Network Security: Terms, Attacks, Components

Common Network Security Terms

• Threat: Something causing damage or danger.
• Vulnerability: Weakness.
• Mitigation: Reduces the chance of an attack.
• Risk: The possibility of something bad happening.

Vectors of Network Attacks

• All users can pass through the network after going through firewalls.
• Firewalls can either block or allow users.

Data Loss Vectors

• Email/Webmail
• Unencrypted Devices
• Cloud Storage Devices: Location of information is unknown.
• Removable Media: USB drives, disks.
• Hard Copy
• Improper Access Control: Someone untrusted accessing email.

Campus Area Network Components

• ASA Firewall (Adaptive Security Appliance): Filters traffic.
• AAA Server (Authentication, Authorization, Accounting).
• IPS (Intrusion Prevention System).
• DMZ (DHCP server, Email Server, Web Server, ESA/WSA).

Firewalls and VPNs

• Firewall: Hardware or software protecting a network from another.
• VPN (Virtual Private Network): Protects privacy by encrypting online traffic, securing sensitive data from hackers and surveillance, even on public WiFi.
• Firewall/VPN Device: Combines features of both.

Small Office and Home Office Networks (SOHO Network)

• SOHO networks are used in small offices and home offices

Wide Area Networks (WAN)

• Used by companies with many branches.
• VPN use secures the connection.

Security of Data Center Networks

• Outside Perimeter Security:
  • On-premise security officers.
  • Fences and gates.
  • Continuous video surveillance.
  • Security breach alarms.
• Inside Perimeter Security:
  • Electronic motion detectors.
  • Security traps.
  • Continuous video surveillance.
  • Biometric access and exit sensors.

VM Specific Threats

• Hyperjacking.
• Instant On activation.
• Antivirus storm.

Components of a Secure Data Center

• Secure segmentation.
• Threat defense.
• Visibility.

Critical MDM Functions for BYOD Networks

• Data encryption.
• PIN enforcement.
• Data wipe.
• Data loss prevention.
• Jailbreak/root detection.

Modern Hacking Titles

• Script Kiddies: Unskilled attackers using available programs.
• Vulnerability Brokers.
• Hacktivists: Fight for someone's rights.
• Cyber Criminals.
• State-Sponsored Hackers: Work for governments.

Penetration Testing Tools

• Password crackers: Crack passwords.
• Wireless hacking: Man in the middle attacks.
• Network scanning/hacking: Nmap.
• Packet crafting.
• Packet sniffers: Capture network data packets.
• Rootkit detectors.
• Fuzzers: Search vulnerabilities.
• Forensic tools.
• Debuggers.
• Hacking operating systems.
• Encryption.
• Vulnerability exploitation.
• Vulnerability Scanners.

Network Hacking Attacks

• Eavesdropping.
• Data modification.
• IP address spoofing.
• Password-based attacks.
• Denial-of-service.
• Man-in-the-middle.
• Compromised-key.
• Sniffer.

Malware

• Software designed to disrupt, damage, or gain unauthorized access to a computer system.
• Types of Malware:
  • Virus: Attaches to a program, replicates.
  • Trojan Horse: Non-self replicating, unexpected functionality.
  • Worm: replicates through a network.
  • Ransomware: Prevents access unless ransom is paid.
  • Spyware: Spies on someone.
  • Adware: Fake displayed ad.
  • Scareware: Pop up.
  • Phishing: Scams to deceive people, revealing information.
  • Rootkits: Like trojan.
• Trojan Horse Classifications:
  • Security software disabler
  • Remote-access
  • Data-sending
  • Destructive
  • Proxy
  • FTP
  • DoS components of Worm
  • Enabling vulnerability.
  • Propagation mechanism.
  • Payload.

Why Networks Are Targeted

• Data manipulation: Changing data for a purpose.
• SYN flood: Denial-of-service attack, consuming resources.
• Smurf attack: Distributed denial-of-service attack using ICMP packets. Uses DOS (1 device) and DDOS (Multiple devices, done with zombies)
• IP Spoofing: Gaining unauthorized access by impersonating another machine.
• System Compromise: Zombies.

Network Attacks

• Syn flood (DOS).
• Data Modification.
• Smurf attack (DDOS).

