Combination of hardware, software, policies, and practices that organizations use to protect information.
Ports and Protocols
Port: Logical communication endpoint that exists on a computer or server.
Inbound Port: Port on a server that is listening for a connection from a client.
Outbound Port: Port created on a client in order to call out to a server that is listening for a connection.
Ports can be any number between 0—65535.
Well-Known Ports: 0—1023 are assigned by IANA.
Registered Ports: 1024—49,151 are registered (you go through IANA) and are usually assigned to proprietary protocols.
Dynamic and Private Ports: 49,152—65,535: Can be used by any application (not registered).
Protocol: Rules governing device communication and exchange.
Important: Things to Know
We must know four things about every port below for the exam:
Port number
Protocol used
TCP or UDP
Basic description
Ports to Remember
Port 21 (TCP): File Transfer Protocol (FTP) - Used to transfer files from host to host.
Port 22 (TCP): SSH, SCP and SFTP - Provides secure remote terminal access and file transfer capabilities.
Port 23 (TCP): Telnet - Provides insecure remote control of another machine using a text-based environment.
Port 25 (TCP): Simple Mail Transfer Protocol (SMTP) - Provides the ability to send emails over the network.
Port 53 (TCP and UDP): Domain Name System (DNS) - Translates domain names into IP addresses.
Port 69 (UDP): Trivial File Transfer Protocol (TFTP) - Used as a lightweight file transfer method for sending configuration files or network booting of an operating system.
Port 80 (TCP): Hypertext Transfer Protocol (HTTP) - Used for insecure web browsing.
Port 88 (UDP): Kerberos - Network authentication protocol.
Port 110 (TCP): Post Office Protocol Version Three (POP3) - Responsible for retrieving email from a server.
Port 119 (TCP): Network News Transfer Protocol (NNTP) - Used for accessing newsgroups.
Port 135 (TCP and UDP): Remote Procedure Call (RPC) - Facilitates communication between different system processes.
Ports 137, 138, and 139 (TCP and UDP): NetBIOS - Networking protocol suite.
Port 143 (TCP): Internet Message Access Protocol (IMAP) - Allows access to email messages on a server.
Ports 6514 (TCP): Syslog TLS - Used in a secure syslog that uses SSL/TLS to encrypt the IP packets using a certificate before sending them across the IP network to the syslog collector.
Firewalls
Safeguards networks by monitoring and controlling traffic based on predefined security rules.
Screened Subnet (dual-homed host): Acts as a security barrier between external untrusted networks and internal trusted networks using a protected host.
Types of Firewalls
Packet Filtering: Checks packet headers for traffic allowance based on IP addresses and port numbers. Very fast. Cannot prevent certain attacks due to limited inspection capabilities in the packet header (Layer 4 Firewall).
Stateful: Monitors all inbound and outbound network connections and requests.11. Stateful firewalls track the state of active connections and automatically allow return traffic for established sessions, meaning if a request is initiated from the inside to a domain, the return traffic is automatically permitted.
Proxy: Intermediary between internal and external connections, making connections on behalf of other endpoints. Circuit-level operates at Level 5; Application-level operates at Layer 7.
Kernel Proxy: Has minimal impact on network performance while thoroughly inspecting packets across all levels.
Next-Generation Firewall (NGFW): Aims to address limitations of traditional firewalls by being more aware of applications and their behaviors. Does deep packet inspection for traffic.
Unified Threat Management Firewall (UTM): Provides ability to conduct multiple security functions in a single appliance.
Web Application Firewall (WAF): Focuses on inspection of HTTP traffic.
Configuring Firewalls
Access Control List
Access Control List (ACL): Rule set placed on firewalls/routers/etc. that allow traffic through a particular interface. Actions are always performed in a top-down rule.
Hardware-based Firewall & Software-based Firewall
Hardware based will protect a whole subnet. Software based will run on a single machine.
IDS and IPS
Intrusion Detection System (IDS): Logs and alerts.
Intrusion Prevention System (IPS): Logs, alerts, takes actions.
IDS
Types
Network IDS (NIDS): Monitors traffic coming in and out of a network.
Host-based IDS (HIDS): Installed on a single host/endpoint, looks for suspicious network traffic going to or from the server/endpoint.
Wireless IDS (WIDS): Detects attempts to cause a Denial of Service or other attacks on a wireless network.
Methods
Signature-based: Analyzes traffic based on defined signatures. Requires frequent updates and cannot protect against zero-day attacks.
Anomaly-based: Analyzes traffic and compares it to a normal baseline to determine whether a threat is occurring (Behavioral-based IDS).
Open Question: What are the specific differences between statistical, protocol, and application-based anomaly IDS methods?
Intrusion Prevention Systems (IPS)
Scans traffic to look for malicious activity and takes action to stop it. Should be placed inside network, right behind firewall.
Network Appliances
Dedicated hardware device with pre-installed software designed to provide specific networking services.
Load Balancer: Distributes network or application traffic across multiple servers.
Application Delivery Controller (ADC): Like a load-balancer, but also has SSL termination, HTTP compression, and content caching.
Proxy Server: Intermediary between a client and a server to provide various functions like content caching, request filtering, and login management.
Network Sensor: Designed to monitor, detect, and analyze traffic and data flow across a network to identify any unusual activities.
Jump Server/Box: Dedicated gateway used by system administrators to securely access devices located in different security zones within the network.
Port Security
Common security feature found on network switches that allows administrators to restrict which devices can connect to a specific port based on the network interface card’s MAC address.
