Bedienungsanleitung D-LINK DFL-1600 BROCHURE 1

[. . . ] However, traditional security devices cannot effectively block massive network connections from the infected victim computers. This white paper will begin by briefly outlining the functionality of the traditional network security technology. D-Link's `New Proactive Network Security Architecture', ZoneDefense, will be subsequently discussed, to give an insight into how this new network security for enterprises can enhance and improve upon the foundations provided by traditional network security technologies. [. . . ] Consequently, this countermeasure can further avoid the spread of viruses to the same subnet or other subnets, as well as preventing a start of hacker attacks that will paralyze critical servers within enterprises. ZoneDefense is triggered when abnormal network traffic conditions meet pre-configured thresholds on the firewall. When this happens, the firewall immediately and automatically contacts the D-Link switches and issues commands to them, that result in blocking any traffic to and from the suspicious 3 D-Link Corporation D-Link Network Security Solution host. A concise test case has been set-out below to demonstrate how Zone Defense prevents a virus-infected computer from paralyzing the internal network of an enterprise. Test Case To put the following test into practice, you may need a port scan tool, such as ipscan or superscan, to simulate the virus attack. In this case, superscan will be utilized to simulate the attack behavior from the virus WORM_SASSER. A. Before setting out the test scenario, it is necessary to detail how the WORM virus behaves when attempting to infect other computers on the network. The virus, WORM_SASSER. A, is a good example. When a computer is infected by WORM_SASSER. A at stage 1, it will scan all other hosts on the same subnet via the Address Resolution Protocol (ARP). At stage 2, the infected computer will send out massive amounts of packets within the same network segment, to try and spread its virus through the Windows LSASS vulnerability. Finally at stage 3, all other hosts on different subnets will become targets, that the infected computer attempts to spread its virus to. At this stage, the infected computer starts to send out large amounts of TCP SYN (DST port: 445) packets, scan all other computers on different subnets and try to infect other hosts with the Windows LSASS vulnerability. During the first two stages, network administrators can set the Zone Defense threshold to 15 ARP/ secT 1 to trigger ZoneDefense. Once the 3Prd and most critical stage has been reached, in which the virus/ worm tries to look for victims on the network, the bulk TCP SYN packets can still overwhelm the L3 network appliances including L3 switches, routers or firewalls; thus network administrators can set the ZoneDefense threshold to 15 TCP (port 445) SYN /sec to trigger ZoneDefense. PF FPT P 1 TP PT The proactive defense toward ARP layer will be expected soon in the next firmware version. 4 D-Link Corporation D-Link Network Security Solution The above explanation on how infected computers might typically spread the virus WORM_SASSER. A, will assist in clarifying the below test scenario. The test scenario is based on a network topology comprising of a D-Link DFL-800 firewall and D-Link managed switchesT 2 30, 31, 40 and 41 which make up the different network segments A, B, C which in turn are connected to the DFL-800. The two user computers 10 and 11 are then connected to the network switch 31 and 41 respectively. PF FPT Figure 1: Network Topology in the Test Scenario 1. User computer 10 (IP: 192. 168. 1. 2) is infected by the virus, WORM_SASSER. A, and starts sending out a large quantity of TCP SYN (DST port: 445) packets to scan all computers on the same and different 2 TP PT For further information about D-Link managed switches, please refer to the appendix. 5 D-Link Corporation D-Link Network Security Solution subnets, spreading the virus in the network through the Windows LSASS vulnerability. Windows LSASS vulnerability is a buffer overrun that allows remote code execution and enables an attacker to gain full control of the affected system. [. . . ] If the packet flow of a host computer triggers the conditions for ZoneDefense, a ZoneDefense command will immediately and automatically be sent to the specified network switch to efficiently block the network connection of the host computer. Thus, for businesses, ZoneDefense greatly reduces the damage and loss caused by viruses and hackers, as well as effectively enhances network performance. Network administrators benefit as it becomes easier and less timely to locate the infected computers. [. . . ]