Upload
krisandi-agusto
View
16
Download
1
Embed Size (px)
DESCRIPTION
test
Citation preview
ANALISIS, PERANCANGAN, DAN IMPLEMENTASI INFRASTRUKTUR KEAMANAN JARINGAN DENGAN
TEKNOLOGI IPS PADA PT. XYZ-TD
Christophorus Calvin Halim Binus University, Jakarta, DKI Jakarta, Indonesia
dan
Jan Dicky Chandra Binus University, Jakarta, DKI Jakarta, Indonesia
Abstrak
Saat ini, infrastruktur jaringan harus disertai sistem keamanan untuk mencegah kerusakan sistem yang ada di perusahaan karena adanya cracker ataupun virus yang mampu menembus jaringan perusahaan. Oleh karena itu, telah dilaksanakan analisis terhadap infrastruktur jaringan PT. XYZ-TD dan melakukan rancangan, serta implementasi infrastruktur jaringan yang baru dengan menambahkan teknologi Intrusion Prevention System (IPS) sebagai alat keamanan untuk PT. XYZ-TD. Metode yang dipakai adalah metodologi analisis, yaitu melakukan peninjauan langsung untuk mengetahui karakteristik infrastruktur jaringan PT. XYZ-TD yang sedang berjalan, dan metodologi PDIOO (Planning, Design, Implementation, Operation and Optimization) dalam melakukan perancangan dan implementasi. Hasil yang dicapai adalah terimplementasinya rancangan yang dibuat untuk infrastruktur jaringan PT. XYZ-TD. Penggunaan modul VLAN, Inter-VLAN-Routing dan ACL memudahkan administrator jaringan PT. XYZ-TD dalam melakukan perawatan dan pengelolaan jaringan. Selain itu, pemasangan IPS juga membuat jaringan PT. XYZ-TD menjadi lebih aman terhadap serangan dari luar maupun dari dalam. Dengan begitu masalah yang terdapat pada PT. XYZ-TD dapat terselesaikan.
Kata kunci : Intrusion Preventiom System, Infrastruktur Keamanan Jaringan, PT. XYZ-TD
1. Pendahuluan
Perkembangan teknologi informasi semakin hari semakin berkembang, khususnya
jaringan komputer yang pada saat ini telah menjadi satu hal yang paling mendasar pada
suatu perusahaan. Hal ini dapat dilihat dari penggunaan jaringan komputer yang telah
menjadi kebutuhan pokok bagi setiap perusahaan, baik perusahaan besar maupun
perusahaan menengah ke bawah. Teknologi jaringan komputer telah menjadi satu kunci
penting dalam era globalisasi dan teknologi informasi.
PT. XYZ-TD merupakan perusahaan yang bergerak di bidang perdagangan dan
distribusi yang berkantor di Jakarta dan salah satu anak perusahaan dari PT. XYZ. PT.
XYZ-TD sedang mengembangkan teknologi informasi untuk mendukung dan
meningkatkan proses bisnis perusahaan. Berdasarkan informasi yang diterima dari staf IT
kantor PT. XYZ-TD, terdapat beberapa masalah di dalam sistem infrastruktur
jaringannya. PT. XYZ-TD ingin mengganti keseluruhan infrastruktur jaringannya dengan
suatu rancangan infrastruktur yang jauh lebih baik. Hal ini dikarenakan pada sistem
jaringan lama hanya menggunakan satu segmen, sehingga bila ada serangan yang masuk
ke dalam jaringan perusahaan dapat menimbulkan masalah bagi seluruh pengguna yang
terhubung pada jaringan perusahaan tersebut.
Selain itu, PT. XYZ-TD baru saja membeli solusi ERP (Enterprise Resource
Planning) yang digunakan untuk meningkatkan kualitas kerja dan daya jual para staf
marketingnya. Aplikasi solusi ini harus diaktifkan selama 24 jam, sebab bila tidak dapat
diakses dalam beberapa waktu saja, maka akan mengganggu proses bisnis perusahaan
yang secara tidak langsung akan mengurangi profit perusahaan. Oleh sebab itu
diperlukanlah suatu alat yang mampu menjaga keamanan jaringan dan aplikasi ERP pada
PT. XYZ-TD dengan menggunakan Intrusion Prevention System (IPS) sebagai suatu
solusi untuk meminimalisir permasalahan pada keamanan jaringan mereka.
