Securing a Local Area Network: An Interim Report on Network Security

This report presents an interim analysis of securing a local area network, examining vulnerabilities and proposing security measures. It delves into the OSI model, analyzing threats at the presentation, application, and session layers. The report details the implementation of VPN tunneling, frame relay, and VLANs to enhance network security. It outlines a network addressing scheme, a project plan, and a network diagram illustrating the proposed solution with multiple routers. The findings highlight TCP session hijacking, data spills, and cryptographic imperfections as key vulnerabilities. Mitigation strategies include username/password configurations, network monitoring tools, and secure protocols like SSH, SSL, and TLS. The conclusion emphasizes the importance of analyzing OSI layers and applying appropriate security measures, including firewalls and access control lists, to reduce unauthorized access and ensure network integrity.

Running head: NETWORK AND SECURITY
An Interim Report on: Securing a Local Area Network
Name of the Student
Name of the University
Author’s Note

1
NETWORK AND SECURITY
Abstract
The report is prepared for planning a local area network and application of security techniques
for securing the network from external access. The different layers of the OSI models are
analyzed for the development of the network. The security threats associated with each of the
layers are analyzed for application of the preventive measures and reduce the risk of
unauthroised access in the network. Thee security principles are evaluated for the
implementation of the security protocol in the network and the report is documented based on the
security principles that can be applied for the development of the project. The security threats
associated with a network can be identified by monitoring the network using network analysis
tools and the security levels that are required to be applied.

2
NETWORK AND SECURITY
Table of Contents
1. Introduction......................................................................................................................3
1.1. Aims..........................................................................................................................3
2. Background......................................................................................................................3
3. Methods...........................................................................................................................4
4. Results..............................................................................................................................8
5. Conclusion.....................................................................................................................11
Bibliography......................................................................................................................12

3
NETWORK AND SECURITY
1. Introduction
A network is developed using four routers and each of the routers communicates with
each other using the border gateway protocol and also uses VPN tunneling for establishment
remote connection for allowing the remote users to access the network. A frame relay cloud is
required to be used for setting the VPN connection and data packets can be transmitted to the
destination using the frame relay. A username and a password is required to be provided to the
remote user to connect with the VPN server and access the network of the organization. A
separate VLAN is required to be created for the different group of users for increasing the
security of the network.
1.1. Aims
The main aim of the report is to analyze the vulnerability of a network with VPN server
when compared with the OSI model and different layers of the model. The different control
measures could be applied for the mitigation of the threats associated with the development of
the network solution and appropriate protocol and cabling is required to be used for the
development of the local area network.
2. Background
There are three areas that are required to be covered in the local area network for the
proposed solution and it is required to be secured from unauthroised access. A router is
connected with the areas and transmits the data packets from different source to the destination
address. The security threats associated with each of the areas are required to be analyzed and it
is compared with the OSI layers such as the presentation, application and session layers. A VPN
server is required to be set up for allowing the remote user to connect with the network and

4
NETWORK AND SECURITY
transmit the data packets [3]. The exchange of the different information in the network is
controlled in the session layer and sending it to the nodes connected in the network. The
transport layer is utilized by the session layer for transmitting the data packets to the destination
address in the network. The interface can be distinguished and issues regarding the security
measures followed by the network are controlled by the session layer and can be used for the
establishment of the remote connection with the user [10]. The presentation layer of the OSI
layer is used for management of the information generated from different applications and it
translated the data like conversion of the EBCDIC into the ASCII file. The presentation layer
also deals with the encryption and decryption of the data and it ensures that the data sent using
the application layer is accessible to the application of the other end. The application layer is
utilized for establishment of a process to process communication and the protocols such as
SMTP, FTP, etc. works on the application layer [7]. Large files can be shared with the
application layer and it is responsible for error handling, recovery and controlling the flow of
data in the network depending on the applications used for communicating with each other.
The security issues associated with each of the network are compared and the proposed
network solution is prepared according to the requirement of the organization. The first router is
used for providing internet to the client pcs connected in the interface of the first router. The
router two is used for firewall and denying access of the unknown hosts to connect with the
network. The router three is used as a frame relay and transfer the data packets to the remote
client connected using the VPN service securely over the network. A proper addressing scheme
is required to be followed for interconnecting the devices and communicate with each other. A

