Overview of Logical Security Concepts and Network Security Measures

Logical Security
Objectives:
● 1.4 - Explain common networking ports, protocols, services, and traffic types
● 4.1 - Explain the importance of basic network security concepts
● 4.3 - Given a scenario, apply network security features, defense techniques, and
solutions
● Identity and Access Management (IAM)
○ Identity and Access Management (IAM)
■ Security process for identification, authentication, and authorization of
users, computers, and entities
■ Provides access to organizational assets like networks, operating systems,
and applications
○ Unique Subjects in IAM
■ Personnel
● Employees with user accounts and access to the system
■ Endpoints
● Devices (desktops, laptops, tablets, cell phones) used to access
the network
260
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Servers
● Machines for machine communication, containing mission-critical
systems and encryption
■ Software
● Applications requiring IAM, often using digital certificates
■ Roles
● Define permissions based on the function an asset fulfills,
applicable to personnel, endpoints, servers, and software
● In Windows
○ People are assigned to different groups then permissions
are given to those groups
○ IAM Systems and tools
■ Directory services and repositories
■ Access management tools
■ Auditing and reporting systems
○ IAM Tasks
■ Account Creation and Deprovisioning
● Provisioning new accounts and disabling/deleting existing
accounts
■ Account Management
● Resetting passwords
● Updating digital certificates
261
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Managing permissions
■ Account Auditing
● Reviewing account activity to ensure legitimacy
■ Evaluating Identity-based Threats
● Identifying and mitigating threats to IAM systems
■ Maintaining Compliance
● Ensuring the system meets security requirements and standards
○ IAM Risks
■ Biggest risk is the risk caused by accounts
● User Accounts
○ Standard accounts with basic permissions
○ Least risky
● Privileged Accounts
○ Administrator, root, or superuser accounts with elevated
permissions, requiring additional auditing
● Shared Accounts
○ Used in small office environments, posing a risk due to
shared passwords and lack of individual accountability
○ Not recommended
262
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Multifactor Authentication (MFA)
○ Multifactor Authentication (MFA)
■ Means authenticating or proving identity using more than one method
■ At least two methods are required for MFA
○ Categories
■ Something You Know
● A knowledge factor
○ Username
○ Password
○ PIN
○ Answers to personal questions
● Two-factor Authentication (2FA)
○ A combination of two MFA categories
○ Use 2FA to increase security
○ A common misconception is that a username and
password constitute 2FA
■ Both are from the knowledge factor, making it a
single factor
● Passwords
○ Weaknesses of Passwords
■ Unchanged default credentials
■ Common passwords
263
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Weak or short passwords
○ Attacks Against Passwords
■ Dictionary Attack
● Guessing the password using every word or
phrase in a dictionary, including variations
like substituting symbols for letters
■ Brute Force Attack
● Trying every possible combination until the
correct password is found
■ Hybrid Attack
● A combination of dictionary and brute force
methods, using keywords related to the
individual's life
○ Prevention of password attacks
■ Password Length and Complexity
● Longer and more complex passwords are
harder to crack
○ Uppercase
○ Lowercase
○ Numbers
○ Special characters
264
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ At least 12 characters long for good
security
■ Something You Have
● A possession factor
○ Smart card
○ RSA key fob
○ RFID tag
■ Something You Are
● An inherence factor
○ Fingerprints
○ Retina scans
○ Voiceprints
● Often used in high-security environments
■ Something You Do
● An action factor
○ The way a person signs his/her name, draws a pattern, or
says a catchphrase
■ Somewhere You Are
● A location factor
○ Geotagging
■ Used to authenticate based on the current GPS
location of a device
265
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Geofencing
■ Used to track devices and receive alerts if they
enter or leave a predefined area
● Used to ensure that devices are in an authorized location for
authentication
● Authentication Methods
○ Authentication
■ The process of determining whether someone or something is who/what
they claim to be
○ Local Authentication
■ Username/password verification stored locally
■ Example
● Personal laptop login
○ LDAP (Lightweight Directory Access Protocol)
■ Centralized client/object database
