CC · Domain 4
Network Security
About 24% of the exam
The OSI layers
- 7 Application
- where the app meets network
- 6 Presentation
- formatting, encoding, encryption
- 5 Session
- sets up and tears down
- 4 Transport
- TCP and UDP, port numbers
- 3 Network
- IP addressing and routing
- 2 Data link
- MAC addresses and frames
- 1 Physical
- cables, radio and voltage
Switches work at layer 2 with MAC addresses, routers at layer 3 with IP addresses, and modern firewalls read layer 7
TCP, UDP and friends
- Client sends SYN
- Server answers SYN-ACK
- Client sends ACK
- Data flows
- FIN closes politely
- TCP
- connection oriented and reliable
- UDP
- fast, best effort, no handshake
- Three-way handshake
- SYN, SYN-ACK, ACK
- RST flag
- the connection was abruptly ended
- ICMP
- ping and traceroute messages
- ARP
- maps IP to MAC
- DHCP
- hands out addresses automatically
- DNS
- turns names into addresses
Addressing
- IPv4
- 32 bits, four octets
- IPv6
- 128 bits, written in hexadecimal
- Private ranges
- 10, 172.16 and 192.168
- Loopback
- 127.0.0.1, the host itself
- Subnet mask
- splits network from host
- NAT
- many private, one public
- Default gateway
- the way off the subnet
- MAC address
- burned into the network interface
Devices on the path
- Hub
- repeats to every port
- Switch
- forwards frames by MAC
- Router
- moves packets between networks
- Firewall
- allows or blocks by rule
- Proxy
- makes requests on your behalf
- Load balancer
- spreads traffic across servers
- Access point
- provides the wireless link
- Endpoint
- the laptop, phone or server
Attacks on the network
Denial of service
- DoS comes from one source
- DDoS comes from a botnet
- Amplification abuses open resolvers
- Reflection forges the victim address
- Rate limiting and scrubbing help
Interception
- On-path sits between the parties
- Sniffing reads unencrypted traffic
- ARP spoofing redirects the local segment
- Evil twin copies the wireless name
- DNS poisoning sends you elsewhere
Malicious code
- Virus needs a host file
- Worm spreads with no help
- Trojan hides inside useful software
- Ransomware encrypts and demands payment
- Side-channel leaks through timing or power
Encryption defeats sniffing, authentication defeats spoofing, and capacity plus filtering defeats flooding
Defenses and where they sit
Filtering
- Firewall enforces the rule list
- Implicit deny ends every list
- Stateful inspection tracks the connection
- Web application firewall protects apps
- Content filter blocks whole categories
Detection
- IDS alerts, IPS blocks
- Host based watches one machine
- Network based watches a segment
- Signatures find the known
- Anomaly detection finds the unusual
- SIEM correlates it all together
Separation
- DMZ holds public facing servers
- VLAN separates logically on one switch
- Microsegmentation isolates individual workloads
- Network access control checks posture
- Guest wireless never touches internal
Ports to know
- 20, 21
- FTP data and control
- 22
- SSH, SFTP and SCP
- 23
- Telnet, plaintext, avoid it
- 25
- SMTP mail transfer
- 53
- DNS name lookups
- 67, 68
- DHCP server and client
- 80, 443
- HTTP and HTTPS
- 110, 143
- POP3 and IMAP
- 389, 636
- LDAP and LDAPS
- 3389
- remote desktop protocol
Swap the insecure protocol
- Telnet to SSH
- encrypted remote command line
- FTP to SFTP
- file transfer over SSH
- HTTP to HTTPS
- TLS protects the session
- POP3 to POP3S
- mail retrieval with TLS
- SNMPv1 to SNMPv3
- adds authentication and encryption
- LDAP to LDAPS
- directory queries over TLS
- WEP to WPA3
- modern wireless protection
Wireless
- WEP is broken, never deploy it
- WPA2 personal shares one passphrase
- WPA3 uses simultaneous authentication of equals
- Enterprise mode authenticates each user
- Change the default administrator password
- Hiding the network name is not security
- MAC filtering is easily bypassed
- Keep guest wireless isolated
VPN and remote access
- VPN
- encrypted tunnel over public network
- Site to site
- office to office link
- Remote access
- one user into the office
- Split tunnel
- only work traffic is tunneled
- Full tunnel
- everything routes through the office
- IPSec
- tunnel at the network layer
- TLS VPN
- runs through the browser
Cloud models
- IaaS
- you manage the operating system
- PaaS
- you manage the application
- SaaS
- you manage the data only
- Public cloud
- shared, multi-tenant infrastructure
- Private cloud
- dedicated to one organization
- Hybrid
- public and private together
- Community
- shared by similar organizations
- Managed provider
- someone else runs it
Data center essentials
- Redundant power feeds and generators
- UPS covers the switchover gap
- HVAC holds temperature and humidity
- Fire suppression that spares equipment
- Hot aisle and cold aisle layout
- Physical access logged and monitored
- Written agreements with the provider
Zero trust thinking
- Never trust, always verify
- Check user, device and context
- Assume the network is hostile
- Grant the smallest useful access
- Re-check when conditions change
- Segment so one breach stays small
Rapid recall
- Switch
- layer 2, MAC addresses
- Router
- layer 3, IP addresses
- IDS
- watches and alerts
- IPS
- watches and blocks
- DMZ
- screened subnet for public services
- VLAN
- logical separation on one switch
- NAT
- hides internal addresses
- Honeypot
- decoy nobody should touch
Reference strip: layers, attacks, defenses, cloud
Layers and protocols
- OSI seven layers in order
- TCP, UDP, ICMP, ARP, DHCP, DNS
- IPv4, IPv6, NAT, subnetting
- Ports 22, 53, 80, 443, 3389
Attacks
- DoS, DDoS, amplification, reflection
- On-path, sniffing, ARP spoofing
- Evil twin and rogue access point
- Virus, worm, trojan, ransomware
Defenses
- Firewall, proxy, content filter
- IDS, IPS, host and network based
- SIEM, antivirus, endpoint protection
- Network access control and posture
Separation
- DMZ, VLAN, microsegmentation
- Guest network isolation
- VPN, site to site and remote
- Zero trust and defense in depth
Cloud and facility
- IaaS, PaaS, SaaS responsibility split
- Public, private, hybrid, community
- Service level agreements and providers
- Power, cooling, fire suppression, redundancy
Quick exam traps
- Trap: Hiding the wireless network name protects it
- Trap: An intrusion detection system blocks the attack
- Trap: NAT is a security control in its own right
- Trap: A padlock icon means the website is trustworthy
- Trap: A VLAN isolates as strongly as a separate physical network
- Trap: UDP is safer than TCP because it is connectionless
- Trap: Moving to the cloud makes the provider responsible for your data
cybercertprep.com · original revision sheet written from the public body of knowledge