5
NETWORK AND SECURITY
3. Methods
The data are collected from different sources and the success of the project is dependent
on the effectiveness of the data collection methodology followed for the development of the
project. The researcher have the responsibility to conduct a feasibility study on the project and
choose the data that can be implemented for reduction of the errors generated in the system and
increase the efficacy of the current project [5]. During conduction of the research rules and
regulation are followed and the right and wrong behavior of the personnel are also involved in
the rese5arch process of the organization. The security policy that can be implemented for the
improvement of the current project is analyzed for application in the current project. The
protection of the organizational data is required to be considered for the application of the
security policy and prevention of the third party access of the network resources [1]. A network
addressing plan is prepared for the network and demonstrated in the following table.
Device Interface Network Address IP Address Subnet Mask
Router 1 S0/3/0 192.168.100.20/30 192.168.100.21 255.255.255.252
S0/3/1 10.10.0.0/30 10.10.0.1 255.255.255.252
S0/2/0 203.0.113.0/28 203.0.113.1 255.255.255.240
Router 2 S0/3/0 192.168.100.20/30 192.168.100.22 255.255.255.252
G0/0.10 192.168.10.0/24 192.168.10.1 255.255.255.0
G0/0.20 192.168.20.0/24 192.168.20.1 255.255.255.0
G0/0.30 192.168.30.0/24 192.168.30.1 255.255.255.0
G0/0.40 192.168.40.0/24 192.168.40.1 255.255.255.0
Router 3 S0/3/0 10.10.2.0/30 10.10.2.2 255.255.255.252

6
NETWORK AND SECURITY
S0/3/1 10.10.2.0/30 10.10.2.1 255.255.255.252
G0/0 10.10.1.0/24 10.10.1.1 255.255.255.0
Fa0/0 10.10.10.0/30 10.10.10.1 255.255.255.252
Router 4 S0/3/0 10.10.2.0/30 10.10.2.2 255.255.255.252
G0/0 10.10.3.0/24 10.10.3.1 255.255.255.0
Fa0/0 10.10.10.0/30 10.10.10.2 255.255.255.252
A project plan is created after analyzing the different layers of the OSI model and the
connection between them. A detailed study is done on the OSI layers and the networking
protocols for the preparation of the project. The threats associated with the address resolution
protocol and the binding of the Mac address with an IP address in the network is also considered
for securing the network from external agents [15]. The routing table stores the MAC address of
the nodes connected in the network and the corresponding IP address of the nodes for connecting
with them. The HTTP connection can be set with SSL for establishment of a secure
communication channel between the client and the receiver connected in the network.
WBS Task Name Duration
1 Requirement analysis 2 days
2 Selection of server for host 3 days
3 Configuring the server 2 days
4 Analysis of core module 3 days
5 Analysis of supporting module 5 days

7
NETWORK AND SECURITY
6 development of core module 4 days
7 Quality assurance and
standardization
7 days
8 Client training 3 days
9 Quality assurance report and
testing
4 days
10 QA management reporting 8 days
11 Development of the network
system
9 days
12 Documentation 7 days

8
NETWORK AND SECURITY
The network design is created and attached with the report for detailed understanding and
getting the overview of the network.
Figure 1: Network Diagram of the proposed solution
(Source: Created by author)
4. Results
The threats and vulnerabilities associated with the network are found after analysis of the
session, presentation and application layer of the OSI layer. They are mitigated with the
application of the cloud relay and creation of username and password in the server for
connecting the remote client to use the network components and communicate with the other
devices connected in the network [11]. The network diagram is prepared with including five

9
NETWORK AND SECURITY
routers and four routers are used for connecting the local device and the sixth router is used for
connecting with the remote clients with the network.
The vulnerabilities of the session layer identified for the preparation of the network are
listed as follows:
 TCP session hijacking for getting the access of the resources connected in the
network
 The ID of the client, password and the permission provided can be accessed by
the hijackers from the session layer and get the unauthroised access of the
network.
 The data can be spilled with the use of the third party applications and service in
the network
The presentation layer is also vulnerable to different service and they are listed as
follows:
 Lack of processing of the information in the presentation layer can result in
crashing of the application and the service
 The unauthroised user can gain access of the server by utilizing the Unicode and
directories and it is required to be protect ted from the unauthroised access.
 The imperfection in the cryptography can also results in compromise of the
security of the network and it becomes accessible to the hackers.
The threats associated with the application layer are listed as follows:

10
NETWORK AND SECURITY
 The external agents such as virus, worms and Trojans can enter into the
organizational network and may cause leakage of the organizational
information.
 The electronic mails can carry spams and it can be used for phasing attacks
and gaining the access of the organizational resources connected in the
network.
 Any third party application may contain flaw codes and it might act as a door
for the intruder for entering into the network.
For controlling the vulnerabilities and the threats associated with each of the layer of the
OSI model the network administrator is responsible to identify the threat and prepare a risk
mitigation plan and countermeasure for each of the risk associated with the network. The threats
can arise from different points in the network and thus it is required to be monitored for the
prevention of the threats. There are different network analysis tools and software’s available that
can be applied for the monitoring of the network and secure the network from unauthroised
access [16]. The routers are required to be configured with username and password such that it
cannot be accessed by any third party for modification of the network configuration. An
appropriate network cabling plan is required to be used for interconnecting the device and reduce
the congestion of the network traffic and increase the efficiency of the proposed network
solution. All the routers are required to be configured with the same protocol such that it can
decrypt the received message from another router connected in the network. Secure socket later
and TLS can be applied in the network for transmission of the data packets in the network
securely and some of the network channels can be isolated by addition of permission control in
the network [9]. An SSH connection is required to be setup and public key is required to be

