ITNv7 Lesson 16 - Network Security Fundamentals

Information theft

Occurs when someone steals personal or confidential information like trade secrets or financial information.

Data loss

Occurs when information on a storage device is damaged or made unusable

identity theft

A crime that involves someone pretending to be another person in order to steal money or obtain benefits

Disruption of service

Preventing legitimate users from accessing services to which they should be entitled

Trojan horse

Malicious code that has been written specifically to look like a legitimate program.

virus

Attaches itself to an actual legitimate program and requires manual intervention from a user to spread from one system to another.

worm

Able to spread automatically (without user intervention) between systems by exploiting vulnerabilities on those devices.

Man-in-the-middle attack

The threat actor gets between devices in the system and intercepts all of the data being transmitted. This information could simply be collected or modified for a specific purpose and delivered to its original destination.

Eavesdropping attack

When devices are being installed, the threat actor can intercept data such as security keys that are used by constrained devices to establish communications once they are up and running

SQL injection (SQLi)

Threat actors uses a flaw in the Structured Query Language (SQL) application that allows them to have access to modify the data or gain administrative privileges.

Routing attack

A threat actor could either place a rogue routing device on the network or modify routing packets to manipulate routers to send all packets to the chosen destination of the threat actor. The threat actor could then drop specific packets, known as selective forwarding, or drop all packets, known as a sinkhole attack.

Reconnaissance attack

Involves an adversary attempting to gather information about a network to identify vulnerabilities

Stateful packet inspection

Prevents or allows access based on whether the traffic is in response to requests from internal hosts

URL filtering

Prevents or allows access based on web addresses or keywords.

Application filtering

Prevents or allows access by specific application types based on port numbers

Packet filtering

Prevents or allows access based on the IP or MAC addresses of the source and destination.

Authentication

Users prove who they are

Authorization

Determines which resources the user can access.

Accounting

Keeps track of the actions of the user.

login block-for 60 attempts 5 within 60

Mitigates brute-force attacks by setting a limit on the maximum number of failed login attempts allowed within a defined period of time.

Steps to Configure SSH

Configure device hostname

Configure a domain name

Generate RSA keys

Create a local user and password

Use the transport input ssh command

Use the login local command

Why is SSH preferred over Telnet?

SSH is encrypted

Intrusion Prevention System (IPS)

detects and blocks attacks in real time

Layered Approach

Using different defenses at various points of the network.