LAN Security Sabrina

LAN Security

• LAN security is a critical component of protecting network resources.
• Attacks on a network may result in loss of time and money due to damage or theft of information or assets.
• Intruders gain network access through software vulnerabilities, hardware attacks, or by guessing usernames and passwords.
• Threat actors gain access to modify software or exploit vulnerabilities.
• After network access, four types of threats may arise:
  • Information Theft
  • Data loss and manipulation
  • Identity Theft
  • Disruption of service

Types of Vulnerabilities

• Vulnerability is the degree of weakness in a network or device.
• Routers, switches, desktops, servers, and security devices have inherent vulnerabilities.
• Network devices under attack are typically endpoints such as servers and desktop computers.
• Three primary vulnerabilities include:
  • Technological: TCP/IP issues, OS weaknesses, Network Equipment weaknesses
  • Configuration: unsecured accounts, easily guessed passwords, misconfigured services and network equipment, unsecure default settings.
  • Security Policy: Lack of written policy, inadequate authentication, missing logical access controls.
• All three of these can leave a network or device open to various attacks, including malicious code and network attacks.

Physical Security

• Network resources can be compromised physically, denying network resource usage by a threat actor.
• Four classes of physical threats are:
  • Hardware: physical damage to servers, routers, switches, and workstations.
  • Environmental: temperature extremes (hot/cold) and humidity extremes.
  • Electrical: voltage spikes, inadequate power, brownouts, and power loss.
  • Maintenance: improper handling of electrical components, lack of critical spare parts, and inadequate labeling.

Network Attacks Today

• Common network attacks include:
  • Distributed Denial of Service (DDoS): a coordinated attack from multiple devices (zombies) to halt public access to websites and resources.
  • Data Breach: an attack compromising organizational data servers or hosts to steal confidential information.
  • Malware: an attack infecting hosts with malicious software causing various problems, e.g., ransomware.

Endpoint Protection

• Endpoints are laptops, desktops, servers, and IP phones as well as employee-owned devices.
• Vulnerable to malware-related attacks originating from email or web browsing.
• Security features include antivirus/antimalware, host-based firewalls, host-based intrusion prevention systems (HIPSs).
• Combination of NAC, AMP, email security appliance (ESA), and web security appliance (WSA).

Authentication with a Local Password

• Authentication methods offer varying security levels.
• Simplest method is using login and password combinations on console, vty lines, and aux ports.
• SSH is a more secure form of remote access requiring a username and password that can be authenticated locally.
• Local database method has limitations as it is not scalable and lacks fallback authentication.

AAA Components

• AAA stands for Authentication, Authorization, and Accounting, providing a framework to control access on network devices.
• Authentication verifies who can access a network.
• Authorization defines what users can do while connected to the network.
• Accounting audits actions performed while accessing the network.

Local and Server-Based AAA Authentication

• Local AAA stores usernames and passwords locally on network devices, ideal for small networks.
• Server-based uses a central AAA server storing usernames and passwords for all users, using RADIUS or TACACS+ protocols to communicate with the AAA server, more suitable for larger networks with multiple routers/switches.

Authorization

• AAA authorization is automatic, doesn't require additional steps after authentication.
• Authorization governs users' actions on the network after authentication.
• Authorization uses attributes describing the user's network access level, used by the AAA Server to determine privileges and restrictions.

Accounting

• AAA accounting collects and reports usage details like connection times, commands, packet and byte counts.
• Serves for auditing and billing purposes.
• Combines with AAA authentication to create detailed logs of user actions, useful for troubleshooting and detecting malicious activity.

802.1X

• A port-based access control and authentication protocol.
• Restricts unauthorized workstation connections to a LAN through switch ports.
• The authentication server authenticates each workstation before granting access to switch services or the LAN.
• Device roles in 802.1X include Client (Supplicant), Switch (Authenticator), and Authentication Server.

Layer 2 Security Threats (Attacks)

• Layer 2 is a weak link in security because LANs are often trusted for all persons/devices connected.
• Common attacks on Layer 2 include MAC table attacks, VLAN attacks, DHCP, ARP, Address Spoofing, and STP attacks.
• If Layer 2 is compromised, the entire layered network is under attack and can cause significant damage.

ARP Attacks (Addressing Protocols)

• Hosts broadcast ARP requests to find the MAC address of a host with a destination IP address in the subnet.
• The host with a matching IP address responds with ARP replies.
• A client can send an unsolicited ARP reply, called a "gratuitous ARP".
• Attackers can send unsolicited ARP replies with a spoofed MAC address to a switch to compromise it.
• Mitigation techniques include DHCP snooping and Dynamic ARP Inspection (DAI).

VLAN Hopping Attacks

• Attackers potentially bypass the router and utilize a switch's automatic trunking port feature to access all VLANs.
• Double-tagging attacks can encapsulate a frame within a frame enabling access to a different VLAN than expected.

DHCP Attacks

• DHCP starvation attacks flood the network with bogus requests, exhausting resources (DoS).
• DHCP spoofing attacks mislead clients with false IP and gateway/DNS information.
• Mitigating measures involve DHCP snooping.

MAC Address Table Attacks

• MAC address table flooding overwhelms the switch memory, leading to all frames being forwarded on all ports within the same VLAN.
• Attackers can capture traffic meant for other hosts on the local network.
• Port security mitigates this issue by limiting the number of allowed MAC addresses on a switch port, only allowing configured or dynamically learned MAC addresses.

Mitigation of LAN Attacks

• Multitude of mitigation techniques exist
  • Port security
  • DHCP snooping
  • Dynamic ARP Inspection (DAI)
  • IP Source Guard (IPSG)

Port Security

• Secures switch ports against unauthorized access.
• Disables unused ports or limits allowed MAC addresses.
• Static or dynamic learning is implemented for secure MAC addresses.
• Port Security violation modes (shutdown, restrict, protect) manage potential unauthorized access when MAC addresses do not match.
• Configured maximum number of validated MAC addresses on a port.

CDP Reconnaissance

• Cisco Discovery Protocol (CDP) is a proprietary Layer 2 protocol used for discovering network devices by administrators for configuration/troubleshooting.
• Sending unencrypted, unauthenticated broadcasted information useful for network mapping/reconnaissance.
• Disable CDP on edge ports connecting to untrusted devices.

STP Attacks

• Attackers use STP to capture network traffic.
• Attackers spoof root bridges and modify network topologies.
• Mitigation involves employing BPDU Guard on all access ports.
• PortFast enables immediate forwarding for access ports, bypassing listening and learning stages to speed up network convergence, but may create spanning-tree loops when used in non-access ports.

Summary of VLAN Hopping Attacks

• Techniques for VLAN hopping include spoofing DTP, using rogue switches with trunk links, and using double-tagging.
• Counter-measures involve disabling DTP on non-trunking ports, disabling unused ports or placing them in unused VLANs, enabling trunk mode on trunking ports, and setting native VLAN to a value other than 1.