Dalam perkembangannya, IPS adalah suatu teknologi informasi untuk
meningkatkan keamanan jaringan yang mampu mencegah cracker dan virus agar tidak
dapat menyerang jaringan PT. XYZ-TD. Awal munculnya IPS berasal dari IDS
(Intrusion Detection system) yang hanya berfungsi untuk mendeteksi aktivitas
mencurigakan dalam sebuah sistem jaringan dan melakukan analisis serta mencari bukti
dari percobaan intrusi/penyusupan. Karena banyaknya ancaman-ancaman terhadap
jaringan perusahaan maka dikembangkanlah teknologi IDS menjadi IPS yang berfungsi
untuk mengidentifikasi jaringan dari aktivitas yang berbahaya, mencatatkan informasi,
memblokir atau menghentikan, dan melaporkan kegiatan berbahaya tersebut.
Dengan perkembangan teknologi jaringan yang ada pada saat ini, tidak dapat
dipungkiri bahwa keamanan jaringan menjadi suatu hal yang harus diperhitungkan. PT.
Seraphim Digital Technology sebagai salah satu perusahaan yang menawarkan solusi IT
terutama di bidang keamanan jaringan melihat hal tersebut dapat membantu untuk
meminimalisir ancaman dan serangan baik internal maupun external yang dapat
mengganggu aliran bisnis perusahaan. Teknologi ini sangat menarik untuk dibahas
karena berkaitan dengan masalah yang sering timbul dalam jaringan komputer khususnya
pada keamanan jaringan, dimana sistem keamanan jaringan dengan teknologi IPS
diharapkan mampu menjaga infrastruktur jaringan kedepannya. Oleh karena itu, dalam
skripsi ini akan membahas mengenai analisis, perancangan, dan pengimplementasian
infrastruktur keamanan jaringan dengan teknologi IPS yang bekerja sama dengan staf IT
PT. Seraphim Digital Technology untuk PT. XYZ-TD beserta evaluasinya.
2. Metodologi
Ruang lingkup penelitian mencakup analisa system jaringan lama PT. XYZ-TD,
perancangan dan implementasi jaringan baru yang sudah terstruktur serta melakukan
pemasangan alat keamanan IPS pada jaringan PT XYZ-TD. Adapun pembahasan
yang dilakukan meliputi sebagai berikut :
- Analisis
- Perancangan
- Evaluasi
2.1. Analisis
Pada topologi jaringan yang lama, dapat dilihat pada gambar 2. masih
menggunakan menggunakan router box dan patch panel dan tidak ada alat keamanan
untuk menjaga jaringan perusahaan, serta masih ada server eksternal yang bergabung
dengan server internal. Maka dalam rancangan topologi jaringan yang baru akan
menggunakan switch Cisco manageable dan router Cisco 1Gb agar jaringan lebih
mudah untuk dikelola dan dirawat serta menggunakan Intrusion Prevention System
buatan IBM untuk mengamankan jaringan dari serangan-serangan. Penggunaan Cisco
Switch dan Cisco Router pada topologi jaringan baru dikarenakan Cisco adalah salah
satu produk terbaik di bidang jaringan komputer, selain itu lebih banyak engineer yang
memiliki sertifikasi Cisco di banding produk lainnya, sehingga lebih mudah untuk
mencari orang yang bisa melakukan pengelolaan terhadap switch dan router yang
dipakai. Penggunaan teknologi Intrusion Prevention System buatan IBM yang sebagai
alat keamanan jaringan karena IPS buatan IBM adalah produk yang dapat diandalkan
serta PT. Seraphim Digital Technology merupakan distributor IPS buatan IBM.
