Introduction to Network Security - Fundamentals and Palo Alto Security Fundamentals

THE CONNECTED GLOBE

  • The Connected Globe course provides a fundamental introduction to the operations of connected devices, routing mechanisms, area networks, and communication protocols.

  • Learning objectives include describing enterprise network operations, networking devices, routed versus routing protocols, network topologies, and infrastructure services such as the Domain Name System (DNS).

Lesson 1: Devices and Connections

  • Historical Context (The NET):

    • In the 1960s, the U.S. Defense Advanced Research Projects Agency (DARPA) developed ARPANET, which served as the precursor to the modern internet.

    • ARPANET was significant for being the first packet-switched network.

    • Packet-Switched Network Definition: A system that breaks data into small blocks called packets, transmits each individual packet from node to node toward its final destination, and reassembles them in the correct sequence once received.

  • Evolution of Connections:

    • The internet is often described as the "network of networks" because it links multiple local area networks (LANs) to a worldwide wide area network (WAN) backbone.

    • Today, billions of devices use the Transmission Control Protocol/Internet Protocol (TCP/IP) suite for communication over packet-switched networks.

    • Key facilitating technologies include routers, routing protocols, SD-WAN, DNS, and the World Wide Web (WWW).

Common Network Devices

  • Routers:

    • Physical or virtual devices that forward data packets to destination networks using logical addresses along a determined path.

    • Best paths are determined via routing protocols using variables such as bandwidth, cost, delay, and distance.

    • Wireless Router: A device combining the functions of a standard router and a wireless access point (AP) to provide routing between wired and wireless segments.

  • Default Gateway:

    • A network node within the IP suite that acts as a forwarding host (router) to external networks when no other specific route matches a packet's destination IP.

    • It serves as an access point involving changes in addressing or networking technology.

  • Access Point (AP):

    • A device connecting to a router or wired network that transmits a Wi-Fi signal to allow wireless devices to join the network.

    • Wireless Repeater: Rebroadcasts signals from a router or AP to extend the range of the Wi-Fi network.

  • Hubs:

    • Also known as concentrators, these connect multiple devices (desktops, laptops, printers) on a LAN.

    • They broadcast incoming traffic out of all ports, which causes network congestion and security risks.

    • Unicast Traffic: Data sent from one specific device to another single device.

    • Broadcast Traffic: Data sent from one device to all other connected devices.

  • Switches:

    • Intelligent hubs that use physical addresses to forward data packets to specific destination ports.

    • Micro-segmentation: A method used by switches to create separate network segments, increasing data transmission rates and security compared to hubs.

    • Switches are used to implement Virtual LANs (VLANs), which logically segregate a network to limit collision and broadcast domains.

Lesson 2: Routing

  • Protocols and Layers:

    • Routed Protocols: Such as IP, these manage packets containing routing information for transport across networks.

    • Routing Protocols: Defined at the Network layer (Layer 3) of the OSI model, specifying how routers communicate. Types include static and dynamic.

  • Static Routing:

    • Requires manual creation and updates of routes by an administrator.

    • Lacks automatic rerouting for failures or congestion unless alternate routes are manual configured.

    • Suitable for small networks or backup/special-case scenarios (e.g., single router accessibility).

    • Benefits: Low bandwidth requirements (no broadcast updates) and built-in security (restricts routing to defined paths).

  • Dynamic Routing:

    • Automatically learns new or alternate routes and periodically updates routing tables with current information.

Dynamic Routing Protocol Classification

  • Distance-Vector Protocol:

    • Makes decisions based on distance (metrics like hop count) and vector (exit interface).

    • Periodically informs neighbors of topology changes.

    • Convergence: The time needed for all routers to update tables after a status change.

    • Issues without Convergence: Routers might send traffic to invalid destinations.

    • Issues during Convergence: Routing information exchange consumes resources, slowing the network for several minutes.

  • Routing Information Protocol (RIP):

    • A distance-vector protocol using hop count as a metric.

