Role-Based Access Control (RBAC): Assign permissions based on roles, not individuals.
Logging & Monitoring
Audit Trails: Keep logs of all network activities.
Alerts: Set up real-time alerts for suspicious activities.
Physical Security
Data Center Access: Restrict who can physically access network hardware.
Device Locks: Use locks on laptops and other portable devices.
Employee Training
Phishing Awareness: Educate staff on the dangers of phishing.
Safe Browsing: Teach best practices for web use.
Data Backups
Regular Backups: Store backups in a secure, offsite location.
Test Restores: Regularly test the restore process.
IEEE 802.1X Protocol
Authentication
Supplicant is the client making the request to access the LAN or wireless access point.
Authenticator takes the packet from the supplicator and sends it to the authentication server until the session is authenticated. Any other information sent before authentication occurs is dropped.
Authentication server provides a database of information required for authentication, and informs the authenticator to deny or permit access to the supplicant.
Authentication methods
Shared key system is a shared key or passphrase that is manually set on both the mobile device and the AP/router.
Open system is when the authentication server has a list of authorized clients to check against when a client requests access. This list is usually in the form of MAC addresses but it varies by network.
Shared Key authentication methods
Wired Equivalent Privacy (WEP) is not recommended for a secure WLAN. The main security risk is hackers capturing the encrypted form of an authentication response frame, using widely available software applications, and using the information to crack WEP encryption.
Wi-Fi Protected Access (WPA) complies with the wireless security standard and strongly increases the level of data protection and access control (authentication) for a wireless network. WPA enforces IEEE 802.1X authentication and key-exchange and only works with dynamic encryption keys.
Wi-Fi Protected Access 2 (WPA2) is a security enhancement to WPA. Users must ensure the mobile device and AP/router are configured using the same WPA version and pre-shared key (PSK).
Association allows the access point or router to record each mobile device so that data is properly delivered. This occurs after authentication is complete.
Proxies
Servers that act as intermediaries between a user's computer and the internet.
Types
Forward Proxy
What It Does: Filters client requests.
Use Case: Content filtering, bypassing geo-restrictions.
Reverse Proxy
What It Does: Routes client requests to the appropriate backend server.
Use Case: Load balancing, caching, SSL termination.
Transparent Proxy
What It Does: Redirects client requests without modification.
Use Case: Content filtering, monitoring.
SOCKS Proxy
What It Does: Transfers any type of network traffic.
Use Case: General-purpose proxy, often used for anonymity.
Advantages
Anonymity
Hides your IP address.
Content Filtering
Blocks access to certain websites or content.
Caching
Stores copies of frequently accessed resources.
Load Balancing
Distributes incoming requests across multiple servers.
Disadvantages
Latency
Can slow down your internet speed.
Security Risks
If not configured properly, can expose sensitive data.
Limited Anonymity
Not all proxies provide full anonymity.
Examples
HAProxy
nginx
Apache HTTP
WiFi
WEP (Wired Equivalent Privacy)
An old security algorithm for wireless networks.
How It Works
Encryption: Uses RC4 stream cipher.
Key: Typically a 40-bit or 104-bit key.
Modern Alternatives
WPA2/WPA3
Stronger encryption and better security features.
WPA2/WPA3
WPA2 (Wi-Fi Protected Access 2)
An advanced security protocol for wireless networks.
Authentication: Typically uses PSK (Pre-Shared Key) or EAP (Extensible Authentication
WPA3 (Wi-Fi Protected Access 3)
The latest and most secure Wi-Fi encryption standard.
How It Works
Encryption: Also uses AES but adds new features like SAE (Simultaneous Authentication of Equals).
Authentication: Enhanced methods for stronger security.
WPA3 is more secure but may not be compatible with older devices.
Both Support
MFP (Management Frame Protection)
EAP methods for enterprise environments
Unified Threat Management (UTM)
UTM solutions stretch beyond the traditional firewall to include an array of network security tools with a single management interface. UTM simplifies the configuration and enforcement of security controls and policies, saving time and resources. Security event logs and reporting are also centralized and simplified to provide a holistic view of network security events.
UTM options and configurations
UTM hardware and software options
Stand-alone UTM network appliance
Set of UTM networked appliances or devices
UTM server software application(s)
Extent of UTM protection options
Single host
Entire network
UTM security service and tool options can include
Firewall
Can be the first line of defense in catching phishing attacks, spam, viruses, malware, and other potential threats that attempt to access an organization’s network. Firewalls can be hardware devices or software applications. Firewalls filter and inspect packets of data attempting to enter and exit a managed network. Rules can be configured to permit or prevent certain types of packets from entering the network.
