Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 3: Mitigating Threats, Defending the Network - Coggle Diagram

- - - - Talos is one of the largest commercial threat intelligence teams in the world, and is comprised of world-class researchers, analysts, and engineers. The goal of Talos is to help protect enterprise users, data, and infrastructure from active adversaries.
- - - - Unfortunately, threat actors are aware of this countermeasure and frequently alter their malware enough that it evades detection. These exploits will enter the network and will also evade antivirus software.
        
        No mitigation technique can be 100% effective. Security incidents are going to happen.
        
        Mitigating DoS Attacks
        
        One of the first signs of a DoS attack is a large number of user complaints about unavailable resources or unusually slow network performance.
        
        Mitigating Reconnaissance Attacks
        
        Reconnaissance attacks are typically the precursor to other attacks that have the intent of gaining unauthorized access to a network or disrupting network functionality.
- - - - Management plane
        
        Responsible for managing network elements. Management plane traffic is generated either by network devices or network management stations using processes and protocols such as Telnet, SSH, TFTP, FTP, NTP, AAA, SNMP, syslog, TACACS+, RADIUS, and NetFlow.
        
        Management plane security can be implemented using the following features
        
        Present legal notification
        
        Displays legal notices. These are often developed by legal counsel of a corporation.
        
        Login and password policy
        
        Restricts device accessibility. Limits the accessible ports and restricts the “who” and “how” methods of access.
        
        Ensure the confidentiality of data
        
        Protects locally stored sensitive data from being viewed or copied. Uses management protocols with strong authentication to mitigate confidentiality attacks aimed at exposing passwords and device configurations.
        
        Role-based access control (RBAC)
        
        Ensures access is only granted to authenticated users, groups, and services. RBAC and authentication, authorization, and accounting (AAA) services provide mechanisms to effectively manage access control.
        
        Authorize actions
        
        Restricts the actions and views that are permitted by any particular user, group, or service.
        
        Enable management access reporting
        
        Logs and accounts for all access. Records who accessed the device, what occurred, and when it occurred.
      - Control plane
        
        Responsible for routing data correctly. Control plane traffic consists of device-generated packets required for the operation of the network itself, such as ARP message exchanges, or OSPF routing advertisements.
        
        Control plane security can be implemented using the following features
        
        Routing protocol authentication
        
        Routing protocol authentication, or neighbor authentication, prevents a router from accepting fraudulent routing updates. Most routing protocols support neighbor authentication.
        
        Control Plane Policing (CoPP)
        
        CoPP is a Cisco IOS feature designed to allow users to control the flow of traffic that is handled by the route processor of a network device.
        
        AutoSecure
        
        AutoSecure can lock down the management plane functions and the forwarding plane services and functions of a router.
      - Data plane (Forwarding plane)
        
        Responsible for forwarding data. Data plane traffic normally consists of user-generated packets being forwarded between end devices. Most traffic travels through the router, or switch, via the data plane.
        
        ACLs perform packet filtering to control which packets move through the network and where those packets are allowed to go. ACLs are used to secure the data plane in a variety of ways
        
        Reducing the chance of DoS attacks
        
        ACLs can be used to specify whether traffic from hosts, networks, or users, can access the network. The ASA TCP intercept feature is a mechanism that can be used to protect end hosts, especially servers, from TCP SYN-flooding attacks.
        
        Providing bandwidth control
        
        ACLs on a slow link can prevent excess traffic.
        
        Blocking unwanted traffic or users
        
        ACLs can filter incoming or outgoing packets on an interface. They can be used to control access based on source addresses, destination addresses, or user authentication.
        
        Mitigating spoofing attacks
        
        ACLs allow security practitioners to implement recommended practices to mitigate spoofing attacks.
        
        Classifying traffic to protect the Management and Control planes
        
        Classifying traffic to protect the Management and Control planes
- - - - Demonstrates an organization’s commitment to security
      - Sets the rules for expected behavior
      - Ensures consistency in system operations, software and hardware acquisition and use, and maintenance
      - Defines the legal consequences of violations
      - Gives security staff the backing of management