Module 3: Comprehensive Network Security and Ethical Hacking Fundamentals

Foundations of Ethical Hacking and Security Assessment

• Definition and Purpose of Ethical Hacking:

  • Ethical hacking involves authorized penetration testing designed to discover security vulnerabilities across an enterprise network.
  • The ultimate objective is to provide an organization with a comprehensive vulnerability assessment report and develop defensive mitigation strategies against identified threats.
  • Defensive controls are constructed by actively testing network elements, such as probing for weak passwords, surveying open port numbers, and identifying unpatched system flaws.

• Curricular Context:

  • Network security builds directly upon local area network (LAN) security principles established in Module 10.
  • Combined coverage of these domains establishes an exhaustive operational foundation in computer security fundamentals.

Core Security Concepts and the Vulnerability Management Lifecycle

• Asset Identification and Inventory:

  • An asset is defined as anything of value owned or paid for by an organization, including physical office items like chairs, wastebaskets, workstations, servers, switches, and routers.
  • The first procedural duty of a security officer is to compile a complete, comprehensive inventory of all organizational assets without omitting any physical or digital property.

• Vulnerability Assessment:

  • Vulnerabilities represent inherent weaknesses, misconfigurations, or flaws in an environment, such as weak user passwords, unclosed port numbers, or missing operating system patches.
  • Automated vulnerability assessment scanners can be installed and executed on servers to uncover weaknesses:
  • Nessus: A commercial, paid vulnerability scanning solution.
  • open vast das: An open-source vulnerability assessment tool that scans systems for open ports, patch deficits, and configuration flaws.

• Threats:

  • A threat is defined as any potential danger to an organizational asset.
  • A vulnerability can exist in a dormant state without an active threat; however, external or internal conditions can evolve to present an active threat at any subsequent point.

• Exploits:

  • An exploit is a specific mechanism or technique engineered to take advantage of an existing vulnerability to gain unauthorized access to a system.
  • Threat actors run vulnerability scans to isolate exposed entry points (such as open ports) and then launch exploits through those vectors.
  • Exploits can introduce further threats into the environment, such as planting malicious background files like keyloggers to record activity and exfiltrate data.

• Mitigation:

  • Mitigation encompasses the operational countermeasures and remediation actions implemented to neutralize vulnerabilities and defend against emerging threats.

• Risk Management and Response Strategies:

  • Risk represents the statistical likelihood or probability that a potential security incident or exploit will occur against an asset.
  • Risk Acceptance: Choosing to tolerate potential loss when the impact or likelihood is negligible. For example, an open office door poses minimal risk of an inexpensive asset like a wastebasket or chair being stolen, justifying acceptance.
  • Risk Mitigation / Protection: Deploying preventative security controls to protect high-value assets. For example, securing laptops by removing them from open offices, securing them in locked enclosures, closing and locking office doors containing desktop workstations, or establishing physical access controls.
  • Risk Transference: Shifting the financial or operational burden of a potential risk to an external third party, primarily through the purchase of insurance policies.

• Standard Security Officer Workflow:

  • Step 1: Inventory all organizational assets.
  • Step 2: Execute vulnerability assessments across all platforms.
  • Step 3: Mitigate identified vulnerabilities and threat vectors.
  • Step 4: Systematically manage and resolve residual risk.

Attack Vectors: External vs. Internal Threats

• External Attack Vectors:

  • Originates from threat actors situated outside the network perimeter.
  • Typically straightforward to mitigate and manage through boundary defense appliances, including firewalls and Intrusion Prevention Systems (IPS).

• Internal Attack Vectors:

  • Originates from internal personnel, authorized users, or corporate employees.
  • Poses elevated risk because internal actors possess verified access privileges, physical proximity, and credentials to access network resources.
  • A single disgruntled employee within an enterprise of thousands of workers can sabotage systems and infrastructure from within the authenticated perimeter.

• Internal Defensive Countermeasures:

  • Enforce strict security policies grounded in the principle of zero trust ("do not trust anyone").
  • Strictly implement least-privilege access controls, providing each employee exclusively with the minimal resources and access rights required to perform designated tasks.

Data Loss Vectors and Prevention Mechanisms

• Primary Vectors for Data Loss and Exfiltration:

  • Electronic mail (email) transmission.
  • Social engineering tactics designed to manipulate individuals into disclosing sensitive records.
  • Stolen or lost unencrypted devices.
  • Unsecured or unauthorized cloud storage devices.
  • Removable storage media (such as external drives or USB sticks).
  • Hard copy physical documents and printed records.
  • Improper or unsegmented user access permissions.

• Data Loss Prevention (DLP) Requirements:

  • Organizations must deploy structured DLP controls across systems to track, detect, and block unauthorized movement of confidential assets.
  • Consistent, verified data backups are fundamentally mandatory to ensure organizational continuity and recovery from data compromise or loss.

