If you do not consider security, you will design the network by looking purely at cost and performance. The minimum cost solution is simply to locate a set of hubs in each communications closet and connect all the hubs together to form a single segment. From a performance standpoint the management personnel do not want to have their network activity slowed by the activity of the staff they supervise or by people from a different department, so one can argue to segment the network on the basis of performance in a way that is close to what is needed for security purposes. If cost is not an issue, each of the proposed segments can simply be connected by a switch.

A realistic solution needs to do the following:

•  Balance the issues of cost and performance

•  Take into consideration the physical layout of the building

•  Maintain security by not violating the trust constraints

Figure 5.8 shows such a solution. Mathematics places all of its staff on a single segment by connecting hubs in the upper and lower floor communication closets. The Mathematics management suite has a segment that bears the burden of traffic from the staff segment. While Mathematics has a lower cost solution, Computer Science has a higher performance solution. Computer Science has five separate segments joined by a switch. Computer Science staff are placed on two separate segments, one for the upper floor and one for the lower floor, not to satisfy any security concern, but because separate hubs on each floor simplified the wiring and provided a low-cost opportunity to enhance performance. Computer Science, Mathematics, and English each have a separate subnet. These three subnets are joined into a single network by a router located in the communication closet on the lower floor.

The solution shown in figure 5.8 provides for reasonable security against sniffing. Absolute security is not provided since it is still possible for anyone to hook up a sniffer on any of the segments. However, data from areas where more security is needed do not flow through areas where less security is needed. The areas where more security is needed have higher levels of physical security as well. Hence, it is increasingly difficult to physically get to a location where sensitive data is flowing on the wires. Also, except on the insecure Computer Science client segment, there is trust between the authorized users of the machines sharing a segment. Hence, an authorized user of a machine cannot use it to sniff data going to or from someone who does not trust the user.

Figure 5.8  Wiring system to satisfy trust constraints and fit the building layout.

You can learn several things from looking at the case study and its solution:

•  A minimum cost solution is not likely to provide for security.

•  A totally secure system is prohibitively expensive, but a reasonably secure system is not.

•  Different approaches to cost and performance trade-offs may be combined in a secure system. Mathematics and Computer Science have different budgets for equipment and needs for network performance.

•  A single solution may provide both security and enhance performance as in the solution shown for Computer Science.

•  A solution that provides for security adds significantly to cost. There is almost no cost difference between having a single segment for Mathematics and the solution shown. An extra wire run from the lower floor staff hub to the upper floor staff hub is one extra cost item as is the bridge separating the two segments.

---

Tip:  A simple hardware barrier that is inexpensive and has the potential for increasing network performance is the installation of a bridge between your machine room and the rest of your facility. In many cases, a great deal of traffic occurs between the computers in the machine room. A bridge placed between the machine room and the rest of the facility prevents this traffic from escaping to less secure areas and reduces the collision rate outside the machine room. Bridges are much less expensive than a router or a switch. In fact, a low-cost personal computer may be configured for this purpose with free software such as Drawbridge available at ftp://net.tamu.edu/pub/security.

---

Drawbridge is a free software package that turns an ordinary PC with a pair of standard Ethernet interfaces into a bridge. Drawbridge is also capable of filtering operations and can act as a cheap alternative to a firewall in small networks. In some cases, you may be able to recycle a used PC considered obsolete for this purpose as the memory and disk requirements of Drawbridge are quite modest.

So far, this section has covered how to avoid sniffing of data from the local part of the Internet. Such an action seems directed toward protection against internal personnel rather than external threats. However, many security breaches are aided either knowingly or unknowingly by internal personnel. In such cases, the hardware barriers described in this section will limit what an intruder, physically present or remote, can do with a sniffer. Not only is physical security greater for the more trusted segments, but so is the technical competence of those in charge of the computer systems. The least technically competent to protect a system from remote intruders must be given systems that cannot be given commands from a remote location (such as a simple personal computer). Systems that can accept commands from remote locations must be administered by those technically competent enough to prevent remote intruders by not making mistakes that will allow remote intruders to gain access to the systems.