0

I am currently working as a technical lead on a project at a financial institution and have a question about how to provide the same level of security expected by the business in an application we are preparing for them.

The legacy system today allows payment operators at a terminal window to interact with an AIX and mainframe system. The replacement system my team will provide will be a more modern "scale-out" distributed system to replace the mainframe. The software is mostly vendor supplied with ancillary and supporting software components being developed in house.

The operators have the ability to move large sums of money so there are a number of security constraints placed on them today. They are not allowed to VPN into the company network from outside, we can't guarantee the security of the workstation they tunneled into our network, and if they were on a public computer somebody could feasibly use low-tech methods to look over their should and jot down account numbers and such. Furthermore each of their workstations are assigned a static IP address within the internal network (Local or Router set, not sure which) so that they can only ever perform their job tasks on their secure provided workstations. I imagine there are firewall rules that whitelist their IP address to the legacy system.

It was brought up that they want a similar level of requirements for the new system which for the operators will be entirely web based (Locked down Browser -> Load Balancer -> Firewall -> Web Server Reverse Proxy -> Firewall -> Application server -> Firewall -> Database). They seem to believe that static IP addresses should give them identical security here but I am not so sure.

IP addresses can be spoofed rather easily and with the stateless nature of HTTP but then I imagine the firewall is looking at the IP protocol level to decide who it lets through. What I am unsure about is how easy it would be to spoof this, for instance if I happened to compromise the password of an operator and I was inside the intranet, is it possible for me forge my IP address to an accepted workstation IP address for that user id?

Even if this kind of IP spoofing is unlikely, are there viable alternatives that can be equally as secure (or more so) and perhaps a little more easy for managers to maintain new and leaving members of the team?

NOTE: I am not sanctioning IP based authentication, simply that IP authentication is the first pass, then the application will challenge for username and password.

  • VLANs may be a better option that still provides the right-machine requirement of a static IP. – Someone Somewhere Apr 17 '16 at 9:08
  • 1
    I assume you use TLS (HTTPS) already, right? Set up a CA and issue client certificates for your users. That's pretty much bulletproof assuming the keys are kept secure, and you can put them on smartcards to make sure they can't be silently stolen by malware. – André Borie Aug 15 '16 at 19:07
1

While you are upgrading the system, you don't want to build the same level of security, but rather, a better level of security. You want to do real authentication, not just IP restrictions.

This can be done by, for example, using hardware security module installed in the workstation. The HSM uses Public Key Authorization to authenticate the machine to the network. Using a VPN (SSL/SSH/IPSec) from the workstation to a gateway machine(s), you form a secure VLAN over the semi secure internal network. The VLAN contains only the systems that are permitted to be accessed from the workstation. Using VLAN, you can control which workstations can connect to which gateway for the secure systems. On top of this, the user can authenticate themselves to the systems they need to access, using traditional username/password and/or hardware token.

IP authentication is for the most part redundant here. The only advantage IP Authentication has over VPN is that IP Authentication is much cheaper to enforce in case of volumetric attack against the gateway. In networks that involves public internet, you always have a risk of volumetric attacks; but in an internal system with mostly semi trusted users, this is usually not something you need to worry about, so I generally would not bother implementing IP auth unless I believe a volumetric attack is a credible attack scenario.

0

Yes, anybody can set a static IP on any workstation assuming they have administrative control over it, same goes for mac addresses. IP filtering should only be one of many layers as it can be easily spoofed, and I wouldn't put too much weight on static IPs for security.

An attacker would spoof one of the clients IP and MACs (can happen on any modern OS), then either wait for the target machine to be shut down and/or the attacker could find a way to shut it down. Then the attacker will be able to spoof the target computer and gain access.

That being said, it sounds like your application is only going to be available to the internal network. If that is the case the attacker would have to be onsite, or otherwise have control of an onsite machine. If I misunderstood and your application is available publicly (can be reached over the internet) then static IP's would provide the same level of security as mentioned above but on a national/global level.

If they are concerned about security they should focus on strong antivirus and user training, if the user downloads a virus onto their work PC there's not much a static IP will do to protect the data. While I don't have any specific references, articles that I remember reading suggest that most data breaches are caused by malware being installed from bugs in popular applications or through phishing attempts.

Other things to consider for your project regarding security:

1) Auditing:
You should try to make it so you can easily audit who, accessed what, from where (IP), at what time. Then make sure your system can flag anomolies (ie: log ins at odd times, unusual IPs, to many failed log in attempts, etc...). If a malicious user gets access to the data, make sure you can identify it as quickly as possible.

2) Encryption
All data should be encrypted, both in transit(traveling between server/client) and at rest (when stored on hard disk). if a malicious user does get access to the data, make sure they cant read it.

3) Access
Make sure users use strong passwords that change every 60-90 days. Restrict their access so that if their account does get compromised, data loss is minimal. This helps prevent 'inside jobs'

4) User training
Users are the downfall to networks. If they enter their credentials in a phishing attempt, download a virus, attach an infected USB, etc then a large portion of the security structure will fail. Teach users what things should look like, what phishing looks like, how viruses get installed and what to do if they suspect something

Security should be layered and thought of as a Plan A, Plan B, Plan C.... with each subsequent plan minimizing the impact if the previous Plan/Layer fails.

Static IPs for client PCs are a rather small and insignificant portion of the entire model. Not to mention the IT administrative nightmare of handling dozens or hundreds of static IPs for client machines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.