    • Hop Limit: Implements a limit of 1515 to prevent routing loops. A destination at 1616 hops is considered unreachable.

    • Loop Prevention Mechanisms:

      • Split Horizon: Prevents a router from advertising a route back out of the interface where it was learned.

      • Triggered Updates: Sends updates immediately upon detecting a change rather than waiting for the standard 30-second30\text{-second} interval.

      • Route Poisoning: Explicitly sets a bad route's hop count to 1616.

      • Hold Down Timers: Prevents accepting updates for an unreachable destination until a timer expires, preventing "flapping" (rapid Up/Down state changes).

  • Link-State Protocol:

    • Requires every router to maintain a complete map of the entire network.

    • Transmits updates regarding adjacent link states to all routers.

    • Features: Compute-intensive, calculates the most efficient route using speed, delay, load, reliability, and cost.

    • Convergence: Rapid, occurring within seconds.

    • Example: Open Shortest Path First (OSPF), used in large enterprise networks divided into areas identified by 32-bit32\text{-bit} identifiers.

  • Path-Vector Protocol:

    • Similar to distance-vector but avoids scalability/hop-count issues.

    • Example: Border Gateway Protocol (BGP), used between separate Autonomous Systems (AS) by Internet Service Providers (ISPs).

Lesson 3: Networks and Topologies

  • Local Area Network (LAN):

    • Connects end-user devices (computers, servers, printers) within a small area to share resources.

    • Uses hardware such as bridges, hubs, switches, and wireless APs.

  • Wide Area Network (WAN):

    • Connects multiple LANs across large geographic areas (cities, countries, or the globe).

    • Uses hardware such as access servers, firewalls, modems, routers, and VPN gateways.

    • Traditional WAN: Relies on a data plane (information) and a control plane (direction) managed manually by engineers.

  • SD-WAN (Software-Defined WAN):

    • Separates control processes from hardware, making them software-configurable.

    • Benefits: Centralized control (deploying policies across the network at once), simplicity through Zero-Touch Provisioning, improved performance for cloud access, and reduced costs by substituting MPLS with broadband.

  • Network Topologies:

    • Star: Every node connects to a central hub/switch; easy to scale but the center is a single point of failure.

    • Mesh: Interconnected nodes provide multiple paths; used for critical components to eliminate bottlenecks.

    • Legacy: Ring and Bus topologies are rarely used in modern environments.

  • Specialized Area Networks:

    • CAN/WCAN: Campus Area Networks for universities or corporate grounds.

    • MAN/WMAN: Metropolitan networks across a city.

    • PAN/WPAN: Personal networks (e.g., linking a smartphone to a smartwatch or Alexa).

    • VAN: Value-Added Networks for industry-specific business process integration.

    • WLAN: Wireless LAN (Wi-Fi).

    • WWAN: Wireless Wide-Area Network using cellular technology.

    • SAN: Storage Area Network connecting servers to disk arrays.

Lesson 4: Domain Name System (DNS)

  • Definition: A distributed, hierarchical database protocol mapping Fully Qualified Domain Names (FQDNs) to IP addresses.

  • Registration: Domain names must be registered with a registrar (e.g., GoDaddy).

  • Root Name Servers: There are 1313 root server networks named a.root-servers.neta.root\text{-servers.net} through m.root-servers.netm.root\text{-servers.net}. DNS servers use a "root hints" file to locate them.

  • Functional Workflow:

    • Host sends a request to a local DNS server.

    • If not authoritative, the server performs a recursive query.

    • Top-down process: Local Server →→ Root Server →→ TLD Server (e.g., .com) →→ Authoritative Domain Server.

  • Security: DNS over HTTPS (DoH) encrypts data between the client and resolver.

  • Record Types:

    • A/AAAA: Maps domain to IPv4/IPv6 address.

    • CNAME: Maps domain to another hostname (Canonical Name).