Internet
Router Box
Switch3COM
Proxy server 1
Proxy server 2
Web server
Switch3COM
Server Aplikasi 1
Switch 3COM
File Server 1
File Server 2
Server Aplikasi 2
Server Antivirus Mail ServerServer Aplikasi 3
Hub IT Hub Busdev, Sales, &Direksi
Hub Pajak Hub Akuntansi
Server Aplikasi Mobile
Open VPN
Gambar 2.1 Topologi jaringan PT.XYZ-TD
2.2. Perancangan
Untuk menjaga keamanan pada struktur jaringan lama PT.XYZ-TD, maka
dibuatlah rancangan jaringan infrastruktur baru yang dapat mendukung kinerja
perusahaan dan sebagai pemecahan masalah dari hasil identifikasi masalah
yang dilakukan sebelumnya. Berikut ini adalah topologi rancangan
infrastruktur keamanan jaringan pada PT. XYZ-TD:
Gambar 2.2 Rancangan Jaringan Baru PT.XYZ-TD
2.3. Evaluasi
Untuk evaluasi hasil implementasi sistem keamanan IPS pada PT. XYZ-TD, kami
menggambil log history satu minggu setelah pemasangan sistem keamanan IPS. Berikut
daftar tabel serangan-serangan yang diblok:
Tabel 4.1 Log History
Tag Name Status Severity Event Count
Source Count
Target Count
POP_Command_Overflow Block High 6289 95 5
MSRPC_Srvsvc_Path_Bo Block High 494 35 252
SSL_Challenge_Length_Overflow Block High 48 1 2
HTTP_Oracle_WebCache_Overflow Block High 45 3 14
Telnet_Polycom_Blank_Password Block High 33 1 17
MSRPC_Race_Heap_Overflow Block High 32 2 15
SQL_SSRP_Slammer_Worm Block High 30 8 3
Email_Virus_Suspicious_Zip Block High 28 9 3
SQL_SSRP_MDAC_Client_Overflow Block High 20 1 2
DNS_RDATA_String_BO Block High 12 4 5
Image_JPEG_Tag_Overflow Block High 9 5 4
Email_Calendar_Code_Exec Block High 4 3 2
Image_JPEG_IE_Size_Overflow Block High 1 1 1
HTTP_repeated_character Block Medium 5405 158 66
Smurf_Attack Block Medium 4350 2 21
Email_Executable_Extension Block Medium 1495 93 76
HTTP_POST_Script Block Medium 31 6 5
YahooMSG_UserID_Overflow Block Medium 13 1 1
ICMP_Protocol_Unreachable_TCP Block Medium 5 3 1
HTTP_Cross_Site_Scripting Block Medium 4 4 3
HTTP_GET_Very_Long Block Medium 2 2 2
Email_Virus_Double_Extension Block Medium 1 1 1
HTTP_ASP_Security_Bypass Block Medium 1 1 1
UDP_Bomb Block Medium 1 1 1
DCOM_SystemActivation_DoS Block Low 164 1 2
HTML_Script_Extension_Evasion Block Low 7 4 6
DNS_Windows_SMTP_MX_DoS Block Low 2 2 2
Image_ANI_RateNumber_DoS Block Low 2 1 1
TCP_Null_Scan Block Low 1 1 1
MOV_Container_Overflow Block Low 1 1 1
Berdasarkan hasil evaluasi dari log history dapat dilihat bahwa serangan-serangan
yang menyerang PT. XYZ-TD berstatus high severity terbanyak adalah
POP_Command_Overflow sebanyak 6289 serangan, serangan berstatus Medium severity
terbanyak adalah HTTP_repeated_character sebanyak 5405 serangan, dan serangan
berstatus low severity terbanyak adalah DCOM_SystemActivation_DoS sebanyak 164
serangan. Dengan adanya pemasangan sistem keamanan IPS, 18.530 serangan mampu
diblok yang membuat jaringan PT. XYZ-TD lebih aman dari serangan-serangan yang
dapat mengganggu kinerja perusahaan.
.
3. Kesimpulan
Berdasarkan hasil evaluasi dari implementasi infrastruktur keamanan jaringan
dengan penggunaan teknologi Intrusion Prevention System (IPS) pada PT. XYZ-TD,
maka dapat disimpulkan :
Penggunaan modul VLAN, Inter-VLAN-Routing dan ACL pada Cisco Switch dan Cisco Router akan mempermudah pekerjaan administrator jaringan dalam
melakukan pengelolaan dan pemeliharaan jaringan PT. XYZ-TD.
