SSCP · Domain 6
Network and Communications Security
About 16% of the exam
The models
- 7 Application
- the protocol the app speaks
- 6 Presentation
- encoding and encryption
- 5 Session
- dialog setup and teardown
- 4 Transport
- TCP, UDP and ports
- 3 Network
- IP addressing and routing
- 2 Data link
- frames, MAC, switching
- 1 Physical
- signal, cable and radio
- TCP/IP model
- link, internet, transport, application
Topologies and media
- Star
- every node to a switch
- Mesh
- many redundant paths
- Bus and ring
- legacy, one shared path
- Twisted pair
- cheap, distance limited
- Fiber
- long distance, hard to tap
- Wireless
- shared medium, easily intercepted
- Broadcast domain
- bounded by a router
- Collision domain
- bounded by a switch port
Ports and protocols
- 22
- SSH, SFTP and SCP
- 25, 587
- SMTP transfer and submission
- 53
- DNS over UDP and TCP
- 80, 443
- HTTP and HTTPS
- 88
- Kerberos authentication
- 161, 162
- SNMP polling and traps
- 389, 636
- LDAP and LDAPS
- 445
- SMB file sharing
- 514
- syslog transport
- 3389
- remote desktop protocol
Devices and placement
- Switch
- layer 2 forwarding by MAC
- Router
- layer 3 forwarding by IP
- Firewall
- policy boundary between zones
- Proxy
- breaks and inspects the session
- Load balancer
- distributes and health checks
- Sensor or tap
- sees traffic without changing it
- Jump server
- controlled path into a zone
- Data diode
- one direction, enforced in hardware
Firewalls, sensors and proxies
Firewalls
- Packet filter checks headers only
- Stateful tracks the connection
- Application layer understands the protocol
- Web application firewall for HTTP
- Implicit deny closes the list
IDS and IPS
- IDS observes and alerts
- IPS sits inline and blocks
- Host based watches one system
- Network based watches a segment
- Signature versus anomaly detection
- Tune to reduce false positives
Proxies and shaping
- Forward proxy controls outbound browsing
- Reverse proxy protects internal servers
- Caching improves performance too
- Traffic shaping prioritizes critical flows
Attacks and countermeasures
Layer 2
- ARP poisoning redirects local traffic
- MAC flooding turns a switch dumb
- VLAN hopping crosses segments
- Rogue DHCP hands out bad settings
- Port security and DHCP snooping help
Layer 3 and 4
- IP spoofing forges the source
- SYN flood exhausts connection tables
- Amplification abuses open services
- On-path intercepts and modifies
- Rate limiting and ingress filtering respond
Application and DNS
- DNS poisoning sends users elsewhere
- DNS tunneling smuggles data out
- Session hijacking steals the token
- Injection and scripting hit applications
- DNSSEC and filtering reduce exposure
Most layer 2 attacks need local access, so switch hardening and port security matter as much as the perimeter firewall
Segmentation
- Separate by function and sensitivity
- VLANs still need enforcement between them
- Screened subnet for public services
- Microsegmentation controls east-west traffic
- Keep the management network separate
- Air gap only when truly disconnected
Network access control
- Device connects
- Port stays closed
- Identity checked
- Posture assessed
- VLAN assigned
- 802.1X
- authenticate before the port opens
- Supplicant
- the client asking to join
- Authenticator
- the switch or access point
- Authentication server
- RADIUS makes the decision
- Posture check
- patched, protected and compliant
- Quarantine VLAN
- remediation before full access
- MAC bypass
- for printers, weak but common
Remote access
- IPSec VPN
- network layer, site or client
- TLS VPN
- reaches through web proxies
- Split tunnel
- only corporate traffic tunneled
- Full tunnel
- all traffic through the office
- Always-on
- connects before the user does
- Jump server
- a single audited entry point
- Multi-factor
- mandatory for remote access
Wireless
- WEP
- broken, cracked in minutes
- WPA2 personal
- shared passphrase, offline cracking
- WPA2 enterprise
- 802.1X with per user credentials
- WPA3
- SAE resists offline guessing
- Evil twin
- fake access point, same name
- Deauthentication
- forced disconnect enables capture
- Rogue access point
- unauthorized radio bridging inside
- Site survey
- coverage, interference and rogue detection
Secure device management
- Manage over an out-of-band network
- Change default credentials before deployment
- Disable unused ports and services
- Use SSH and SNMPv3 only
- Back up and version every configuration
- Patch firmware on a schedule
- Send device logs to a collector
Software defined and cloud networks
- Control plane separated from forwarding
- The controller is a prized target
- Policy is pushed, not configured individually
- Cloud gives flow logs, not packets
- Security groups act as host firewalls
- Overlays hide the physical topology
Watching the traffic
- Packet capture
- the full payload, briefly held
- Flow records
- who spoke to whom
- Span port
- copies traffic to a sensor
- Network tap
- passive copy that cannot drop
- Syslog
- device events to a collector
- SNMP trap
- the device reports an event
- Baseline
- what normal traffic looks like
Rapid recall
- Broadcast domain
- one VLAN, split by routers
- Implicit deny
- not permitted means blocked
- North-south
- traffic in and out
- East-west
- traffic between internal systems
- Inline
- can block, adds a dependency
- Out of band
- management path kept separate
- Fail closed
- block when the device fails
Reference strip: layers, devices, attacks, wireless
Fundamentals
- OSI and TCP/IP layer mapping
- Topologies, media, domains
- Addressing, subnetting, NAT
- Ports 22, 53, 443, 445, 3389
Devices
- Switch, router, firewall, proxy
- IDS, IPS, tap, span port
- Load balancer and jump server
- Data diode for one-way transfer
Access control
- 802.1X, RADIUS, posture checks
- Quarantine VLAN and remediation
- VPN types and tunneling choices
- Multi-factor for remote sessions
Attacks
- ARP poisoning, MAC flooding, VLAN hopping
- SYN flood, spoofing, amplification
- DNS poisoning and tunneling
- Evil twin and deauthentication
Wireless
- WEP, WPA2, WPA3, SAE
- Personal versus enterprise mode
- Site surveys and rogue detection
- Guest isolation and IoT segments
Quick exam traps
- Trap: A VLAN alone stops traffic between segments
- Trap: An intrusion detection sensor can block the attack
- Trap: Hiding the wireless network name secures it
- Trap: Split tunneling protects all remote traffic
- Trap: Fiber cannot be tapped at all
- Trap: SNMP version 2c is safe on a management network
- Trap: A span port never drops packets under load
cybercertprep.com · original revision sheet written from the public body of knowledge