COMPTIA NETWORK+ N10-009 PART III

SECURE SHELL (SSH)

• ALLOWS YOU TO USE TERMINAL SCREEN TO A REMOTE DEVICE, BUT ALL TRAFFIC SENT OVER THE NETWORK IS ENCRYPTED

• ENCRYPTED CONSOLE COMMUNICATION - tcp/22

• LOOKS & ACTS THE SAME AS TELNET - tcp/23

  • DESIGNED TO REPLACE TELNET

GRAPHICAL USER INTERFACE (GUI)

• SHARE DESKTOP FROM REMOTE LOCATION

MICROSOFT REMOTE DESKTOP PROTOCOL (RDP)

• FOR WINDOWS COMPUTERS

• OR YOU CAN USE REMOTE DESKTOP PROTOCOL CLIENTS FOR NEARLY ANY OTHER OPERATING SYSTEM (i.e.) MAC OS, LINUX, ETC. . . .)

VIRTUAL NETWORK COMPUTING (VNC)

• USES REMOTE FRAME BUFFER (RFB) PROTOCOL

  • SIMILAR IN FUNCTION TO MICROSOFT’S RDP

• CAN BE RUN ON MANY DIFFERENT OPERATING SYSTEMS

APPLICATION PROGRAMMING INTERFACE (API)

• CONNECT & CONTROL A DEVICE USING THE LANGUAGE THAT THAT DEVICE WOULD EXPECT

• AUTOMATE PROCESS & SET UP ADDITIONAL TASKS IF WE NEED TO DO ANY TYPE OF ERROR HANDLING

CONSOLE

• ALLOWS YOU TO CONNECT THROUGH A SERIAL CONNECTION

• PLUG IN RJ45 SERIAL, DB9 SERIAL CONNECTION, ETC. . . .

• MORE MODERN CONNECTION - USB CONNECTION

• PERFECT SOLUTION IF YOU LOSE NETWORK CONNECTIVITY TO A DEVICE

• WILL ALWAYS BE AVAILABLE

• TEXT-BASED SERIAL INTERFACE

• REQUIRES SERIAL OR USB CONNECTION

  • MAY NEED USB TO DB9 SERIAL ADAPTER

JUMP BOX

• ACCESS SECURE NETWORK ZONES

  • PROVIDES ACCESS MECHANISM TO PROTECTED NETWORK

• HIGHLY-SECURED DEVICE

• SSH / TUNNEL / VPN TO THE JUMP SERVER

• ENSURE JUMP SERVER IS ALWAYS KEPT UP TO DATE WITH SECURITY PATCHES & HIGH LEVEL OF AUTHENTICATION IS PROVIDED

IN-BAND MANAGEMENT

• ASSIGN IP TO A DEVICE & THEN CONNECT TO IT USING SSH OR A WEB-BASED FRONT END

• SOMETIMES A SEPARATE INTERFACE ON THE DEVICE

• OTHER TIMES IT’S BUILT INTO OTHER INTERFACES THAT ALREADY EXIST ON THE DEVICE

• WHEN CONFIGURING A DEVICE, YOU WOULD NEED TO PROVIDE IT WITH MANAGEMENT IP ADDRESS, SUBNET MASK, & OTHER IMPORTANT NETWORKING DETAILS

OUT-OF-BAND MANAGEMENT

• USES A SERIAL INTERFACE THAT DOES NOT USE OUR EXISTING NETWORK

• COMMONLY SOMETHING LIKE A SEPARATE MANAGEMENT OR CONSOLE INTERFACE THAT WE’D PLUG INTO USING SERIAL CONNECTION

• MORE MODERN DEVICES - USB CONNECTION

• SEPARATE CONSOLE OR COMM PORT ALLOWS US TO CONNECT A MODEM

• i.e.) USE STANDARD PHONE LINE, CONNECT A MODEM TO THE PHONE LINE, & BE ABLE TO DIAL INTO THAT DEVICE EVEN WHEN THE NETWORK IS DOWN

DATA IN TRANSIT

• DATA TRANSFERRED ACROSS THE NETWORK (WIRED OR WIRELESS)