    • MX: Identifies email servers.

    • PTR: Pointer for reverse DNS lookups (IP to host).

    • SOA: Start of Authority (zone administrator info, serial numbers).

    • NS: Identifies authoritative name servers.

    • TXT: Stores text information.

Lesson 5: Internet of Things (IoT)

  • Expansion: There are over 5 billion5\text{ billion} internet users. By 20252025, nearly 30 billion30\text{ billion} IoT devices and 9 billion9\text{ billion} smartphone subscriptions will use 160 exabytes (EB)160\text{ exabytes (EB)} of monthly data.

  • IoT Connectivity Categories:

    • Cellular:

      • 2G/2.5G: Low cost, low sensors.

      • 3G: Rates between 384 Kbps384\text{ Kbps} and 168 Mbps168\text{ Mbps}.

      • 4G/LTE: Speeds over 3 Gbps3\text{ Gbps}; latency under 2 ms2\text{ ms}.

      • 5G: Ultra-low latency, massive scalability, network slicing.

    • Satellite:

      • C-band: 4 to 8 GHz4\text{ to } 8\text{ GHz} (Wi-Fi, radar).

      • L-band: 1 to 2 GHz1\text{ to } 2\text{ GHz} (GPS, radio).

    • Short-Range Wireless:

      • ANT+: Proprietary multicast for wearables.

      • 6LoWPAN: IPv6 over low-power wireless for smart bulbs/meters.

      • Bluetooth/BLE (Bluetooth 4.0+): BLE consumes significantly less power.

      • Wi-Fi/802.11: IEEE standards.

        • 802.11n (Wi-Fi 4): 2.42.4 and 5 GHz5\text{ GHz}, 54 to 600 Mbit/s54\text{ to } 600\text{ Mbit/s}.

        • 802.11ac (Wi-Fi 5): 5 GHz5\text{ GHz}, 433 Mbit/s to 3.46 Gbit/s433\text{ Mbit/s to } 3.46\text{ Gbit/s}.

        • 802.11ax (Wi-Fi 6): Multi-band, up to 11 Gbit/s11\text{ Gbit/s}.

      • Z-Wave: Home automation (mesh).

      • Zigbee/802.14: Industrial/Smart home mesh.

    • LP-WAN/WWAN:

      • NB-IoT: Uses LTE subset (200 kHz200\text{ kHz} range) for indoor density.

      • LoRaWAN: Open standard for secure public networks.

      • Sigfox: Subscription cellular LPWA using Ultra Narrowband (UNB).

      • WiMAX (802.16): Broadband failover/smart grids.

  • Identity of Things (IDoT): IAM for human-to-device/device-to-device interaction; involves naming, identity lifecycles, and PII protection.

  • Security Challenges:

    • 98%98\% of IoT traffic is unencrypted.

    • 57%57\% of devices are vulnerable to high-severity attacks.

    • 40%40\% of medical imaging (IoMT) devices run on unsupported OS.

  • Industrial IoT / Palo Alto Solutions: Uses ML-based techniques for device discovery, Zero Trust privilege recommendations, and behavior monitoring to stop threats like cryptojacking or the Conficker worm.

NETWORKING AND ADDRESSING

  • This course details IP addressing, subnetting, model layers, and the lifecycle of data packets.

Lesson 1: IP Addressing

  • Numbering Systems:

    • Decimal (Base 10): Numerals 0 to 90\text{ to } 9.

    • Hexadecimal (Base 16): 16 digits (0 to 90\text{ to } 9 and A to FA\text{ to } F); used to represent a byte as two digits.

    • Binary (Base 2): Transistor-based (11 for "on/closed," 00 for "off/open").

  • IPv4 Logical Addressing:

    • 32-bit32\text{-bit} address space allowing 4.3 billion4.3\text{ billion} public addresses.

    • Loopback Range: 127.0.0.1 to 127.255.255.255127.0.0.1 \text{ to } 127.255.255.255 used for host-internal troubleshooting.

