Troubleshooting Security Issues in Remote Administration

Security Tools and Threats

• Netcat is a tool used for remote system administration and can also perform banner grabbing, which gathers information on OS, services, and applications.
• Banner grabbing can be used by hackers to open a backdoor.

Common Security Issues

• Unencrypted credentials or clear text passwords should never be used, especially with obsolete protocols.
• Logs and events anomalies should be recorded and monitored to identify potential security issues.
• Permission issues can arise from outdated user rights lists.
• Access violations should be logged and alerted.
• Certificate issues occur when a user attempts to use a certificate with an incomplete chain of trust.
• Data exfiltration is an attack where an attacker attempts to steal data.

Troubleshooting Security Issues

• Misconfigured devices, such as firewalls, content filters, and access points, can create security issues.
• Weak security configurations can be improved by choosing strong cipher suites, strong password policies, and educating users.
• Personnel issues can be mitigated by training users and enforcing separation of duties.
• Social engineering attacks can be prevented by training users and enforcing social media policies.
• Unauthorized software can be prevented by having a well-defined policy and regular audits.

Security Weaknesses

• Improper input handling can lead to vulnerabilities, such as SQL injection or cross-site scripting.
• Improper error handling can cause an application to fail or an OS to crash.
• Misconfiguration or weak configuration of ports, networking devices, and protocols can create security risks.
• Default configuration of devices, such as using default VLAN with default credentials, is a risk.
• Resource exhaustion can occur when there is a lack of resources to complete a task.
• Untrained users can fall for spam and leave their PC vulnerable.
• Improperly configured accounts, such as system or generic accounts, can create security risks.
• Vulnerable business processes, such as not performing background checks, can create security risks.

Defense-in-Depth and Layered Security

• Defense-in-depth involves implementing multiple layers of protection, including vendor diversity, control diversity, administrative, technical, and physical controls.
• Vendor diversity involves using security controls from different vendors to increase security.
• Control diversity involves using different security control types, such as technical, administrative, and physical controls.
• Administrative controls include policies, regulations, and laws.
• Technical controls include firewalls, IDS, and proxy servers.
• User training is essential to inform users of threats and help them avoid common attacks.

Network Architecture Concepts

• Zones or topologies include DMZ, extranet, intranet, wireless, guest, and honeynets.
• DMZ is a buffer zone between the internet and an internal network, and every computer in the DMZ should be a bastion host.
• Extranet is a part of the network that can be accessed by authorized entities from outside the network.
• Intranet is an internal network for sharing content with other employees.
• Wireless networks use access points to bridge wired connections.
• Guest networks are typically wireless connections for guests.
• Honeynets are a group of honeypots, which are sloppily locked down servers that allow an attacker relatively easy access to observe current methodologies used in attacks.
• NAT translates public IP to private IP, but is not compatible with IPsec.