Cybersecurity Fundamentals Part 3

Cybersecurity Fundamentals (Part 3)

• Network Security: A set of measures and strategies to secure network infrastructure, protecting wired/wireless networks, routers, switches, firewalls, servers, and endpoints. Key responsibilities include access control, data protection, network monitoring, and intrusion detection.

Key Responsibilities/Tasks

• Access Control: Only authorized users and devices can access network resources.
• Data Protection: Encrypts data in transit and at rest using protocols like IPSec, SSL/TLS to secure sensitive information.
• Network Monitoring and Logging: Continuous monitoring of network traffic, detecting security incidents, monitoring network activity, analyzing logs to find anomalies, and using IDS/IPS systems to block or alert on suspicious activity and threats.

Network Security (II)

• Perimeter Defense: Security controls at the network perimeter to filter incoming/outgoing traffic (firewalls and DMZs), monitor/detect intrusion using IDS/IPS, and secure remote access with VPNs.
• Network Vulnerability Management: Regularly assessing the network for vulnerabilities and taking action to mitigate them, such as ensuring network devices are configured securely (patches/updates), and conducting security assessments (penetration testing).

Network Security (III)

• Network Security Activities (NIST Framework Core Functions):
  • Identify: Asset Management (ID.AM), Risk Assessment (ID.RA), Network Security Governance (ID.GV).
  • Protect: Access Control (PR.AC), Network Segmentation (PR.AC-5), Encryption (PR.DS-2), Endpoint Protection (PR.PT), Security Training (RP.AT)
  • Detect: Network Traffic Analysis (DE.AE), Log and Event Monitoring (DE.CM), Intrusion Detection (DE.DP)

Network Security (IV)

• Respond: Network Incident Response Plan (RS.RP), Security Incident Investigation (RS.AN), Mitigation and Containment (RS.MI), Communication and Reporting (RS.CO), Forensics (RS.AN-3)
• Recover: Business Continuity (BC) Planning (RC.RP), System Restoration (RC.RP), Lessons Learned (RC.IM), Post-Incident Review (RC.IM)

TCP/IP Network Model

• Key Points: Stacked protocol layers and data encapsulation. This shows a clear relationship between the TCP/IP and OSI models illustrating how protocols and services relate to each layer.

TCP/IP Vulnerabilities, Threats and Attacks

• Main Weakness: Lack of built-in security, and lack of native methods for encryption, integrity, and authentication.
• Generic Threats/Attacks:
  • Sniffing: Unauthorized interception/monitoring of network traffic (exploits lack of encryption).
  • Spoofing: Masquerading as something or someone else in a network communication (lack of authentication).
  • Hijacking: Attacker takes control of an established network session/connection between two parties (lack of authentication/integrity and weaknesses in session management).
  • Man-in-the-Middle (MitM) Attacks: Attacker intercepts (and potentially alters) communication between sender and receiver without their knowledge (MitM exploits issues in the network layers).
  • Denial of Service (DoS): Make network resources, services, or applications unavailable to legitimate users by overwhelming them with excessive traffic/requests.
  • Hostile network activity: Actions taken by attackers or malicious actors to compromise network security, gain unauthorized access, or disrupt network operations. This includes actions like port scanning, brute-force attacks.

Secure Protocols

• Secure protocols: Address security concerns (confidentiality, integrity, authenticity) in data and communications, improving upon the classic TCP/IP functionality. Protocols can be implemented at various layers of the stack, applying cryptographic techniques.

IPsec (Internet Protocol Security)

• Network Layer (Layer 3): A suite of protocols used to secure IP communications at the network layer. Provides IP packet authentication and (optionally) encryption using HMAC and ESP. IKE provides secure key exchanges. Uses Asymmetric encryption, Different Hellman, Digital Certificates

TLS (Transport Layer Security)

• Transport Layer (Layer 4): Secure communication channel between a client and server at the transport layer. Provides data integrity, confidentiality, and authentication at the packet level. Uses Handshake Protocol and Record Protocol.

SSH (Secure Shell)

• Application Layer (Layer 7): Provides end-to-end encryption for interactive sessions, adds user authentication methods such as password and public keys.

Perimeter Protection

• Objective: Securing an organization's network by protecting the outer boundary (perimeter) from external threats/attacks.
• Countermeasures:
  • Firewalls and network segmentation
  • Virtual Private Networks (VPNs)
  • Intrusion Detection and Prevention Systems (IDS/IPS)
  • Security Information and Event Management (SIEM) Systems
  • Web Application Firewalls (WAFs), Content Filtering

Firewalls

• Network Access Control Devices: Barrier between the organization's internal network and the untrusted external network. Uses filtering and controlling incoming/outgoing network traffic based on predefined security rules. All traffic passes through to permit or deny authorized traffic

Virtual Private Networks (VPNs)

• Extension of a private local network over an uncontrolled public network infrastructure.
• Typical Function: Establishing secure connections to maintain the confidentiality of traffic, relies on tunneling by creating a logical connection between endpoints, encapsulating one protocol within another. Common use cases include secure interconnection across parts of an organization, and remote access for users to connect to the internal network.
  • Different ways of tunneling

Intrusion Detection/Prevention Systems (IDS/IPS)

• IDS: Monitors network/system activity for signs of unauthorized access, attacks, or abnormal behavior. Passive and alerts on potential threats.
• IPS: Same detection methods as IDS, takes automated actions to prevent or mitigate detected threats. Proactive, blocking traffic to/from specific IP addresses, dropping malicious packets, and resetting connections.
• Deployment Types: Network-based (NIDS) sensors monitor traffic, and host-based (HIDS) agents monitor individual device activities, such as file changes, logs, and system calls.
• Detection Methods: Signature-based and Anomaly-based.