3B. Analyse Appliance Monitoring Output

Question 1

Be able to interpret System event logs, Firewall logs, WAF Logs, Proxy Server Logs, Intrusion Detection and Prevention logs

Answer 1

a

Question 2

What information do syslogs provide?

Answer 2

information about the state of the network, servers, hardware, and applications, including details such as errors, security events, and authentication events sent over port 514 TCP/IP. No encryption or authentication.

Question 3

How has syslog been improved in its latest implementation?

Answer 3

• Now uses port 1468 for delivery confirmation, so if a syslog is not delivered, it will be sent again
• Uses TLS to encrypt msgs sent to servers
• Uses MD5/SHA1 for authentication and integrity

Question 4

What is an implicit deny firewall rule?

Answer 4

Traffic that does not match a specified rule is dropped

Question 5

What are some key principles of firewall rulesets?

Answer 5

1) Block incoming requests from internal or private, loopback, and multicast IP address ranges as these have obviously been spoofed
2) Block incoming requests from protocols that should only be functioning at a local network level (e.g., ICMP, DHCP)
3) Configure IPv6 rules. Some hosts run dual-stack TCP/IP implementations with IPv6 on by default. Misconfiguration of a router could allow adversaries unfiltered access to the network over IPv6

Question 6

Dropping vs Rejecting

Answer 6

Dropping involves not informing the client that a packet has been blocked, making it harder for adversaries to determine port states, while Rejecting will send a response to the client, which is useful for troubleshooting

Question 7

What security intelligence do firewall logs provide?

Answer 7

1) Connections permitted or denied
2) Port and protocol usage
3) Bandwidth usage
4) Address translation audit trail

Question 8

What are some guidelines for Egress filtering?

Answer 8

• Allow only whitelisted application ports, restrict destination addresses to authorised internet hosts (or use URL/content filtering to detect malicious traffic)
• Restrict DNS lookups to your own DNS services
• Block known bad IP addresses
• Block IP address spaces that are not authorised on local network
• Block internet access from host subnets that do not need it

Question 9

Firewalking

Answer 9

Recon technique that involves enumerating firewall configurations. Attacker identifies open ports on the perimeter firewall, crafts packet for open port with TTL of one past the firewall. If the packet is received, it will respond with “TTL Exceeded”. Can be mitigated with NAT.

Question 10

Black holes

Answer 10

A type of defensive packet filtering whereby traffic is silently dropped before reaching its destination e.g. to mitigate a DoS, DoS traffic is sent to an IP address that is mapped to a non-existent host.

Question 11

Sinkholes

Answer 11

Similar to black holes, except that traffic is redirected to another network for analysis

Question 12

Forward Proxy

Answer 12

A server that forwards internal host HTTP requests to the intended destination
- Useful if outbound traffic must comply with policies
- Improves performance as it uses caching services

Question 13

Non-transparent Proxy

Answer 13

client must be configured with the server address to have HTTP requests forwarded by proxy server

Question 14

transparent proxy

Answer 14

proxy intercepts traffic even if client isn’t configured to the server address. This is implemented at Network Layer.

Question 15

What do Forward Proxy logs show?

Answer 15

• User ID
• Request method used by client
• HTTP status code
• Size of MIME type of the resource returned to the client

Question 16

Reverse proxy

Answer 16

A server that protects clients from direct contact with client requests.

Question 17

What do Reverse Proxy logs show?

Answer 17

• Indicators of attack or compromise e.g., malicious code in HTTP request headers and URLS
• Statistical analysis of response codes can identify anomalous deviation from baseline traffic

Question 18

What is an IDS?

Answer 18

A packet sniffer (i.e., sensor) placed inside a firewall, attached to a SPAN or TAP port, that uses a ruleset to match suspicious traffic and generate event logs

Question 19

What is IEEE 802.1X?

Answer 19

A standard for encapsulating EAP communications that provide port-based authentication

Question 20

Port-based NAC (PNAC)

Answer 20

Network access device (e.g., switch, router) requests authentication of the connecting host (i.e., supplicant) before activating the port. Does this by activating the EAPoL protocol and waits for the supplicant to provide authentication data

Question 21

Health Policy

Answer 21

set of rules and guidelines that define the minimum security configuration that a device must meet to be granted network access (e.g., firmware version, IDS status)