Dengan adanya Intrusion Prevention System (IPS) pada jaringan PT. XYZ-TD lebih dari 18.530 serangan mampu diblok, sehingga membuat jaringan PT. XYZ-TD lebih
aman.
Daftar Pustaka [1] Angelescu, S. (2010). CCNA Certification All-In-One for Dummies. Indianapolis: Wiley Publishing, Inc. [2] ISS X-Force. (2011, December 17). Apple Quicktime atom length detected (MOV_Container_Overflow). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/MOV_Container_Overflow.htm
[3] ISS X-Force. (2011, December 17). HTML Script Extension Evasion (HTML_Script_Extension_Evasion). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTML_Script_Extension_Evasion.htm
[4] ISS X-Force. (2011, December 17). HTTP GET contains repeated characters (HTTP_repeated_character). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_repeated_character.htm
[5] ISS X-Force. (2011, December 17). HTTP POST contains malicious script (HTTP_POST_Script). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_POST_Script.htm
[6] ISS X-Force. (2011, December 17). ICMP Protocol Unreachable TCP denial of service (ICMP_Protocol_Unreachable_TCP). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/ICMP_Protocol_Unreachable_TCP.htm
[7] ISS X-Force. (2011, December 17). Mail attachment with a suspicious file name (Email_Executable_Extension). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Email_Executable_Extension.htm
[8] ISS X-Force. (2011, December 17). Mail attachment with a suspicious file name (Email_Virus_Double_Extension). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Email_Virus_Double_Extension.htm
[9] ISS X-Force. (2011, December 17). Mail message contains suspicious ZIP file (Email_Virus_Suspicious_Zip). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/Email_Virus_Suspicious_Zip.htm
[10]ISS X-Force. (2011, December 17). Microsoft ASP.NET Framework bypass security (HTTP_ASP_Security_Bypass). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_ASP_Security_Bypass.htm
[11]ISS X-Force. (2011, December 17). Microsoft Data Access Components (MDAC) broadcast request buffer overflow (SQL_SSRP_MDAC_Client_Overflow). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/SQL_SSRP_MDAC_Client_Overflow.htm
[12]ISS X-Force. (2011, December 17). Microsoft Exchange iCal MODPROPS denial of service (Email_Calendar_Code_Exec). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/Email_Calendar_Code_Exec.htm
[13]ISS X-Force. (2011, December 17). Microsoft IIS Cross-Site Scripting (HTTP Cross site scripting). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_Cross_Site_Scripting.htm
[14]ISS X-Force. (2011, December 17). Microsoft Internet Explorer JPEG image buffer overflow (Image_JPEG_IE_Size_Overflow). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/Image_JPEG_IE_Size_Overflow.htm
[15]ISS X-Force. (2011, December 17). Microsoft Windows 2000 and XP RPC race condition (MSRPC_Race_Heap_Overflow). Retrieved December 19, 2011, from www.iss.net: MSRPC_Race_Heap_Overflow
[16]ISS X-Force. (2011, December 17). Microsoft Windows ANI file zero rate number overflow denial of service (Image_ANI_RateNumber_DoS). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Image_ANI_RateNumber_DoS.htm
[16]ISS X-Force. (2011, December 17). Microsoft Windows DNS client data string buffer overflow (DNS_RDATA_String_BO). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/DNS_RDATA_String_BO.htm
[17]ISS X-Force. (2011, December 17). Microsoft Windows JPEG buffer overflow (Image_JPEG_Tag_Overflow). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Image_JPEG_Tag_Overflow.htm
[18]ISS X-Force. (2011, December 17). Microsoft Windows RPCSS Service RPC message can cause denial of service (DCOM_SystemActivation_DoS). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/DCOM_SystemActivation_DoS.htm
[19]ISS X-Force. (2011, December 17). Microsoft Windows Server Service RPC code execution (MSRPC_Srvsvc_Path_Bo). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/MSRPC_Srvsvc_Path_Bo.htm
[20]ISS X-Force. (2011, December 17). Microsoft Windows SMTP Service and Microsoft Exchange SMTP DNS Mail Exchanger (MX) denial of service (DNS_Windows_SMTP_MX_DoS). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/DNS_Windows_SMTP_MX_DoS.htm
[21]ISS X-Force. (2011, December 17). NCSA httpd allows remote users to execute commands (HTTP_GET_Very_Long). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_GET_Very_Long.htm
