Securing Networks

Securing Networks

• Completion of this section enables describing present network security and explains how all network types require protection.

Current State of Affairs

• Networks face constant attacks from various origins like China, the United States, and Turkey.
• Common attack targets include the United States, Philippines, and South Korea.
• Attack types vary, affecting services, ports, and systems.

Drivers for Network Security

• Common network security terms include threat, vulnerability, mitigation, and risk.

Vectors of Network Attacks

• Network attacks can originate externally through the internet, targeting systems directly
• Attacks can originate internally from compromised hosts, infiltrating the internal network.

Data Loss

• Data loss vectors include email/webmail, unencrypted devices, cloud storage, removable media, hard copies, and improper access control.

Network Topology Overview

• Network topologies include:
  • Campus Area Networks with elements like AAA servers, ASA firewalls, VPNs, and DHCP servers.
  • Small Office/Home Office (SOHO) Networks with wireless routers and layer 2 switches.
  • Wide Area Networks (WANs) connecting branch sites, regional sites, and mobile workers.
  • Data Center Networks employing on-premise security officers, fences, video surveillance, and biometric sensors for security.

Network Threats

• Section completion allows description of network security evolution
• Section completion allows description of attack tools variety used by hackers
• Section completion allows description of malware
• And explanation of typical network attacks

Who is Hacking Our Networks?

• Modern hacking titles include:
  • Script Kiddies.
  • Vulnerability Brokers.
  • Hacktivists.
  • Cyber Criminals.
  • State-Sponsored Hackers.

Hacker Tools

• Penetration testing tools include:
  • Password crackers and wireless hacking tools
  • Network scanning and hacking tools plus packet crafting tools.
  • Packet sniffers and Rootkit detectors.
  • Fuzzers to find vulnerabilities.
• Security tools include:
  • Forensic tools and debuggers.
  • Hacking operating systems and encryption programs.
  • Vulnerability exploitation and vulnerability scanners.

Categories of Attack Tools

• Network hacking attacks:
  • Eavesdropping and data modification
  • IP address spoofing and denial-of-service.
  • Man-in-the-middle and compromised-key attacks.
  • Sniffers

Malware

• Types of malware:
  • Viruses execute unwanted and potentially harmful functions on a device.
  • Worms replicate and spread across networks automatically.
  • Trojan horses disguise themselves as legitimate files or applications to perform malicious acts.
• Trojan horse classifications:
  • Security software disablers and Remote-access tools
  • Data-sending and destructive tools
  • Proxy, FTP, and DoS tools
• Worm components:
  • Enabling vulnerability, Propagation mechanism, and payload
  • Worm propagation happens in cycles including propagating for 19 days, launching an attack for 7 days then going dormant, before repeating

Other Malware

• Other forms of Malware include:
  • Ransomware, Scareware
  • Spyware, Phishing
  • Adware, Rootkits

Types of Network Attacks

• Attacks include:
  • Reconnaissance, used to gather info
  • Access, used to gain access
  • DoS, denial of service
  • Data modification, used to manipulate data
  • Syn Flood, a type of DoS attack
  • Smurf attack, type of DoS

Reconnaissance Attacks

• Actions include:
  • Initial query of target and ping sweep of target network
  • Port scans of active IP addresses, vulnerability scanners, and use of exploitation tools

Access Attacks

• Access attacks are used:
  • To retrieve data and gain access
  • To escalate access privileges
• Types of access attacks:
  • Password attacks and port redirection
  • Man-in-the-middle attacks and buffer overflows.
  • IP, MAC, and DHCP spoofing.

Social Engineering Attacks

• Common attacks include:
  • Pretexting and phishing.
  • Spearphishing and spamming
  • Tailgating and quid pro quo tactics ("something for something").

Denial of Service Attacks

• This disrupts access to services

DDoS Attacks

• A hacker builds a network of infected machines called a botnet, where compromised computers are zombies controlled by handler systems.
• Zombie computers continue to scan and infect more targets.
• The hacker instructs the handler system to make the botnet of zombies carry out the DDoS attack.

Mitigating Threats

• Completion of this section means the ability:
  • To describe defending methods and resources to protect network.
  • To know the domains collection for network security.
  • To explain Cisco SecureX Architecture purpose.
  • To describe techniques used to mitigate common network attacks.
  • To explain securing the three functional areas of Cisco routers and switches.

Defending the Network

• Best practices include:
  • Developing a written security policy.
  • Educating employees about social engineering risks to validate identities.
  • Controlling physical access to systems.
  • Using strong passwords, encrypting sensitive data, and implementing security hardware/software.
  • Performing regular backups, shutting down unnecessary services, and keeping patches up-to-date to prevent privilege escalation.
  • Performing security audits to assess network.

Network Security Professionals

• Personnel roles:
  • CIO and CISO
  • Security Operations Manager and Chief Security Officer
  • Security Manager and Network Security Engineer

Network Security Organizations

• Common organzations include:
  • CERT and SANS
  • MITRE and FIRST
  • (ISC)2 and MS-ISAC

CIA Triad

• Confidentiality uses encryption to protect data, Integrity uses hashing ensures data is pristine during use, Availability assures accessibility through network hardening and backups.

Network Security Domains

• Include:
  • Risk assessment.
  • Security policy and organization of information security, asset management, and human resources security.
  • Physical and environmental security and communications/operations management.
  • Information systems acquisition, development, and maintenance, access control and information security incident management.
  • Compliance and business continuity management.

Mitigating Malware

• Mitigating software to employ:
  • Antivirus, antispyware and internet security
  • Firewall, antispam and antiphishing

Mitigating Worms

• Employ inoculation and quarantines

Mitigating Reconnaissance Attacks

• Implementing authentication to ensure proper access.
• Using encryption to render packet sniffer attacks useless.
• Employ antisniffer tools and a switched infrastructure
• A firewall and IPS should be employed

Mitigating Access Attacks

• Strong password security
• Principle of minimum trust
• Cryptography and applying OS and APP patches protects from access attacks

Mitigating DoS Attacks

• IPS and firewalls (Cisco ASAs and ISRs)
• Antispoofing technologies and Quality of Service-traffic policing

NFP Framework

• Framework including :
  • Control Plane with a Routing Protocol and IP Routing Table.
  • Management Plane with Management Processes.
  • Data Plane with an IP Forwarding Table.
• Elements connect using Exchange of Routing Information, Management Sessions, Incoming and Outgoing packets

Securing the Control Plane

• Employ:
  • AutoSecure actions and routing protocol authentication
  • Control Plane Policing (CoPP)

Securing the Management Plane

• Employ: -Enabling login and password policy.
  • Presenting legal notification.
  • Ensuring the confidentiality of data using SSH and HTTPS.
  • Enabling role-based access control, authorizing actions and enabling management access reporting.

Securing the Data Plane

• Employ:
  • ACLs and antispoofing actions
  • Layer 2 security including port security, DHCP snooping, dynamic ARP inspection (DAI).

Summary

• Chapter aims to explain network security
• Chapter aims to describe threats and attacks types
• Chapter aims to explain tools/procedures to mitigate the effects of malware and network attacks