Switches use intelligence to prevent collisions on the network, allowing ports to operate in duplex.22. Hubs broadcast to all ports (half-duplex, causing collisions). Switches learn MAC addresses and send frames only to the target port, allowing simultaneous two-way (full-duplex) communication without collisions.
Content Addressable Memory (CAM) Table: Used to store information about the MAC addresses that are available on any given port of the switch.
Enable port security (links MAC addresses to a specific network interface) or MAC filtering on the switch ports.
Persistent (Sticky) MAC Learning: Feature in network port security where the switch automatically learns and associates MAC addresses with specific interfaces.
802.1x Protocol: Standardized framework used for port-based authentication for both wired and wireless networks.33. 802.1X is the standard framework for network access control. EAP is the protocol inside 802.1X that carries the actual authentication data. Requires three roles: Supplicant, Authenticator, Authentication Server.
RADIUS: Cross-platform. Does not support remote access protocol, NetBIOS Frame Protocol, or X.25 protocol.
TACACS+: Cisco-proprietary protocol. Slower because it uses TCP tunnels, which provides integrity, authentication, authorization, and accounting. Supports all networking protocols.
EAP
EAP-MD5: Utilizes simple passwords and the challenge handshake authentication process to provide remote access authentication.
EAP-TLS: Uses PKI with digital certificate being installed on client and server as method of authentication.
EAP-TTLS: Require digital certificate on server, but not on the client.
EAP-FAST: Uses protected access credential instead of certificate to establish mutual authentication.
PEAP: Supports mutual authentication by using server certificates and Microsoft Active Directory databases for it to authenticate a password from the client.
LEAP: Variant that only works on Cisco-based devices. Proprietary, not cross-platform.
Securing Network Communications
Virtual Private Network (VPN)
Extends a private network over a public one, enabling users to securely send and receive data.
Site-to-Site: Establishes secure tunnels over the public Internet for interconnecting remote sites.
Client-to-Site: Connects individual devices directly to organizations HQ, enabling remote users to access the network.
Full Tunnel: Maximizes security by encrypting all traffic to the HQ while integrating clients with the network.
Split Tunnel: Divides traffic and network requests and then routes them to the appropriate network.
Clientless VPN: Secures remote access through browser-based VPN tunnels without needing client software or hardware configuration.
TLS
Transport Layer Security (TLS): Protocol that provides cryptographic security for secure connections and is used for secure web browsing and data transfer.
Transmission Control Protocol (TCP): Used by TLS to establish secure connections between a client and server.
Datagram Transport Layer Security (DTLS): A UDP-based version of TLS that offers the same security level as TLS while maintaining faster operations.
IPSec
Internet Protocol Security (IPSec): Protocol suite for secure communications through authentication and data encryption in IP networks.
IPSec Steps: Request to start Internet Key Exchange (IKE), IKE Phase 1, IKE Phase 2, Data transfer, Tunnel termination.
Transport Mode: Employs original IP header, ideal for client-to-site VPNs and is advantageous when dealing with MTU constraints.
Tunneling Mode: Encapsulates the entire packet, which increases packet size and can exceed the MTU. Used for site-to-site.
Authentication Header (AH): Offers connectionless data integrity and data origin authentication for IP datagrams using cryptographic hash as identification information.
Encapsulating Security Payload (ESP): Employed for providing authentication, integrity, replay protection, and data confidentiality by encrypting the packet’s payload.44. AH provides integrity and authentication for both the payload and the IP header, but offers no encryption. ESP encrypts the payload, but does not provide protection for the outer IP header on its own.
SD-WAN and SASE
SD-WAN
Software-Defined Wide-Area Network (SD-WAN): Virtualized approach to managing and optimizing wide area network connections to efficiently route traffic between remote sites, data centers, and cloud environments.
SASE
Secure Access Service Edge (SASE): Used to consolidate numerous networking and security functions into a single cloud-native service to ensure that secure and access for end-users can be achieved.
Infrastructure Considerations
Correct Placement: The placement of routers, access points, and switches should be considered.
Security Zones & Screened Subnets: Security Zone: Distinct segment within a network. Screened Subnet: Hosts public-facing services such as web servers, email servers, and DNS.
Understand Attack Surface: Refers to all points where an unauthorized user can try to enter data to or extract data from an environment.
Determine Connectivity Methods: How different components of a network communicate with each other and with external networks.
Understand Device Attributes: Active (IPS), Passive (IDS), Inline, Tap-Based.
Failure Mode: Fail-open: Allows all traffic in event of failure. Fail-closed: Block all traffic in event of failure.
Selecting Infrastructure Controls
Control: Protective measure put in place to reduce potential risks and safeguard an organizations assets.
Principles
Principle of Least Privilege: Grants users/systems only necessary access rights to perform their duties.
Defense in Depth: Use multiple layers of security to mitigate threats even if one control fails.
Risk-based Approach: Prioritize controls based on potential risks and vulnerabilities.
Lifecycle Management: Regularly review/update/retire controls to adapt to evolving threat landscapes.
Open Design Principle: Ensure transparency and accountability through rigorous testing.
Stateful firewalls track the state of active connections and automatically allow return traffic for established sessions, meaning if a request is initiated from the inside to a domain, the return traffic is automatically permitted.↩︎
Hubs broadcast to all ports (half-duplex, causing collisions). Switches learn MAC addresses and send frames only to the target port, allowing simultaneous two-way (full-duplex) communication without collisions.↩︎
802.1X is the standard framework for network access control. EAP is the protocol inside 802.1X that carries the actual authentication data.↩︎
AH provides integrity and authentication for both the payload and the IP header, but offers no encryption. ESP encrypts the payload, but does not provide protection for the outer IP header on its own.↩︎