[22]ISS X-Force. (2011, December 17). Oracle9i Application Server Web Cache HTTP Request Method buffer overflow (HTTP_Oracle_WebCache_Overflow). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_Oracle_WebCache_Overflow.htm
[23]ISS X-Force. (2011, December 17). Polycom ViewStation password is blank (Telnet_Polycom_Blank_Password). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/Telnet_Polycom_Blank_Password.htm
[24]ISS X-Force. (2011, December 17). Qpopper contains a buffer overflow that could allow root access (POP_Command_Overflow). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/POP_Command_Overflow.htm
[25]ISS X-Force. (2011, December 17). Smurf denial of service (Smurf_Attack). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Smurf_Attack.htm
[26]ISS X-Force. (2011, December 17). SQL Slammer worm propagation (SQL_SSRP_Slammer_Worm). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/SQL_SSRP_Slammer_Worm.htm
[27]ISS X-Force. (2011, December 17). SSLV2 Client Hello Overflow (SSL_Challenge_Length_Overflow). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/SSL_Challenge_Length_Overflow.htm
[28]ISS X-Force. (2011, December 17). SunOS can be crashed with malformed UDP packets (UDP_Bomb). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/UDP_Bomb.htm
[29]ISS X-Force. (2011, December 17). TCP Half scan (Stealth scan) (TCP null scan). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/TCP_Null_Scan.htm
[30]ISS X-Force. (2011, December 17). Yahoo! Messenger victimID buffer overflow (YahooMSG_UserID_Overflow). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/YahooMSG_UserID_Overflow.htm
[31]Rob Payne, K. M. (2003). Cisco certified internetwork expert: study guide (2nd Edition ed.). California: SYBEX Inc.
[32]Tanenbaum, A. S. (2003). Computer Network (4th edition ed.). New Jersey: Prentice Hall.
ANALYSIS, DESIGN, DAN IMPLEMENTATION NETWORK
INFRASTRUCTURE SECURITY WITH IPS TECHNOLOGY AT PT. XYZ-TD
Christophorus Calvin Halim Binus University, Jakarta, DKI Jakarta, Indonesia
and
Jan Dicky Chandra Binus University, Jakarta, DKI Jakarta, Indonesia
Abstract
Currently, the network infrastructure must be accompanied by a security system to prevent damage to existing systems in the company because of a cracker or a virus that can penetrate corporate networks. Therefore, it has been carried out analysis of PT. XYZ-TD network infrastructure and do design, and implementation of new network infrastructure by adding technology Intrusion Prevention System (IPS) as a security tool for PT. XYZ-TD. The method used is the analytical methodology, by conducting direct observation to determine the characteristics of the PT. XYZ-TD network infrastructure is being run, and the methodology PDIOO (Planning, Design, Implementation, Operation and Optimization) in doing the design and implementation. The results obtained are implemented design for PT. XYZ-TD network infrastructure. The use of module VLAN, Inter-VLAN-Routing and ACL facilitate PT. XYZ-TD network administrator in doing maintenance and management of the network. In addition, the installation of IPS also makes the PT. XYZ-TD network to be more secure against attack from outside or from within. That way there are problems in PT. XYZ-TD can be resolved.
Kata kunci : Intrusion Preventiom System, Network Infrastructure Security, PT. XYZ-TD
1. Introduction
Development of information technology is increasingly growing, especially
computer networks at this time has become one of the most fundamental thing in a
company. It can be seen from the use of computer networks has become a basic
requirement for any company, whether large or medium companies. Computer network
technology has become an important key in the era of globalization and information
technology.
PT. XYZ-TD is a company engaged in trading and distribution offices in Jakarta
and one subsidiary company of PT. XYZ. PT. XYZ-TD is developing information
technology to support and improve business processes. Based on information received
from the IT staff at PT. XYZ-TD, there are some problems in the network infrastructure
systems. PT. XYZ-TD would like to replace the entire network infrastructure with an
infrastructure design that much better. This is because the old network system using only
one segment, so if there are attacks that enter into the corporate network could cause
problems for all users who connect to the corporate network.
