Sec+ Chapter 12: Network Security Flashcards
Defense in depth
Medieval army attacking a castle analogy
Security principle that says environments must be built around multiple controls to ensure that one failure in a single control, or multiple controls, won’t cause a security breach
OSI Model
Open systems interconnection model
From the bottom-up
1) Physical
2) Data
3) Network
4) Transport
5) Session
6) Presentation
7) Application
Network segmentation
The act of dividing up a network into logical, virtual, or physical groupings
VLAN
Virtual LAN
A broadcast domain that’s segmented at OSI layer 2 (data)
Switches and other devices are used to create VLANs
DMZ
Demilitarized zone / screened subnet
Network zones containing systems that are exposed to less trusted areas
Commonly used to contain web services or other internet-facing devices
Intranet
Internal network protected from external access
Employees only for internal or VPN access only
Extranet
Network set up for external access, usually by partners or customers rather than the public at large
Unlike a DMZ, this usually requires additional authentication to gain access
Zero trust
A concept that says nobody should be trusted, regardless of if they’re an internal or external person or system
Zero trust network
A network that includes security between systems as well as at security boundaries
NAC
Network access control / network admissions control
NAC validates security status for systems and allows or disallows connection to a network
Rules for access can be based on user, group, location, application, etc
Agent based NAC
Requires installation and adds complexity and maintenance
Provides greater insight and control
Agentless NAC
Lightweight installs, easier to handle for machines that aren’t centrally managed or have devices that don’t support NAC agent
Provides less detail and can’t be scheduled
Port security
Limiting the number of MACs that can be used on a single port
Prevents MAC spoofing, content addressable memory (CAM) table overflows, and extending network through additional devices
CAM table
Content addressable memory table
Maps MAC addresses to IP addresses which allows switches to send traffic to the correct port
CAM table attack vector
Attackers who can fill CAM tables can make switches fail over to broadcasting traffic, making otherwise inaccessible traffic visible on their local port
Effectively turns the switch into a hub without any intelligence for where frames should be sent
All frames are sent to all interfaces on the switch
Loop protection
Detecting loops and disabling ports to prevent loops from causing issues
STP
Spanning tree protocol
A common way to implement loop control on layer 2 networks
STP is also great at finding problems in a network
EX: An outage occurs, and you lose connectivity on a network path
STP constantly monitors itself and can go into convergence mode to examine what interfaces are available based on an outage
It can work around the problem, maintain comms on the network, and still prevent loops
Broadcast storm control
AKA Storm control
Prevents broadcast packets from being amplified as they traverse a network
Occurs when a loop in a network causes traffic amplification as switches attempt to figure out where traffic should be sent
Limit the number of broadcasts per second, control multicast or unicast, or manage the change over normal traffic patterns
BPDU guard
Bridge protocol data unit guard
STP takes 20-30 sec before it understands what path to use when a new device is connected to the network
It has to perform the same checks every time we plug in
Instead of the delay, we can configure the switch to let it know the only thing plugging in is an end station
Bypass the STP listening and learning, plug device in and instantly start communicating on the network
The issue is someone could plug in with another switch, and there would be a loop over that connection
To get the speed with port fast and security of STP, configure BPDU guard on the switch
BPDU is the primary protocol used by STP
Switch will constantly watch comms coming from interfaces, and if an interface ever sends a BPDU frame it recognizes a switch could be on the other side of comm
Port fast is then disabled before a loop can occur
DHCP snooping
Someone can plug in a DHCP server not authorized to be on the network, which creates DoS or security issue
Switches have software that look for these problems though called DHCP snooping
Switch is configured with a list of trusted interfaces, but also other untrusted interfaces
Switch watches for DHCP conversations, and if it appears from an untrusted interface, the switch filters out the conversation and disallows it from being sent
SPAN
Switched port analyzer
Does the same as port mirror, but can combine traffic from multiple ports to a single port for analysis
Port mirror
Sends a copy of all traffic sent to one switch port to another switch port for monitoring
VPN