• AKA: DATA IN-MOTION

• NOT MUCH PROTECTION AS IT TRAVELS

• REQUIREMENT FOR SECURITY WOULD COME OTHER DEVICES (i.e.) FIREWALLS, INTRUSION PREVENTION SYSTEM)

• MIGHT ALSO INCLUDE ADDITIONAL SECURITY TO DATA IN-MOTION (i.e.) TRANSPORT LAYER SECURITY (TLS) & IPSec (INTERNET PROTOCOL SECURITY)

DATA AT REST

• SAVING INFO TO HARD DRIVE, SSD, OR ANY OTHER STORAGE DEVICE

• COMMON WAY TO ENCRYPT DATA AT REST IS TO ENCRYPT THE INFO AS YOU WRITE IT TO THE STORAGE DRIVE

  • i.e.) WHOLE DISK ENCRYPTION, DATABASE ENCRYPTION, FILE OR FOLDER ENCRYPTION

• ONLY AUTHORIZED USERS CAN ACCESS DATA

PUBLIC KEY INFRASTRUCTURE (PKI)

• POLICIES & CONTROL OF ALL THESE DIFFERENT CERTIFICATES

• IF CREATING DIGITAL CERTIFICATES, ENCRYPTION KEYS, OR ANY OTHER TYPE OF DIGITAL SECURITY, THEN YOU’LL WANT TO RELY ON POLICIES YOU CONFIGURE

• LOTS OF PLANNING

• BINDING OF PUBLIC KEYS TO PEOPLE OR DEVICES

  • CERTIFICATE OF AUTHORITY

DIGITAL CERTIFICATE

• DIGITALLY SIGNED BY CENTRAL CERTIFICATE AUTHORITY

• ADDS TRUST TO INDIVIDUAL CERTIFICATES THAT ARE THEN DEPLOYED TO USERS OR DEVICES

• DIGITAL SIGNATURE ADDS TRUST

• CERTIFICATE CREATION CAN BE BUILT INTO OS

WEB OF TRUST

• ADDS OTHER USERS FOR ADDITIONAL TRUST

• IF A TRUSTS B & B TRUSTS C, THEN A CAN ALSO TRUST C

CERTIFICATE AUTHORITIES

• CENTRALIZED AUTHORITY THAT ALL CERTIFICATES START FROM

• IF ANYTHING IS SIGNED ULTIMATELY BY CENTRALIZED AUTHORITY, YOU CAN TRUST IT ANYWHERE IN YOUR ORGANIZATION

• HAS DIGITALLY SIGNED THE WEBSITE CERTIFICATE

• REAL-TIME VERIFICATION

SELF-SIGNED CERTIFICATES

• IF ALL DEVICES & USERS ARE WITHIN YOUR OWN ORGANIZATION, YOU COULD CREATE YOUR OWN CERTIFICATE AUTHORITY

• INTERNAL CERTIFICATE AUTHORITY WILL BE SELF-SIGNING ALL OF THE CERTIFICATES THAT ARE CREATED

• BUILD OWN CERTIFICATE AUTHORITY

• INSTALL CERTIFICATE AUTHORITY CERTIFICATE / TRUSTED CHAIN ON ALL DEVICES

IDENTITY & ACCESS MANAGEMENT (IAM)

• PROCESS OF MANAGING PERMISSIONS & ACCESS TO THAT DATA

• INVOLVES CREATING ACCESS CONTROL TO THAT DATA TO ENSURE ONLY USERS ACCESS INFO THEY REALLY NEED TO PERFORM THEIR JOB

• NEED PROPER AUTHENTICATION TO VERIFY THE USER & AUTHORIZATION FOR DATA ONCE USERS GAINED ACCESS

• WAY TO TRACK & MONITOR ACCESS TO THE DATA SO WE CAN AUDIT & UNDERSTAND WHO ACCESSED THAT INFO

LEAST PRIVILEGE

• USER WILL ONLY HAVE RIGHTS & PERMISSIONS THAT ARE NECESSARY TO ACCESS INFO THEY NEED TO PERFORM THEIR JOB FUNCTION & NO ADDITIONAL ACCESS WOULD BE GRANTED

ROLE-BASED ACCESS CONTROL (RBAC)

