We mentioned that it's necessary to confirm the identity of the remote user.
There's a special type of server providing such services.
It's called the radius server in the RAFC documents.
The standard is labeled with the numbers 2 1 3 8 and 2 1 3 9 in the Microsoft environment.
It's been implemented as the IAEA has or the server NPR's network policy server has been available from
Windows Server 2008 onward.
And I guess Internet authentication service can be found even in earlier versions of Windows.
The radius server is a central place that allows you to authenticate remote users and control their
access remote users are defined as those who connect from outside the local network using for example
VPN.
The radius server controls remote access servers or A-S.
Let's see how it all works.
First a user is trying to connect to a corporate network that is to say a remote access server the Ross
server then the server which is configured as a central radious server client will send the request
for it on behalf of the user.
The radius server should be physically as close to the domain controller as possible.
In the next step the radius will s the domain controller if the user provided correct credentials if
the log in and password or the certificate are correct.
If their credentials match and the user has the right to log on to the remote server the radius server
will inform the remote access server.
Then it will last through remote access server to create a virtual interface for the user.
Eventually a connection is established.
There exist several ways to check credentials.
First of them is the chat protocol.
It is specified in the RAFC documents 1994.
This is one of the protocols which you should never use for CHEP to work you need irreversibly encrypted
password this protocol doesn't encrypt the channel.
Therefore the data is sent in clear text.
The protocol has been modified by Microsoft and is called hemis chap this version allows you to encrypt
the data to do this.
It uses MPP Microsoft point to point encryption.
However it does not protect against replay attacks or sesshin capture.
We don't use them as cheap either because it doesn't provide mutual authentication.
Mutual authentication is available only in M-S chap version to this protocol allows you to store reversibility
encrypted passwords and this chap Version 2 is the least secure protocol among those that we should
use in practice.
In every possible case and there are many.
You should use the extensible authentication protocol EAP in one of the available modes for example
the TLM mode at present this is the only protocol that guarantees the security of the authentication
data and the data is sent through the channel established in this way.
It also allows you to confirm the identity of a user or a host not only with a password but with a public
key certificate a smart card.
There are two more protocols that can be found on the lists of older network devices Rosse servers and
Windows systems.
You should not however ever use them.
These are the IP protocol which sends the password in clear text and the later version of PSP which
uses reversible password encryption the latter can be broken by modern computers in real time.
And when it comes to the former there's nothing to be cracked.
The last topic we'll discuss in this module is network access control and corporate networks.
There are more and more computers that are beyond direct control.
These are not the demilitarized zone computers.
These are users laptops and mobile devices.
Therefore you have to take a different approach to subnetwork.
They're not croupe computers in the sun.
That's according to their IP addresses or their function should be grouped according to their security
level.
This is how the network access protection or any IP works and AP is a mechanism supposed to automatically
verify the conformity of your computer with certain standards.
For example if the internet connection firewall is enabled whether the virus scanner is installed and
whether it is active or if the operating system is updated or if there exists a fixed list of tests
that the computer must pass before it's connected to the network.
Until the computer meets these requirements it will be isolated.
It will be automatically connected to a specific separate subnet.
How can you create such a subnet.
The first ways to use IP SEC unless the client meets the security requirements it will not be given
a certificate which can be used to communicate with IP SEC without this certificate.
The computer has access only to selected subnets such a separate subnet should consist of a remediation
server and a server allowing to download and install missing updates another way to implement network
access control is to use code to dot one X protocol which we have discussed earlier you can enable or
disable a switch port depending on whether the computer passed all the tests or not.
You can also assign the computer to an appropriate VLAN network access control can also be implemented
with the use of the DHC server a DHC server with two address pools grants addresses from the pool age
to computers that meet the policies requirements whereas to computers who don't get grants addresses
from will be clients to connect remotely to our network can also be verified by the radius server.
The mechanism described implemented in the way that's usually done then Windows has one more important
vantage rather than being carried out on a one off basis during the connection.
Computer security tests are carried out regularly over a period of time specified by the MP s policy.
If someone turns off the firewall while connected to their corporate network there will be immediately
disconnected from them that work or the firewall will automatically be enabled by the server.
The technical implementation should proceed as follows.
First we need agents that will gather information about the computer's configuration.
Also there must exist a mechanism that will implement the method we've just discussed will demonstrate
how it will work on the safest mode possible.
That is the IP stack mode.
First connect the computer to the corporate network.
In Windows systems there's a security agent that assesses the security level of the computer this service
is installed along with the operating system the service communicates with the quarantine server the
networks access control server in order to check the rules currently enforce the agent evaluates the
computer in terms of compliance with these rules in force and reports on the result of the evaluation
to the server.
If the result is positive the computer will be given a certificate a certification authority issued
a certificate that will be downloaded automatically certificates used in the network access control
or short lived certificates their default validity period is 10 hours.
This means that the entire infrastructure associated with the certificate evocation and status checking
is not needed.
This is a very simple mechanism.
If a computer fails the test it will be redirected to a remediation server and as a consequence its
security level will increase.
It could involve for example installing missing patches likely it will happen automatically and go unnoticed
by the user.
After the patches had been installed the agent should assess the computer security status as consistent
with the security policy.
This means that it will be granted a certificate thanks to this you will be able to use IP and get full
access to the corporate network.
The whole mechanism is not strictly speaking a solution for security but it fits very well with current
trends in computer systems security it eliminates the risk coming from neglectful users who for communication
with the network use computers which have been connected to open public networks and which have run
the programs from trusted sources.
The second part of this module has been devoted to the additional protocols and services that help secure
the computer infrastructure.
Thank you.