IP Protocol and Vulnerabilities

Module 3: Attacking the Foundation

• IP (Internet Protocol) operates at Layer 3 as a connectionless protocol, responsible for delivering packets from source to destination.
• IP does not handle packet flow management; TCP at Layer 4 primarily manages this.
• IP Address Spoofing involves threat actors sending packets with modified (spoofed) IP addresses because IP does not validate the source IP address.
• IPv4 headers include a 4-bit version field (set to 0100) and a minimum length of 20 bytes.
• Wireshark is a tool used to analyze IPv4 headers, identifying fields like source IP address, version, header length, DS field, flags, and TTL.
• IPv6 headers also include a 4-bit version field, set to 0110.
• IP vulnerabilities are targeted by various attacks like ICMP, DoS, DDoS, address spoofing, Man-in-the-Middle (MiTM), and session hijacking.
• ICMP (Internet Control Message Protocol) attacks are used for reconnaissance, scanning, DoS, and DDoS; threat actors can inject rogue route entries into routing tables using ICMP router discovery.
• Amplification, reflection, and spoofing techniques are used by threat actors to create DoS attacks.
• Address Spoofing Attacks create packets with false source IP addresses to hide the sender's identity.
• These attacks can be non-blind (session hijacking) or blind (DoS attack).
• MAC (Media Access Control) address spoofing requires access to the internal network.
• UDP (User Datagram Protocol) flood attacks exhaust network resources.
• Attackers use tools like UDP Unicorn to flood a server with UDP packets, often from a spoofed host.
• The server responds with unreachable ICMP port messages, generating traffic that uses up bandwidth.

Module 4: IP Services

• ARP (Address Resolution Protocol) vulnerabilities involve hosts broadcasting ARP Requests to determine the MAC address of a host with a specific IP address.
• Clients can send unsolicited ARP replies, known as "gratuitous ARP."
• ARP poisoning involves threat actors compromising the ARP cache of devices on a local network to conduct MiTM attacks by associating the threat actor's MAC address with the IP address of the default gateway.
• Passive ARP poisoning steals confidential information, while active ARP poisoning modifies data or injects malicious data.
• DNS (Domain Name System) attacks exploit open resolvers that answer queries from clients outside their administrative domain.
• DNS resolver vulnerabilities include amplification and resource utilization attacks.
• DNS amplification attacks involve sending DNS messages to open resolvers using the IP address of a target host; DNS resource utilization attacks (DoS) consume all available resources.
• Domain Generation Algorithms are used in malware to randomly generate domain names as rendezvous points for command and control (C&C) servers.
• DNS Tunneling is stopped by filtering DNS traffic to inspect for longer than average queries or those with suspicious domain names.
• Web attacks redirect victims visiting a compromised web page to a site with malicious code; an exploit kit scans the victim's computer for software vulnerabilities, injects code, and connects to a malware server to download a payload.
• Email threats involve HTML emails bypassing security layers, facilitating attacks like phishing, spam, and malware.
• Security appliances like Cisco Email Security Appliance help detect and block known email threats.
• Web-exposed databases connect web applications to relational databases to access sensitive data.
• Cross-Site Scripting (XSS) occurs when malicious scripts are injected into web pages executed client-side.
• Stored (persistent) XSS is permanently stored on the infected server.
• Reflected (non-persistent) XSS requires a malicious script in a link, and visitors must click the infected link.
• Prevention of XSS attacks involves developers being aware of XSS vulnerabilities and using IPS implementations, web proxies, and services like Cisco Umbrella.
• Network attack mitigation requires vigilance and education, including developing a written security policy, educating employees, controlling physical access, using strong passwords, encrypting data, implementing security hardware and software, performing backups, and keeping software updated.
• Mitigating malware involves using antivirus software and security devices at the network perimeter.
• Mitigating reconnaissance attacks includes implementing authentication, encryption, anti-sniffer tools, a switched infrastructure, and firewalls.
• Mitigating access attacks involves strong password security, the principle of least privilege, cryptography, and applying operating system and application patches.
• Mitigating DoS attacks involves using network software and anti-spoofing technologies like port security, DHCP snooping, IP Source Guard, DAI, and ACLs.

