4 of the OSI Model coordinates communications between systems. Layer 4 identifies which application protocols (HTTP, SNTP, FTP, etc.) are included with each packet and uses this information to hand off the packet to the appropriate higher-layer software. Layer 4 switches make packet forwarding decisions based not only on the MAC address and IP address, but also on the application a packet belongs to.

Because Layer 4 devices enable you to establish priorities for network traffic based on application, you can assign a high priority to packets belonging to vital in-house applications, such as Peoplesoft®, with different forwarding rules for low-priority packets, such as generic HTTP-based Internet traffic.

Layer 4 switches also provide an effective wire-speed security shield for your network.

TEMPEST is an acronym for Telecommunications Electronics Material Protected from Emanating Spurious Transmissions. It pertains to technical security countermeasures, standards, and instrumentation that prevent or minimize the exploitation of vulnerable data communication equipment by technical surveillance or eavesdropping.

What puts your data communication equipment at risk? Many things. But first and foremost, its microchip.

Any device with a microchip generates an electromagnetic field, often called a “compromising emanation” by security experts. With the proper surveillance equipment, these emanations can be intercepted and the signal reconstructed and analyzed. Unprotected equipment can, in fact, emit a signal into the air like a radio station—and nobody wants to risk his or her job and a whole lot more by broadcasting national security or trade secrets to the wrong people.

Some of the most vulnerable devices are speakerphones, printers, fax machines, scanners, external disc drives, and other high-speed, high-bandwidth peripherals. If the snoop is using a high-quality interception device, your equipment’s signals can be acquired up to several hundred feet away.

Arguably one of the most vulnerable pieces of equipment is an analog VGA monitor. If a spy were to introduce a Trojan into your system, he or she could monitor and store key presses and passwords used during the day. When the system’s not in use at night, the spy could pulse the VGA screen with grayscale images that have a strong signal at particular frequencies. VGA uses single-ended signaling that has a high common-mode emission level not protected by cable shielding, and it’s possible to monitor these signals outside the secure zone using a radio receiver. Even without a Trojan, a sophisticated receiver located nearby picks up and views what’s on the VGA monitor.

What TEMPEST is and isn’t.
It should come as no surprise that the Federal government became concerned about signal leakage. In fact, its interest goes back to the days of World War I when the Army was trying to exploit weaknesses of enemy combat phones and radio transmitters. Since then, the scope of the government’s interests has broadened beyond battlefield equipment. In the last 40 years, the National Security Agency (NSA) has taken several industry measurement standards and greatly beefed them up. These enhanced criteria are commonly referred to as the TEMPEST standards (although the NSA also calls them EMSEC standards, short for “emissions security”).

TEMPEST disciplines involve designing circuits to minimize emanations and the application of appropriate shielding, grounding, and bonding. Some methods used include radiation screening, alarms, and isolation.

A TEMPEST-approved device resembles its non-secure version with a few key differences. If it’s a network component such as a switch, it comes in a heavy metal case. It also has special shielding, a modified power supply, and perhaps a few other modifications from the standard model. If you need to open the device’s case, a special torque wrench for use with TEMPEST-only products is required.

TEMPEST test equipment is very expensive and is sold exclusively to government agencies. Nobody can sell you commercial TEMPEST testing equipment. And if someone offers you a “TEMPEST surveillance system,” you need to be aware of two things: First, TEMPEST is counter-surveillance science and the offer is a fraud; second, the salesperson is committing a federal felony.

If you buy surveillance equipment—authentic or not—then you have also commited a felony. Construction of, possession of, attempting a sale of, or attempting a purchase of said surveillance equipment is illegal. Even if the product purchased is a hoax, the law will take your intentions into account as much as the salesperson’s. Don’t be surprised if you both go to jail.

In the United States, you can learn about TEMPEST testing only in special schools sanctioned by, if not run by, the NSA. Courses to earn the TEMPEST Technician or TEMPEST Engineer certifications are very expensive. These classes are offered to a limited number of people who have a very high level of security clearance and who will be working on TEMPEST-approved equipment all the time.

TEMPEST ratings.
All TEMPEST-approved communication devices have a rating based on their application and/or environment.

Type 1: This rating is for classified cryptographic equipment used for national security purposes. It’s endorsed by the NSA for securing telecommunications and automated information systems and for the protection of classified or sensitive U.S. Government information.

Type 2: This rating is for unclassified cryptographic equipment used by U.S. Government agencies, state and local governments, and sponsored U.S. Government contractors. It’s endorsed by the NSA for securing telecommunications and automated information systems and for the protection of unclassified but sensitive information, such as contract bids.

Type 3: This rating is for unclassified commercial cryptographic equipment that implements an algorithm registered with the National Institute of Standards and Technology (NIST). It’s for use in protecting sensitive information, like a corporation’s network communications.

A terminal server (sometimes called a serial server or a console server or a device server) is a hardware device that enables you to connect serial devices across a network.

Terminal servers acquired their name because they were originally used for long-distance connection of dumb terminals to large mainframe systems such as VAX™. Today, the name terminal server refers to a device that connects any serial device to a network, usually Ethernet. In this day of network-ready devices, terminal servers are not as common as they used to be, but they’re still frequently used for applications such as remote connection of PLCs, sensors, or automatic teller machines.

The primary advantage of terminal servers is that they save you the cost of running separate RS-232 devices. By using a network, you can connect serial devices even over very long distances—as far as your network stretches. It’s even possible to connect serial devices across the Internet. A terminal server connects the remote serial device to the network, and then another terminal server somewhere else on the network connects to the other serial device.

