MODULE 12 - CERTIFICATION CYBER OPS ASSOCIATE Flashcards
Network Topologies
Network Representations
Network architects and administrators must be able to show what their networks will look like.
They need to be able to easily see which components connect to other components, where they will be located, and how they will be connected.
Diagrams of networks often use symbols, like those shown in the figure, to represent the different devices and connections that make up a network.
https://snipboard.io/8cdTEp.jpg
A diagram provides an easy way to understand how devices connect in a large network.
This type of “picture” of a network is known as a topology diagram.
The ability to recognize the logical representations of the physical networking components is critical to being able to visualize the organization and operation of a network.
In addition to these representations, specialized terminology is used to describe how each of these devices and media connect to each other:
– Network Interface Card (NIC)
– Physical Port
– Interface
https://snipboard.io/8cdTEp.jpg
A diagram provides an easy way to understand how devices connect in a large network.
This type of “picture” of a network is known as a topology diagram.
The ability to recognize the logical representations of the physical networking components is critical to being able to visualize the organization and operation of a network.
In addition to these representations, specialized terminology is used to describe how each of these devices and media connect to each other:
– Network Interface Card (NIC)
– Physical Port
– Interface
https://snipboard.io/8cdTEp.jpg
A diagram provides an easy way to understand how devices connect in a large network.
This type of “picture” of a network is known as a topology diagram.
The ability to recognize the logical representations of the physical networking components is critical to being able to visualize the organization and operation of a network.
In addition to these representations, specialized terminology is used to describe how each of these devices and media connect to each other:
– Network Interface Card (NIC)
– Physical Port
– Interface
https://snipboard.io/8cdTEp.jpg
A diagram provides an easy way to understand how devices connect in a large network.
This type of “picture” of a network is known as a topology diagram.
The ability to recognize the logical representations of the physical networking components is critical to being able to visualize the organization and operation of a network.
In addition to these representations, specialized terminology is used to describe how each of these devices and media connect to each other:
– Network Interface Card (NIC)
– Physical Port
– Interface
Network Interface Card (NIC) :
A NIC physically connects the end device to the network.
https://snipboard.io/8cdTEp.jpg
A diagram provides an easy way to understand how devices connect in a large network.
This type of “picture” of a network is known as a topology diagram.
The ability to recognize the logical representations of the physical networking components is critical to being able to visualize the organization and operation of a network.
In addition to these representations, specialized terminology is used to describe how each of these devices and media connect to each other:
– Network Interface Card (NIC)
– Physical Port
– Interface
Physical Port :
A connector or outlet on a networking device where the media connects to an end device or another networking device.
https://snipboard.io/8cdTEp.jpg
A diagram provides an easy way to understand how devices connect in a large network.
This type of “picture” of a network is known as a topology diagram.
The ability to recognize the logical representations of the physical networking components is critical to being able to visualize the organization and operation of a network.
In addition to these representations, specialized terminology is used to describe how each of these devices and media connect to each other:
– Network Interface Card (NIC)
– Physical Port
– Interface
Interface :
Specialized ports on a networking device that connect to individual networks. Because routers connect networks, the ports on a router are referred to as network interfaces. Note: The terms port and interface are often used interchangeably.
Topology Diagrams Topology diagrams are mandatory documentation for anyone working with a network.
They provide a visual map of how the network is connected.
There are two types of topology diagrams:
physical and logical.
Physical Topology Diagrams
Physical topology diagrams illustrate the physical location of intermediary devices and cable installation, as shown in the figure.
You can see that the rooms in which these devices are located are labeled in this physical topology.
https://snipboard.io/TflmrV.jpg
Logical Topology Diagrams
Logical topology diagrams illustrate devices, ports, and the addressing scheme of the network, as shown in the figure.
You can see which end devices are connected to which intermediary devices and what media is being used.
https://snipboard.io/HejSIg.jpg
The topologies shown in the physical and logical diagrams are appropriate for your level of understanding at this point in the course.
Search the internet for “network topology diagrams” to see some more complex examples.
If you add the word “Cisco” to your search phrase, you will find many topologies using icons that are similar to what you have seen in these figures.
Networks of Many Sizes
Now that you are familiar with the components that make up networks and their representations in physical and logical topologies, you are ready to learn about the many different types of networks.
Networks come in all sizes.
They range from simple networks consisting of two computers, to networks connecting millions of devices.
Simple home networks let you share resources, such as printers, documents, pictures, and music, among a few local end devices.
Small office and home office (SOHO) networks allow people to work from home, or a remote office.
Many self-employed workers use these types of networks to advertise and sell products, order supplies, and communicate with customers.
usinesses and large organizations use networks to provide consolidation, storage, and access to information on network servers.
Networks provide email, instant messaging, and collaboration among employees.
Many organizations use their network’s connection to the internet to provide products and services to customers. The internet is the largest network in existence.
