Network Security Fundamentals and Defense Strategies

Network Security Fundamentals
Objectives:
● 4.1 - Explain the importance of basic network security concepts
● 4.3 - Given a scenario, apply network security features, defense techniques, and
solutions
● The CIA Triad
○ CIA Triad
■ Fundamental to network security comprising Confidentiality, Integrity,
and Availability
○ Confidentiality
■ Ensures data privacy using encryption and authentication
■ Symmetric Encryption
● Both sender and receiver use the same key for encryption and
decryption
● Fast but challenging for key management
■ Asymmetric Encryption
○ Involves a key pair
■ Public key – known to everyone
■ Private key – known only to the owner
225
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Sender uses the receiver's public key to encrypt the data,
ensuring confidentiality
○ In e-commerce, asymmetric keys are used to exchange a
symmetric key for secure communication.
■ Key exchange process
● Client requests a secure website using
HTTPS
● Server provides its public key with a digital
certificate
● Client encrypts a random number with the
server's public key and sends it back
● Server decrypts the number using its private
key
● Both parties use the random number as a
symmetric key for secure communication
○ Integrity
■ Verifies data is not modified in transit or storage, preventing spoofing and
unauthorized data changes
■ Hashing
● Algorithm creates a unique fingerprint for data, allowing
verification of data integrity
226
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Availability
■ Ensures data accessibility
■ Can be achieved through redundant network design and components
■ Threats to Availability
● Network floods
● Hardware failures
● Power outages
● Other disruptions
● Threats and Vulnerabilities
○ Risk exists where threats and vulnerabilities intersect within networks
○ Understanding the different threats and vulnerabilities can add protection
mechanisms to help mitigate risks
○ Threat
■ Person or event that has the potential to negatively impact valuable
resources
● Hackers
● Hurricanes
○ Vulnerability
■ Weakness in system design, implementation, or lack of preventive
mechanisms
227
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Usually within the user’s control
● Running outdated software
● Insufficient battery backup
○ Risk
■ Occurs when a threat exploits a vulnerability
■ No risk if no threat targets a vulnerability or if no vulnerability exists
○ Types of Threats
■ Internal Threat
○ Originates from within the organization
■ Malicious employee
■ Unknowing end user
■ External Threat
● Originates from outside the organization
○ Hackers
○ Environmental events
○ Types of Vulnerabilities
■ Environmental Vulnerabilities
● Weaknesses in the surrounding area affecting services
○ Hurricanes
○ Earthquakes
228
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Physical Vulnerabilities
● Weaknesses in the building infrastructure
○ Unlocked doors
○ Misconfigured systems
■ Operational Vulnerabilities
● Weaknesses in policies and procedures
○ Poorly enforced policies
■ Technical Vulnerabilities
● System-specific weaknesses
○ Misconfigurations
○ Outdated hardware
○ Malicious softwares
● Common Vulnerabilities and Exposures (CVEs)
○ List of publicly disclosed vulnerabilities – known
vulnerabilities
○ Provides details on vulnerabilities and affected software
● Zero-Day Vulnerabilities
○ Newly discovered vulnerabilities
○ Exploited before a patch is available
○ Exploiting Vulnerability
■ Taking advantage of a vulnerability as a threat actor
229
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Exploit
● Software code that takes advantage of a vulnerability
■ Prevention
● Keep systems updated with latest patches
● Use up-to-date anti-malware software
● Risk Management
○ Risk Management
■ Involves identifying, evaluating, and prioritizing risks
■ Aims to allocate resources to minimize, monitor, and control the
probability or impact of vulnerabilities being exploited by threats
○ Risk Assessment
■ Process to identify potential hazards and analyze their likelihood and
consequences
■ Determines an organization's tolerance for such events occurring
○ Types of Risk Assessments
■ Security Risk Assessment
● Identifies, assesses, and implements key security controls within
an application, system, or network
● Threat Assessment
