Malware and its effects
Mitigate Malware
End devices are prone to Malware attacks, Malicious software designed to damage, disrupt, steal or generally inflict bad or illegitimate action on data, hosts or a network.
Several factors make the identification of malware particularly difficult:
- Vast amount of malware exists and is created on a daily basis, often results in the uselessness of intrusion detection systems (IDS) based on signature.
- Malware integration: Malware is often integrated in otherwise-trusted applications and sent over protocols that are traditionally allowed through firewalls and access lists.
- Restricted amount of resources: Organizations have narrow range of resources (both human and technology) to effective control the massive amounts of traffic that pass through the network. The quantity of data traffic, both good and bad, has become so large that it is almost too much for any one organization to keep up.
- Use of encryption: The increasing use of encryption has added another challenge for organizations trying to gain visibility into malicious traffic residing on the network.
How to mitigate against malware?
The most effective method of mitigating malware threats is to prevent the malware from entering the network at all.
• Advanced Malware Protection Techniques that do not rely solely on signature definitions.
• Scan all incoming email messages, including attachments for malware. Set SPAM filters to reduce unwanted emails. Limit user access to only company approved links, messages and email addresses.
• Security devices at the network perimeter can identify known malware files based on their indicators of compromise. The files can be removed from the incoming data stream before they cause an incident.
• Set automatic real-time signature updates & blacklisting
• Monitoring for suspicious behaviour
Anti-Virus Software / Anti malware software on endpoints:
• Helps prevent hosts from getting infected and spreading malicious code.
• Automated updates keep the virus definitions up to date.
• Do not prevent viruses from entering the network.
Preventative Measures
• Security devices at the network perimeter can identify unknown malware files based on their indicators of compromise, that is, suspicious behaviour, for example, unusual network traffic. The files can be removed from the incoming data stream before they cause an incident.
• Automatic updates
• Monitoring for suspicious behaviour
Explain what each of the logical planes are on a network device, the value of dividing the functions of a network device into planes and provide examples of technologies designed to protect each of these planes.
Routers and switches can be logically divided into three planes:
• Control Plane: Responsible for routing data correctly
• Management Plane: Responsible for managing network elements
• Data Plane: Responsible for forwarding data.
By dividing the network into the three planes we can better protect and secure the traffic traversing each of these planes.
Control Plane
In the Control Plane we have device generated traffic required for the operation of the network such as routing protocol updates. Updates can be protected through routing protocol authentication thus preventing a router from accepting fraudulent updates.
Management Plane
Management plane traffic generated either by network devices or network management stations are an attractive target to hackers and the management plane has several technologies designed to mitigate such risks. For example, use of strong management protocols providing confidentiality, integrity and authentication.
• Login and password policy
• Present legal notification
• Ensure the confidentiality of data
• Role Based Access
• Authorise actions
• Enable management access reporting
Data Plane
Data plane or user traffic forwarded through a device can be secured using ACL’s, ant spoofing mechanism’s and layer 2 security features. We can implement the following measures:
• ACL’s
• Block unwanted traffic or users
• Reduce the chance of DoS attacks (close half open sessions)
• Mitigate spoofing attacks
• Provide bandwidth control
• Classify traffic to protect management and control plane
Layer 2 devices can also help secure the infrastructure:
• Port security
• DHCP Spoofing
• Dynamic ARP inspection
• IP Source Guard
Explain how configuring an enable secret password helps to protect a device from being compromised by an attack?
The goal is to always prevent unauthorized users from accessing a device using Telnet, SSH, or via the console. If attackers are able to penetrate this first layer of defense, using an enable secret password prevents them from being able to alter the configuration of the device. Unless the enable secret password is known, a user cannot go into privileged EXEC mode where they can display the running config and enter various configuration commands to make changes to the router. This provides an additional layer of security.
Securing an edge router is a critical step in securing the network and three areas of router security must be maintained… Explain each of these and give examples.
Physical Security
Physical security pertains to where the device is physically located. We can categorise physical controls as
• Preventative: Prevents Access (It must be in a secure locked room, accessible by only those authorised)
• Deterrent: Deters access (Installation of video surveillance)
• Detective: Detects access (Installation of Motion sensors)
It must also be protected from environmental factors to ensure it is free from electrostatic or magnetic interference has fire suppression and temperature and humidity control.
In the event of a power failure it should be supported by UPS reducing the possibility of a network failure from power loss.
