Network security
Triangle of CIA, our mission of protecting our environment
You can make a house so secure that no one can enter or leave it. But that destroys the whole meaning of a house.
The more secure it is, the less usable it becomes so we must find a middle path.
Confidentiality
Is ensuring the data itself remains confidential / secure.
Integrity
Is ensuring that your data is trustworthy, to make sure these is the data I stored previously and not that someone edited it.
Availability
Keep your system online, because one attack is “if I can’t get to it, I disable it”
Understanding Types of Security Threats
DoS Attacks
These attacks are pretty ruthless. Denying service of something you present.
When you start a halfway communication. TCP has a threeway handshake. The SYN, so you wanna start a connection. The server replies with SYNACK, like acknowledge the connection. Your device should reply now with ACK where the actual connection begins. A TCP SYN attack now start the connection with a SYN but never replies to the SYNACK and just tries to flood this buffer.
Spoofing attacks
This allows you to impersonate someone else, like MAC-address spoofing which allows you to change your MAC-address on the fly. This on the other hand allows you to start for example a DHCP DoS attack. So you basically send a lot of DHCP requests to all of your MAC-addresses so that there are no IP addresses left thus the DHCP server cannot function properly because it is not handing out IP addresses anymore.
Reflection / Amplification attacks
This is used when the attacker wants to hide their identity often happens via VPN. Or amplification called DDOS attacks, where you compromise other clients, and with all of the force of these clients together you try to flood another for example webserver.
MIM attack
Man-in-the-middle attack. You bring in a rogue DHCP servers, which sends out invalid IP addresses, that hopes to set up that alternate world. So within your DHCP request you could send your clients to a rogue router on that network, and route that traffic back to the original router, so no one would ever realize whats going on. This is one of the more dangerous attacks you can pull off.
Reconnaissance attack
This is where you going after information. Could be something like “Who is cisco.com” where is it registered. Get that information to pull of a social engineering attack for example. Or a port scan for example. You have to have open ports, but that is exactly one window of our house, which is a possible vulnerability.
Malware
Virus, worm, trojan horse, or ransomware or install a backdoor that all is supposed to be malware.
Understanding Identity and Password Attacks
Password attacks
- Reconnaissance (find out more about that person)
- Dictionary (people will start hacking through the hashed passwords using a dictionary)
- Brute force (just try these hashes and log in, with the power of datacenters)
The password should be:
- Length: 15-char
- Complex
- Unique
One of the effective mitigating factors is MFA. Using two out of three of these methods (KNOW, HAVE, ARE).
Usually there are lists of hashed passwords and just try these passwords.
Social engineering
- Spear phishing (change the name of the sender to the name of a employee and try to phish)
- Whaling (spear phishing to f.e. a CEO, CIO)
- Smishing (SMS phishing)
- Vishing (voice phishing)
- Tailgating (relying on somebody curtesy, walk with another person in to the building)
How to mitigate:
- User awareness
- User training
- Physical control
Cisco puts all of this under a umbrella AAA.
Understanding the Place of Cisco AAA
Cisco triple A stands for authentication, authorization and accounting.
Authentication -> who are you?
Authorization -> what can you do?
Accounting -> what did you do?
A triple A server is a server where all our devices point to that server, where a central database of usernames and passwords live.
The triple A server could handle the database on its own or redirect all of the traffic to f.e. a windows active directory server. This allows you to have a single user account for all of your devices, and when the users leaves the organization you can delete it, and its gone everywhere.
There are used two protocols to communicate with a triple A server (EAP (expansible authentication protocol – 802.1X):
- RADIUS (the industry standard)
- TACACS+ (Cisco proprietary)
Most of the 802.1X applies to WiFi (PSK or WPA2 is a part of 802.1X).