Security Techniques

Extended Service Set (ESS) configuration

Involves multiple wireless access points working together to create a unified extended coverage area for users in a large building or facility

Adjacent Channel Interference

Occurs when the channels selected for adjacent wireless accsss points do not have enough space between the channels

Site Survey

Process of planning and designing a wireless network to provide a solution

Heat Map

Graphical representation of the wireless coverage, the signal strength, and frequency utilization data at different location on a map

Wired Equivalent Privacy (WEP)

OLD wireless security standard meant to match wired LAN security for wireless networks

(64 and 128 bit)

Wi-Fi Protected Access (WPA)

(2003) Temporary improvement of WEP while the IEEE 802.11i standard was being developed

WPA2

Improved data protection and network access control by addressing weaknesses in WPA version

WPA3

Latest version using AES encryption and introducing new features like SAE, Enhanced Open, updated cryptographic protocols, and management protection frames

It includes:

• Management Protection Frames

• GCMP

• SAE

• OWE

Simultaneous Authentication of Equals (SAE)

Enhances security by offering a key establishment protocol to guard against offline dictionary attacks

Enhanced Open Wireless Encryption (OWE)

Advancement in wireless security, especially for networks using open authentication. Providing individual data encryption between user and the WAP. Guarding against eavesdropping attacks in public WiFi settings.

Cryptographic Protocol

Uses a newer variant of AES known as the AES GCMP

Galois Counter Mode Protocol (GCMP)

Supports 128-bit AES for personal networks and 192-bit AES for enterprise networks with WPA3

Management Protection Frames

Required to protect network from key recovery attacks

Authentication, Authorization, and Accounting (AAA) Protocol

Plays a role in network security by centralizing user authentication to permit only authorized users to access network resources. By using RADIUS or TACACS+

RADIUS

Client/Server protocol offering AAA Services for network users.

• Secure Network Access by confirming user identities via a central server and enforcing predefined access rules

• Monitoring user activity

TACACS+

Separates the functions of AAA to allow for more granular control over processes.

Authentication Protocols

Confirm user identities for network security and authorized access

EAP

Authentication framework that supports multiple authentication methods

Application Security

Critical aspect of software development that focuses on building applications that are secure by design

• Input Validation

• Secure Cookies

• Static Code Analysis

• Dynamic Code Analysis

• Code Signing

• Sandboxing

Code Signing

Technique used to confirm the identity of the software author and guarantee that the code has not been altered or corrupted since it was signed

Sandboxing

Security mechanism that is used to isolate running programs by limiting the resources they can access and the changes they can make to a system

Network Access Control (NAC)

Scans devices from their security status before granting network access, Safeguarding for both known and unknown dvevices

Persistent Agent

Software installed on a device requesting network access

Non-Persistent Agent

Users connect to Wi-Fi, access a web portal, and click a link for login in these solutions

Web Filtering

Used to restrict or control the content a user can access on the Internet

EX:

• Agent-based

• Content Categorization

• Centralized Proxies

• Block Rules

• URL Scanning

• Reputation based Filtering

DNS Filtering

Used to block accces to certain websites by preventing the translation of specific domain names to their corresponding IP addresses

DomainKeys Identified Mail (DKIM)

Allows the receiver to check if the email was actually sent by the domain it claims to be sent from and if the content was tampered with during transit

Adds digital signature

Sender Policy Framework (SPF)

Email authentication method designed to prevent forging sender addresses during email delivery

When SPF server receives an email it can verify the senders IP address against a list of authorized IPs in the domain.

• Prevent email spoofing

• Improving email deliverability

• Enhanced Domain reputation

Domain-based Message Authentication, Reporting & Conformance (DMARC)

An email validation system designed to detect and prevent email spoofing

Helps with:

• Email compromise attacks

• Phishing Emais

• Email Scams

Email Gateway

Server or system that serves as the entry and exit point for emails.(Transfer of email over Internet and local server)

Improves:

• Routing

• Security

• Policy Enforcement

• Encryption + Decryption

On-premise Email Gateway

Physical server that is located within an organization’s own data center or premises that provides an organization with control over their email system

Cloud-based Email Gateway

Is hosted by a 3rd party cloud service providers to provide greater scalability and ease of maintenance

Hybrid Email Gatewy

Combines both On-premise and cloud-based gateways

Spam Filtering

Process of detecting unwanted and unsolicited emails and preventing them from reaching a user’s email inbox

Endpoint Detection and Response (EDR)

Category of security tools that monitor endpoint and network events and record the information in a central database

File Integrity Monitoring (FIM)

Used to validate the integrity of an OS and application software files using a verification method between the current fill state and known, good baseline.

Helps Identify Changes in these Files:

• Binary

• System + Application

• Configuration + Parameter

Extended Detection and Response (XDR)

Security strategy that integrates multiple protection technologies into a single platform to improve detection accuracy and simplify the incident response process

Collect data from:

• Email

• Endpoint

• Server

• Cloud

• Network

User Behavior Analytics (UBA)

Deploys big data and machine learning to analyze user behaviors for detecting security threats. By spotting anomalies in established patterns, indicating potential threats

Benefits:

• Early Detection

• Insider Threat Protection

• Improved Incident Response