Virtual private network
Creates a virtual network link across a public network that allows endpoints to act as if they’re on the same network
Encryption is not a requirement, but often used in the tunnel
IPSec VPN
Internet protocol security VPN
Allows authentication and encryption over a layer 3 network, and also supports packet signing along with encryption
This allows for secure data, but anti replay built into the conversation
Two core IPSec protocols:
1) AH (authentication header): No encryption, hash of the packet and a shared key, adds AH to the packet header
Provides data integrity with hash
Guarantee origin of data with authentication key
Prevents replay attacks with sequence numbers
2) ESP (encapsulation security payload): Encryption with AES, hash with SHA 256, and authenticates
In most implementations, this will be combined with AH to make sure the data gets through the network without alteration
Two modes:
1) Tunnel mode: entire packet sent is protected
2) Transport mode: IP header not protected, but IP payload is
SSL VPN
Current implementation actually uses TLS, not SSL and comms over port 443
It’s either:
1) Portal based: Users access through web page and then access services
2) Tunnel mode: IPSec VPN, entire packet sent is protected
L2TP VPN
Layer 2 tunneling protocol VPN
Many site to site VPNs are implemented with L2TP
Connects two networks together as if they’re on same layer 2 network but it’s happening through a layer 3 network
Doesn’t provide encryption, just provides tunnels
Often combined with IPSec for security
Site to site VPN
Used to create a secure network channel between two or more sites
Typically, they’re always on since they extend an org’s network
Firewalls often serve as the VPN concentrators
Remote access VPN
Used mainly by remote workers in as-needed mode and are turned on when they need specific resources, systems, or trusted connection
Full tunnel VPN
All data and network traffic is sent through an encrypted tunnel to the VPN concentrator, and the user can’t break out of that tunnel to send information to another device directly
Data is sent to VPN concentrator which decides where that information needs to go before sending back to the remote user
Split tunnel VPN
The admin of the VPN can configure some information to go through the tunnel, and other information can go outside the tunnel
Traffic doesn’t need to go through the full tunnel to communicate with devices that aren’t on the tunnel
Jump server
A highly secure, hardened, and monitored device that spans two or more networks, allowing users to connect to it from one network and then “jump” to another
SSH, tunnel, VPN to other devices on the network
Load balancer
Distributes traffic to multiple systems, provides redundancy, and allows for ease of upgrades and patching
Proxy server
A device that sits between the users and the rest of the network
Accepts and forwards requests, centralizing the requests and allowing actions to be taken on the requests and responses
Useful for caching info, access control, URL filters, content scanning
Forward proxies
Accepts client requests, forwards to server, receives answer, validates, and sends user copy of the response
Conceals original client and can anonymize traffic or provide access to resources blocked by IP or location
Commonly used to protect and control user access to the internet
Reverse proxies
Users from internet hit a proxy to gain access to internal services on your network
Proxy examines requests from users, if not malicious and valid, sends requests to webserver and gets response, sends copy of answer to user on the internet
NAT
Network address translation
Allows a pool of addresses to be translated to one or more external addresses
EX: Allow many private IPs to use a single public IP to access internet
NAT gateway
In-home router
A network tool that provides private IPs and uses NAT to allow a single public IP to serve many devices behind the router
By default blocks all inbound access
Content filters
Allows or blocks traffic based on specific content rules
Simple rules: blocked URLs, domains, etc
Complex rules: Blocked by IP reputation, pattern matching, etc
DLP solutions
Data loss prevention solutions
Ensure data isn’t extracted or accidentally sent from a network
Frequently pairs agents on systems with filtering capability at the network border, email services, and exfiltration points
IDS
Intrusion detection system
Detects threats in your network and alerts you
Can’t take direct action
IPS
Intrusion prevention system
Detects threats in your network and takes direct action to stop them
Stateless firewalls
Does not keep track of traffic flows, and needs a rule base that covers all comms in both directions
Each packet is individually examined, regardless of past history
Traffic sent outside of an active session will traverse a stateless firewall
Not smart, has no idea about requests and responses, always defaults to its existing rule base
