Please enable JavaScript.

Coggle requires JavaScript to display documents.

5.1 Explain LAN security concepts in switch networks, Dominic Mathew -…

- - - - covers attacks on enterprise networks
      - Simply search the internet for “latest network attacks”
        
        find up-to-date information on current attacks
    - - a coordinated attack from many devices
      - called zombies
      - the intention of degrading or halting public access
        
        an organization’s website and resources.
    - - an attack in which an organization’s data servers or hosts
        
        compromised to steal confidential information
    - - an attack in which an organization’s hosts
        
        infected with malicious software
        
        cause a variety of problems
      - For example
        
        ransomware such as WannaCry encrypts the data on a host and locks access to it until a ransom is paid
  - - - originate through email or web browsing.
    - - antivirus/antimalware
      - host based firewalls
      - host based intrusion prevention systems (HIPSs).
    - - NAC
      - AMP software
      - an email security appliance (ESA)
      - a web security appliance (WSA)
  - - - required to protect the network perimeter from
        outside access
    - - enabled route
      - provides a secure connection to remote
        
        users across a public network
        
        into the enterprise network
      - can be integrated into the firewall.
    - - provides stateful packet inspection, application visibility and control
      - a next generation intrusion prevention system (NGIPS)
      - advanced malware protection (AMP)
      - URL filtering
    - - (AAA) services
        
        authentication
        
        authorization
        
        accounting
      - Larger enterprise
        
        incorporated into an appliance
        
        can manage access policies across a wide variety of users and device type
        
        Identity Services Engine (ISE)
        
        an example of a NAC device.
  - - - The Cisco ESA device is designed to monitor Simple Mail Transfer Protocol (SMTP)
      - constantly updated by real time feeds from the Cisco Talos
        
        detects and correlates threats and solutions
        
        using a worldwide database monitoring system
      - This threat intelligence data
        
        pulled by the Cisco ESA every three to five minutes.
    - - Block known threats
      - Remediate against stealth malware that evaded initial detection
      - Discard emails with bad links
      - Encrypt content in outgoing email to prevent data loss
      - Block access to newly infected sites
  - - - helps organizations address the challenges of securing and controlling web traffic
    - - advanced malware protection
      - application visibility and control
      - acceptable use policy controls
      - reporting
    - - features and applications
        
        chat, messaging, video and audio, can be allowed
        
        restricted with time and bandwidth limits, or blocked, according to the organization’s requirements.
    - - blacklisting of URLs
      - URL filtering
      - malware scanning
      - URL categorization
      - Web application filtering
      - encryption and decryption of web traffic
- - - - Layer 2 Vulnerabilities
        
        The OSI reference model is divided into seven layers which work independently of each other. For example, if a threat actor with access to the internal network captured Layer 2, then all the security implemented on the layers above would be useless. The figure below shows the function of each layer.
      - Switch Attack Categories
        
        Layer 2 is considered to be the weakest link in the system, and Layer 1 is considered the strongest link. LANs were traditionally under the administrative control of a single organization. Today, with BYOD and more sophisticated attacks, our LANs have become more vulnerable to penetration.
      - Switch Attack Mitigation Techniques
        
        strategies are recommended if the management protocols are not secured.
        
        Always use secure variants of management protocols such as SSH, Secure Copy Protocol
        (SCP), Secure FTP (SFTP), and Secure Socket Layer/Transport Layer Security (SSL/TLS)
        
        Consider using out of band management network to manage devices.
        
        Use a dedicated management VLAN where nothing but management traffic resides.
        
        Use ACLs to filter unwanted access.
  - - - Layer 2 LAN switches build a table based on source MAC addresses in received frames. MAC address tables are stored in memory and used to more efficiently switch frames.
    - - MAC address flooding attacks take advantage of this. They bombarded the switch with fake source MAC addresses until the switch MAC address table is full. This allows a threat actor to capture all frames sent from one host to another on the local LAN or local VLAN.
    - - MAC addresses in its MAC address table. A tool such as macof can flood a switch with up to 8,000 bogus frames per second; creating a MAC address table overflow attack in a matter of a few seconds.
      - Another reason why these attack tools are dangerous is because they not only affect the
        local switch, they can also affect other connected Layer 2 switches.
        
        When the MAC address table of a switch is full, it starts flooding out all ports including those connected to other layers of the network.
      - Network administrators must implement security measures to ensure that only a limited number of source MAC addresses can be learned on a particular port. Port security is further discussed in another module of the OS/Systems Programming Assembly Language (OSP) for Windows 7 and later operating systems.