    • Private Address Ranges:

      • Class A: 10.0.0.0 to 10.255.255.25510.0.0.0\text{ to } 10.255.255.255

      • Class B: 172.16.0.0 to 172.31.255.255172.16.0.0\text{ to } 172.31.255.255

      • Class C: 192.168.0.0 to 192.168.255.255192.168.0.0\text{ to } 192.168.255.255

  • Subnet Mask:

    • Distinguishes network portion (contiguous "on" bits) from host portion.

    • Default masks: Class A (255.0.0.0255.0.0.0); Class B (255.255.0.0255.255.0.0); Class C (255.255.255.0255.255.255.0).

  • IPv6 Logical Addressing:

    • 128-bit128\text{-bit} space providing approximately 3.4×10383.4 \times 10^{38} addresses.

    • Format: 8 hextets of 4 hexadecimal digits (16 bits per hextet16\text{ bits per hextet}).

    • Upper 64 bits (48-bit global +16-bit subnet48\text{-bit global } + 16\text{-bit subnet}) and Lower 64 bits (node/interface).

    • Simplification Rules:

      1. Omit leading zeros in hextets.

      2. Use double colons (::::) once for consecutive zero hextets.

      3. Mixed environments: x:x:x:x:x:x:d.d.d.dx:x:x:x:x:x:d.d.d.d

  • Network Address Translation (NAT):

    • Maps private address spaces to public ones to preserve routability across the internet.

Lesson 2: Subnetting

  • Logic: Dividing large networks to limit traffic and visibility.

  • Class Capacities:

    • Class A: Over 16 million (224−2)16\text{ million } (2^{24}-2) host addresses.

    • Class B: Over 65,000 (216−2)65,000\text{ } (2^{16}-2) host addresses.

    • Class C: 254 (28−2)254\text{ } (2^8-2) host addresses.

    • Note: 22 addresses are always subtracted per network (one for the network address, one for the broadcast address).

  • CIDR & VLSM:

    • CIDR: Classless Inter-Domain Routing replaces fixed boundaries with arbitrary bit boundaries.

    • VLSM: Variable-Length Subnet Masking allows allocation on any bit boundary.

    • Supernetting: Aggregating contiguous network prefixes to reduce routing table size.

Lesson 3: TCP/IP and OSI Model

  • OSI Model (7 Layers):

    • Layer 7 - Application: FTP (20/21), HTTP (80), HTTPS (443), IMAP (143), POP3 (110), SMTP (25), SNMP (161/162), Telnet (23).

    • Layer 6 - Presentation: Code conversion/encryption (ASCII, EBCDIC, GIF, JPEG, MPEG).

    • Layer 5 - Session: Session management (NFS, RPC, SSH, SIP).

    • Layer 4 - Transport: Reliable transport and flow control.

      • TCP: Connection-oriented, three-way handshake, reliable (acknowledgments), slower.

      • UDP: Connectionless, best-effort, faster, low overhead (DNS, streaming).

      • SCTP: Message-oriented but reliable like TCP.

    • Layer 3 - Network: Routing, logical addressing (IP), routers.

    • Layer 2 - Data Link: Framing and physical delivery.

      • LLC Sublayer: Sequencing and flow control.

      • MAC Sublayer: Hardware addressing, framing, and CRC error control.

    • Layer 1 - Physical: Electrical/mechanical signaling (cables, bits).

  • TCP/IP Model (4 Layers):

    • Layer 4 - Application (OSI 5-7).

    • Layer 3 - Transport (OSI 4).

    • Layer 2 - Internet (OSI 3).

    • Layer 1 - Network Access (OSI 1-2).

Lesson 4: Packet Lifecycle

  • Circuit Switching: Dedicated physical path established for a session; inefficient for data usage.

  • Packet Switching: Path shared across nodes; resilient to congestion.