11
NETWORK AND SECURITY
generated from the devices for encryption of the connection and connecting with the VPN server.
The server used for the establishment of the VPN connection can be LINUX or Windows and
public key is required for connecting with the server.
5. Conclusion
From the above report it can be concluded that the network is developed after a detailed
analysis of the OSI layers and the risk associated with the different layers of the model is
analyzed for the development of the network solution. The routers are configured with frame
relay for allowing remote client to connect with the network and increase the efficiency of the
network. Firewall and access control list is used for increasing the security of the network. The
routers used in the network are configured with username and password for reducing the risk of
unauthroised access of the router and reconfiguring it. Different subnets and network address is
used for connecting the hosts with each of the routers and VLANs are created for improvement
of the utilization of the bandwidth. For the establishment of the secure VPN connection with the
remote client the username and password is setup for the client and a firewall is installed at the
entry and exit point off the network to filter the unauthroised users to connect with the network.

12
NETWORK AND SECURITY
Bibliography
[1].Asrani, Aman, Vipul Koul, and Rishabh Khot. "Review of Network Steganography
Techniques." Imperial Journal of Interdisciplinary Research 2, no. 12 (2016).
[2].Dham, Vikram, and Padmanabha R. Rao. "Systems and methods for establishing network
connections using local mediation services." U.S. Patent 8,626,879, issued January 7,
2014.
[3].Duursma, Martin, Anatoliy Panasyuk, Robert Ciraldo, Anthony Ungerman, Bradley
Pedersen, Tom Davis III, and Marc Bloomfield. "Apparatus and method for determining
a program neighborhood for a client node in a client-server network." U.S. Patent
8,527,615, issued September 3, 2013.
[4].Falk, Rainer, and Florian Kohlmayer. "Method and arrangement for providing a wireless
mesh network." U.S. Patent 8,495,360, issued July 23, 2013.
[5].Huang, Xingxing, Jianyang Shi, Jiehui Li, Yiguang Wang, and Nan Chi. "A Gb/s VLC
transmission using hardware preequalization circuit." IEEE Photonics Technology Letters
27, no. 18 (2015): 1915-1918.
[6].Karaoguz, Jeyhan, and Richard G. Martin. "Communication system and method for
discovering end-points that utilize a link layer connection in a wired/wireless local area
network." U.S. Patent 8,493,918, issued July 23, 2013.
[7].Lor, Kar-Wing Edward, Richard Martin, and Alarabi Omar Hassen. "Enterprise wireless
local area network switching system." U.S. Patent 8,838,752, issued September 16, 2014.
[8].Mahalingam, Mallik, Dinesh Dutt, Kenneth Duda, Puneet Agarwal, Lawrence Kreeger,
T. Sridhar, Mike Bursell, and Chris Wright. Virtual extensible local area network

13
NETWORK AND SECURITY
(VXLAN): A framework for overlaying virtualized layer 2 networks over layer 3
networks. No. RFC 7348. 2014.
[9].Monk, Anton, Ron Porat, Wee Peng Goh, Magnus Berggren, Ron Lee, Edward Warner,
Brett Bernath, and Yusuf Ozturk. "Physical layer transmitter for use in a broadband local
area network." U.S. Patent 8,621,539, issued December 31, 2013.
[10]. Mowry, Robert P. "Method and apparatus for a storage server to automatically
discover and join a network storage cluster." U.S. Patent Application 14/546,979, filed
November 18, 2014.
[11]. Neuhaeuser, Jakob, and Lorenzo D'Angelo. "Collecting and distributing wearable
sensor data: An embedded personal area network to local area network gateway server."
In Engineering in Medicine and Biology Society (EMBC), 2013 35th Annual
International Conference of the IEEE, pp. 4650-4653. IEEE, 2013.
[12]. Phatak, Shirish H., Chandra Kilaru Satish, Murali Rangarajan, and Pratik
Shankarial Rana. "Transparent file system access for wide area network file system
acceleration." U.S. Patent 8,346,966, issued January 1, 2013.
[13]. Scherzer, Tamir, and Shimon Scherzer. "Dynamically created and expanded
wireless network." U.S. Patent 8,358,638, issued January 22, 2013.
[14]. Sheynblat, Leonid. "Local area network assisted positioning." U.S. Patent
8,483,717, issued July 9, 2013.
[15]. Taniuchi, Kenichi, Yoshihiro Ohba, Sunil Madhani, Subir Das, and Ashutosh
Dutta. "Network discovery mechanisms." U.S. Patent 8,717,931, issued May 6, 2014.
[16]. Thiyagarajan, Venkatesan. "Systems and methods for updating firmware over a
network." U.S. Patent 8,966,101, issued February 24, 2015.