• YOU HAVE A ROLE IN YOUR ORGANIZATION

• RIGHTS & PERMISSIONS VARY DEPENDING ON THEIR ROLE

• ADMIN OF NETWORK DETERMINES WHAT TYPE OF ROL AN INDIVIDUAL MIGHT HAVE & WHAT PERMISSIONS ARE ASSOCIATED WITH THAT INDIVIDUAL ROLE

• ADMIN ASSIGNS USERS TO EACH OF THOSE INDIVIDUAL ROLE DEFINITIONS

• WINDOWS USES GROUPS TO PROVIDE ROLE-BASED ACCESS CONTROL

GEOGRAPHIC RESTRICTIONS

• IDENTIFY WHERE USER HAPPENS TO BE & THEN WE CAN ASSIGN DIFFERENT RIGHTS & PERMISSIONS BASED ON WHERE THEY MAY BE LOCATED

• IDENTIFY BASED ON IP ADDRESS (NOT ALWAYS ACCURATE)

• USE GPS (VERY ACCURATE)

GEOFENCING

• AUTOMATICALLY ALLOW OR RESTRICT ACCESS WHEN THE USER IS IN A PARTICULAR LOCATION

• DON’T ALLOW APP TO RUN UNLESS YOU’RE NEAR THE OFFICE

CLOSED CIRCUIT TELEVISION (CCTV)

• MANY ORGANIZATIONS WILL SUPPLEMENT PHYSICAL SECURITY THROUGH USE OF CAMERAS

• VERY COMMON SECURITY TECHNOLOGY

• MOTION DETECTION, READ LICENSE TAGS, OR IDENTIFY A USER BASED ON FACIAL RECOGNITION

• NETWORKED TOGETHER TO ONE CENTRAL POINT WHERE THEY CAN STORE THIS INFO OVER LONG PERIOD OF TIME

DOOR LOCKS

• CONVENTIONAL

  • LOCK & KEY

• DEADBOLT

  • PHYSICAL BOLT

• ELECTRONIC

  • KEYLESS, PIN

• TOKEN-BASED

  • RFID BADGE, MAGNETIC SWIPE CARD, OR KEY FOB

• BIOMETRIC

  • HAND, FINGERS OR RETINA

AAA FRAMEWORK

• AUTHENTICATION

  • PROVE WHO YOU SAY YOU ARE

• AUTHORIZATION

  • NEED TO BE SURE YOU’RE PROVIDED PROPER ACCESS FILES, DIRECTORIES, OR AREAS OF NETWORK BASED ON WHO YOU SAY YOU ARE

• ACCOUNTING

  • TRACK PEOPLE THAT ARE LOGGING IN / LOGGING OUT

  • DOCUMENT WHEN SOMEONE DOES NOT COMPLETE AUTHENTICATION PROCESS PROPERLY

SINGLE SIGN-ON (SSO)

• PROVIDE CREDENTIALS ONE TIME

• DON’T HAVE TO PROVIDE THAT INFO AGAIN

• USUALLY LIMITED BY TIME - 24 HOURS

REMOTE AUTHENTICATION DIAL-IN USER SERVICE (RADIUS)

• COMMON PROTOCOL USED DURING AUTHENTICATION

• SOMEONE LOGS IN TO THEIR VPN CONCENTRATOR, THE CONCENTRATOR MAY BE COMMUNICATING TO AAA SERVER USING RADIUS PROTOCOL

• i.e.) INSTALLING NEW VPN CONCENTRATOR OR FIREWALL - MAY SEE RADIUS AS ONE OF THE OPTIONS AVAILABLE FOR AUTHENTICATION

LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL (LDAP)

• READ & WRITE INFO FROM A CENTRALIZED DIRECTORY ON THE NETWORK

  • SIMILAR TO PHONE DIRECTORY OR A PHONE LISTING WHERE YOU COULD SEARCH FOR USERS OR DEPARTMENTS

• USED TO QUERY & UPDATE X.500 DIRECTORY

  • USED IN WINDOWS ACTIVE DIRECTORY, APPLE OPENDIRECTORY, NOVELL eDIRECTORY, etc. . .