In addition, PT. XYZ-TD just bought a solution ERP (Enterprise Resource
Planning) is used to improve the quality of work and the marketability of its marketing
staff. Application of this solution must be activated for 24 hours, because if not accessible
in some time, it will disrupt the business processes which will indirectly reduce the profit
of the company. Therefore so requires a tool capable of maintaining network security and
ERP applications on PT. XYZ-TD with the use of Intrusion Prevention System (IPS) as a
solution to minimize the problems on their network security.
In the process, IPS is an information technology to improve network security that
can prevent crackers and viruses that can not attack the PT. XYZ-TD network. Early
emergence of IPS came from IDS (Intrusion Detection System) which only serves to
detect suspicious activity in a network system and perform analysis and look for evidence
of experimental intrusion/infiltration. Since the number of threats to the companies
network IDS to IPS is developing technology that serves to identify the network from
malicious activity, logging information, block or stop, and report these dangerous
activities.
With the development of network technology that exist at present, it is undeniable
that network security becomes a matter that should be taken into account. PT. Seraphim
Digital Technology as a company offering IT solutions, especially in the field of view of
network security that can help to minimize the threat and both internal and external
attacks that could disrupt the flow of business. This technology is very interesting to
discuss because it deals with issues that often arise in computer networks, especially in
network security, network security system with which the IPS technology is expected to
maintain the network infrastructure in the future. Therefore, in this paper will discuss the
analysis, design, and implementation of network security infrastructure with IPS
technology in collaboration with IT staff PT. Seraphim Digital Technology for the PT.
XYZ-TD and its evaluation.
2. Metodologi
The scope of research includes analysis of the old network system of PT. XYZ-
TD, design and implementation of new networks that are structured as well as
installing safety devices on the network IPS PT. XYZ-TD. The discussion is carried
out include the following:
- Analysis
- Design
- Evaluation
2.1. Analysis
At that time the network topology, can be seen in Figure 2. still use the router box
and use the patch panel and there is no security tools to keep your corporate network,
and there are still external servers that join the internal server. So in the design of
new network topologies will be using Cisco switches and routers Cisco 1Gb
manageable so that the network easier to manage and maintain, and use IBM's
Intrusion Prevention System made to secure the network from attacks. The use of
Cisco switches and Cisco routers in the network topology due to the new Cisco is
one of the best products in the field of computer network, except that more engineers
who have Cisco certifications in the appeal of other products, making it easier to find
someone who could take over management of switches and routers is used. The use
of technology made by IBM Intrusion Prevention System which as a network
security tool for IPS products made by IBM is a reliable and PT. Seraphim Digital
Technology is a distributor of IPS made by IBM.
Figure 2.1 PT.XYZ-TD Network Topology
2.2. Design
To maintain security on the old network structure PT.XYZ-TD, then made
the design of new network infrastructure that can support the company's
performance and as a result of solving the problem of identifying problems
before. Here is a topology design of network security infrastructure at the PT.