Intrusion detection system (IDS)
Passively monitors packets of data and network traffic for unusual patterns that could indicate an attack. IDS devices can monitor entire networks (NIDS) or just a single host (HIDS). IDS identifies, logs, and alerts IT Support about suspicious traffic. However, IDS does not prevent an attack from occurring. This system gives IT Support professionals the opportunity to inspect flagged events to determine how to handle the threat on a case by case basis.
Intrusion prevention system (IPS)
Actively monitors packets and network traffic for potential malicious attacks. IPS systems can be configured to automatically block attacks or to allow manual interventions. IPS devices can monitor entire networks (NIPS) or just a single host (HIPS).
Antivirus software
Uses a signature database to obtain the profiles of malicious files, such as spyware, Trojans, malware, worms, and more. The antivirus software monitors the organization’s network and systems for these virus signatures. Once identified, the software will block, quarantine, or destroy them.
Anti-malware software
Scans information streams for known malicious malware signatures and blocks threats. Additionally, anti-malware software can use heuristic analysis to detect novel malware threats by identifying key behaviors and characteristics. The software can also use sandboxing to isolate suspicious files.
Spam gateway
Filters, identifies, and quarantines spam email. Spam gateways are network servers that use Domain Name Server (DNS) management tools to protect against spam.
Web and content filters
Block user access to risky and malicious websites. When a user attempts to access an unauthorized or suspicious website using a browser, the UTM web filter can prevent the website from loading. The filter can also be customized to block certain types of websites or specific URLs, like social media or other websites that might be a distraction in the workplace.
Data leak/loss prevention (DLP)
Monitors outgoing network traffic for personal, sensitive, and confidential data. DLP includes a verification system to determine if the external data transfer is authorized or malicious, and can block unauthorized attempts.
Virtual Private Network (VPN)
Encrypts data and creates a private “tunnel” to safely transmit the data through a public network.
Stream-based vs. proxy-based UTM inspections
Stream-based inspection, also called flow-based inspection
UTM devices inspects data samples from packets for malicious content and threats as the packets flow through the device in a stream of data. This process minimizes the duration of the security inspection, which keeps network data flowing at a faster rate than a proxy-based inspection.
Proxy-based inspection
A UTM network appliance works as a proxy server for the flow of network traffic. The UTM appliance intercepts packets and uses them to reconstruct files. Then the UTM device will analyze the file for threats before allowing the file to continue on to its intended destination. Although this security screening process is more thorough than the stream-based inspection technique, proxy-based inspections are slower in the transmission of data.
Benefits of using UTM
UTM can be cost-effective
Reduces the time and resources needed to manage multiple stand-alone security tools. Purchasing a suite of integrated tools may also be less expensive than buying each tool separately.
UTM is flexible and adaptable
Offers flexible solutions and options for security management. The security services and tools in a UTM can be implemented in any combination that is appropriate for each network environment.
UTM offers integrated and centralized management
Consolidates multiple security tools into a central management console. This simplifies monitoring and addressing security threats, as well as streamlines the management of updates to the UTM components. The central management feature also helps IT Support staff identify and stop the full extent of an attack across an entire network.
Risks of using UTM
UTM can become a single point of failure in a network security attack
If an attack disables an entire UTM solution, there would be no other backup security services or tools to stop that attack. One of the core principles of information systems management is to design and implement redundant, backup, and failover systems. When one element of an IT system is attacked or experiences a failure, there should always be a backup or parallel system to replace it.
UTM might be a waste of resources for small businesses
Small businesses may not need a robust security solution like UTM. The time and money needed to purchase, implement, and manage a complex UTM system may not provide a significant return on security benefits for a smaller network. Cybercriminals are more likely to attack larger targets.
tcpdump
A command-line utility that captures and analyzes network traffic.
How It Works
Capture Filters: Specify what kind of packets to capture.
Display Filters: Control what information is displayed.
Use Cases
Troubleshooting: Identify network issues.
Security: Detect suspicious activity.
Performance Tuning: Analyze network performance.
Basic Commands
tcpdump -i eth0
Capture All Traffic on an Interface
tcpdump -i eth0 host 192.168.1.1
Capture Specific Host Traffic
tcpdump -i eth0 port 80
Capture Specific Port Traffic
tcpdump -i eth0 -w output.pcap
Capture and Save to File
wireshark
A popular network protocol analyzer with a graphical interface.
How It Works
Capture Filters: Specify what to capture, similar to tcpdump.
Display Filters: Fine-tune what you see in the interface.
Packet Details: View packet contents in various formats.
Use Cases
Troubleshooting: Diagnose network issues.
Security Audits: Detect anomalies or unauthorized access.
Learning: Great educational tool for understanding network protocols.
Host-Based Firewall
A software firewall that controls incoming and outgoing network traffic based on a set of user-defined rules.
