Network Security Fundamentals

Securing Networks

• This section aims to describe the current network security landscape and explain the need to protect all types of networks.

Current State of Affairs

• Networks are targets of various attacks.

Drivers for Network Security

• Threat refers to a potential danger to a network.
• Vulnerability refers to weakness in system that can be exploited.
• Mitigation involves actions taken to reduce impact or likelihood of a threat.
• Risk indicates the potential for loss or damage when a vulnerability is exploited.

Vectors of Network Attacks

• Network attacks can originate from external threats, internal threats or compromised hosts.

Data Loss

• Data can be lost through Email/Webmail, unencrypted devices, cloud storage, removable media, hard copies, or improper access controls.

Network Topology Overview

• Networks can be divided into Campus Area Networks, Small Office and Home Office Networks, Wide Area Networks, and Data Center Networks

Data Center Network security

• Outside perimeter security for data centers include on-premise security, fences and gates, continuous video surveillance and security breach alarms
• Inside perimeter security includes electronic motion detectors, security traps, continuous video surveillance and biometric access and exit sensors

Network Threats

• This section aims to enable students to describe the evolution of network security
• To describe the various types of attack tools used by hackers
• To Describe malware and explain common network attacks

Who is Hacking Our Networks?

• Modern hacking titles include script kiddies, Vulnerability Brokers, Hacktivists, Cyber Criminals, State-Sponsored Hackers

Hacker Tools

• Sophistication of attacker tools and technical knowledge needed has increased.

Evolution of Security Tools

• Penetration testing tools include password crackers, wireless hacking, network scanning/hacking, packet crafting/sniffers, rootkit detectors and fuzzers to search vulnerabilities
• Other tools include forensic tools, debuggers, hacking operating systems, encryption tools, vulnerability exploitation tools and vulnerability scanners

Categories of Attack Tools

• Network hacking attacks include eavesdropping, data modification, IP address spoofing, denial-of-service, man-in-the-middle, compromised-key, and sniffers.

Malware

• Is malicious software.

Types of Malware

• Virus is malicious software which executes a specific unwanted, often harmful, function
• Worm executes arbitrary code; installs copies of itself in infected computer's memory; automatically replicates and spreads across networks
• Trojan horse is a non-self-replicating malware that contains malicious code, designed to look like a legitimate application or file

Trojan Horse Classifications

• Can be classified as a: Security software disabler, Remote-access tool, Data-sending tool, Destructive tool, Proxy, FTP, or DoS tool.

Worm Components

• Worm components include enabling vulnerability, propagation mechanism and a payload.
• The worm will propagate for 19 days, launch DoS attack for the next 7 days, stop and go dormant for a few days, then repeat the cycle.

Other Types of Malware

• Other types of malware are Ransomware, Scareware, Spyware, Phishing, Adware and Rootkits

Types of Network Attacks

• Include Reconnaissance, Access, and DoS

Reconnaissance Attacks

• Initial query of a target
• Ping sweep of the target network
• Port scan of active IP addresses
• Vulnerability scanners
• Exploitation tools

Access Attacks

• Some reasons why hackers use access attacks are to retrieve data, to gain access or to escalate access privileges
• Types of access attacks include password attacks, port redirection attacks, man-in-the-middle attacks, buffer overflows, and IP, MAC and DHCP spoofing

Social Engineering Attacks

• Social Engineering Attacks include: Pretexting, Phishing, Spearphishing, Spam, Tailgating, and Something for Something

Denial of Service Attacks

• Designed to disrupt network access

DDoS Attacks

• The steps for DDoS attacks include building a network of infected machines, use those zombie computers to scan and infect more targets, then the hacker instructs the system to make the botnet of zombies carry out the DDoS attack
• A network of infected hosts is called a botnet.
• Compromised computers are called zombies, controlled by handler systems.

Mitigating Threats

• The goal of the section is to learn about the methods and resources to protect the networks
• To understand a collection of domains for network security
• Explain the purpose of the Cisco SecureX Architecture
• Describe the techniques used to mitigate common network attacks
• Explain how to secure the three functional areas of Cisco routers and switches

Defending the Network

• Includes network security professionals and various security organizations.

