Network Security Terms and Components

• Common network security terms are:
• A threat is anything that can cause damage or danger.
• Vulnerability refers to a weakness.
• Mitigation is reducing the chance of an attack.
• Risk represents the possibility of something bad happening.

Network Attack Vectors

• All users can pass through the network after going through firewalls.
• Firewalls can either block or allow users.

Data Loss Vectors

• Potential vectors for data loss include:
• Email and webmail
• Unencrypted devices
• Cloud storage devices
• Removable media like USB drives and disks
• Hard copies
• Improper access control, like an untrusted person accessing email

Campus Area Network Components

• Campus Area Network contains elements such as:
• ASA firewall to filter traffic
• AAA server for authentication, authorization, and accounting
• IPS for intrusion prevention
• DMZ, which includes DHCP, email, and web servers, ESA/WSA

Security Devices

• A firewall can be hardware or software and protects one network from another.
• VPNs (Virtual Private Networks) protect privacy by encrypting online traffic. This sensitive data can be protected data from hackers and government surveillance agencies.
• Firewalls and VPN features are sometimes combined into a single device.

Network Types

• Small Office and Home Office (SOHO) networks use a wireless router and a Layer 2 switch.
• Wide Area Networks (WANs) are used by companies with many branches, often using a VPN to secure the line.

Data Center Security

• Outside perimeter security includes:
• On-premise security officers, fences, and gates
• Continuous video surveillance
• Security breach alarms
• Inside perimeter security includes:
• Electronic motion detectors and security traps
• Continuous video surveillance
• Biometric access and exit sensors

Virtual Machine Threats

• VM (Virtual Machine) threats include:
• Hyperjacking
• Instant On activation, and antivirus storms
• Secure Data Center components include:
• Secure segmentation
• Threat defense, and visibility
• Critical MDM (Mobile Device Management) functions for BYOD (Bring Your Own Device) networks include:
• Data encryption
• PIN enforcement, data wipe
• Data loss prevention
• Jailbreak/root detection

Modern Hacking Titles

• Current hacking roles include:
• Script Kiddies: unskilled attackers that use readily available programs
• Vulnerability Brokers
• Hacktivists: individuals who fight for a cause
• Cyber Criminals
• State-Sponsored Hackers: those who work for governments

Penetration Testing

• Penetration testing tools:
• Password crackers, wireless hacking, network scanning,
• Packet crafting and sniffers, rootkit detectors
• Fuzzers, forensics, debuggers
• Hacking operating systems and vulnerability scanners

Network Hacking Attacks

• Types of network hacking attacks:
• Eavesdropping and data modification
• IP address spoofing and password-based attacks (like guessing)
• Denial-of-service, man-in-the-middle, compromised-key attacks, and sniffers

Malware Types

• Malware is software designed to disrupt, damage, or gain unauthorized access to a system.
• Types of malware:
• Viruses attach to programs and replicate.
• Trojan Horses are non-self-replicating malware that contain unexpected functions.
• Worms propagate copies of self through a network.
• Ransomware is malicious software that prevents users from accessing their systems
• Spyware spies on someone
• Adware delivers malicious code and fake displayed ads when clicked.
• Scareware is pop ups.
• Phishing scams are used by attackers, deceive people into revealing sensitive information.
• Rootkits are like trojan viruses.

Trojan Classifications

• Trojan Horses are classified as:
• Security software disablers, used for remote access, data-sending
• Destructive, used as a proxy, FTP
• DoS
• Worms' components are:
• Enabling vulnerability, propagation mechanism, and payload

Network Targeting Reasons

Networks are targeted because of:

• Data manipulation: changing data for a purpose.
• SYN flood: overwhelms a system with SYN requests.
• Smurf attack: uses ICMP packets with a spoofed source IP broadcast to a network like DoS or DDoS.
• IP Spoofing: gains unauthorized access by impersonating another machine.
• Systems compromised by hackers become zombies.

Network Attack Variants

• Additional network attacks include:
• Syn flood (DoS)
• Data Modification
• Smurf attack (DDoS)
• Reconnaissance Attacks involve:
• Initial queries, ping sweeps, port scans, vulnerability scans
• Exploitation tools

Hacker Attack Objectives

• Hackers use access attacks to:
• Retrieve data.
• Gain access.
• Escalate access privileges.

Common Access Attacks

• Types of access attacks include:
• Password attacks.
• Trust exploitation and port redirection.
• Man-in-the-middle attacks.
• Buffer overflow attacks.
• IP, MAC, DHCP spoofing.