X.500 DISTINGUISHED NAMES

• ALLOWS US TO ASSOCIATE ATTRIBUTES TO A USER OR A DEVICE

• ATTRIBUTE = VALUE PAIRS

• MOST SPECIFIC ATTRIBUTE IS LISTED FIRST

CONTAINERS

• HIGHER LEVEL OBJECTS

• COUNTRY, ORGANIZATION, ORGANIZATIONAL UNITS

LEAF OBJECTS

• INDIVIDUAL USERS & DEVICES

• USERS, COMPUTERS, PRINTERS, FILES

SECURITY ASSERTION MARKUP LANGUAGE (SAML)

• OPEN STANDARD FOR AUTHENTICATION & AUTHORIZATION

• MAKE AUTHENTICATION & AUTHORIZATION PROCESS OPEN SO WE CAN APPLY IT TO MANY DIFFERENT TYPES OF APPLICATIONS

• NOT ORIGINALLY BUILT FOR MOBILE DEVICES

TERMINAL ACCESS CONTROLLER ACCESS-CONTROL SYSTEM PLUS (TACACS)

• REMOTE AUTHENTICATION PROTOCOL

• CREATED TO CONTROL ACCESS TO DIAL-UP LINES TO ARPANET

TERMINAL ACCESS CONTROLLER ACCESS-CONTROL SYSTEM PLUS (TACACS+)

• COMMONLY ASSOCIATED WITH CISCO DEVICES

• LATEST VERSION OF TERMINAL ACCESS CONTROLLER ACCESS-CONTROL SYSTEM PLUS (TACACS)

• NOT BACKWARDS COMPATIBLE

• MORE AUTHENTICATION REQUESTS & RESPONSE CODES

MULTIFACTOR AUTHENTICATION

• ADDITIONAL FACTORS TO THE AUTHENTICATION PROCESS

• MEMORIZED PASSWORD, MOBILE APP WITH PARTICULAR NUMBER WE NEED TO PROVIDE, GPS DETAILS THAT SHOW WE’RE LOCATED WITHIN CORPORATE FACILITY

• SOMETHING YOU KNOW (PASSWORD), SOMETHING YOU HAVE (MOBILE PHONE WITH APP), SOMETHING YOU ARE (BIOMETRIC READING - FINGERPRINT), OR SOMEWHERE YOU ARE (GPS LOCATION)

TIME-BASED ONE-TIME PASSWORD (TOTP) ALGORITHM

• FACTOR OF SOMETHING YOU HAVE

• INTEGRATED INTO AN APP THAT YOU MIGHT HAVE ON YOUR MOBILE DEVICE

• USUALLY HAS SECRET KEY ASSOCIATED WITH IT

• USES TIME OF DAY TO PROVIDE A PSEUDORANDOM TYPE OF NUMBER SYSTEM

  • CHANGES EVERY 30 SECONDS

• MORE COMMON ONE-TIME PASSWORD METHODS

  • i.e.) GOOGLE, FACEBOOK, MICROSOFT, etc. . . .

HONEYPOT

• VIRTUAL NETWORK WITH VIRTUAL SERVERS & VIRTUAL COMPONENTS THAT WOULD BE VERY ATTRACTIVE TO AN ATTACKER

HONEYNET

• LARGER DECEPTION NETWORK WITH ONE OR MORE HONEYPOTS

RISK

• EXPOSURE WE HAVE TO SOMETHING THAT IS HARMFUL OR DANGEROUS

• IF WE NEED TO DESCRIBE HOW POSSIBLE IT MIGHT BE FOR SOMETHING BAD TO HAPPEN

• CONSTANT CONCERN

VULNERABILITIES

• SET OF WEAKNESSES ASSOCIATED WITH CURRENT VERSION OF OPERATING SYSTEM

• SOME VULNERABILITIES ARE NEVER DISCOVERED

EXPLOITS

• TAKING ADVANTAGE OF VULNERABILITY TO GAIN ACCESS TO A SYSTEM OR GAIN ACCESS TO DATA

THREAT

• WHAT IS USED BY THE ATTACKER TO EXPLOIT THAT VULNERABILITY

• MIGHT BE ACCIDENTAL (i.e.) FIRE OR FLOOD)

• IF OPERATING SYSTEM HAS A VULNERABILITY, THERE MAY BE A THREAT AGENT THAT TAKES ADVANTAGE OF THAT VULNERABILITY BY CREATING A THREAT ACTION

• THREAT ACTION WILL EXPLOIT VULNERABILITY & ALLOW ATTACKER TO GAIN ACCESS TO SYSTEM

• RESULTS IS A LOSS OF SECURITY (i.e.) DATA BREACH, SYSTEM FAIL, etc. . . .)