How It Works
Rule-Based: You set rules for allowing or blocking specific traffic.
Stateful Inspection: Keeps track of the state of active connections.
Application-Level Filtering: Controls traffic based on specific applications.
Common Features
Inbound/Outbound Rules: Control traffic coming in and going out.
Logging: Keeps a record of allowed and blocked connections.
Alerts: Notifies you of suspicious activity.
Examples
Windows Firewall: Built into Windows OS.
UFW (Uncomplicated Firewall): Popular on Linux systems.
Little Snitch: Known for macOS.
Logging and Auditing
Types of Logs
System Logs: OS-level activities.
Application Logs: Specific to a particular application.
Security Logs: Unauthorized access attempts, policy violations, etc.
Manual Auditing: Periodic reviews by human auditors.
Common Tools
Syslog: Standard for message logging on Unix systems.
Windows Event Viewer: For Windows systems.
Splunk: Advanced tool for log collection and analysis.
Best Practices
Regular Reviews: Don't just collect logs; review them.
Secure Storage: Keep logs in a secure, tamper-proof environment.
Retention Policy: Decide how long to keep logs based on legal and operational needs.
rsyslog
An open-source utility for log processing on Unix and Unix-like systems. It's an extension of the original syslog protocol.
How It Works
Collects Logs: From different parts of the system and network.
Filters: Based on content, severity, facility, etc.
Forwards: Sends logs to various destinations like files, databases, or other servers.
commands
sudo systemctl status rsyslog
Check Status
sudo systemctl restart rsyslog
Restart Service
tail -f /var/log/syslog
View Logs
Configuration File
/etc/rsyslog.conf
Best Practices
Centralized Logging: Use rsyslog to forward logs to a centralized server for easier management.
Secure Transport: Use TLS for secure log transmission over networks.
SIEM (Security Information and Event Management)
A comprehensive solution that provides real-time analysis of security alerts generated by various hardware and software infrastructures.
Core Functions
Data Aggregation: Collects data from multiple sources.
Event Correlation: Links related records and identifies patterns.
Alerting: Notifies admins of suspicious activities.
Dashboards: Summarizes the security status.
Compliance Reports: Helps in meeting regulatory standards.
Popular Solutions
Splunk: Known for its powerful analytics.
IBM QRadar: Offers AI capabilities.
ArcSight: Good for large enterprises.
Best Practices
Fine-Tune Alerts: Too many false positives can be as bad as missing an actual threat.
Regular Updates: Keep the SIEM software up-to-date.
User Training: Make sure the team knows how to use the SIEM effectively.
Disk Encryption
A technology that encrypts the entire hard drive, making it unreadable without the correct decryption key or password.
How It Works
Full Disk Encryption (FDE): Encrypts the entire disk, including the OS.
File-Level Encryption: Encrypts individual files or folders.
Popular Tools
BitLocker: Integrated into Windows, works well with TPM.
FileVault 2: macOS solution.
LUKS: For Linux systems.
FTE Options
PGP (Pretty Good Privacy)
BitLocker: Integrates well with TPM (Trusted Platform Module).
Problems
Malware
A type of malicious software that can be used to obtain your sensitive information, or delete or modify files
Types
Virus
Infects files and spreads when the host is activated.
File-based
self-replicating
Worm
Spreads across networks without user action.
Network-based
self-replicating
Trojan
Disguised as legitimate software but carries malicious code.
Deceptive
non-replicating
Ransomware
Encrypts files and demands payment for decryption
Encrypting
extortion-based
Spyware
Collects personal information without consent.
Data-collecting
stealthy
Adware
Shows unwanted ads and can be intrusive.
Annoying
revenue-generating
Rootkit
Gains admin-level control over a system
Stealthy
privileged access
Botnet
Networks of compromised computers controlled remotely
Network-based
remote control
Keylogger
Records keystrokes to capture sensitive info
Data-collecting
stealthy
Fileless Malware
Lives in memory, not in files.
Evasive
memory-resident
Backdoor
Provides unauthorized remote access to a system.
Stealthy
privileged access
remote control
Logic Bomb
A piece of code that triggers malicious activity when certain conditions are met.
Conditional
stealthy
event-driven
Measure
Antimalware Protection, Malware Removal
Gather and verify
Symptoms
Running slower than normal
Restarts on its own multiple times
Uses all or a higher than normal amount of memory
After you’ve gathered information, verify that the issues are still occurring by monitoring the computer for a period of time. One way to monitor and verify is to review the activity on the computer’s resource manager where you can see open processes running on a system.
When looking at the resource manager, you might see a program with a name you do not recognize, a program that is using a lot of memory, or both. If you see a suspicious program, you should investigate this application by asking the user if it is familiar to them.