Reconnaissance Attacks

• Initial query of a target.
• Ping sweep of the target network.
• Port scan of active IP addresses.
• Vulnerability scanners.
• Exploitation tools.

Why Hackers Use Access Attacks

• Retrieve data.
• Gain access.
• Escalate access privileges

Types of Access Attacks

• Password.
• Trust exploitation.
• Port redirection.
• Man-in-the-middle.
• Buffer overflow.
• IP, MAC, DHCP spoofing.

Social Engineering Attacks

• Pretexting.
• Phishing.
• Spear Phishing.
• Spam.
• Something for Something (Trojan).
• Baiting.

DOS Attack

• DOS (Denial of Service): Overwhelming a network/server with excessive traffic.

DDOS Attack

• DDOS (Distributed Denial of Service):
  • Hacker builds a network of infected machines (botnet).
  • Compromised computers (zombies) are controlled by handler systems.
  • Zombie computers scan and infect more targets.
  • Hacker instructs handler system to carry out DDoS attack.

Types of Network Security Professionals

• Chief Information Officer (CIO).
• Chief Information Security Officer (CISO).
• Security Operations (SecOps) Manager.
• Chief Security Officer (CSO).
• Security Manager.
• Network Security Engineer.

Security Organizations

• CERT - www.cert.org
• SANS - www.sans.org
• MITRE - www.mitre.org
• FIRST (Forum of Incident Response and Security Teams) - www.first.org
• InfoSec (Information System Security) - www.infosyssec.org
• (ISC)² (International Information System Security Certification Consortium) - www.isc2.org
• MS-ISAC (Multi-State Information Sharing & Analysis Center) - msisac.cisecurity.org
• Components of Cryptography
  • Confidentiality: Encryption to hide data.
  • Integrity: Hashing algorithms to ensure data is unaltered.
  • Availability: Assuring data accessibility, network hardening, and backups.

Network Security Domains

• Risk assessment.
• Security policy.
• Organization of information security.
• Asset management.
• Human resources security.
• Physical and environmental security.
• Communications and operations management.
• Information systems acquisition, development, and maintenance.
• Access control.
• Information security incident management.
• Business continuity management.
• Compliance.

Network Security Policy Use

• Used for mitigation.

Network Security Policy

• Based on specific questions.
  • What do you have that others want?
  • What processes, data, or information systems are critical to you?
  • What would stop your business or organization?

Security Artichoke

• Way to protect with many layers of security.
• Artichoke attack: Attacker breaks through layers one by one to reveal data.

SecureX Product Families

• Server Edge and Branch.
• Secure Email and Web.
• Secure Mobility.
• Secure Access.
• Secure Data Center and Virtualization.

Security Policies Based on Five Parameters

• Type of device being used.
• Person's identity.
• Application in use.
• Location.
• Time of access.

Mitigating Malware

• Stopping or reducing damage from malicious software.

Mitigating Worms

• Inoculation: Preventive method against network attacks.
• Quarantine: Removing infected system to prevent worm spread.
• Treatment: Removing the worm and repairing damage.

Mitigating Reconnaissance Attacks

• Implementing authentication.
• Using encryption.
• Using anti-sniffer tools.
• Implementing switched infrastructure.
• Using a firewall and IPS.

Mitigating Access Attacks

• Strong password security.
• Principle of minimum trust.
• Cryptography.
• Applying OS and application patches.

Mitigating DoS Attacks

• Using IPS and firewalls (Cisco ASAs and ISRs).
• Anti Spoofing technologies.
• Quality of service-traffic policing.

NFP Framework

Securing the Control Plane

• AutoSecure.
• Routing protocol authentication.
• Control Plane Policing (CoPP).

Securing the Management Plane

• Enabling login and password policy.
• Presenting legal notification.
• Ensuring confidentiality via SSH and HTTPS.
• Enabling role-based access control.
• Authorizing actions.
• Enabling management access reporting.

Securing the Data Plane

• Using ACLs.
• Anti Spoofing.
• Layer 2 security including port security, DHCP snooping, and DAI.

Chapter Objectives

• Explain network security.
• Describe various types of threats and attacks.
• Explain tools and procedures to mitigate the effects of malware and common network attacks.

Explore common network security terms like threat, vulnerability, mitigation, and risk. Learn about network attack vectors and data loss vectors. Understand campus area network components and the difference between firewalls and VPNs.