○ Focuses on identifying different threats that may harm
systems or networks
230
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ MITRE ATT&CK Framework
■ A knowledge base of adversary tactics and
techniques, derived from real-world observations
■ Allows administrators or analysts to understand the
methods used by threats to harm networks
■ Helps identify where to focus resources for better
protection
● Vulnerability Assessment
○ Identifies, quantifies, and prioritizes risks and
vulnerabilities
○ Uses vulnerability scanner tools
■ Nessus
■ QualysGuard
■ OpenVAS
● Penetration Test
○ Attempts to exploit vulnerabilities within the system or
network for evaluation of an IT infrastructure security
○ Validates the effectiveness of defensive mechanisms and
adherence to security policies
● Posture Assessment
○ Assesses an organization's attack surface to understand its
cyber risk posture and exposure to threats
231
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Includes four main steps:
■ Defining mission-critical components
■ Identifying strengths, weaknesses , and security
issues
■ Strengthening security position
■ Staying in control
■ Business Risk Assessment
● Identifies, understands, and evaluates potential hazards in the
workplace
● Process Assessment
○ Examines processes used by an organization against a set
of criteria to determine their capability to perform within
quality, cost, and schedule goals
● Vendor Assessment
○ Evaluates a prospective vendor to determine if they can
effectively meet the business's obligations and needs
regarding the product
○ Importance
■ Ensures vendors and suppliers implement and
maintain appropriate security controls.
■ Mitigates the threat of supply chain vulnerabilities,
such as counterfeit devices with malware
232
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Audits and Compliance
○ Audits and Compliance
■ Critical for ensuring data integrity, confidentiality, and availability
■ Organizations span across geographical borders, subject to various laws
and regulations
○ Data Locality
■ Refers to geographic location where data is stored and processed
■ Influenced by legal and regulatory requirements
● Every country has its own laws governing data protection, privacy,
and sovereignty
○ Payment Card Industry Data Security Standard (PCI DSS)
■ Security standards for companies handling credit card information
■ Not a law but a contractual requirement for handling cardholder data
○ General Data Protection Regulation (GDPR)
■ European Union (EU) regulation focusing on data protection and privacy
■ Applies to all organizations operating within the EU or offering
goods/services to individuals inside the EU
■ Provides individuals with greater control over their personal data
● Right to be informed
● Right of access
● Right to rectification
● Right to erasure
233
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Right to restrict processing
○ Implementation and Compliance
■ Implement continuous monitoring and auditing programs
■ Regular audits to ensure compliance with relevant standards and
regulations
■ Employee training on auditing and compliance processes
● Also includes implications of non-compliance
○ Potential legal and financial penalties
■ Develop clear policies and procedures for data handling, access control,
and incident response
● Device Hardening
○ Device Hardening
■ Refers to ensuring that a device has had any unnecessary application or
port disabled or removed from the host
■ Process of securing a host system by reducing its attack surface
■ Key Practices
● Run only necessary services
● Install monitoring software for malware protection
● Establish a maintenance schedule for system patching
■ Applies to endpoint devices, servers, network infrastructure, and mobile
devices
234
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Endpoint Security Software
■ Install anti-malware, antivirus, spam filters, host-based firewalls, and log
collection agents
■ Enhances security posture and threat detection capabilities
○ Specialized Hardware
■ Manufacturers add secure hardware like UEFI, TPM, and HSM
■ Aids in securing devices, especially as networks become more
de-perimeterized
○ Host Hardening Practices
■ Ensure all software is patched and up-to-date
■ Ensure that device is properly configured
■ Remove unnecessary applications.