CIA TRIAD

• AKA: AIC TRIAD

• FUNDAMENTALS OF SECURITY

• C: CONFIDENTIALITY

• I: INTEGRITY

• A: AVAILABILITY

CIA TRIAD - CONFIDENTIALITY

• MAKE DATA CONFIDENTIAL

• RESTRICTING ACCESS TO DATA OR ENCRYPTING DATA

CIA TRIAD - INTEGRITY

• DATA WE ARE REFERENCING HAS NOT BEEN MODIFIED BY ANY THIRD-PARTY MEANS

• i.e.) MESSAGES SENT ACROSS NETWORK CAN’T BE MODIFIED UNLESS THERE’S SOME TYPE OF DETECTION IN PLACE - DIGITAL SIGNATURES

CIA TRIAD - AVAILABILITY

• BE SURE THAT ALL OF SECURITY WE ARE APPLYING TOWARDS DATA & SYSTEMS DOESN’T AFFECT OVERALL ACCESS & AVAILABILITY OF THE SYSTEMS THEMSELVES

COMPLIANCE

• MEETING STANDARDS OF LAWS, POLICIES, & REGULATIONS

• NOT FOLLOWING COMPLIANCE REQUIREMENTS CAN RESULT IN FINES, INCARCERATION, OR LOSS OF EMPLOYMENT

• MAY BE WIDE RANGING - NATIONAL, TERRITORY, OR STATE LAWS

  • MAY BE DOMESTIC & INTERNATIONAL REQUIREMENTS

DATA LOCALIZATION

• ANY DATA COLLECTED BY THAT COUNTRY MUST STAY INSIDE OF THAT COUNTRY

• i.e.) GENERAL DATA PROTECTION REGULATION (GDPR) - ASSOCIATED WITH EUROPEAN UNION

• NEED TO UNDERSTAND WHERE DATA IS SUPPOSED TO BE LOCATED & WHERE THE DATA CAN MOVE ONCE IT’S BEEN STORED

GENERAL DATA PROTECTION REGULATION (GDPR)

• REGULATION THAT’S ASSOCIATED WITH THE PROTECTION & PRIVACY OF DATA ASSOCIATED WITH INDIVIDUALS THAT RESIDE WITHIN THE EUROPEAN UNION

• INCLUDES, BUT NOT LIMITED TO, NAME, ADDRESS, PHOTO, EMAIL, BANK DETAILS, ETC. . . .

• ANY DATA COLLECTED ON EUROPEAN CITIZENS MUST BE STORED IN EUROPEAN UNION

  • USERS CAN DECIDE WHERE DATA GOES & CAN CHOOSE TO REMOVE DATA FROM SITES IF THEY PREFER

• WAY FOR INDIVIDUALS TO PROTECT DATA THAT THEY THEMSELVES OWN

PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)

• STANDARD FOR PROTECTING CREDIT CARDS

PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS) OBJECTIVES

• BUILD & MAINTAIN A SECURE NETWORK & SYSTEMS

• PROTECT CARDHOLDER DATA

• MAINTAIN VULNERABILITY MANAGEMENT PROGRAM

• IMPLEMENT STRONG ACCESS CONTROL MEASURES

• REGULARLY MONITOR & TEST NETWORKS

• MAINTAIN ALL INFORMATION SECURITY POLICY

INTERNET of THINGS (IoT)

• SENSORS - HEATING & COOLING, LIGHTING

• SMART DEVICES - HOME AUTOMATION, VIDEO DOORBELLS

• WEARABLE TECH - WATCHES, HEALTH MONITORS

• SEGMENTING IoT DEVICES ONTO THEIR OWN NETWORK & AWAY FROM DATA MIGHT BE A GOOD CHOICE FOR IT SECURITY

INDUSTRIAL INTERNET of THINGS (IIoT)