■ Contains a hierarchal organization of the users, groups, servers, and
systems in the network
■ Port
● 389 – plain text
● 636 – secure
266
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Platforms
● Unix
● Linux
● Mac
● Windows
■ Example
● Validating user/password over the network
○ Kerberos
■ Windows domain authentication/authorization
■ Mutual authentication
● User verifies server, server verifies user
■ Key Distribution Center (KDC)
● Issues tickets for authentication and ticket granting
● Tickets
○ Ticket Granting Ticket (TGT)
○ Service ticket/session key
■ Port 88
■ Example
● Windows domain environment
○ SSO (Single Sign-On)
■ Single login for multiple resources
267
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Works by creating trust relationships between various applications and
resources
■ Benefit
● Simplifies access, reduces password management
■ Drawback
● Compromised credentials give access to all resources
● MFA can help keeping secure access
■ Example
● Using Google account to log in to various services
○ SAML (Security Assertion Markup Language)
■ XML-based authentication data exchange
■ Usage
● SSO or federated identity management
■ Roles
● Service provider
● User agent (e.g., web browser)
● Identity provider
■ Example
● Using Google as an identity provider to access a website
○ RADIUS (Remote Authentication Dial-In User Service)
■ Centralized administration for authentication
268
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Usage
● Dial-up
● VPN
● Wireless authentication
■ Protocol
● UDP
○ Port 1812 – for authentication
○ Port 1813 – for accounting
■ A cross-platform standard
○ TACACS+ (Terminal Access Controller Access-Control System Plus)
■ Cisco proprietary authentication/authorization
■ Usage
● 802.1X network authenticator
■ Protocol
● TCP (slower than RADIUS)
■ Benefits
● Can provide some additional security features
● Can be used to independently conduct authentication,
authorization, and accounting processes
● Supports all major network protocols
○ Requires Cisco devices
269
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Time-Based Authentication
■ A security mechanism that will generate temporary dynamic password or
token that is valid for a short period of time
■ Most often implemented as TOTP (Time-Based One-Time Passwords)
■ Part of MFA
■ Benefit
● Enhances security, resistant to replay attacks
■ Implementation
● Software (Google Authenticator)
● Hardware (RSA Key fob)
● Security Principles
○ Least Privilege
■ Users should use the lowest level of permissions necessary to complete
job functions
■ Administrators should only use elevated privileges when necessary
■ Applies to user accounts, system designs, and network configurations
○ Role-based Access
■ Methods of Access Control
● Discretionary Access Control (DAC)
○ Access control method where owners of resources
determine access permissions
270
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Owners assign permissions to files or folders they create
○ Challenges
■ Ensuring every object has an owner
■ Owners set appropriate permissions
● Mandatory Access Control (MAC)
○ Access control policy where the computer system
determines access
○ Uses data labels to assign trust levels to subjects and
objects
○ Commonly used in military systems for highly classified
information
○ Need-to-Know Principle
■ Users must have both the necessary clearance level
and a need to know to access information
■ Ensures access is restricted to only those who
require it for their job functions
● Role-Based Access Control (RBAC)
○ Access control model based on defining roles for job
functions
○ Permissions are assigned to roles, and users are assigned
to roles
271
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Users inherit permissions based on their role, simplifying
access control management
○ Role-Based Groups
■ Grouping users based on their job functions
■ Assigning permissions to groups rather than
individual users
■ Facilitates access control based on job roles,
improving security and manageability
■ Power Users
● A user group with permissions between
regular users and administrators
● Can perform certain administrative tasks
like adding printers or changing the system
time
● Illustrates the concept of assigning
permissions based on job functions
● Encryption
○ Data Encryption
■ A fundamental method for securing data
272
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Encoding information and allowing access only with the correct security
key
○ Unencrypted Data (Cleartext/Plaintext)
■ Easily accessible and viewable format
■ Stored, transmitted, and processed in an unprotected format
○ Encrypted Data (Ciphertext)
■ Scrambled up and unreadable without the proper decryption key
○ Benefits of Encryption