Quarantine malware
To quarantine, or separate, the infected device from the rest of the network, you should disconnect from the internet by turning off WiFi and unplugging the ethernet cable. Once the computer is disconnected, the malware can no longer spread to other computers on the network.
You should also disable any automatic system backup. Some malware can reinfect a computer by using automatic backup, because you can restore the system with files infected by the malware.
Remove malware
run an offline malware scan
you may need to briefly connect to the internet to confirm that your malware program is fully updated.
The scan should successfully identify, quarantine, and remove the malware on the computer. Once the process is complete, monitor the computer again to confirm that there are no further issues.
To help ensure that a malware infection doesn’t happen again threat definitions should be set to update automatically, and to automatically scan for and quarantine suspected malware.
After the malware has been removed from the computer, you should turn back on the automatic backup tool and manually create a safe restore point. If the computer needs attention in the future, this new restore point is confirmed safe and clean.
Malware education
Keep the computer and software updated
Use a non-administrator account whenever possible
Think twice before clicking links or downloading anything
Be careful about opening email attachments or images
Don't trust pop-up windows that ask to download software
Limit your file-sharing
Use antivirus software
Key takeaways
An infected device should be isolated from the local network and internet as soon as possible.
Antivirus and Anti-Malware software is a key tool for detecting and removing malware.
Keeping threat protection software updated makes malware removal faster and easier.
Education is the first and best line of defense against malware.
Physical security
Guards
Guards monitor controlled access points throughout a facility to prevent unauthorized access.
Door locks
Door locks allow an area to be restricted. Only people with an authorized unlocking mechanism, like a key or security badge, can gain access to the restricted area.
Equipment locks
Equipment locks can restrict the movement of sensitive equipment, like servers, storage media, or terminals, by anchoring them to a less mobile structure. Only people with an authorized unlocking mechanism, like a key or security badge, can release the controlled equipment from its anchored location.
Video surveillance
Video cameras allow continuous observation and recorded activity playback within controlled areas. Video surveillance can document who accesses a controlled area, how they access it, and what they do there.
Alarm systems
Alarm systems notify security by sounding an alarm or sending a message when a controlled area is accessed.
Motion sensors
Motion sensors are devices that detect movement within a controlled area. Motion sensors can trigger alarm systems or video surveillance.
Protecting the entry points of a building
Access control vestibules
Access control vestibules create a space between two sets of interlocking doors or gateways to prevent unauthorized individuals from following authorized individuals into controlled facilities.
Badge readers
Badge readers are devices that read information encoded into a plastic card. They identify each user by the badge they present to the device. Badge readers can be used to control electrically operated door locks and can be built into computer terminals to control access to information.
Protecting the outside of a building
Bollards
Bollards are sturdy, short, vertical posts placed to restrict access of vehicles to a controlled area.
Fences
Fences are physical barriers, with many different designs, that enclose controlled areas to establish a perimeter and keep out external threats.
Attacks
Network Attacks
types
Denial of Service (DoS)
Overwhelms a system to make it unavailable.
Bandwidth exhaustion, resource depletion.
Distributed Denial of Service (DDoS)
DoS attack from multiple sources
Multiple origins, high traffic volume.
Man-in-the-Middle (MitM)
Intercepts and alters communication between two parties.
Eavesdropping, data tampering.
Packet Sniffing
Captures data packets to analyze network traffic.
Passive, data capture.
Port Scanning
Identifies open ports on a network.
Reconnaissance, vulnerability assessment.
IP Spoofing
Fakes the source IP address in data packets.
Deceptive, identity masking.
ARP Poisoning
Links an attacker's MAC address with an IP address.
Deceptive, local network attack.
SQL Injection
Injects malicious SQL code into a database query.
Data manipulation, unauthorized access.
Phishing
Uses fake websites or emails to collect sensitive info.
Deceptive, social engineering.
Zero-Day Exploit
Attacks a vulnerability before it's patched.
Opportunistic, high impact.
Session Hijacking
Unauthorized takeover of an established user session.
Eavesdropping, unauthorized access, data theft.
Rogue AP (Access Point) Attack
An unauthorized access point is set up to capture network traffic.
Deceptive, unauthorized access, data capture.
Client-Side Attacks
Targets vulnerabilities in client software like browsers and plugins.
Exploitative, user-focused, often requires user interaction.
Cross-Site Scripting (XSS) Attacks
Injects malicious scripts into web pages viewed by others.
Script injection, user-focused, web application vulnerability.
types
Stored XSS
The script is permanently stored on the target server.
Reflected XSS
The script is embedded in a URL and only affects users who click the link.
DOM-based XSS
Manipulates the Document Object Model (DOM) of a web page.
Password Attacks
Attempts to crack or bypass authentication mechanisms