Router Hardening
Hardening a router means that the router is secured against attacks as best as possible. Each of the functional planes provide different functionality that needs protecting.
This means we need to:
• Secure administration control. Ensure that only authorised personnel have access and level of access is controlled.
• Unused ports and interfaces should be disabled reducing the number of ways a device can be accessed. (aux layer / 2 ports)
• Unnecessary services and default services that are enabled but not required should be disabled as these can be exploited by an attacker (DoS attack)
Operating System Security
There are a few procedures involved in securing the features and performance of the router operating system
• Equip routers with the maximum amount of memory possible. The availability of memory can help mitigate risks to the network from some denial of service (DoS) attacks while supporting the widest range of security services.
• Use the latest, stable version of the operating system that meets the feature specifications of the router or network device. Security and encryption features in an operating system are improved and updated over time, which makes it critical to have the most up-to-date version.
• Keep a secure copy of router operating system images and router configuration files as backups.
When logging and managing information flow, the information flow between management hosts and the managing device can take two paths. Briefly explain each of these?
As a general rule, for security purposes, OOB management is appropriate for large enterprise networks. However, it is not always desirable. The decision to use OOB management depends on the type of management applications running and the protocols being monitored.
OOB management guidelines are:
• Provide the highest level of security.
• Mitigate the risk of passing insecure management protocols over the production network.
In-band management is recommended in smaller networks as a means of achieving a more cost-effective security deployment. In such architectures, management traffic flows in-band in all cases. It is made as secure as possible using secure management protocols, for example using SSH instead of Telnet.
In-band management guidelines are:
• Apply only to devices that need to be managed or monitored.
• Use IPsec, SSH, or SSL when possible.
• Decide whether the management channel needs to be open at all times.
Providing secure administrative access to a network device involves more than configuring just a password. Briefly explain a best practice in the administration of network devices from a management network?
• A dedicate VLAN should be established for network management
• A dedicated network management workstation should be established
• A packet filter should be configured to allow only identified administrative hosts
• All traffic between the administrator and network devices should be encrypted.
When logging and managing information flow, the information flow between management hosts and the managing device can take two paths. Briefly explain each of these?
As a general rule, for security purposes, OOB management is appropriate for large enterprise networks. However, it is not always desirable. The decision to use OOB management depends on the type of management applications running and the protocols being monitored.
OOB management guidelines are:
• Provide the highest level of security.
• Mitigate the risk of passing insecure management protocols over the production network.
In-band management is recommended in smaller networks as a means of achieving a more cost-effective security deployment. In such architectures, management traffic flows in-band in all cases. It is made as secure as possible using secure management protocols, for example using SSH instead of Telnet.
In-band management guidelines are:
• Apply only to devices that need to be managed or monitored.
• Use IPsec, SSH, or SSL when possible.
• Decide whether the management channel needs to be open at all times.
The IOS includes 3 privilege levels by default, each of which defines what commands are available to a user. Explain the purpose, commands and prompts identifying each of these levels?
Privilege level 0: Includes the disable, enable, exit and logout commands
Privilege level 1: This is User EXEC mode. The command prompt at this mode includes the ‘>’ sign. From this it is not possible to make configuration changes, in other words, the command configure terminal is not available.
Privilege level 15: This is Privilege EXEC mode. This is the highest privilege level, where all CLI commands are available. The command prompt at this mode is the ‘#’ sign.
What are the additional privilege levels?
Additional privilege levels range from 2 to 14 and can be used to provide customised access control.
AAA is an architectural framework for enabling a set of three independent security functions. Briefly explain each of these?
- Authentication: Enables a user to be identified and verified prior to being granted access to a network device and / or network services.
- Authorization: Defines the Access privileges and restrictions to be enforced for an authenticated user.
- Accounting: Provides the ability to track and log user access, includes user identity start and stop times, executed commands and so on. In other words, it maintains a security log of events
RADIUS and TACACS can be compared using a number of different criteria that determine how they should be deployed on a network. What are the criteria that determine their primary use?