■ Mitigates risks associated with access control failures
■ Even if access controls are bypassed, encrypted data remains unreadable
○ Data State
■ Location of data within a processing system
■ Data can exist in only one of three states
● Data at Rest
○ Data stored on memory, hard drives, or storage devices
○ Vulnerable without encryption
○ Types of encryption to support the confidentiality
■ Full disk encryption
■ Folder encryption
■ File encryption
■ Database encryption
273
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Data in Transit/Motion
○ Data moving between systems or within a system
○ Examples of encryption usage
■ TLS/SSL for web server communication
■ IPsec for VPN connections
■ WPA2 with AES for wireless connections
● Data in Use/Processing
○ Data being read into memory or processed by the CPU
○ Active data held in RAM, CPU caches, or registers
○ Involves encryption and integrity checks to protect data
during processing
■ Data Moves constantly between these different states continually
■ Data security must address protection during each state transition
● Internet Protocol Security (IPSec)
○ Internet Protocol Security (IPsec)
■ A secure network protocol suite that provides authentication and
encryption of data packets to create a secure encrypted communication
path between two computers over an internet protocol network
■ Widely used for VPNs (virtual private networks)
274
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Functions
● Confidentiality
○ Achieved through data encryption
● Integrity
○ Ensured by hashing data before transmission and verifying
upon receipt
● Authentication
○ Each party verifies their identity
● Anti-replay
○ Prevents duplicate packet transmission and attacks
involving captured and resent packets
○ Five Main Steps
■ Key Exchange Request
● Initiates the VPN connection
■ IKE Phase 1
● Authenticates parties and establishes a secure channel for
negotiation
● Utilizes Diffie-Hellman key exchange to create a shared secret key
for establishing secure tunnels
● Modes
○ Main Mode
275
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Conducts three two-way exchanges between the
peers, from the initiator to the receiver
● 1 – Agree on algorithms and hashes
● 2 – Use Diffie-Hellman key exchange to
generate shared secret key
● 3 – Verify identities
○ Aggressive Mode
■ Fewer exchanges for faster initial connection
■ Less secure
■ IKE Phase 2
● Negotiates security association parameters and establishes the
secure tunnel
● Quick Mode
○ Only occurs after IKE already established the secure tunnel
in Phase 1
■ Data Transfer
● Allows data transfer over the secure tunnel using negotiated
parameters
■ IPSec Tunnel Termination
● Occurs when security associations are terminated through mutual
agreement or due to timeout
276
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Diffie-Hellman Key Exchange
■ Allows two systems that do not know each other to be able to exchange
keys and trust each other
○ Data Transfer Modes
■ Transport Mode
● Uses original IP header
● Suitable for client-to-site VPNs
■ Tunneling Mode
● Encapsulates the entire packet
● Suitable for site-to-site VPNs
○ Security Protocols
■ Authentication Header (AH)
● Provides data integrity and origin authentication, but not
confidentiality
■ Encapsulating Security Payload (ESP)
● Provides authentication, integrity, replay protection, and
confidentiality of the data
○ Client-to-Site VPNs
■ Typically use transport mode with AH for integrity and ESP for encryption
of data
277
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Site-to-Site VPNs
■ Typically use tunneling mode with both AH and ESP for integrity,
encryption, and protection of entire packets
● Public Key Infrastructure (PKI)
○ Public Key Infrastructure (PKI)
■ A system of hardware, software, policies, procedures, and people that is
based on asymmetric encryption
■ Used for secure data transfer, authentication, and encrypted
communications over networks
■ Creates a secure connection from end to end
■ Asymmetric Encryption
● Uses public and private keys for encryption and decryption
● Public key is used to encrypt data, private key is used to decrypt
data
● Ensures confidentiality and authenticity of data
● Process
○ 1 – Browser requests server's public key from Certificate
Authority
○ 2 – Browser encrypts shared secret key with server's public
key
278
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ 3 – Encrypted key is sent to server, which decrypts it with
its private key
○ 4 – AES is used to create a secure tunnel for data transfer
● Benefits
○ Ensures confidentiality of data
○ Provides authentication of servers
○ Facilitates secure communication over networks
○ Relation to Public Key Cryptography