In fact, the term internet means a “network of networks”. It is a collection of interconnected private and public networks.
In small businesses and homes, many computers function as both the servers and clients on the network.
This type of network is called a peer-to-peer network.
– Small Home
– Small Office and Home Office
– Medium to Large
– World Wide
In small businesses and homes, many computers function as both the servers and clients on the network.
This type of network is called a peer-to-peer network.
– Small Home
– Small Office and Home Office
– Medium to Large
– World Wide
Small Home :
Small Home Networks Small home networks connect a few computers to each other and to the internet.
In small businesses and homes, many computers function as both the servers and clients on the network.
This type of network is called a peer-to-peer network.
– Small Home
– Small Office and Home Office
– Medium to Large
– World Wide
Small Office and Home Office :
Small Office and Home Office Networks
The SOHO network allows computers in a home office or a remote office to connect to a corporate network, or access centralized, shared resources.
In small businesses and homes, many computers function as both the servers and clients on the network.
This type of network is called a peer-to-peer network.
– Small Home
– Small Office and Home Office
– Medium to Large
– World Wide
Medium to Large :
Medium to Large Networks Medium to large networks, such as those used by corporations and schools, can have many locations with hundreds or thousands of interconnected hosts.
In small businesses and homes, many computers function as both the servers and clients on the network.
This type of network is called a peer-to-peer network.
– Small Home
– Small Office and Home Office
– Medium to Large
– World Wide
Medium to Large :
World Wide Networks
The internet is a network of networks that connects hundreds of millions of computers world-wide.
LANs and WANs Network infrastructures vary greatly in terms of:
Size of the area covered
Number of users connected
Number and types of services available
Area of responsibility
The two most common types of network infrastructures are Local Area Networks (LANs), and Wide Area Networks (WANs).
A LAN is a network infrastructure that provides access to users and end devices in a small geographical area.
A LAN is typically used in a department within an enterprise, a home, or a small business network.
A WAN is a network infrastructure that provides access to other networks over a wide geographical area, which is typically owned and managed by a larger corporation or a telecommunications service provider.
The figure shows LANs connected to a WAN.
https://snipboard.io/8qdmyW.jpg
LANs A LAN is a network infrastructure that spans a small geographical area.
LANs have specific characteristics: LANs interconnect end devices in a limited area such as a home, school, office building, or campus.
A LAN is usually administered by a single organization or individual. Administrative control is enforced at the network level and governs the security and access control policies.
LANs provide high-speed bandwidth to internal end devices and intermediary devices, as shown in the figure.
https://snipboard.io/ZBSFYh.jpg
WANs The figure shows a WAN which interconnects two LANs.
A WAN is a network infrastructure that spans a wide geographical area. WANs are typically managed by service providers (SPs) or Internet Service Providers (ISPs).
WANs have specific characteristics: WANs interconnect LANs over wide geographical areas such as between cities, states, provinces, countries, or continents.
WANs are usually administered by multiple service providers. WANs typically provide slower speed links between LANs.
https://snipboard.io/0cIzWB.jpg
The Three-Layer Network
Design Model
The campus wired LAN uses a hierarchical design model to separate the network topology into modular groups or layers.
Separating the design into layers allows each layer to implement specific functions, which simplifies the network design.
This also simplifies the deployment and management of the network.
The campus wired LAN enables communications between devices in a building or group of buildings, as well as interconnection to the WAN and Internet edge at the network core.
A hierarchical LAN design includes the access, distribution, and core layers as shown in the figure.
Hierarchical Design Model
https://snipboard.io/RsecZd.jpg
Each layer is designed to meet specific functions. The access layer provides endpoints and users direct access to the network.
The distribution layer aggregates access layers and provides connectivity to services. Finally, the core layer provides connectivity between distribution layers for large LAN environments.
User traffic is initiated at the access layer and passes through the other layers if the functionality of those layers is required.
Even though the hierarchical model has three layers, some smaller enterprise networks may implement a two-tier hierarchical design.
In a two-tier hierarchical design, the core and distribution layers are collapsed into one layer, reducing cost and complexity, as shown in the figure.
Collapsed Core
https://snipboard.io/1Qx6D9.jpg
In flat or meshed network architectures, changes tend to affect a large number of systems.
Hierarchical design helps constrain operational changes to a subset of the network, which makes it easy to manage as well as improve resiliency.
Modular structuring of the network into small, easy-to-understand elements also facilitates resiliency through improved fault isolation.
Common Security
Architectures Firewall design is primarily about device interfaces permitting or denying traffic based on the source, the destination, and the type of traffic.
Some designs are as simple as designating an outside network and inside network, which are determined by two interfaces on a firewall.
Here are three common firewall designs.