XYZ-TD:
Figure 2.2 PT.XYZ-TD New Design
2.3. Evaluation
To evaluate the implementation of the IPS security system on PT. XYZ-TD, we
took this log history one week after the installation of security systems IPS. The following
table lists blocked attacks:
Table 2.1 Log History
TagName Status SeverityEventCount
SourceCount
TargetCount
POP_Command_Overflow Block High 6289 95 5
MSRPC_Srvsvc_Path_Bo Block High 494 35 252
SSL_Challenge_Length_Overflow Block High 48 1 2
HTTP_Oracle_WebCache_Overflow Block High 45 3 14
Telnet_Polycom_Blank_Password Block High 33 1 17
MSRPC_Race_Heap_Overflow Block High 32 2 15
SQL_SSRP_Slammer_Worm Block High 30 8 3
Email_Virus_Suspicious_Zip Block High 28 9 3
SQL_SSRP_MDAC_Client_Overflow Block High 20 1 2
DNS_RDATA_String_BO Block High 12 4 5
Image_JPEG_Tag_Overflow Block High 9 5 4
Email_Calendar_Code_Exec Block High 4 3 2
Image_JPEG_IE_Size_Overflow Block High 1 1 1
HTTP_repeated_character Block Medium 5405 158 66
Smurf_Attack Block Medium 4350 2 21
Email_Executable_Extension Block Medium 1495 93 76
HTTP_POST_Script Block Medium 31 6 5
YahooMSG_UserID_Overflow Block Medium 13 1 1
ICMP_Protocol_Unreachable_TCP Block Medium 5 3 1
HTTP_Cross_Site_Scripting Block Medium 4 4 3
HTTP_GET_Very_Long Block Medium 2 2 2
Email_Virus_Double_Extension Block Medium 1 1 1
HTTP_ASP_Security_Bypass Block Medium 1 1 1
UDP_Bomb Block Medium 1 1 1
DCOM_SystemActivation_DoS Block Low 164 1 2
HTML_Script_Extension_Evasion Block Low 7 4 6
DNS_Windows_SMTP_MX_DoS Block Low 2 2 2
Image_ANI_RateNumber_DoS Block Low 2 1 1
TCP_Null_Scan Block Low 1 1 1
MOV_Container_Overflow Block Low 1 1 1
Based on the evaluation of the history log can be seen that the attacks that attack
the PT. XYZ-TD status of high severity is POP_Command_Overflow as much as 6289
most attacks, Medium severity status as most are HTTP_repeated_character 5405 attacks,
and attacks low-status is the highest severity DCOM_SystemActivation_DoS as much as
164 attacks. With the installation of security systems IPS, 18 530 attacks can be blocked to
create a network of PT. XYZ-TD is more secure from attacks that could disrupt the
company's performance.
3. Conclusion
Based on the evaluation of the implementation of network security infrastructure
with the use of Intrusion Prevention System (IPS) at PT. XYZ-TD, it can be concluded:
Use of module VLAN, Inter-VLAN-ACL on the Cisco Routing and Switch and Cisco Router will facilitate the work of network administrators in managing and
maintaining a network of PT. XYZ-TD.
With the Intrusion Prevention System (IPS) on the PT. XYZ-TD network more than 18.530 attacks can be blocked, making the PT. XYZ-TD network is more secure.
Daftar Pustaka [1] Angelescu, S. (2010). CCNA Certification All-In-One for Dummies. Indianapolis: Wiley Publishing, Inc. [2] ISS X-Force. (2011, December 17). Apple Quicktime atom length detected (MOV_Container_Overflow). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/MOV_Container_Overflow.htm
[3] ISS X-Force. (2011, December 17). HTML Script Extension Evasion (HTML_Script_Extension_Evasion). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTML_Script_Extension_Evasion.htm
[4] ISS X-Force. (2011, December 17). HTTP GET contains repeated characters (HTTP_repeated_character). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_repeated_character.htm
[5] ISS X-Force. (2011, December 17). HTTP POST contains malicious script (HTTP_POST_Script). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_POST_Script.htm
[6] ISS X-Force. (2011, December 17). ICMP Protocol Unreachable TCP denial of service (ICMP_Protocol_Unreachable_TCP). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/ICMP_Protocol_Unreachable_TCP.htm
[7] ISS X-Force. (2011, December 17). Mail attachment with a suspicious file name (Email_Executable_Extension). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Email_Executable_Extension.htm
[8] ISS X-Force. (2011, December 17). Mail attachment with a suspicious file name (Email_Virus_Double_Extension). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Email_Virus_Double_Extension.htm
[9] ISS X-Force. (2011, December 17). Mail message contains suspicious ZIP file (Email_Virus_Suspicious_Zip). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/Email_Virus_Suspicious_Zip.htm
[10]ISS X-Force. (2011, December 17). Microsoft ASP.NET Framework bypass security (HTTP_ASP_Security_Bypass). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_ASP_Security_Bypass.htm
