Security in Distributed Network
M.S. Nisha Ms. Rashmi Saboo
JIET, NH-65, Pali road, Near Mogra, Jodhpur- 342008
(ms.nisha@jietjodhpur.com, seemsab@gmail.com )
Abstract
This paper tries to figure out the various
mechanisms that can be applied for the
security of the distributed network. It
also lists the various means by which the
biometrics can be used for authentication
and providing security in a network.
1. Introduction
Security for stand-alone
computers and small networks was
handled by physical security and by
logging into computers and domains.
With open networks like the Internet and
pervasive environments, issues
concerning security and trust become
crucial. There is no longer the physical
aspect of security due to the distributed
nature of the networks and the concept
of user authentication to a domain is not
possible. In such an open,
heterogeneous, distributed environment
there is a great likelihood that
inconsistent interpretations will be made
of the security information in different
domains. Existing security
infrastructures deal with authentication
and access control. These mechanisms
are inadequate for the increased
flexibility required by distributed
networks.
2. Security Modes
2.1 LAN Guidelines
It is often difficult to distinguish where
the individual server ends and the
network begins. Some Network
Operating Systems can be configured so
that the end user logs into a domain to
access network resources. For other
NOSs the user logs into a server. In the
case of the latter, the server is the
network. Certainly the discussion
covering guidelines for passwords can
be applied directly to network
authentication.
2.2 Controlling End User Access
Creating an account and assigning a
password are only small parts of giving
someone access to the network. A
network administrator also has to
determine other account parameters such
as when an end user can access the
network, what groups the user is
associated with, what files he or she can
access, and limitations on network and
server resources.
2.3 Concurrent Logins
Users should not be allowed concurrent
sign-on privileges. Once an end user has
logged into a network they should not be
able to login somewhere else without
first logging out from where they
originally logged in. The only exception
to this rule should be the LAN
administrator and his or her backup.
While anybody recognizes that this
could cause operational problems for
some users, there are several reasons for
limiting concurrent sign-ons. First, it
saves network resources, such as
memory and licenses. It can also prevent
the unauthorized use of an account, so
long as the user is logged in. It also
prevents the user from forgetting to log
out. When we allow concurrent sign-ons,
the end users often lose track of where
they are logged in and forget to sign off
everywhere. Users can leave themselves
logged into the network on a workstation
without even realizing it. They open a
window of vulnerability to the network
and themselves when they leave
accounts signed on. One solution to this
problem is to implement a process that
automatically logs off inactive users.
There are also systems that freeze a
workstation or lock a keyboard on an
inactive session, after a specified period
of time. To release the keyboard lock the
user must enter a password.
2.4 Available Disk Space
It is important to limit the amount of
disk space allocated to each end user.
giving users unlimited disk space may
end up requiring the purchase of
additional disk capacity. We have seen
situations where users crashed servers
because their accounts did not restrict
the amount of disk space the user was
allowed. In one instance, a user was
running a report that spooled a massive
file to disk. The result was that all the
available space was consumed, and the
server crashed. Users should also be
encouraged to clean up their directories
on a regular basis. We recognize that the
comparative cost for disk drives
continues to drop to where the cost per
megabyte is nominal, but disk drives still
need to be backed up.
2.5 Restrictions to Location or
Workstation
Consideration should be given to
restricting, to a specific workstation, end
users who are authorized to enter
sensitive transactions or who perform
particularly sensitive and/or confidential
work. It is preferable to locate the station
in a restricted area. Obviously, access to
the server itself should be restricted to
the LAN administrator and his/her
backup.
2.5.1 Time/Day Restrictions
Employees who are authorized to access
and use sensitive and/or confidential
data can access it during office hours
only. If an employee does not normally
work in the evenings and on the
weekends, then the ability to access the
network should be restricted for that
time period. Most every operating
system and NOS has the capability to
restrict an account's access to specific
time periods.
2.5.2 Access to Directories and
Trustee Rights
Users should only be given access rights
to directories they need to function. If a
user needs temporary access to a
directory, the access rights should be
removed when they are no longer
needed.
Users should only be given the trustee
rights they need to do their job. Once a
right is no longer required, remove it
right away. Trustee rights should be
audited periodically.
2.6 File Attributes
File-access attributes, such as read,
write, execute, and delete, should be
granted based on need. In addition, files