– Private and Public
– Demilitarized Zone
– Zone-Based Privacy Firewalls
Private and Public :
As shown in the figure, the public network (or outside network) is untrusted, and the private network (or inside network) is trusted.
Typically, a firewall with two interfaces is configured as follows: Traffic originating from the private network is permitted and inspected as it travels toward the public network.
Inspected traffic returning from the public network and associated with traffic that originated from the private network is permitted.
Traffic originating from the public network and traveling to the private network is generally blocked.
https://snipboard.io/GOFqy9.jpg
Common Security
Architectures Firewall design is primarily about device interfaces permitting or denying traffic based on the source, the destination, and the type of traffic.
Some designs are as simple as designating an outside network and inside network, which are determined by two interfaces on a firewall.
Here are three common firewall designs.
– Private and Public
– Demilitarized Zone
– Zone-Based Privacy Firewalls
Demilitarized Zone A demilitarized zone (DMZ) is a firewall design where there is typically one inside interface connected to the private network, one outside interface connected to the public network, and one DMZ interface, as shown in the figure.
Traffic originating from the private network is inspected as it travels toward the public or DMZ network. This traffic is permitted with little or no restriction. Inspected traffic returning from the DMZ or public network to the private network is permitted.
Traffic originating from the DMZ network and traveling to the private network is usually blocked. Traffic originating from the DMZ network and traveling to the public network is selectively permitted based on service requirements.
Traffic originating from the public network and traveling toward the DMZ is selectively permitted and inspected. This type of traffic is typically email, DNS, HTTP, or HTTPS traffic.
Return traffic from the DMZ to the public network is dynamically permitted. Traffic originating from the public network and traveling to the private network is blocked.
https://snipboard.io/XTMkoB.jpg
Common Security
Architectures Firewall design is primarily about device interfaces permitting or denying traffic based on the source, the destination, and the type of traffic.
Some designs are as simple as designating an outside network and inside network, which are determined by two interfaces on a firewall.
Here are three common firewall designs.
– Private and Public
– Demilitarized Zone
– Zone-Based Privacy Firewalls
Zone-Based Privacy Firewalls Zone-based policy firewalls (ZPFs) use the concept of zones to provide additional flexibility.
A zone is a group of one or more interfaces that have similar functions or features. Zones help you specify where a Cisco IOS firewall rule or policy should be applied. In the figure, security policies for LAN 1 and LAN 2 are similar and can be grouped into a zone for firewall configurations.
By default, the traffic between interfaces in the same zone is not subject to any policy and passes freely. However, all zone-to-zone traffic is blocked. In order to permit traffic between zones, a policy allowing or inspecting traffic must be configured.
The only exception to this default deny any policy is the router self zone. The self zone is the router itself and includes all the router interface IP addresses. Policy configurations that include the self zone would apply to traffic destined to and sourced from the router.
By default, there is no policy for this type of traffic. Traffic that should be considered when designing a policy for the self zone includes management plane and control plane traffic, such as SSH, SNMP, and routing protocols.
https://snipboard.io/x1OtNm.jpg
Firewalls A firewall is a system, or group of systems, that enforces an access control policy between networks.
Click each button to learn more about firewalls.
– Common Firewall Properties
– Firewall Benefits
– Firewall Limitations
Click each button to learn more about firewalls.
– Common Firewall Properties
– Firewall Benefits
– Firewall Limitations
Common Firewall Properties :
All firewalls share some common properties: Firewalls are resistant to network attacks.
Firewalls are the only transit point between internal corporate networks and external networks because all traffic flows through the firewall.
Firewalls enforce the access control policy.
Click each button to learn more about firewalls.
– Common Firewall Properties
– Firewall Benefits
– Firewall Limitations
Firewall Benefits :
There are several benefits of using a firewall in a network: They prevent the exposure of sensitive hosts, resources, and applications to untrusted users.
They sanitize protocol flow, which prevents the exploitation of protocol flaws. They block malicious data from servers and clients.
They reduce security management complexity by off-loading most of the network access control to a few firewalls in the network.
Click each button to learn more about firewalls.
– Common Firewall Properties
– Firewall Benefits
– Firewall Limitations
Firewall Limitations :
Firewalls also have some limitations:
A misconfigured firewall can have serious consequences for the network, such as becoming a single point of failure.
The data from many applications cannot be passed over firewalls securely.
Users might proactively search for ways around the firewall to receive blocked material, which exposes the network to potential attack.
Network performance can slow down.
Unauthorized traffic can be tunneled or hidden as legitimate traffic through the firewall.
Firewall Type Descriptions
It is important to understand the different types of firewalls and their specific capabilities so that the right firewall is used for each situation.
– Packet Filtering (Statelss Firewall)
– Statefull Firewall
– Gateway Firewall
– Next Generation Firewall
Packet Filtering (Statelss Firewall) :
Packet filtering firewalls are usually part of a router firewall, which permits or denies traffic based on Layer 3 and Layer 4 information.