Threat Actor Profiles and Classifications

• White Hat Hackers:

  • Ethical security professionals operating within legal boundaries to locate vulnerabilities, penetration-test infrastructure, harden network devices, and enforce stringent password policies.

• Black Hat Hackers:

  • Malicious, unethical criminals who breach computer networks for personal financial gain, disruption, or destructive objectives.

• Gray Hat Hackers:

  • Individuals who perform unauthorized or arguably unethical actions without explicit malicious intent or financial motivation.
  • Often publicly disclose system vulnerabilities without prior consent to embarrass organizations, executives, or system administrators.

• Script Kiddies:

  • Inexperienced individuals, adolescents, or hobbyists lacking deep technical skills.
  • Execute attacks by downloading and launching pre-packaged exploit kits freely accessible on the darknet.

• Vulnerability Brokers:

  • Typically gray hat operators who locate zero-day vulnerabilities and system exploits, reporting their findings directly to hardware or software vendors in exchange for bug bounties or monetary rewards.

• Hacktivists:

  • Ideologically driven attackers who penetrate targets to expose secrets, express political protest, or publicly embarrass government entities and organizations.

• Cybercriminals:

  • Highly organized criminal actors who initiate sophisticated cyber intrusions to steal funds, intellectual property, or commercially valuable assets.

• State Sponsors:

  • Nation-state-backed intelligence or military threat actors targeting geopolitical rivals for foreign intelligence gathering, espionage, or critical infrastructure sabotage.

Security Assessment and Penetration Testing Tools

• Password Crackers:

  • Utility tools used to test authentication robustness and decrypt offline password hashes:
  • try to the Ripper: Classic, high-speed password hash cracking software.
  • TC Hydra: High-performance network logon cracking tool supporting parallel dictionary attacks.
  • rainbowcrack: Hash cracker that utilizes precomputed rainbow tables to accelerate hash recovery.
  • Medusa: Fast, modular, parallelized brute-force authentication cracker.

• Wireless Hacking Tools:

  • Exploitation and auditing frameworks designed to penetrate wireless network architectures, including protected Wi-Fi Protected Access (WPA) deployments:
  • air crank: Wireless network packet capturing and key cracking suite.
  • kismet: Passive wireless network detector, packet sniffer, and intrusion detection system.

• Network Scanning Tools:

  • Port and protocol scanning suites used to discover operational services and open communication sockets:
  • tcp/udp and TP scan: Scanning utilities targeting TCP and UDP transport layers to map available service ports.

• Packet Crafting Tools:

  • Software designed to forge, assemble, modify, and transmit custom network packets across targeted infrastructures:
  • your Cena: Specialized network layer penetration tool recognized for exploiting Cisco infrastructure and layer-$2$ network protocols.
  • HP: Network packet generator and analyzer utility capable of crafting custom TCP/IP packets.
  • nemesis: Command-line network packet injection suite used to test network infrastructure resilience.

• Packet Sniffing and Interception Tools:

  • Traffic analysis software that monitors and captures raw network traffic:
  • while your shark: Open-source protocol analyzer downloaded for packet-level capture and inspection.
  • either cap: Comprehensive man-in-the-middle (MitM) suite capable of sniffing live connections, content filtering, and active protocol dissection.
  • SSL strip: Historical interception tool that bypassed encrypted web interactions prior to $2012$ by stripping Secure Sockets Layer (SSL) certificates and downgrading HTTPS connections to plaintext HTTP, exposing sensitive data to eavesdroppers.

Password Security Policies and Defense Mechanisms

• Browser and Credential Storage Prohibitions:

  • Never save website passwords within web browsers or client-side prompt dialogs.
  • Operating systems like Windows automatically store credentials on local storage in hashed formats; these local hashes can be extracted and cracked offline by attackers.

• Passphrase Construction Guidelines:

  • Passwords must be structured as long passphrases forming complete, personalized sentences unknown to others.
  • Passwords must incorporate a combination of uppercase letters, lowercase letters, and numeric characters.
  • Complete dictionary words should never be utilized in isolation due to their vulnerability to wordlist dictionaries.
  • Passwords must not be shorter than acceptable complexity lengths to prevent fast computational cracking.

• Password Rotation Frequency:

  • Passwords must be updated periodically, with an operational policy requirement of changing credentials at least every $3\,\text{months}$.
  • Scheduled rotation is imperative in shared computing environments, including workplaces, schools, and academic labs where multiple users access the same physical terminals.

• The Mechanics of Offline Hash Cracking:

  • Attackers routinely acquire password hashes from local machines or breached databases to execute unmonitored offline attacks over days, weeks, or months.
  • Threat actors employ extensive rainbow tables and pre-compiled wordlists containing over $115\,\text{GB}$ of raw password permutations.
  • Changing a password every $3\,\text{months}$ completely neutralizes long-running dictionary attacks; an attacker attempting to brute-force a hash across several months will compute an expired credential that has already been discarded.