Terminal servers act as virtual serial ports by providing the appropriate connectors for serial data and also by grouping serial data in both directions into Ethernet TCP/IP packets. This conversion enables you to connect serial devices across Ethernet without the need for software changes.

Because terminal servers send data across a network, security is a consideration. If your network is isolated, you can get by with an inexpensive terminal server that has few or no security functions. But if you’re using a terminal server to make network connections across a network that’s also an Internet subnet, you should look for a terminal server that offers extensive security features.

Frequency-Hopping Spread Spectrum wireless communication provides error-free transmission, top security, and high levels of throughput without the need for an FCC site license. The key to Spread Spectrum is a frequency-hopping transceiver.

Narrow-band frequency hoppers use a predefined algorithm to maintain synchronization and high throughput between master and remote modems. They achieve this by continually switching or “hopping” from one transmission frequency to another throughout the Spread Spectrum band. The sequence of frequencies is very difficult to predict and thus nearly impossible to eavesdrop on or jam. If interference is encountered at any particular frequency, the built-in error correction detects it and resends the data packet at the next frequency hop. Because EMI/RFI interference rarely affects the entire available bandwidth, and each frequency hop is at least 6 MHz, the radio transmitter has access to as many as 100 frequencies within the spectrum to avoid interference and ensure that data gets through.

OSI Layer Physical Component

7-Application

Applicaton Software

LAN-Compatible Software E-Mail, Diagnostics, Word Processing, Database

Network Applications

6-Presentation

Data- Conversion Utilities

Vendor-Specific Network Shells and Gateway™ Workstation Software

5-Session

Network Operating System

SPX

NetBIOS

DECnet™

TCP/IP

AppleTalk®

4-Transport

Novell® NetWare® IPX™

PC LAN

LAN Mgr

DECnet

PC/TCP®

VINES™

NFS

TOPS®

Apple Share®

3-Network Control

2-Data Link

Network

E

A

TR

P

TR

E

TR

E

E

E

P

E

P

1-Physical

E=Ethernet; TR=Token Ring; A=ARCNET®; P=PhoneNET®

With the rapid development of computer networks over the last decade, high-end switching has become one of the most important functions on a network for moving data efficiently and quickly from one place to another.

Here’s how a switch works: As data passes through the switch, it examines addressing information attached to each data packet. From this information, the switch determines the packet’s destination on the network. It then creates a virtual link to the destination and sends the packet there.

The efficiency and speed of a switch depends on its algorithms, its switching fabric, and its processor. Its complexity is determined by the layer at which the switch operates in the OSI (Open Systems Interconnection) Reference Model (see above).

OSI is a layered network design framework that establishes a standard so that devices from different vendors work together. Network addresses are based on this OSI Model and are hierarchical. The more details that are included, the more specific the address becomes and the easier it is to find.

The Layer at which the switch operates is determined by how much addressing detail the switch reads as data passes through.

Switches can also be considered low end or high end. A low-end switch operates in Layer 2 of the OSI Model and can also operate in a combination of Layers 2 and 3. High-end switches operate in Layer 3, Layer 4, or a combination of the two.

Layer 2 Switches (The Data-Link Layer)

Layer 2 switches operate using physical network addresses. Physical addresses, also known as link-layer, hardware, or MAC-layer addresses, identify individual devices. Most hardware devices are permanently assigned this number during the manufacturing process.

Switches operating at Layer 2 are very fast because they’re just sorting physical addresses, but they usually aren’t very smart—that is, they don’t look at the data packet very closely to learn anything more about where it’s headed.

Layer 3 Switches (The Network Layer)

Layer 3 switches use network or IP addresses that identify locations on the network. They read network addresses more closely than Layer 2 switches—they identify network locations as well as the physical device. A location can be a LAN workstation, a location in a computer’s memory, or even a different packet of data traveling through a network.

Switches operating at Layer 3 are smarter than Layer 2 devices and incorporate routing functions to actively calculate the best way to send a packet to its destination. But although they’re smarter, they may not be as fast if their algorithms, fabric, and processor don’t support high speeds.

Layer 4 Switches (The Transport Layer)

Layer 4 of the OSI Model coordinates communications between systems. Layer 4 switches are capable of identifying which application protocols (HTTP, SNTP, FTP, and so forth) are included with each packet, and they use this information to hand off the packet to the appropriate higher-layer software. Layer 4 switches make packet-forwarding decisions based not only on the MAC address and IP address, but also on the application to which a packet belongs.

Because Layer 4 devices enable you to establish priorities for network traffic based on application, you can assign a high priority to packets belonging to vital in-house applications such as Peoplesoft, with different forwarding rules for low-priority packets such as generic HTTP-based Internet traffic.

Layer 4 switches also provide an effective wire-speed security shield for your network because any company- or industry-specific protocols can be confined to only authorized switched ports or users. This security feature is often reinforced with traffic filtering and forwarding features.

Common Criteria (EAL4+) defines a common set of tests regarding the process of the design, testing, verification, and shipping of new security products. Common Criteria enables customers to assess a level of trust in how a product has been designed, tested, built, and shipped.

TEMPEST testing, while classified, is regarded as a process that assesses the threat of data linking by various covert electromagnetic eavesdropping mechanisms. The TEMPEST designation is often required by military organizations. TEMPEST, as a security standard, pertains to technical security countermeasures, standards, and instrumentation that prevent or minimize the exploitation of vulnerable data communications equipment by technical surveillance or eavesdropping.

Both testing standards are important, they just test for different things.

TEMPEST-Secure KVM Switches
For 2 or 4 ports, with USB, and DVI-I or VGA the ServSwitch Secure KVM Switch with USB (page 382) provides control and separation of up to four PCs connected to secure and unsecure networks through just one keyboard, monitor, and mouse.