• ONE MACHINE COMMUNICATING WITH ANOTHER MACHINE IN ORDER TO KEEP ALL SYSTEMS RUNNING

• ENTIRE MANUFACTURING LINE BASED ON ALL DEVICES BEING ABLE TO COMMUNICATE PROPERLY FROM ONE TO THE OTHER

• BY SEGMENTING, YOU’RE PREVENTING ANY EXTERNAL DEVICES FROM DISRUPTING THAT VERY IMPORTANT COMMUNICATION

• OIL & GAS, ROBOTICS, MEDICAL DEVICES

SUPERVISORY CONTROL & DATA ACQUISITION (SCADA) SYSTEM

• LARGE SYSTEMS THAT MIGHT BE IN A MANUFACTURING ENVIRONMENT OR MIGHT BE USED FOR POWER GENERATION

• MULTI-SITE INDUSTRIAL CONTROL SYSTEMS (ICS)

• REQUIRE REAL-TIME MONITORING

• NEED TO ENSURE WE ARE ABLE TO CONTROL THE SYSTEM ACROSS THE NETWORK

OPERATIONAL TECHNOLOGY (OT)

• HARDWARE & SOFTWARE FOR INDUSTRIAL EQUIPMENT

• i.e.) KEEP ELECTRIC GRID UP & RUNNING, TRAFFIC CONTROL, OR ENTIRE MANUFACTURING PLANT

• IF FAILURE OCCURS, RESULTS CAN BE VERY WIDE RANGING

  • i.e.) IF YOU LOSE TRAFFIC CONTROL, TRAFFIC LIGHTS MAY NOT WORK PROPERLY

GUEST NETWORKS

• SEPARATE WIRELESS NETWORK FOR VISITORS

• PREVENT ANY TYPE OF ACCESS TO INTERNAL SERVICES

• CONTROLLED ACCESS - PASSWORD OR LOGIN

• IF ACCESS POINTS SUPPORT IT

BRING YOUR OWN DEVICE (BYOD)

• AKA: BRING YOUR OWN TECHNOLOGY

• WHEN YOU OWN A MOBILE DEVICE & YOU BRING IT INTO THE OFFICE TO BE ABLE TO ALSO USE IT FOR WORK PURPOSES

• DEVICE NEEDS TO MEET COMPANY’S REQUIREMENTS FOR PROPER SECURITY

• ORGANIZATION WILL SEGMENT DEVICE SO PRIVATE INFO REMAINS PRIVATE ON YOUR PHONE - SEPARATE AREA WILL BE SPECIFIC FOR OFFICE USE

DENIAL of SERVICE (DoS)

• ACTION OR SERIES OF ACTIONS THAT CAUSES A SERVICE TO FAIL

• OVERLOADING OF A SYSTEM WHERE OTHER ARE NOT ABLE TO ACCESS B/C NO RESOURCES ARE AVAILABLE ON THAT PARTICULAR SYSTEM

• KEEP SYSTEM UP TO DATE WITH LATEST SECURITY PATCHES

DISTRIBUTED DENIAL of SERVICE (DDoS)

• MULTIPLE DEVICES ALL ACTING IN UNISON TO CAUSE DENIAL OF SERVICE

• i.e.) SINGLE BOTNET MAY BE ABLE TO TAKE OVER MILLIONS OF PERSONAL COMPUTERS & HAVE ALL DEVICES DIRECT ALL TRAFFIC TOWARDS ONE SINGLE SERVER ON THE INTERNET

ASYMMETRIC THREAT

• DEVICES WITH VERY LIMITED ACCESS TO INTERNET COULD STILL MANAGE TO BRING DOWN SYSTEMS WITH MANY MORE RESOURCES AVAILABLE

• ATTACKER HAS FEWER RESOURCES

DISTRIBUTED DENIAL of SERVICE (DDoS) REFELCTION & AMPLIFICATION

• ATTACKERS SENDS A LITTLE BIT OF INFO INTO THE INTERNET & THE INTERNET IS ABLE TO MULTIPLY THAT PARTICULAR ATTACK & SEND A MUCH LARGER AMOUNT OF TRAFFIC TO VICTIM’S DEVICE

• ATTACKERS EFFECTIVELY TAKEN SYSTEMS & PROTOCOLS WE USE EVERY DAY & TURNED ALL OF THOSE AGAINST US

  • NETWORK TIME PROTOCOL (NTP), DOMAIN NAME SYSTEM (DNS), INTERNET CONTROL MESSAGE PROTOCOL

VIRTUAL LOCAL AREA NETWORK (VLAN)

