Let's take a look at network threats and attacks for the Network
Security for Certified in Cybersecurity examination.
We divided this course into three parts: Computer Networking,
Network Threats and Attacks, and Network Infrastructure.
When we took a look at computer networking,
we saw the basics of how networks work,
but networks provide a tremendous business advantage.
They allow us to communicate,
but they are also the source and victim of many
different types of threats and attacks.
We need to know what's going on.
This is a slide we saw before,
but it's an important one because it allows us to be aware of
the types of threats we face from some type of threat
intelligence feeds such as commercial feeds,
open source intelligence feeds, and various blogs and comments,
whether or not it's in the social media or mainstream media
that indicates and highlights some of the types of attacks
being used by hackers today.
We need to know what type of activity is going on.
And a problem for many companies is they don't know what's normal,
so therefore, if they see something abnormal,
they don't identify it as being different from usual.
This means we need to monitor our traffic so we're able to
see when there's something going on, which is not part of normal activity.
We also need to know what types of attacks are coming.
This is where we often develop signatures.
We put together an attack signature that says,
these are the types of tools and techniques being used
so we can especially watch for these.
We see that many hackers use similar attack methods against multiple customers.
If one person has experienced some type of an attack,
then,
very often we'll see they'll use that same type of attack
against other organizations and victims as well.
Very often,
we see that hackers will focus on one specific type of industry sector,
say healthcare, or they might focus for a while on education.
Well,
if I'm working in one of those areas that is part of the
mainstream type of attacks going on today,
I need to be especially watchful and prepared.
One of the things we need to watch out for is a DDoS;
that is a distributed denial‑of‑service,
and when we are subject to that type of attack,
then we have to be ready for it so that we could either deflect the attack,
and an example of that was an anti‑spam organization.
They knew that someday they would be attacked,
so therefore,
they set up an infrastructure so when an attack came after them in one location,
they quickly diverted all of their services to another location.
So the attack was going against an empty target.
As soon as the attackers realized that, they moved to another place,
and where the company had moved to,
but then the anti‑spam organization just quickly moved to another,
and they played a bit of a game that's sometimes called
whack‑a‑mole where you try to hit a target here,
then it moves somewhere else, they hit it there,
they move somewhere else,
and that idea of attack deflection allowed them to keep providing service,
even though they were under a massive attack that was trying to
deprive their customers of having service.
A denial‑of‑service is when our services don't work.
A distributed denial‑of‑service is where that attack is amplified
to come from many different locations at once.
The other thing we can do, and we see several companies do this,
is they attempt to absorb the attack traffic.
They have big enough pipes, or we could say enough bandwidth,
so when an attack comes in, they are able to actually take that,
dump it off to the side, and still allow legitimate traffic to come through.
This can be done either by the organization itself or by using some of
the commercial feeds that are out there that will help us to be able to
filter out any type of attack traffic.
Our firewalls are important in this regard,
because a firewall is, just like with a medieval city,
the gate in the wall to the city,
and that gate is where we are able to filter what traffic
comes in and also what traffic goes out.
If we set up our controls correctly, we can make sure,
first of all, that an inbound attack is stopped,
but also that it filters to make sure that we are not the
source of an attack on someone else.
In other words, we also filter outbound traffic as well.
This filtering of outbound or exiting traffic is
often known as egress monitoring.
We watch for what's going out to make sure there's
nothing malicious going out of our network,
and we also watch to make sure there's nothing sensitive,
using things like data loss and data leakage prevention systems,
that will try to ensure that there's no data going out through the
firewall that really shouldn't have gone out,
that will say Classified, for example.
Very often, firewall rules will be set up either as whitelisting or blacklisting.
Whitelisting quite simply says,
this is what's allowed; everything else is prohibited.
Blacklisting says, we will allow everything,
except these things that are prohibited.
It's a difference in culture, mentality,
and of course,
whether or not we use whitelists or blacklists is very often
dependent on the level of security we need and would be
reasonable for our organization.
It's important that firewalls are installed in the correct place.
They need to be where the traffic goes.
Now, this is often difficult in today's wireless world,
because not all of our traffic is coming through fiber.
A lot of our traffic could be coming through wireless,
from a cell phone that has been connected to the network and
has access outside of the network perimeter,
and so our firewalls are important,
both internally to protect our internal systems from external,
but also even between different internal network segments so that we can
ensure that traffic from finance isn't visible to people,
for example, in HR.
When we look at firewall operations, the important thing is the rules.
We'll call that the configuration of the firewall.
What rules do we put in place and make sure that those rules are reasonable,
they're backed up by policy,
because it should never be such that someone just puts a rule
in because they think it's a good idea.
No,
it's management that determines what should or should not be
allowed with things like acceptable use policies,
for example.
But when we need to make a change to the rule,
this is where we need to be careful,
because we could put the rules in the wrong order.
We've already allowed something that we would have later prohibited.
And it's important here that when we put the rules in that
they're accurate so we don't end up limiting traffic that
should have been allowed.
Many organizations have had this problem.
They put a rule in the firewall that actually
blocked legitimate traffic as well.
So change control is important.