containing confidential or sensitive
information should be restricted to a
minimum number of users. File
attributes for executables should be
restricted. End users should only have
read access to those files that are needed
to function. Particular attention should
be paid to operating system executables.
If file attributes for executable files are
not restricted, the executable files can be
modified. With loosely defined file
attributes, important executable files can
be changed or replaced with Trojan
horse programs.
2.7 Other Privileges
Network commands and executables
should be restricted to administrators,
auditors, and security personnel. With
certain operating systems, such as
Windows NT, consider renaming the
administrator account to something else.
That way a potential hacker won't know
the name of the privileged account.
One of the things that every system
administrator fears most is a hacker
gaining privileged administrative access
to a system over the network. Privileged
accounts such as administrator for NT or
root for UNIX should not be allowed to
login over the network. Network access
to the administrative account can be
restricted in different ways for different
operating systems.
2.8 Remove Inactive Accounts
Organizations should review network
user accounts on a regular bases and
delete any accounts that are no longer
required. Accounts for users or
employees no longer with the
organization should be deleted. Firms
should also delete inactive accounts,
removing or disabling username
accounts that have not been accessed in
the last three to six months. Hackers
frequently try to exploit inactive
accounts for the initial break into a
system or as a means to gain access to a
network again. They know they can alter
an inactive account, by changing the
password, for example, without fear of
the change being detected by the user of
the account. The guest account should
not have the same privileges as normal
accounts.
2.9 Single Sign-On
Presently, every morning we enter in
multiple usernames and passwords to
gain access to the various networks,
systems, and applications that we need
in order to perform my job. we have a
password for the NT domain, a password
for the Novell server, different
passwords for different UNIX systems, a
password for my e-mail, and passwords
for various applications.
Having so many passwords can be
confusing to end users and can actually
create vulnerabilities, because the only
way the end user can remember the
passwords is to write them down. One
alternative to using multiple passwords
is the use of a single sign-on (SSO).
With an SSO system users are only
required to authenticate themselves
once. Once users have authenticated
themselves the SSO system handles the
management and access to other network
resources, such as servers, files, and
applications.
While policy-based management can
have advantages it also holds risks.
When Windows 2000 was first released
there was much debate about the security
of Active Directory. When utilizing
Active Directory Services, there are
dangers associated with loosely defined
policies or the granting of broad
administrative privileges to managers
and administrators, which can result in
gaping holes in an organization's
network security. At the very least it can
result in potential exposure of
confidential information. Due to the
design of Active Directory,
administrators who have been restricted
from accessing particular network
objects can actually take ownership of
the restricted objects with a few clicks of
a mouse. Microsoft's response to the
flaw was to recommend that multiple
domains be implemented with Active
Directory, which defeats the purpose of
implementing the directory service. It is
amusing to note that Microsoft's initial
response to the flaw was to call it a
"feature" of Active Directory. We guess
it's true that any software bug
sufficiently advanced becomes a feature.
However, Active Directory is not alone
in containing risks associated with
loosely defined policies. The same
danger is associated with any policy
based system and can result from poorly
defined or implemented policies. With
Active Directory, the risk is heightened
by the concern that organizations will
attempt to implement it with the same
broad privileges that they had
implemented NT domains. Active
Directory and NT domains are two
entirely different systems with different
approaches to security and implementing
them in the same manner can have
disastrous results.
2.10 Honeypot Systems
One technique that many administrators
employ is the use of "honeypot"
systems. They are basically deception
systems that contain phony services,
files, and applications designed to
emulate wellknown holes with the goal
of entrapping hackers. They are designed
to attract hackers, hence the name
"honeypot."
The honeypot is intended to make
hackers believe that they have
discovered a real system. The system is
designed to lure a hacker into a "safe"
network or server that impersonates
important applications or information.
When the hacker enters the honeypot the
trap is sprung and the alarm is sounded.
2.11 Static IP Addresses Versus
Dynamic Host Configuration Protocol
(DHCP)
DHCP enables network administrators to
centrally manage and automate the
assignment of IP addresses for an
organization's network. This means that
a computer with a DHCP client can
dynamically obtain an IP address from a
remote server (DHCP server). Each time
a workstation logs into the network it is
