L25: Analyze, Report, Automate

Goal of network mapping

Discover and interpret the layout of a given system

Stateful firewall

Keep track of the network connections

Stateless firewall

Examine packets individually without considering their context within a conversation

How to test firewalls

Simulate various traffic types, Look for holes, Use tools (hping3, nmap, curl, telnet, netcat)

Tunneling

Wrap the traffic inside protocols that the firewall allows

Port knocking

Use a specific sequence of connections to try to trigger rule changes in the firewall

Source spoofing

Test how the firewall responds to spoofed traffic

Payload obfuscation

Determine whether the firewall is inspecting the packet payloads or just the headers

Wireless enumeration

Discover nearby SSIDs, Capture handshakes for WPA cracking, Monitor channel usage

Non-switched traffic

All frames sent to every port

Switched traffic

Learns MAC address per port and only forwards frames to that destination

Promiscuous mode

NIC processes all ethernet frames it sees, not just those addressed to its MAC address

Monitor mode

NIC captures all raw 802.11 frames on a given channel (beacons, probe requests, handshakes, etc)

Virtual Local Area Network (VLAN)

Switches use VLAN tagging (tag with ID) to determine where the packet belongs

MITRE ATT&CK

For technique mapping

NIST CSF

For broad risk management cycles

Strategic threat intelligence

High-level trends

Tactical threat intelligence

IoCs, attacker tools

Operational threat intelligence

Active campaigns

Technical threat intelligence

Raw data like exploit code

Executive reports

high-level, non-technical risk-focused summaries and business impact

Technical reports

precise language (tool versions, commands), steps to reproduce, severity, remediation instructions

Fields of a ticket

Summary, description, severity, labels, status, assignee, due date

Lifecycle of a ticket

1. Open

2. In progress

3. Resolved

4. Closed

Questions to prepare a clear-cut retest strategy

1. Who executes?

2. What will it affect?

3. How will it happen?

What is DevSecOps?

Embed security into every phase of SDLC

philosophies of DevSecOps

Security is everyone’s responsibility, Security flaws should be addressed earlier