  • Workflow:

    1. Application sends data blocks to TCP stack.

    2. TCP stack determines MSS (typically 1,460 bytes1,460\text{ bytes}).

    3. TCP adds headers (segments).

    4. IP stack adds source/destination IPs (packets).

    5. Network adapter converts packet to bits for transmission.

Lesson 5: Data Encapsulation

  • Logic: Each layer wraps information from the layer above in its data section.

  • PDU (Protocol Data Unit):

    • Layer 1: Bit.

    • Layer 2: Frame.

    • Layer 3: Packet.

    • Layer 4: Segment or Datagram.

ENDPOINT SECURITY

  • Focuses on protecting devices (laptops, phones, IoT) from malware, ransomware, and phishing.

Lesson 1: Endpoint Security Elements

  • Includes endpoint protection, anti-malware/spyware, personal firewalls, HIPS (Host-based IPS), MDM, and server management.

  • Endpoint Classification: Attack surface has increased due to mobile/IoT growth. Shodan.io is a search engine used to find connected devices.

  • Zero-Day Exploit: Targets new vulnerabilities before vendors release patches. Network firewalls cannot block these without updated signatures.

Lesson 2: Malware and Anti-Malware

  • Terminology:

    • Metamorphism: Malware changing signature patterns each iteration.

    • Polymorphism: Changing filenames or encryption keys.

    • Malspam: Popular delivery via unsolicited emails.

  • Approaches to Detection:

    1. Signature-Based: Uses file signatures. Actions: Quarantine, Alert, Delete. Reactive: ineffective against zero-days or daily variations (20,000 new daily20,000\text{ new daily}).

    2. Container-Based: Virtual barriers around processes. Resource-intensive; can be circumvented.

    3. Application Allow Listing: Positive control model (only approved apps run). Difficult in BYOD/Cloud environments; vulnerable apps can still be exploited in memory.

    4. Anomaly-Based: Detects patterns not conforming to baseline.

      • Heuristic: Packet/traffic patterns.

      • Behavior: Evaluates intended actions before execution.

Lesson 3 & 4: Golden Image, Firewalls, and HIPS

  • Golden Image: Standard configuration used for enterprise hardening (disabling unused services).

  • Network Firewall: Protects external perimeters.

  • Personal/Host Firewall: Operates at Layer 7. Netfilter/iptables is popular for Linux.

  • HIPS: Agent-based detection on endpoints. Palo Alto surveys indicate significant (25%25\%) end-user performance impact.

Lesson 5 & 6: Mobile and Server Management

  • MDM Features: Policy enforcement (passcodes), Malware protection, Software distribution, Remote wipe, Geofencing.

  • Jailbreaking/Rooting: Removing vendor software restrictions.

  • IAM and Directory Services:

    • Active Directory: Microsoft service using LDAP, Kerberos, and DNS.

    • OpenLDAP: Open-source client-server protocol.

  • Patch Management: Reactive race against time; no protection for zero-days.

  • Configuration Management: Formal process to maintain standard security settings (e.g., disabling USBs).

Lesson 7: Structured Troubleshooting

  • Network Baseline: Metrics of "normal" operations (memory utilization, response times).

  • Network Documentation: Physical/logical diagrams, data flows, and manuals.

  • OSI Troubleshooting Approach:

    • Physical: Verify power and cables.

    • Data Link: Encryption standards (Wi-Fi keys) and frame types.

    • Network: IP conflicts, SSIDs, ICMP commands (ping, traceroute).

    • Transport: Network congestion, TTL values.

    • Session: Expired tokens, power standby (sleep) resets.

    • Presentation: Encryption key changes, browser incompatibilities.

    • Application: App conflicts, caching, reinstallation needs.

NETWORK SECURITY

Lesson 1: Legacy Firewalls

  • Packet Filtering (1st Gen): Layer 4 inspection of IP, Protocol, and Port. No session context.

  • Stateful Packet Inspection (2nd Gen): Layer 4; maintains session state. Faster because it doesn't inspect packets after the initial connection establishment.