assigned an IP address. An alternative
would be to use preassigned static IP
addresses that each system would be
individually configured to use. The
major advantages of DHCP include
simplicity of configuration for the
clients, more efficient assignment of IP
addresses, and ease of administration.
The major disadvantage of DHCP is that
the assignment of IP addresses is
temporary. There are other alternatives
to DHCP, such as Reverse Address
Resolution Protocol (RARP) or
Bootstrap Protocol (BOOTP), that
essentially function the same way.
2.3 Biometrics
2.3.1Identification and Authentication
There are three basic methods employed
for identification and authentication.
They are listed as follows:
• Something you know
• Something you have
• Something you are
2.3.2 Biometric Identification and
Authentication
Biometric authentication is the process
of using some physical characteristic,
trait, aspect of physical being, or
behavior to authenticate one's identity.
The most commonly known example is
the process of employing fingerprints to
identify an individual. Biometric
authentication usually fits into one of
two general categories. The first is
physical characteristic recognition
(PCR), which relies upon a physical
characteristic such as a fingerprint, retina
or iris scan, voiceprint, or facial
geometry for identification and
authentication. The second category is
behavioral characteristic recognition
(BCR). BCR relies on behavioral
characteristics such as how a person
types at a keyboard, writes, or signs his
or her name.
2.3.3 Biometric Identification
Reliability
There are two critical characteristics that
reviewed before deploying any system.
They are listed as follows:
• False acceptance rate (FAR)
• False rejection rate (FRR)
The FAR is the rate at which a system
incorrectly accepts or recognizes a
would-be user as authorized to access
the system when in fact he or she are
not.
The FRR, the rate at which a system
incorrectly rejects a legitimate user. The
FRR is important to the successful
deployment of any biometric
authentication system. If the FRR of a
system is too high, it can cause end-user
frustration. The frustration can lead users
to circumvent proper authentication
procedures to avoid the biometric
system.
2.3.4 Backup Authentication
An effective biometric system needs to
be able to handle temporary
physiological changes. The backup
methods to authenticate users in the
event the biometrics fail.
2.3.5 Environmental Conditions
The environment in which it will operate
will effect a lot. Water, noise, moisture,
and dirt can adversely impact the
operation of some biometric
authentication systems. A factory floor
where workers get their hands dirty with
grease or where the conditions are very
wet would not be the best environment
to install a fingerprint reader or hand
reader. A fingerprint reader or hand
scanner would be equally ineffectual in
an environment where workers wear
gloves.
A retina scanner or face geometry reader
would not be advised in an environment
in which individuals must wear
protective eyewear or masks. In
addition, voiceprint readers would not
work well in noisy environments.
2.3.6 User Acceptance
To achieve a successful deployment of a
biometric authentication system, it is
important to gauge user acceptance of
the technology being used. Users may be
uncomfortable with retina scanners and
find recording of fingerprints an
invasion of privacy. Another issue that
needs to be considered before deploying
a system is general hygiene.
2.3.7 Security of the Biometric System
Another critical factor with biometric
identification and authentication systems
is how it handles communication and
storage. The mathematical representation
of fingerprint is sent to the server for
identification and authentication.
Another method would be to store the security”
template on the local system. In addition, 4. John D. Woodward (Jr.), Nicholas M.
storing the template on a local hard drive Orlans, Peter T. Higgins “ Biometrics”
would introduce other security issues. 5. Anil K. Jain, Ruud Bolle, Sharath
If the templates are stored on a server we Pankanti “Biometrics: personal
also need to consider how they are identification in
stored and the security employed to networked society”
prevent them from being compromised.
These are the types of issues that an
administrator needs to take into account
before deploying any biometric
identification and authentication system.

2.3.8 Interoperability
Another issue that is much more difficult
to resolve and we believe will be around
for a while is the fact that there is no
interoperability between biometric
systems. Every single product on the
market is proprietary. It is also difficult
to find a product that has operating
system interoperability. As a result, if we
work for a large organization, we will be
hard pressed to find a system that can be
deployed across the entire enterprise.

2.4 Conclusion
Security is the need of current world.
Our paper discusses the different
methods which can be used to ensure
security in network. Security is
everybody's business, and only with
everyone's cooperation, an intelligent
policy, and consistent practices, will it
be achievable.

2.5 References

1. Joseph Migga kizza “Computer

network security”
2. Secure Computers and Networks
Analysis, design and implementation
“Eric A. Fisc, Gregory B White”
3. Gregory B. White, Eric A. Fisch, Udo
W. Pooch “Computer system and
network