We should document what all of the rules are,
of course, because it's important that we know who asked for that rule,
and if there's a question about it, we can go back and ask them,
why is that rule there?
A firewall records lots of different types of activity,
what did come through, and what was blocked,
but it's no good to have logs of what happened if nobody ever looks at the logs.
Again, we need to know what is good normal traffic,
and what are the normal volumes of traffic?
So if something strange happens, we would be aware of it.
Now the problem with encryption is that encryption
makes the firewall less effective,
because the encrypted traffic cannot easily be examined by the firewall,
and even if the firewall was able to see some encrypted traffic,
we start to see performance hits as well,
and a lot of our traffic is not making it through the firewall,
it becomes a point of congestion.
We often use virtual private networks,
and virtual private networks are often using encryption to protect their data.
And this means that when that traffic comes through,
again,
the firewall may not be able to really see clearly if there was
something malicious or unwanted in that encrypted traffic.
One of the hardest things to do is find good staff,
because firewall administration is not always a really
interesting long‑term career job, it can be.
Certainly, there can be a lot of opportunity to learn and investigate,
but quite often, people move on, areas of more responsibility,
and we bring in new staff that needs now to be trained,
they need to know what to look for.
They need to have the proper training to know how to
configure and monitor that firewall as well.
Two of the most common tools used in conjunction with network security are
intrusion detection systems and intrusion prevention systems.
They are based on the same type of engine or the same
type of operational characteristic.
The difference is that a detection system logs traffic,
a prevention system can actually block traffic.
These came out of something we knew originally as misuse detection.
A person who is authorized misuses the system,
and the idea is that we needed to be able to determine what
was legitimate traffic and what was bad traffic from a
legitimate or authorized user, as well as,
of course, blocked traffic from an intruder that had no right to be there at all.
We very often use IDS and IPS systems as part of our
layered defense or defense in‑depth model.
In this way, we can, for example, have the internet,
there off to the left, and put an IDS in front of our firewall.
It's recording what type of traffic is coming to the firewall.
The firewall does its job to block,
but allow traffic that should be allowed through,
but then maybe we put another IDS in behind the firewall,
maybe in towards the internal network or up towards our
demilitarized zone where we have our web server.
So here, we can see what traffic did make it through the firewall.
Maybe that's a very enlightening log that can show us there are
things getting through the firewall that shouldn't,
for example.
Then we can, in front of our servers and internal networks,
put in an intrusion prevention system that if it sees something it doesn't like,
it will actually block it.
It's the difference between a person who sits at the side of
the road and watches the traffic go by.
That person sees pretty much everything,
and they can be very accurate at recording how many cars or trucks went by.
But there's not much that that type of person who's only
monitoring will be able to do about maybe bad traffic.
Instead, we now have an IPS.
The person sitting beside the road was an IDS,
intrusion detection,
but intrusion prevention means that person can actually step and block traffic.
Now, the problem with this, of course,
is you don't want it to block legitimate traffic,
and it can take a lot of work to tune an intrusion prevention
system that it won't start blocking legitimate traffic or
letting bad traffic go through.
We can also, as we see on our server here,
have host‑based intrusion detection and prevention systems.
These will try to pick up any changes on that server,
and you're all very familiar with that these days.
You can be doing something and all of a sudden you get,
bloop, a little window comes up and that window says,
this program is trying to make a change to your system.
Should we allow it?
And you'll need to answer in an administrator password to permit that.
That's a host‑based intrusion prevention system,
which is preventing a program from making a change
until it has your approval for that.
How do IDSs and IPSs operate?
They often look for things such as known attack signatures,
a signature that we know, oh, this is how an attack is configured,
or they look for a pattern of activity.
If you see this, then this, then this, that's bad.
So those are two of the types of analysis engines we use,
pattern matching and signature based.
The other is anomaly detection.
What is something which is an anomaly, different from normal?
We know that we have a normal amount of traffic that goes down the road,
but all of a sudden there's a huge amount at once.
That's an anomaly that could be an indication maybe
of a denial‑of‑service attack.
And, this looks at things such as improper protocols.
An old example of this was ICMP.
ICMP, Internet Control Management Protocol,
is a really good tool we can use to ensure we have
connectivity between different devices.
The problem with it is that someone said we can
misconfigure that little ping packet, the ICMP packet,
now to be an enormous size, and that was what we called the ping of death.
It tried to say that it was a normal ICMP packet,
but of course, it wasn't and could cause network disruptions.
That's what a protocol anomaly would be.
We could also have traffic anomalies and that is different types of traffic,
maybe we have traffic going to some other type of,
should we say, server or application we've never seen before,
and we say, that doesn't look right, or we could have statistical,
a flood of traffic that just wouldn't be what would
be the normal flow of traffic.
The other is heuristic where we're looking and saying,
this is normal behavior, but has that changed?
Now,
one of the problems with this is that these types of systems are
very good at picking up new types of attacks,
but sometimes they'll overreact.
They'll react to an attack that wasn't really a problem.
And this is where we need things like heuristics
that will maybe look at something, they'll put it into a sandbox,
we can examine it for a little while,
and then if it looks like it's properly behaving,
allow it through.