■ Block unnecessary ports and services
■ Control external storage devices tightly
■ Disable unneeded accounts
■ Rename default accounts
■ Change default passwords
○ Additional Host Hardening Practices
■ Configure standardized OS baselines
■ Implement allow and deny lists for applications
■ Use security and group policies
■ Restrict command line interface and peripheral device usage
235
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Balancing Security and Usability
■ Open the least amount of ports
■ Run the least amount of services needed
○ Network Interfaces
■ Disable unneeded network connections
■ Consider wired, wireless, and management LAN interfaces
○ Services
■ Disable unused services (e.g., CUPS daemon for print server)
○ Ports
■ Close ports not needed for services
■ Use host-based firewalls for further hardening
○ Disk Encryption
■ Enable full disk encryption or use self-encrypting drives
■ Protects data at rest from unauthorized access
○ Account Review
■ Disable or delete unused accounts
■ Follow the rule of thumb
● Disable, delete, or block anything unused or unneeded
○ Consideration of Device Lifecycle
■ End of Life (EOL)
● Date when a manufacturer will no longer sell a given product
236
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ End of Support (EOS)
● Last date that a manufacturer will support a given product
■ Ensure devices are always using supported and up-to-date software to
prevent vulnerabilities
● Understanding Device Hardening: Demonstration
● Physical Security
○ Physical Security in Networking
■ Importance of Physical Security
● Protecting networking equipment is crucial to prevent
unauthorized access and tampering
○ Detection Mechanisms
■ Refer to security controls that are used during an event to find out
whether or not something malicious may have happened
■ Cameras
● Used to monitor entrances, exits, and critical areas
● Types
○ Wired
■ Allows the device to be physically cabled from the
camera to a central monitoring station
237
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Wireless
■ No physical cables
■ Susceptible to interference
○ Outdoor
■ Should be able to withstand elements
○ Indoor
■ Monitors things contained inside the building
■ Lighter, cheaper, and easier to install
○ PTZ (Pan, Tilt, Zoom) Camera
○ Infrared Camera
■ Displays images based on the amount of heat in the
room
○ Ultrasonic Camera
■ Uses sound-based detection
○ Prevention Mechanisms
■ Controls that are put in place to prevent things from happening
■ Access Control Hardware
● Controls access to secure areas
● Badge Readers
○ Rely on either a magnetic strip, a chip card, or RFID
● Biometric Readers
○ Fingerprint, retina scans, or voice prints
238
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Two-factor authentication can be added for more secure data center
■ Access Control Vestibules
● Area between two doorways for authentication
● Used in high-security facilities
● Example
○ Turnstiles
■ Smart Lockers
● Used to store personal electronic devices
● Can be accessed using employee badges
■ Locking Racks and Cabinets
● Protect networking equipment from tampering
● Controlled by a key custodian
● Standard server and networking equipment rack
○ 48 units high
○ 50 inches deep
○ 20 inches wide
■ Employee Training
● Crucial for preventing security breaches
● Provides awareness of security policies and procedures
● Reduces vulnerabilities caused by misconfiguration or user error
● Offers a high return on investment for companies of all sizes
239
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Honeypots and Active Defense
○ Active Defense
■ Practice of responding to threats by destroying or deceiving the threat
actor's capabilities
■ Involves having an engagement with the adversary
○ Honeypot
■ A host or server set up to attract attackers, allowing organizations to
observe and learn from their attack methods
■ A form of active defense, designed to lure attackers away from critical
network components
■ Can be a single host or part of a larger network (Honeynet), enticing
attackers with seemingly valuable information
○ Active Defense Strategies
■ Attribution
● Involves identifying and publishing an attacker's methods,
techniques, and tactics for threat intelligence
● Helps security researchers and organizations understand and
counteract specific threats
■ Annoyance Strategies
● Use techniques like obfuscation to waste attackers' time and
resources
240
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Examples
○ Bogus DNS entries
○ Decoy directories on web servers
○ Port triggering and spoofing
■ Hack Back
● Involves offensive techniques to identify and degrade attackers'
capabilities
● Legally and ethically complex, often discouraged due to legal and
reputational risks
○ Legal Considerations
■ Active defense strategies, especially hack back, have significant legal
implications
■ Understand and comply with local laws and regulations before
considering these strategies