They are stateless firewalls that use a simple policy table look-up that filters traffic based on specific criteria. For example, SMTP servers listen to port 25 by default.
An administrator can configure the packet filtering firewall to block port 25 from a specific workstation to prevent it from broadcasting an email virus
https://snipboard.io/CfRVWK.jpg
Firewall Type Descriptions
It is important to understand the different types of firewalls and their specific capabilities so that the right firewall is used for each situation.
– Packet Filtering (Statelss Firewall)
– Statefull Firewall
– Gateway Firewall
– Next Generation Firewall
Statefull Firewall :
Stateful firewalls are the most versatile and the most common firewall technologies in use.
Stateful firewalls provide stateful packet filtering by using connection information maintained in a state table.
Stateful filtering is a firewall architecture that is classified at the network layer.
It also analyzes traffic at OSI Layer 4 and Layer 5.
https://snipboard.io/cT9Lm1.jpg
Firewall Type Descriptions
It is important to understand the different types of firewalls and their specific capabilities so that the right firewall is used for each situation.
– Packet Filtering (Statelss Firewall)
– Statefull Firewall
– Gateway Firewall
– Next Generation Firewall
Gateway Firewall :
An application gateway firewall (proxy firewall), as shown in the figure, filters information at Layers 3, 4, 5, and 7 of the OSI reference model.
Most of the firewall control and filtering is done in software. When a client needs to access a remote server, it connects to a proxy server.
The proxy server connects to the remote server on behalf of the client. Therefore, the server only sees a connection from the proxy server.
https://snipboard.io/36pjma.jpg
Firewall Type Descriptions
It is important to understand the different types of firewalls and their specific capabilities so that the right firewall is used for each situation.
– Packet Filtering (Statelss Firewall)
– Statefull Firewall
– Gateway Firewall
– Next Generation Firewall
Next Generation Firewall :
Next-generation firewalls (NGFW) go beyond stateful firewalls by providing:
Integrated intrusion prevention
Application awareness and control to see and block risky apps
Upgrade paths to include future information feeds
Techniques to address evolving security threats
https://snipboard.io/GYM1CH.jpg
Other methods of implementing firewalls include: :
– Host-based (server and personal) firewall
– Transparent firewall
– Hybrid firewall
Host-based (server and personal) firewall :
A PC or server with firewall software running on it.
Other methods of implementing firewalls include: :
– Host-based (server and personal) firewall
– Transparent firewall
– Hybrid firewall
Transparent firewall :
Filters IP traffic between a pair of bridged interfaces.
Other methods of implementing firewalls include: :
– Host-based (server and personal) firewall
– Transparent firewall
– Hybrid firewall
Hybrid firewall :
A combination of the various firewall types.
For example, an application inspection firewall combines a stateful firewall with an application gateway firewall.
Intrusion Prevention and Detection Devices :
A networking architecture paradigm shift is required to defend against fast-moving and evolving attacks. This must include cost-effective detection and prevention systems, such as intrusion detection systems (IDS) or the more scalable intrusion prevention systems (IPS).
The network architecture integrates these solutions into the entry and exit points of the network.
When implementing IDS or IPS, it is important to be familiar with the types of systems available, host-based and network-based approaches, the placement of these systems, the role of signature categories, and possible actions that a Cisco IOS router can take when an attack is detected.
The figure shows how an IPS device handles malicious traffic.
IDS and IPS Characteristics https://snipboard.io/zjEgfI.jpg
https://snipboard.io/SqwkcD.jpg
IDS and IPS technologies are both deployed as sensors.
An IDS or IPS sensor can be in the form of several different devices:
A router configured with Cisco IOS IPS software
A device specifically designed to provide dedicated IDS or IPS services
A network module installed in an adaptive security appliance (ASA), switch, or router
IDS and IPS technologies use signatures to detect patterns in network traffic.
A signature is a set of rules that an IDS or IPS uses to detect malicious activity.
Signatures can be used to detect severe breaches of security, to detect common network attacks, and to gather information.
IDS and IPS technologies can detect atomic signature patterns (single-packet) or composite signature patterns (multi-packet).
IDS and IPS technologies use signatures to detect patterns in network traffic.
A signature is a set of rules that an IDS or IPS uses to detect malicious activity.
Signatures can be used to detect severe breaches of security, to detect common network attacks, and to gather information.
IDS and IPS technologies can detect atomic signature patterns (single-packet) or composite signature patterns (multi-packet).
IDS and IPS technologies use signatures to detect patterns in network traffic.
A signature is a set of rules that an IDS or IPS uses to detect malicious activity.
Signatures can be used to detect severe breaches of security, to detect common network attacks, and to gather information.
IDS and IPS technologies can detect atomic signature patterns (single-packet) or composite signature patterns (multi-packet).