■ Public Key Cryptography
● Encryption and decryption process that is just one small part of
the overall PKI
■ PKI uses public key cryptography for its functions
■ PKI encompasses the entire system of managing digital keys and
certificates
○ Components of PKI
■ Certificate Authority (CA)
● A trusted third party that issues digital certificates and maintains
trust between CAs worldwide
■ Key Escrow
● Secure storage of cryptographic keys, allowing retrieval in cases of
key loss or legal investigations
279
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Challenges
○ Security concerns with key escrow
○ Need for strong regulations and security measures to
protect keys
○ Conclusion
■ PKI is crucial for secure communication and data exchange on the
internet
■ Understanding PKI components and processes is essential for network
security
● Digital Certificates
○ Digital Certificate
■ A digitally signed electronic document that binds a public key with a
user's identity
■ Used for users, servers, workstations, or devices
○ X.509 Protocol
■ Standard for digital certificates within PKI
● Contains owner/user information and certificate authority details
○ Wildcard Certificate
■ Allows multiple subdomains to use the same public key certificate
■ Useful for managing subdomains off a main web domain
280
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Certificate Revocation
● If a server using a wildcard certificate is compromised, the
certificate needs to be revoked, affecting all subdomain servers
■ Reissuing Process
● Reissuing a new certificate is quick
● Having one wildcard certificate allows quick reissuance and
deployment to all servers
■ Multiple Domains
● For organizations with multiple websites on different domains,
using a wildcard certificate isn't suitable
■ Subject Alternate Name (SAN) Field
● Certificate that specifies what additional domains and IP
addresses will be supported
● Used to cover multiple domains with one certificate
● Modify the SAN field in the digital certificate
■ Wildcard vs. SAN Field
● Use a SAN field for different domains
● Use a wildcard certificate for subdomains of the same domain
○ Single-Sided and Dual-Sided Certificates
■ Single-Sided Certificate
● Authenticates only the server to the user
● Requires no certificate from the user
281
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Dual-Sided Certificate
● Requires both server and user to validate each other using
certificates
● Offers higher security but requiring more processing power
○ Self-Signed Certificate
■ Signed by the entity it certifies
■ Lacks external verification and trust
■ Suitable for closed or non-production systems
○ Third-Party Certificate
■ Issued by a trusted certificate authority (CA), embedded in major web
browsers and operating systems
■ Offers a higher level of trust and security
○ Root of Trust
■ Validates certificates in a chain from a trusted root certificate authority,
ensuring trustworthiness
○ Certificate Authority (CA)
■ Issues digital certificates
● Contains CA details, serial number, issue/expiry dates, and version
○ Registration Authority (RA)
■ Processes certificate requests from users
■ Forwards requests to the CA for digital certificate creation
282
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Certificate Signing Request (CSR)
■ Contains entity details and public key
■ A vital component in the process of obtaining a digital certificate from a
CA
○ Certificate Revocation List (CRL)
■ Maintained by CAs, lists revoked digital certificates to prevent their use
○ Key Escrow Agents
■ Securely hold copies of user's private keys in case of key loss
○ Key Recovery Agents
■ Specialized software to restore lost or corrupted keys
○ Trust and Security
■ Central to digital certificates, compromised root certificate authorities
can lead to certificate revocation and reissuance
● Understanding Digital Certificates: Demonstration
● Key Management
○ Key Management
■ Involves generating, exchanging, storing, and using encryption keys
securely
○ Importance of Strong Keys
■ A strong key is essential for encryption
283
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Weak passwords can compromise the confidentiality of files even with
strong encryption algorithms
○ Secure Key Exchange
■ Asymmetric methods are often used to encrypt symmetric keys for secure
transmission
● Diffie Hellman algorithm is an example used in VPN, SSL, TLS
connections, etc
○ Secure Storage
■ Keys must be securely stored when not in use, similar to passwords
■ Leaving keys vulnerable can lead to unauthorized decryption of files
○ Regular Key Rotation
■ Keys should be changed periodically to enhance security
■ Regular rotation resets the clock on potential attacks, increasing
confidentiality