CCNA Security v2.0: Modern Network Threats

Modern Network Security Threats

• The presentation is about modern network security threats.
• The course is CCNA Security v2.0.
• The presenter is Dr. Nadhir Ben Halima.
• The presentation outlines the following topics:
  • Introduction
  • Securing networks
  • Network threats
  • Mitigating threats
  • Summary

Securing Networks

• The current network security landscape needs to be described.
• All types of networks require protection.

Current State of Affairs

• Networks are targets for various attacks.

Networks Are Targets

• Data shows attack origins, targets, and attack types.
• Locations of attacks and perpetrators are presented on a world map.
• The data represents past attacks (2015).

Drivers for Network Security

• Common network security terms are:
  • Threat
  • Vulnerability
  • Mitigation
  • Risk
• The presentation includes examples of vulnerabilities and their severity scores.

Vectors of Network Attacks

• External threats attack via the internet.
• Internal threats attack from compromised hosts.

Data Loss

• Vectors of data loss include:
  • Email/Webmail
  • Unencrypted Devices
  • Cloud Storage Devices
  • Removable Media
  • Hard Copy
  • Improper Access Control

Network Topology Overview

• Different network topologies (Campus Area Networks, SOHO Networks, Wide Area Networks, and Data Center Networks) are shown.
• Each topology has a diagram illustrating the components and their connections.

Campus Area Networks

• Components include:
  • AAA Server
  • ASA Firewall
  • Layer 3 Switches
  • Layer 2 Switches
  • Web Server
  • Email Server
  • DHCP Server
  • Hosts
  • VPN
  • IPS
  • ESA/WSA

Small Office and Home Office Networks

• Components include:
  • Wireless router
  • Layer 2 switch
  • Wireless host
  • Desktop computers

Wide Area Networks

• Components include:
  • Branch Site
  • POP (Point of Presence)
  • Regional Site
  • SOHO Site
  • Mobile Worker
  • Main Site
  • Cisco ASA Firewall
  • Corporate

Data Center Networks

• Outside perimeter security includes:
  • On-premise security officers
  • Fences and gates
  • Continuous video surveillance
  • Security breach alarms
• Inside perimeter security includes:
  • Electronic motion detectors
  • Security traps
  • Continuous video surveillance
  • Biometric access and exit sensors

Network Threats

• An understanding of the evolution of network security is crucial.
• The different types of attack tools used by hackers need to be described.
• Malware needs to be described.
• Common network attacks should be explained.

Who is Hacking Our Networks?

• Different types of hackers are discussed:
  • Script Kiddies
  • Vulnerability Brokers
  • Hacktivists
  • Cyber Criminals
  • State-Sponsored Hackers
• The presentation also includes White Hat Hackers, Grey Hat Hackers, and Black Hat Hackers.

Hacker Tools

• The various types of attack tools used by hackers are discussed.

Introduction of Attack Tools

• Shows the trend of increasing sophistication of attack tools and technical knowledge needed over time.

Evolution of Security Tools

• The evolution of security tools is discussed (like Penetration testing tools, Forensic, Debuggers).

Categories of Attack Tools

• Network hacking attacks are outlined, including:
  • Eavesdropping
  • Data modification
  • IP address spoofing
  • Denial-of-service
  • Man-in-the-middle
  • Compromised-key
  • Sniffer

Malware

• Various types of malware are presented and defined in detail, such as viruses, worms, and Trojan horses. Diagrams illustrating the different malwares are shown.

Viruses

• A malicious program is described.
• A Warning! slide about virus alert is included

Trojan Horse Classification

• Types of Trojan Horses are reviewed (security software disabler, remote-access, data-sending, destructive, proxy, FTP, DoS).

Worms

• Initial Code Red Worm Infection and later infection spread details are shown in world maps.
• The worm propagation steps are highlighted, including the repeat cycle, propagation details and attack steps.

Other Malware

• Shows other types of Malware, such as Adware, Spyware, Rootkits, and Scareware, and Phishing.

Common Network Attacks

• Types of common Network Attacks (Syn Flood, Smurf, Reconnaissance, DoS, etc) are discussed. Diagrams are displayed

Reconnaissance Attacks

• Initial query a target network
• Ping sweep of the target (network)
• Port scan of active IP addresses
• Exploit vulnerability scanners
• Using exploitation tools

Access Attacks

• A few reasons why hackers use access attacks are:
  • To retrieve data
  • To gain access
  • To escalate access privileges
• Examples of access attacks are presented (password attacks, port redirection, man-in-the-middle attacks, buffer overflow, IP, MAC, and DHCP spoofing.

Social Engineering Attacks

• Types of social engineering attacks are reviewed (Pretexting, Phishing, Spearphishing).
• Descriptions and examples for each attack are given.
• Other methods include Spam, Tailgating, and Something for Something.

Denial of Service Attacks

• A denial-of-service attack is explained with a diagram showing multiple pings targeting a web server, overwhelming it until it cannot respond.

DDoS Attacks

• How hackers build a network of infected machines (botnet) and control them to launch a distributed denial-of-service attack is discussed.
• The concept of zombies is explained.

Mitigating Threats

• Methods and resources to protect networks are described.
• A collection of domains for network security is described.
• The purpose of Cisco SecureX Architecture is explained.
• Techniques to mitigate common network attacks are described.
• How to secure three functional areas (control, management, and data planes) of Cisco routers and switches is explained.
• Specific steps such as developing policy, educating employees, controlling physical access, and using strong passwords are suggested to mitigate threats.

Defending the Network

• Best practices for network defense are detailed (developing a security policy, educating employees, controlling physical access).
• Best practice recommendations are outlined, including password policies, data encryption, and data backup.
• Tools to mitigate malware (antivirus software, anti-spyware, firewall, anti-spam) are outlined.
• Methods to mitigate worms (inoculation, containment, quarantine, treatment) are discussed with an accompanying diagram.

Mitigating Reconnaissance Attacks

• Ways to mitigate reconnaissance attacks:
  • Implement authentication for proper access.
  • Use encryption and tools to detect packet sniffer attacks
    • implement a switched infrastructure.
  • Use a firewall and IPS

Mitigating Access Attacks

• Recommendations for password security (using strong passwords, the Principle of minimum trust, Cryptography).
• The importance of applying operating system and application patches to prevent potential vulnerabilities and security exploits.

Mitigating DoS Attacks

• Using IPS and firewalls (Cisco ASAs and ISRs) and Antispoofing technologies, and Quality of Service-traffic policing are suggestions for mitigating DoS attacks.

Cisco Network Foundation Protection Framework

• The NFP Framework is explained in terms of control and management planes.

Securing the Control Plane

• AutoSecure and Routing protocol authentication and Control Plane Policing (CoPP) techniques are reviewed

Securing the Management Plane

• A review of best practices for Securing the Management Plane (Enabling login/password policy, Presenting legal notifications, Ensuring confidentiality of data, Role-based control, Authorizing actions, and enabling management reporting.

Securing the Data Plane

• ACLs and Antispoofing, and Layer 2 security strategies are detailed for securing the Data Plane.

Summary

• Chapter objectives are to explain network security, describe different types of threats and attacks, and explain tools/procedures for mitigating the effects of malware and common network attacks.