Social Engineering Attacks

• Social engineering attacks consist of:
• Pretexting: Using an invented scenario to persuade victims to divulge information or perform actions
• Phishing: Sending fraudulent emails or messages that appear to be from legitimate sources to trick individuals into providing sensitive information
• Spear Phishing: Targeting specific individuals or groups with personalized phishing attacks
• Spam: Sending unsolicited bulk emails as a form of advertising or to distribute malware
• Something for Something (Trojan): Offering a seemingly valuable item or service in exchange for the victim's cooperation, leading to the installation of malware
• Baiting: Using a false promise (e.g., a free download or enticing offer) to lure victims into a trap, often involving malware or data theft

DoS and DDoS Attacks

• A DoS (Denial of Service) attack overwhelms a network or server with excessive traffic.
• A DDOS (Distributed Denial of Service) attack
• A hacker builds a network of infected machines called a botnet controlled by handler systems, with compromised computers are called zombies.
• Zombie computers scan for more targets while the hacker instructs the botnet to carry out the DDoS attack.

Network Security Roles

• Network security professionals include:
• Chief Information Officer (CIO)/Chief Information Security Officer (CISO)
• Security Operations (SecOps) Manager
• Chief Security Officer (CSO)
• Security Manager
• Network Security Engineer

Security Organizations

• Types of network security organizations:
• CERT: www.cert.org
• SANS: www.sans.org
• MITRE: www.mitre.org
• FIRST (Forum of Incident Response and Security Teams): www.first.org
• InfoSec (Information System Security): www.infosyssec.org
• (ISC)² (International Information System Security Certification Consortium): www.isc2.org
• MS-ISAC (Multi-State Information Sharing & Analysis Center): msisac.cisecurity.org

Cryptography Components

• Cryptography components:
• Confidentiality: Uses encryption to hide data.
• Integrity: Uses hashing algorithms to ensure data is unaltered.
• Availabilit Assures data is accessible. Guaranteed by network hardening mechanisms and backup systems.

Network Security Domains

• Network security domains include:
• Risk assessment and security policy
• Organization of information security and asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Information systems acquisition, development, and maintenance
• Access control
• Information security incident management
• Business continuity management
• Compliance
• Network security policy: is used for mitigation.
• Network security policy questions to be made:
• What do others want from you?
• Which processes, things, or systems are critical to you?
• What would stop your company or organization from doing its goals?

Security Artichoke

• A security artichoke protects something by using many layers of security.
• The artichoke attack: describes when an attacker breaks through layers of security one by one of defensives.

SecureX

• SecureX product families:
• Server Edge and Branch
• Secure Email and Web
• Secure Mobility
• Secure Access
• Secure Data Center and Virtualization

Network Scanning Element

• Centralized Context-Aware Network Scanning Elements define security policies based on:
• Type of device being used for access
• Person's identity
• Application in use
• Location
• Time of access

Mitigating Malware

• Mitigating Malware: involves using antivirus, antispyware, firewalls, antispam, and antiphishing measures, removing the malware, blocking its spread, and fixing any problems caused.

Mitigating Worms

• To mitigate worms via:
• Inoculation: is a preventive method (Before infection).
• Quarantine: Restriction to prevent the spread of worms (After infection).
• Treatment: Remove the worm.

Mitigating Reconnaissance Attacks

What are mitigation techniques used to mitigate reconnaissance attacks?

• Implement authentication
• Use encryption
• Use anti-sniffer tools.
• Implement a switched infrastructure.
• Use a firewall and IPS.

Mitigating Access Attacks

• Mitigation methods for access attacks include:
• Strong password security.
• Principle of minimum trust.
• Cryptography.
• Applying OS and application patches.

Mitigating DoS Attacks

To mitigatie DoS attacks:

• IPS and firewalls (Cisco ASAs and ISRs).
• Anti Spoofing technologies.
• Quality of service-traffic policing.

Securing NPS Framework

• To secure the control plane:
• Configure AutoSecure
• Implement routing protocol authentication
• Implement Control Plane Policing (CoPP)
• How to secure the management plane:
• By enabling login/password policies, presenting legal notifications
• Ensuring data confidentiality via SSH and HTTPS
• Enabling role-based access control, authorizing actions, and enabling management access reporting
• To secure the data plane:
• Use ACLs
• Anti Spoofing
• Layer 2 security, DHCP snooping, dynamic ARP inspection (DAI)

Chapter Objectives

• Key objectives include explaining network security, describing various types of threats and attacks, and explaining tools and procedures to mitigate malware and common network attacks.

Explore network security terms like threats, vulnerabilities, mitigation, and risk. Learn about network attack vectors, data loss vectors including email, unencrypted devices, and removable media. Understand campus area network components such as ASA firewalls, AAA servers, IPS, and DMZ.