Network Security Professionals

• Include Chief Information Officer (CIO), Chief Information Security Officer (CISO), Security Operations (SecOps) Manager, Chief Security Officer (CSO), Security Manager, and Network Security Engineer

Network Security Organizations

• Include CERT, SANS, MITRE, FIRST, INFOSYSSEC, MS-ISAC

Confidentiality, Integrity, Availability

• Confidentiality uses encryption to encrypt and hide data
• Integrity uses hashing algorithms to ensure data is unaltered during operation
• Availability assures data is accessible guaranteed by network hardening mechanisms and backup systems

Network Security Domains

• Include: Risk assessment, security policy, organization of information security, Asset management, human resources security, Physical and environmental security
• Also includes communications and operations management, information systems acquisition, development, and maintenance, access control
• Other components are information security incident management, business continuity management, and compliance.

Network Security Policy Objectives

• It's important to consider what data you have that others want.
• What data or information sysstems are critical.
• What would stop the company from doing business .

Mitigating Common Network Threats

• Requires implementing certain measures for each threat.

Defending the Network

• Best practices include developing written security policies, educating employees about social engineering risks, controlling physical access to systems, using strong passwords.
• Further practices include encrypting sensitive data, implementing security hardware/software, performing regular backups, shutting down unnecessary ports/services, keeping patches updated and performing security audits

Mitigating Malware

• Anti-virus and security software can mitigate malware threats

Mitigating Worms

• Processes include inoculation, containment, and quarantining and treatment

Mitigating Reconnaissance Attacks

• Techniques include implementing authentication for access, using encryption for packet sniffers, and anti-sniffer tools, and using firewalls and IPS.

Mitigating Access Attacks

• This requires strong passwords, the principle of minimum trust, cryptography and applying system patches

Mitigating DoS Attacks

• IPS and firewalls, antispoofing technologies, and quality of service traffic policing

NFP Framework

• The Cisco Network Foundation Protection (NFP) Framework is comprised of three planes: control, management and data

Securing the Control Plane

• The control plane is secured through AutoSecure, routing protocol authentication and control plane policing

Securing the Management Plane

• Achieved by enabling login and password policy, legal notification, ensuring data confidentiality using SSH and HTTPS, role-based access control, authorizing actions, and enabling management access reporting

Securing the Data Plane

• Secured using ACLs, antispoofing, and Layer 2 security including port security, DHCP snooping, and DAI

Securing Network Devices

• This secion explains how to secure a network perimeter
• How to configure secure administrative access to Cisco routers
• Enhanced security for virtual logins
• How to configure an SSH daemon for secure remote management.

Securing the Edge Router

• Edge Router Security Approaches can include a single router, defense in depth, or use a DMZ.
• Three areas of Router Security are physical, router operating system and configuration file, and router hardening.

Secure Administrative Access Tasks

• Restrict device accessibility.
• Log and account for all access.
• Authenticate access.
• Authorize actions.
• Present legal notification.
• Ensure the confidentiality of data.

Secure Local and Remote Access

• Local access can be achieved through a serial connection
• Remote Access can be done using Telnet/SSH or Modem and Aux Port

Configuring Secure Administrative Access

• Guidelines for strong passwords include using at least 10 characters, mixing uppercase and lowercase letters, numbers, symbols, and spaces.
• Avoid dictionary words and easily identifiable information. Misspell words and change passwords. Never write passwords down.
• Configure all secret passwords using type 8 or type 9 passwords.

Securing Line Access

Configuring Enhanced Security for Virtual Logins

• Virtual login security enhancements include implementing delays between successive login attempts, enabling login shutdown, and generating system-logging messages for login detection.
• The login block-for command sets blocking time, attempts, and the time window for attempts.

Configuring SSH

• SSH can be enabled on a Cisco router as an SSH server or client.
• SSH client running on a host, such as PuTTY, OpenSSH, or TeraTerm.

Assigning Administrative Roles

• Administrative privilege levels control command availability.
• Role-based CLI access also controls command availability.

Configuring Privilege Levels

• Privilege levels range from 0 to 15, with 0 being user-level access, 1 being the default for router login, 2-14 being customizable, and 15 being for enable mode.
• EXEC mode is privilege level 1, with only user-level commands.
• Privileged EXEC mode is level 15 with all enable-level commands.
• The privilege mode {level level | reset} command is used to configure privilege levels.
• A command with multiple keywords grants access to all commands using those keywords.

