After your Novell file server has been properly set up to take advantage of its native security, you should focus on adding security over and above what is offered with NetWare. Why? Because NetWare Connect was specifically designed to be an access product, not a security product.
There are a variety of security solutions you can employ to add to native NetWare security. Additional security products ensure that your system will be protected as you add remote users. In my opinion, it is critical that remote or "on-net" users be properly authenticated. There are a variety of methods for user authentication, including:
The greatest advantage to using dial back as a solution is its low cost. Quite a few remote communications packages support dial back as a security feature, and some modems support dial back at the hardware level. With so many software and hardware platforms supporting dial back, it is a fairly easy solution to implement. The system will become more difficult to support as the number of remote users increases. On the down side, this solution can create phone billing issues, such as who pays for the calls. On the positive side, it can also eliminate billing issues. It depends on how you set it up.
A cautionary note: remote users should use phone services that do not include call forwarding, or they should shut off the call forwarding feature. Remote users with call forwarding could allow intruders to validate themselves by forwarding phone calls to any location they want. There are many, easy methods to gain access to phone numbers and to change an individual phone number at a remote user location.
Also, make sure that when the call-back process occurs, an actual hang up on the host side occurs. Some phone systems only hang up the call if the calling party hangs up first. Hackers have found that they can hold the line open and spoof the host into thinking a call back verification has occurred. You should thoroughly test for this possibility and eliminate it on any system where call back will be used as a security measure.
How does it work? The CND information is passed to the receiving end of the call between the first and second ring. The CND information is passed directly from the phone company switch that supports the caller to the switch supporting the recipient of the call. The recipient's switch then passes the CND information to the user's premises. There is no actual connection between the caller side and the receiving side before the phone is picked up. This makes spoofing nearly impossible.
The largest drawback to using CND: in most areas, CND information is not passed between multiple phone carriers. So a call originating in phone company A's area does not pass the CND information to the recipient in phone company B's area. The FCC has stated that by April 1995, all the phone companies must be able to pass the CND information to any recipient phone company. This solution is dependent upon when the differing phone companies comply with this request.
Some of the devices for CND verification sit between the phone system and the host's modem. These devices can be set to not pass the call on to the modem if the CND information does not match the remote user's table. There are several leading brand modems that are designed to support different CND features. A solution using CND for security could reside at the modem, a black box on either side of the modem, or in software. As this service becomes more transparent and readily available, it will be a good solution to add to the security tool box.
What is data encryption? A key is used to encrypt or decrypt a packet of information. The key used to encrypt/decrypt a packet of data works just like a physical key and lock. Without the proper key, a lock can not be opened or closed. Both the sender and recipient of the data must use the proper keys to view any information that is being exchanged.
The negotiation of these keys can occur at a variety of times in the communications session. This key exchange process is handled in different ways for use in different encryption solutions. Keys should never be sent in the clear across phone lines. This means that the key used to encrypt/decrypt data should be known by both parties prior to the communications session. In some solutions, the user must actually enter the key. In others solutions, a hardware or software device handles the key negotiation.
Encryption/decryption can be done through the use of special modems, devices that sit between the modem and computer, or by using software. As noted above, these devices or systems will usually handle key exchange and key changes. The process of encryption/decryption can add overhead to the communications process. In an environment where use of an extremely long key is used, the overhead can be significant.
One of the side benefits of data encryption is that it maintains data confidentiality. In a case where the encrypted data stream is being monitored by intruders, they will not be able to decipher the contents of the data without the proper key. Even if an intruder is able to get the data-encrypted data stream, being able to decrypt it with today's systems is nearly impossible without the proper key. Important note: for encryption to be valuable, good key management should accompany the system.
Challenge response systems offer the best added security, since the key values are either continually changed by the host on a time-based system, or are issued only once. Either way, your system is more secure. Some systems change keys at random times as often as every 30 seconds. Other systems generate unique, one-time only passwords every time a user logs on. Both types of systems offer a higher level of security than what is inherent with native NetWare security. Intruders cannot guess the "result" codes because the codes have gone through an encryption algorithm using a key value unknown - and unknowable - to intruders.
Challenge/response systems typically consist of a hardware solution on the host end and a hand-held calculator type device on the remote end. Most of these solutions are operating system and host independent, so they can work with a wide variety of end user solutions. Challenge/response systems are usually easier to manage than most security systems. However, one of the most important components is key management. When you consider what type of challenge/response system will be best for your network, keep in mind key management. Look for solutions where end users and administrators do not have to spend a lot of time administering the system. Do not pass information over unsecured telnets, and, if possible, keep key management in-house. It's more secure.
Easy system and key manageability;
Long-term cost effectiveness (consider per-user cost, not just per-port cost);
Level of security required;
Scalability and flexibility (support for all the platforms in your environment), and
Ease of use for both end users and administrators.