Module 12: System and Network Defense

• Physical security involves using fences and physical barriers, security gates, bollards, vehicle entry barriers, and guard shelters.
• Biometrics uses physiological or behavioral characteristics for authentication, considering factors like accuracy, speed, acceptability, uniqueness, resistance to counterfeiting, reliability, and data storage.
• Surveillance uses RFID asset tags to manage and locate information system assets.
• Application security necessitates a robust process including developing, testing, staging, producing, provisioning, and deprovisioning.
• Security coding techniques include normalization, stored procedures, obfuscation, camouflage, and code reuse.
• Input validation controls data input to maintain database integrity.
• Validation rules check that data falls within defined parameters like size, format, consistency, range, and check digit.
• Integrity checks use hash functions and checksums to measure data consistency.
• Other application security practices include code signing, business continuity planning, and disaster recovery plans, as well as data classification standards and backup procedures for data loss.
• Network hardening involves using a port scanner to detect open ports for insecure network services.
• Secure DHCP by physically securing the DHCP server, patching software, locating the DHCP server behind a firewall, monitoring DHCP activity, and uninstalling unused services and applications.
• Zone transfers and dynamic updates should be disabled or restricted, with enabled logging, DNSSEC, and signed zones.
• Use secure services with authentication, along with system patching and updates to protect routing services.
• Use SSH. rather than Telnet for managing connections because it provides more encryption.
• Use SNMPv3, because it utilizes cryptography and can prevent eavesdropping.
• Implement a Zero Trust model to protect the network's security.
• Wireless and mobile devices require wireless device authentication.
• Mutual authentication prevents unauthorized access.
• Mobile device management secures mobile devices.
• Content and application management should be implemented.
• Implement context-aware authentication and remote wiping.
• High availability design aims to eliminate downtime as much as possible.
• Design principles involve eliminating single points of failure, providing for crossover, and detecting failures.
• N+1 redundancy ensures system availability.
• RAID (Redundant Array of Independent Disks) is used to take data normally stored on a single disk and spreads it out among multiple disks.
• Location redundancy should be used.
• Create resilient designs using methods and configurations that tolerate system or network failures.
• Perform regular data backups and store backups off-site.
• Embedded and specialized systems require security measures.
• Implement firewalls that recognize VoIP to monitor streams and filter abnormal signals.
• Implement secure system software design practices, basic encryption for all controller communication, and firewall implementation in vehicle systems.
• Use honeypots, honeynets, and DNS sinkholes.

Module 18: Cryptography

• Confidentiality is achieved through asymmetric and symmetric encryption.
• Symmetric encryption uses the same pre-shared key to encrypt and decrypt data.
• Asymmetric encryption uses a public key and a private key.
• Data masking replaces sensitive information with non-sensitive versions.
• Steganography hides information in plain sight.
• Elements of secure communications are data integrity, origin authentication, data confidentiality, and non-repudiation.
• Hashing verifies data integrity using one-way functions; MD5 is insecure and should be avoided.
• MD5 produces a 128-bit hashed message.
• SHA-1 creates a 160-bit hashed message and is slightly slower than MD5; it is a legacy algorithm.
• SHA-2 includes SHA-224, SHA-256, SHA-384, and SHA-512.
• SHA-3 is the newest hashing algorithm as a replacement for SHA-2.
• Origin Authentication uses a keyed-hash message authentication code (HMAC) to add integrity assurance.
• Digital forensics uses hashing to verify all digital media that have files.
• Hashing passwords turns any amount of data into a fixed-length digital hash.
• Cracking Hashes involves dictionary and brute-force attacks.
• Implementing salting prevents dictionary attacks and makes it impossible to use lookup tables.
• Public key cryptography uses digital signatures to provide authenticity, integrity, and non-repudiation.
• Digital signatures for digital certificates are equivalent to an electronic passport.
• Authorities and the PKI Trust System uses SSL certificates to confirm website domain identity.
• PKI safeguards digital identities from hacking and facilitates a scalable trust relationship.
• Applications and impacts of cryptography require understanding of cryptographic algorithms for investigating related security incidents.

Module 20: Network Security Data

• Alert data has messages generated by IPSs or IDSs, in response to traffic that goes against the signature of a known exploit.
• Session data is a record of a conversation between two network endpoints.
• Full packet captures are the most detailed network data collected and require the greatest storage.
• Statistical data is created through the analysis of various forms of network data.
• End device logs include host logs from HIDS, which detect and prevent intrusions, creating and storing logs.
• Syslog includes specifications for message formats, a client-server application structure, and network protocol.
• Server logs provide data for network security monitoring.
• DNS Proxy Server logs document all DNS queries and responses.
• SIEM combines SEM and SIM tools for a comprehensive view using log collection, normalization, correlation, aggregation, reporting, and compliance.
• Network logs include Tcpdump, a packet analyzer that displays packet captures.
• NetFlow provides information about network users and applications, peak usage, and traffic routing.
• Cisco Application Visibility and Control uses Cisco NBAR2 to classify applications.
• Content filter logs are the functions devices use to ensure security monitoring.
• Proxy servers generate logs of requests and responses, which can be analyzed to determine which hosts' destinations are safe or potentially malicious, and insights into downloaded resources.
• Next-generation firewalls extend network security beyond IP addresses.

Module 22: Governance and Compliance

• IT Security Governance determines who is authorized to make decisions about cybersecurity risks within an organization.
• A cybersecurity policy is a high-level document outlining an organization's vision for cybersecurity, including goals, needs, scope, and responsibilities.
• Specific security policies include ID and authentication, password, acceptable use, network maintenance, incident handling, data, credential, and organizational policies.
• Ethics in cybersecurity require understanding the law in order to make certain decisions.
• The rights ethics approach is guided by the principle that an individual can make their own decisions.
• There are three categories of cybercrime: computer-targeted, computer-assisted, and computer-incidental.
• IT Security Management Framework follows ISO 27000, a universal framework applicable to every organization.
• Organizations must identify which domains, control objectives, and controls apply to the environment.
• ISO controls address security objectives for data at rest and in transit.
• The CIS created critical security controls to improve the cyber defenses.
• An attestation report (SSAE or SOC) confirms that controls are in place at a specific point in time.