Configuring Role-Based CLI

• Security operator privileges example includes configuring AAA, issuing show commands, and configuring firewall, IDS/IPS, and NetFlow.
• WAN engineer privilege examples includes configuring routing and interfaces and issuing show commands.
• Superviews contain views but not commands, two superviews can share a CLI view.

Monitoring and Managing Devices

• Use the Cisco IOS resilient configuration feature to secure the Cisco IOS image and configuration files.
• Compare in-band and out-of-band management access.
• Configure syslog to log system events, secure SNMPv3 access using ACLs, and NTP to accurately timestamp all devices.

Securing Cisco IOS Image and Configuration Files

• The Cisco IOS Resilient Configuration feature copies the running configuration to the primary bootset.
• This feature secures the smallest working set of files and detects image or configuration version mismatch automatically.

Using Syslog for Network Security

• Syslog sends system messages to a Syslog server.
• Syslog security levels range from 0 (emergencies, system unusable) to 7 (debugging messages).
• Column 1 of a Syslog includes the sequence number.
• Column 2 contains a timestamp, facility of message origin and severity.
• Also includes the mnemonic and description.

Configuring System Logging

• Configuring steps:
  • logging host [hostname | ip-address]
  • logging trap level (optional)
  • logging source-interface interface-type interface-number
  • logging on

Using SNMP for Network Security

• A managed node uses an SNMP agent to communicate with an SNMP Manager.

Using NTP

• NTP authenticates network time.

Using Automated Security Features

• Use security audit tools to determine IOS-based router vulnerabilities.
• Use AutoSecure to enable security on IOS-based routers.

Performing a Security Audit

• Discovery Protocols CDP and LLDP can indicate security vulnerabilites
• Additional recommendations to ensure device security are:
  • Disable unneccesary services and interfaces
  • Disable and restrict commonly configured management services
  • Disable probes and scans and ensure terminal access security
  • Disable gratuitous and proxy ARPs
  • Disable IP-directed broadcasts

Locking Down a Router Using AutoSecure

• The command auto secure enhances security but does not make the router absolutely secure from all security attacks.
• The auto secure command guides through configuring various security measures.
  • auto secure [no-interact | full] [forwarding | management] [ntp| login | ssh | firewall | tcp-intercept]
• Options for the auto secure command include:
  • no-interact, to avoid prompts for interactive configurations.
  • full, to be prompted for all interactive questions (default).
  • forwarding, to secure forwarding plane only.
  • management, to secure management plane only.
  • ntp, to configure NTP feature.
  • login, to configure login feature.
  • ssh, to configure SSH feature.
  • firewall, to configure firewall feature.
  • tcp-intercept, to configure TCP-Intercept feature.
• Steps for using auto secure are that the command is entered, wizard gathers information about outside interfaces, AutoSecure secures management plane by disabling unnecessary services, and autosecure prompts for a banner as well as passwords, and enables password and login features.
• Next, iterfaces are secured and the forwarding plane is secured.

Securing the Control Plane

• Configure routing protocol authentication.
• Explain the function of Control Plane Policing.

Routing Protocol Authentication

• Consequences of protocol spoofing:
  • Redirect traffic to create routing loops.
  • Redirect traffic to be monitored on an insecure link.
  • Redirect traffic to discard it.

OSPF MD5 Routing Protocol Authentication

• Configured on the router to have neighboring authentication

OSPF SHA Routing Protocol Authentication

• Specifies an SHA authentication key chain and assigns it to the desired interfaces.

Control Plane Policing

• Protects the control plane from DoS attacks.

Network Device Operations

• Include Control and Managment Planes, and Data Plane

Control and Management Plane Vulnerabilities

• Can be secured to add extra layers of security.

CoPP Operation

• CoPP is used in control and managment planes to further secure network device operations

Chapter Objectives:

• Configure secure administrative access.
• Configure command authorization using privilege levels and role-based CLI.
• Implement the secure management and monitoring of network devices.
• Use automated features to enable security on IOS-based routers.
• Implement control plane security.