  • Application Firewalls (3rd Gen): Layer 7 gateways/proxies. High security (malware/web filtering) but negative performance impact.

Lesson 2-4: IDS/IPS, Web Filters, and VPNs

  • IDS vs. IPS: IDS is passive (alerts), IPS is active (blocks inline).

  • Classifications:

    • Knowledge-Based: Signature database; lower false alarms.

    • Behavior-Based: Activity baseline; high false-positive rate; detects unknown attacks.

  • Web Content Filters: Database matching URLs. Disadvantage: False positives require admin intervention.

  • VPN Protocols:

    • L2TP: Secure with IPsec.

    • SSTP: Microsoft SSL 3.0 tunnel.

    • OpenVPN: Open-source, up to 256-bit256\text{-bit} encryption.

    • PPTP: Fastest but least secure (port 1723).

    • IPsec: Requires VPN client. Uses Security Associations (SA) and IKE.

    • Split Tunneling: Some traffic goes to VPN, some to internet. Requires personal firewalls to prevent "side door" attacks.

PALO ALTO NETWORKS STRATA

Lesson 1-3: Architecture and Identification

  • Prevention-First Architecture: Foundation is the Next-Generation Firewall (NGFW).

  • NGFW Elements:

    • Single-Pass Parallel Processing (SP3): Integrates IPS, anti-malware, and URL filtering into one stream-based engine.

    • App-ID: Identifies applications regardless of port/protocol/encryption/evasion. Enables positive enforcement.

    • User-ID: Associates IP addresses with user roles (Active Directory, etc.). Policies follow users across locations.

    • Content-ID: Analyzes allowed traffic for exploits and malware using uniform signatures, SSL decryption, and cloud-based intelligence.

  • IAM and Zero Trust:

    • PoLP: Principle of Least Privilege.

    • RBAC: Role-based access control.

    • ABAC/DAC/MAC: Attribute, Discretionary, and Mandatory access controls.

Lesson 4-7: Deployment and Services

  • Appliances: PA-7000 (Data Center), PA-5450 (150Gbps150\text{Gbps}, hyperscale), PA-1400 (PoE support), PA-400 (Enterprise branch), PA-220R (Ruggedized for manufacturing).

  • VM-Series: Virtualized for private/multicloud (AWS, GCP, Azure).

  • CN-Series (Containers): Kubernetes native. Supports Distributed (daemon set on nodes) or Clustered (dedicated security node) modes.

  • K2-Series: 5G-ready5G\text{-ready} for mobile tunnels.

  • Tools:

    • IronSkillet: Day-one best-practice configuration templates.

    • Expedition: Migration tool for 3rd party vendors (Cisco, Fortinet, Check Point).

    • BPA: Assessment tool for security policy gaps and capability adoption heatmaps.

Lesson 8: Five-Step Zero Trust Methodology

  1. Define Protect Surface: DaaS (Data, Applications, Assets, Services).

  2. Map Transaction Flow: Scan internal resource interaction.

  3. Architect the Network: Bespoke designs.

  4. Create Policy: Kipling Method (Who, What, When, Where, Why, How).

  5. Monitor and Maintain: Focus on Layer 7 operational logs.

Lesson 9-10: Subscriptions and Panorama

  • DNS Security: Predictive analytics for C2 and data theft.

  • URL Filtering: PAN-DB category matching; User-Credential Detection.

  • Threat Prevention: Blocks known malware, C2, and vulnerability exploits.

  • WildFire: Cloud-based sandbox analysis. Verdicts: Benign, Grayware, Malware, Phishing.

  • Cortex Data Lake: Centralized cloud logging.

  • Panorama: Centralized management.

    • Modes: Panorama Mode (All), Management Only, Log Collector.

    • Device Groups: Pre-rules (headquarters enforced), Post-rules, and Local Rules (autonomous).

    • Templates: Common network/device setups managed through stacks.