RADIUS vs TACACS+ — Quick Notes
Protocol & Ports
* RADIUS
- Cisco legacy (older impls): UDP 1645 (auth/authz), UDP 1646 (acct)
- Industry standard: UDP 1812 (authentication/authorization), UDP 1813 (accounting)
TACACS+
- TCP 49 (single well-known port)
Encryption & EAP
- RADIUS
- Encrypts only the password in Access-Request packets
- Supports EAP (e.g., for 802.1X)
TACACS+
- Encrypts the entire payload
- Does not support EAP
Authentication / Authorization / Accounting Flow
- RADIUS
- Auth & authz combined in the same exchange
- Accounting is a separate exchange
- Limited command authorization (not granular per command on devices)
TACACS+
- Authentication, authorization, and accounting are separate
- Granular CLI command authorization (per-user / per-group)
Accounting Focus
- RADIUS
- Strong session accounting (e.g., user sessions, VPN/WLAN/802.1X)
- No detailed network-device CLI accounting
- TACACS+
- Network-device CLI accounting (who ran which command, when)
Primary Use Cases
- RADIUS
- Secure network access (WLAN, VPN, 802.1X device authentication)
- TACACS+
- Network device access (administrative logins)
- Management of network devices (fine-grained command control & logging)
Refer to the above topology and configuration. Briefly explain the purpose of this configuration?
R1 has been configured as follows:
!
aaa new-model
!
aaa authentication login default local
!
username admin1 secret 5 $1$mERr$Ty/EkWXcSXEwIckISrps8/
!
line con 0
password ciscoconpa55
login authentication default
Answer
AAA has been enabled on the device and AAA authentication for the console login has been configured to use the local database through the default authentication list.
SSH has been enabled on R1 and the following configuration has now been added to the configuration.
aaa authentication login SSH-LOGIN local
!
line vty 0 4
password ciscovtypa55
login authentication SSH-LOGIN
transport input ssh
Answer
A new authentication list SSH-LOGIN has been configured and line vty is configured to use this. The authentication list SSH-LOCAL is case sensitive
What are the two most common AAA protocols and what is each of their preferred use?
The two most common AAA protocols are TACACS and RADIUS.
AAA is recommended for network device access control and TACACS+ is the protocol of choice on Cisco proprietary networks.
AAA is recommended for secure network access control and used to obtain the identity of a device or user before that device or user is allowed access to the network. RADIUS is the preferred protocol for secure network access.
What internal LAN elements should be protected in a network infrastructure?
• Endpoints
• Network infrastructure devices susceptible to LAN related attacks
Briefly explain four measures and their purpose that organisations can take to protect their endpoints from existing and new threats
(You should in your answer identify devices and techniques that also provide host protection)?
• Antimalware software: Protects endpoints from malware
• Spam filtering: Prevents spam emails from reaching endpoints
• Blacklisting: Prevents endpoints from connecting to websites with bad reputations by immediately blocking connections based on the latest reputations.
• Data Loss Prevention: Prevents sensitive information from being lost or stolen
The following are examples of devices and techniques that implement host protections at the network level.
Devices and techniques that provide host protection include:
• Advanced Malware Protection (AMP) – This provides endpoint protection from viruses and malware.
• Email Security Appliance (ESA) – This provides filtering of SPAM and potentially malicious emails before they reach the endpoint. An example is the Cisco ESA.
• Web Security Appliance (WSA) – This provides filtering and blocking of websites to prevent hosts from reaching dangerous locations on the web. The Cisco WSA provides control over how users access the internet and can enforce acceptable use policies, control access to specific sites and services, and scan for malware.
• Network Admission Control (NAC) – This permits only authorized and compliant systems to connect to the network
• Data Loss Prevention - This can be provided through hardware and software encryption of local drive [This is not at the network level]
Briefly explain the purpose of Network Access Control (NAC) and give an example of a port-based NAC standard?
The purpose of NAC is to allow only authorised and compliant systems whether managed or unmanaged to access the network.
802.1x is a standard for port based network access control that provides an authentication mechanism for Local Area Networks(LAN) and Wireless Local Area Networks(WLAN).
On a layer 2 switch what when using 802.1X which three traffic types can be sent if the authentication port-control auto command is configured, but the client has not yet been authenticated?
Until the workstation is authenticated, 802.1X access control enables only:
• Extensible Authentication Protocol over LAN (EAPOL)
• Cisco Discovery Protocol (CDP)
• Spanning Tree Protocol (STP) traffic through the port to which the workstation is connected.
After authentication succeeds, normal traffic can pass through the port.
Briefly explain the purpose of Network Access Control (NAC) and give an example of a port-based NAC standard?