• DESIGNED TO KEEP DIFFERENT PARTS OF THE NETWORK SEPARATED FROM OTHER PARTS

• SEPARATES THE DIFFERENT DEVICES INTO THEIR OWN SEPARATE NETWORK

• EACH NETWORK IS NOT ABLE TO COMMUNICATE WITH THE OTHER UNLESS THERE HAPPENS TO BE A ROUTER BETWEEN THEM

SWITCH SPOOFING

• TAKE ADVANTAGE OF A CONFIGURATION ON SWITCH THAT AUTO-CONFIGURES AN INTERFACE TO BE EITHER AN INTERFACE FOR A DEVICE OR AN INTERFACE FOR ANOTHER SWITCH

• WHEN YOU CONNECT DEVICE TO A SWITCH, SWITCH WILL AUTOMATICALLY DETERMINE WHAT’S ON THE OTHER SIDE

• SWITCH TO SWITCH CONNECTION - COULD CONFIGURE A TRUNK CONNECTION

• KEY TO HOPPING FROM ONE VLAN TO ANOTHER - PRETENDING THAT YOU ARE A SWITCH & BEING ABLE TO MOVE TO WHATEVER VLAN YOU LIKE THROUGH THAT TRUNK

• DISABLING AUTO-NEGOTIATION PROCESS, YOU REMOVE SWITCH SPOOFING FROM ABILITY TO HOP BETWEEN VLANS

DOUBLE TAGGING

• VLAN TAGS ARE USED IN TRUNKING BETWEEN SWITCHES

• ADDING ADDITIONAL TAGS ALLOWS US TO POSSIBLY COMMUNICATE TO A DIFFERENT VLAN

• TAKES ADVANTAGE OF “NATIVE” VLAN CONFIGURATION FOR A SWITCH

• CERTAIN CONFIGURATIONS - WE HAVE ONE SWITCH REMOVE FIRST TAG & PLACE DATA ONTO APPROPRIATE VLAN, & THEN HAVE SEPARATE SWITCH REMOVE SECOND TAG & PLACE FRAME INTO A DIFFERENT VLAN

• GOOD FOR DENIAL of SERVICE (DoS)

MEDIA ACCESS CONTROL (MAC) ADDRESS

• HARDWARE ADDRESS OF ETHERNET ADAPTER INSIDE OF YOUR DEVICE

• UNIQUE TO A DEVICE

• SEND INFO SPECIFICALLY TO YOUR DEVICE & NO ONE ELSE’S

• 48 BITS / 6 BYTES LONG

• FIRST 3 BYTES ARE THE SAME, LAST 3 BYTES CHANGE

MAC FLOODING

• MAC TABLE IS ONLY SO BIG

• ATTACKER SENDS MANY, MANY FRAMES TO THIS SWITCH ALL WITH DIFFERENT SOURCE MAC ADDRESSES

• QUICKLY FILLS UP VERY LIMITED SPACE THAT’S AVAILABLE FOR MAC ADDRESS TABLE

• TURN SWITCH INTO A HUB - EVERY INBOUND FRAME INTO THE SWITCH IS AUTOMATICALLY FORWARDED TO EVERY OTHER INTERFACE THAT HAPPENS TO BE ON THAT SWITCH

• CAN BE RESTRICTED IN SWITCH’S PORT SECURITY SETTINGS

SPOOFING

• ONE PERSON OR DEVICE PRETENDS TO BE ANOTHER PERSON OR DEVICE

• i.e.) FAKE WEB SERVER, FAKE DNS SERVER, EMAIL ADDRESS, CALLER ID

• TECHNIQUE THAT ALLOWS ATTACKERS TO HAVE ACCESS TO A SYSTEM OR PERSON THAT NORMALLY THEY WOULD NOT HAVE

ON-PATH ATTACKS

• ATTACKER SITS IN THE MIDDLE OF A CONVERSATION & BE ABLE TO MONITOR OR EVEN CHANGE CONTENTS OF THAT CONVERSATION

ARP POISIONING

• AKA: IP SPOOFING

• ATTACKER IS PRETENDING TO BE IP ADDRESS THAT THEY REALLY ARE NOT