[11]ISS X-Force. (2011, December 17). Microsoft Data Access Components (MDAC) broadcast request buffer overflow (SQL_SSRP_MDAC_Client_Overflow). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/SQL_SSRP_MDAC_Client_Overflow.htm
[12]ISS X-Force. (2011, December 17). Microsoft Exchange iCal MODPROPS denial of service (Email_Calendar_Code_Exec). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/Email_Calendar_Code_Exec.htm
[13]ISS X-Force. (2011, December 17). Microsoft IIS Cross-Site Scripting (HTTP Cross site scripting). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_Cross_Site_Scripting.htm
[14]ISS X-Force. (2011, December 17). Microsoft Internet Explorer JPEG image buffer overflow (Image_JPEG_IE_Size_Overflow). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/Image_JPEG_IE_Size_Overflow.htm
[15]ISS X-Force. (2011, December 17). Microsoft Windows 2000 and XP RPC race condition (MSRPC_Race_Heap_Overflow). Retrieved December 19, 2011, from www.iss.net: MSRPC_Race_Heap_Overflow
[16]ISS X-Force. (2011, December 17). Microsoft Windows ANI file zero rate number overflow denial of service (Image_ANI_RateNumber_DoS). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Image_ANI_RateNumber_DoS.htm
[16]ISS X-Force. (2011, December 17). Microsoft Windows DNS client data string buffer overflow (DNS_RDATA_String_BO). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/DNS_RDATA_String_BO.htm
[17]ISS X-Force. (2011, December 17). Microsoft Windows JPEG buffer overflow (Image_JPEG_Tag_Overflow). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Image_JPEG_Tag_Overflow.htm
[18]ISS X-Force. (2011, December 17). Microsoft Windows RPCSS Service RPC message can cause denial of service (DCOM_SystemActivation_DoS). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/DCOM_SystemActivation_DoS.htm
[19]ISS X-Force. (2011, December 17). Microsoft Windows Server Service RPC code execution (MSRPC_Srvsvc_Path_Bo). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/MSRPC_Srvsvc_Path_Bo.htm
[20]ISS X-Force. (2011, December 17). Microsoft Windows SMTP Service and Microsoft Exchange SMTP DNS Mail Exchanger (MX) denial of service (DNS_Windows_SMTP_MX_DoS). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/DNS_Windows_SMTP_MX_DoS.htm
[21]ISS X-Force. (2011, December 17). NCSA httpd allows remote users to execute commands (HTTP_GET_Very_Long). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_GET_Very_Long.htm
[22]ISS X-Force. (2011, December 17). Oracle9i Application Server Web Cache HTTP Request Method buffer overflow (HTTP_Oracle_WebCache_Overflow). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/HTTP_Oracle_WebCache_Overflow.htm
[23]ISS X-Force. (2011, December 17). Polycom ViewStation password is blank (Telnet_Polycom_Blank_Password). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/Telnet_Polycom_Blank_Password.htm
[24]ISS X-Force. (2011, December 17). Qpopper contains a buffer overflow that could allow root access (POP_Command_Overflow). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/POP_Command_Overflow.htm
[25]ISS X-Force. (2011, December 17). Smurf denial of service (Smurf_Attack). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/Smurf_Attack.htm
[26]ISS X-Force. (2011, December 17). SQL Slammer worm propagation (SQL_SSRP_Slammer_Worm). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/SQL_SSRP_Slammer_Worm.htm
[27]ISS X-Force. (2011, December 17). SSLV2 Client Hello Overflow (SSL_Challenge_Length_Overflow). Retrieved December 19, 2011, from http://www.iss.net: http://www.iss.net/security_center/reference/vuln/SSL_Challenge_Length_Overflow.htm
[28]ISS X-Force. (2011, December 17). SunOS can be crashed with malformed UDP packets (UDP_Bomb). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/UDP_Bomb.htm
[29]ISS X-Force. (2011, December 17). TCP Half scan (Stealth scan) (TCP null scan). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/TCP_Null_Scan.htm
[30]ISS X-Force. (2011, December 17). Yahoo! Messenger victimID buffer overflow (YahooMSG_UserID_Overflow). Retrieved December 19, 2011, from www.iss.net: http://www.iss.net/security_center/reference/vuln/YahooMSG_UserID_Overflow.htm
[31]Rob Payne, K. M. (2003). Cisco certified internetwork expert: study guide (2nd Edition ed.). California: SYBEX Inc.
[32]Tanenbaum, A. S. (2003). Computer Network (4th edition ed.). New Jersey: Prentice Hall.