The purpose of NAC is to allow only authorised and compliant systems whether managed or unmanaged to access the network.
802.1x is a standard for port based network access control that provides an authentication mechanism for Local Area Networks(LAN) and Wireless Local Area Networks(WLAN).
Briefly explain what a CAM table attack is and what measures can be taken to mitigate this type of attack?
A CAM table attack, or MAC flooding, occurs when an attacker overwhelms a switch’s CAM table with fake MAC addresses, using a tool such as macof.
Once the table is full, the switch can no longer map MAC addresses to ports and begins broadcasting all traffic to every port. This allows the attacker to intercept network traffic using a packet sniffer. The attack only affects devices within the same LAN or VLAN.
To mitigate this, port security can be used to limit the number of MAC addresses per port. For larger networks, 802.1X with Network Access Control (NAC) and an Identity Services Engine (ISE) provides scalable protection. Additional steps include disabling unused ports and placing them in an isolated VLAN.
What is the purpose of enabling BPDU Guard and where should this be configured?
A BPDU (Bridge Protocol Data Unit) is a message that network switches exchange to manage the network topology and prevent network loops
When you enable BPDU Guard, a switch port that was forwarding now stops and disables the port if a BPDU is seen inbound on the port. You would enable BPDU Guard on an access port as a end user should never be generating BPDU’s.
VLAN architecture simplifies network maintenance and improves performance, however, it opens the door to abuse.
Briefly explain the VLAN hopping attack which takes advantage of a VLAN implementation, explain how this attack is launched and how it might be mitigated?
VLAN’s create separate broadcast domains on switches, therefore endpoints on different VLAN’s are unable to communicate with each other unless permitted to do so by a layer 3 device.
A VLAN hopping attack enables traffic from one VLAN to be seen by another VLAN without the aid of a router, the attacker configures a host to act like a switch and take advantage of the auto trunking feature.
It can be launched by spoofing 802.1q and DTP messages from the attacking host to cause the switch to enter trunk mode or through the introduction of a rouge switch and enabling trunking.
If successful, the attacker can access all the VLAN’s on the switch and see all traffic sent and received
VLAN hopping and VLAN double-tagging attacks can be prevented by implementing the following trunk security guidelines:
• Disabling trunks on all access ports (lab)
• Disabling auto trunking (lab)
• Change the native VLAN (lab)
• Ensure that native VLAN is used only on trunk links (lab)
Briefly explain how the following two network attacks work, their purpose and how they might be mitigated?
(i) DHCP Spoofing
(ii) DHCP Starvation
A DHCP spoofing attack occurs when a rogue DHCP server is connected to the network and provides false IP configuration parameters to legitimate clients. A rogue server can provide a variety of misleading information:
Wrong default gateway - The rogue server provides an invalid gateway, or its own IP address, to create a man-in-the-middle attack.
Wrong DNS server - The rogue server provides an incorrect DNS server address that points the user to a nefarious website.
Wrong IP address - The rogue server provides an invalid IP address which effectively creates a DoS attack on the DHCP client.
Mitigation: Enable DHCP Snooping to trust only legitimate DHCP ports and block unauthorized DHCP offers.
(ii) DHCP Starvation:
An attacker floods the DHCP server with fake DHCP requests using random MAC addresses until all IP addresses are leased, preventing real users from connecting. Tool such as Gobbler is used to do this.
Mitigation:Use Port Security to limit MAC addresses per port and DHCP Snooping to rate-limit DHCP messages.
DHCP messages received on trusted ports are allowed to pass through the device. And packets from these ports are automatically forwarded.
If DHCP Snooping is not enabled, all ports are trusted by default. An untrusted port is a port that is not allowed to assign DHCP addresses.
-
Questions58
-
Chapter 1 Questions24
-
Chapter 2 Questions25
-
Chapter 3 Questions23
-
Chapter 4 Questions25
-
Module 1-4 Questions73
-
Modules 5-765
-
Modules 8-1049
-
Modules 13-1452
-
Firewalls47
-
Tutorial 611
-
Modules 11-1222
-
Modules 15-1724
-
Modules 18-1922
-
Modules 20-2221
-
Network Security Practice Final64
-
Tutorial Week 913
-
Tutorial 824
-
Tutorial 710
-
Mock Theory A14
-
Internet Security Theory Exam 22/2315
-
Internet Secuirty Theory Exam 25-2615
