Unit 3: Securing Networks

New to switches, MAC addresses or DNS? Do the Unit 3 Primer: Networking Basics first. This topic assumes it.

1. Four common network attacks (3.1.A)

ARP poisoning: getting on the path 3.1.A.1

The default gateway uses ARP to build a table that pairs IP addresses with MAC addresses. In ARP poisoning, the adversary sends the gateway falsified ARP packets so that the target’s IP address is linked to the adversary’s MAC address. Traffic meant for the target now reaches the adversary first. Often the adversary poisons both sides, the gateway and the target, so traffic in both directions passes through it. Faking a MAC address like this is MAC spoofing.

This makes ARP poisoning an on-path attack, also called a man-in-the-middle attack. The adversary sits in the data stream between two parties, captures what each sends, and may copy or alter it before passing it on. Both parties believe they are talking directly to each other. Run the ARP poisoning simulator to see the gateway’s table change.

MAC flooding: making a switch broadcast 3.1.A.2

A switch normally sends each frame only to the port where the destination MAC address lives. In MAC flooding, the adversary sends the switch many Ethernet frames, each with a different MAC address. This can force the switch into broadcast mode, so it sends frames out of every port, and the adversary collects frames meant for other devices. Capturing data in transit to record and copy it is eavesdropping, also called sniffing. Try it in the simulator below.

switch# show mac address-table
Vlan  Mac Address       Type      Ports
  1   3c52.824a.9f10    DYNAMIC   Fa0/1
  1   5a01.9c44.7b21    DYNAMIC   Fa0/2
  1   02a1.77c3.0e91    DYNAMIC   Fa0/4
  1   9ef0.12bb.4c07    DYNAMIC   Fa0/4
  1   36d2.e8a1.55f3    DYNAMIC   Fa0/4
  1   c4a8.0b9e.71d2    DYNAMIC   Fa0/4
  ... thousands more on Fa0/4 ...

DNS poisoning: sending users to a fake site 3.1.A.3

In DNS poisoning, the adversary pretends to be an authoritative name server (NS) and plants a fake DNS record on a DNS server. Browsers that ask that server are redirected to a malicious website built to look like the real login page. Users type their real usernames and passwords, and the adversary captures them. Setting up a fake login site to collect real credentials is credential harvesting.

Smurf attacks: turning a network against a victim 3.1.A.4

A smurf attack tries to overwhelm a network with ICMP requests. The adversary sends many requests with the victim’s address as the source to the network’s broadcast address. The gateway passes each request to every device on the network, and every device replies to the victim. The flood of replies can block legitimate messages.

• A denial of service (DoS) attack makes a system or resource unavailable to authorized users. A smurf attack is one kind.
• When many devices attack the same target at the same time, it is a distributed denial of service (DDoS) attack.

2. How adversaries exploit network weaknesses (3.1.B)

1. No firewall, or a badly configured one 3.1.B.1. Malicious traffic sent in from outside can flood the network (a DoS), map how it is laid out inside, or impersonate (spoof) a legitimate device.
2. One compromised device 3.1.B.2. Once adversaries control one device, they often use that access to compromise other devices on the same local area network (LAN). This is lateral movement.
3. An open data port 3.1.B.3. A wall data port leads straight to a switch port. Unless the switch limits which devices each port accepts (port security), anyone who plugs in is on the LAN, ready to launch DoS, MAC flooding or MAC spoofing attacks.
4. A signal that leaves the building 3.1.B.4. Standing outside a secure space, an adversary can pick up the wireless access point’s signal and beacon frames, learn about the wireless network, and attempt eavesdropping and cryptographic attacks.
5. A network that does not check who joins 3.1.B.5. Adversaries try to join a network so they can launch attacks from inside it. If the network never asks a device or user to prove who they are, joining is easy.
6. A rogue access point 3.1.B.6. An adversary plugs a wireless access point into an open network port. The rogue access point gives wireless access to the LAN, possibly from outside the building, and bypasses the firewalls at the network boundary. How far it reaches depends on the network design: port security, device authentication and internal segmentation can stop or limit it.
7. Wireless encryption that can be broken 3.1.B.7. Adversaries can try to break wireless encryption, then intercept, steal or compromise data on the network. Topic 3.2 covers strong encryption.

3. Assessing and documenting network risks (3.1.C)

What is at stake 3.1.C.1. Network vulnerabilities can let adversaries intercept and alter data in transit, launch DoS attacks, or move laterally to more sensitive or critical systems. Each of these threatens confidentiality, integrity or availability.

Finding vulnerabilities 3.1.C.2. Automated vulnerability scanners check networks, devices and applications for known vulnerabilities. Their reports usually list each vulnerability found, its severity, and how to mitigate it.

Likelihood 3.1.C.3. Exploiting many network vulnerabilities takes advanced technical ability and knowledge. The harder an exploit is, the lower its likelihood.

Rating the risk 3.1.C.4 to 3.1.C.6

CED examples: high, a single unsegmented internal network reachable through Wi-Fi with weak encryption, with a server running the organization’s web application on it; moderate, an external firewall not configured to block ICMP traffic from outside.

When you document a risk, state the vulnerability, how likely it is to be exploited (and why), what the impact would be, and the rating that follows.

Where this shows up next

• Protecting networks with policies and wireless security: topic 3.2.
• Segmentation, which limits lateral movement: topic 3.3.
• Firewalls at every point of ingress and egress: topic 3.4.
• Detecting each attack in this topic: topic 3.5.

New to beacon frames and access points? The Wireless basics lesson in the Unit 3 Primer covers them.

1. Network security policies (3.2.A)

Policies are managerial controls: they set the minimum standard every device must meet.

Why ban local accounts? A local account lives only on that one device, so it escapes central control: nobody reviews it, and it often keeps a weak or default password. An approved authentication server keeps every login in one managed place.

2. Configuring wireless security (3.2.B)

• Disable beacon frame broadcasting on wireless access points (WAPs), so adversaries have a harder time finding the network and learning its basic properties 3.2.B.1. In real equipment this usually means the access point still beacons but leaves the network name blank (“hidden service set identifier (SSID)”) while still showing its MAC address, channel and security type, so it hides the network from casual view, not from a determined adversary.
• Control broadcast direction and signal strength, so the signal does not reach beyond the space the access point should cover 3.2.B.2.
• Enable strong encryption, so intercepted wireless frames cannot be read 3.2.B.3:

• Enable MAC filtering to keep unauthorized devices off the network, and require users to authenticate when they join 3.2.B.4.

Prevent: each setting answers an attack from 1.3 or 3.1. MAC filtering and authentication keep unauthorized devices off, WPA3 counters eavesdropping on wireless frames, and limiting the signal counters war driving from outside (driving or walking around a site to detect its wireless signals; see 1.3).

Now audit a real-looking router configuration against the policy.

1. Ways to segment a network (3.3.A)

Case file: Northgate High

The school’s network is split into four segments: a screened subnet for the public website, a staff subnet with grade records, a student VLAN for classroom laptops, and a VLAN for security cameras. When a student laptop catches malware, its traffic stays on the student VLAN, and firewall rules keep it away from the staff subnet and the cameras.

2. Why segmentation increases security (3.3.B)

• Network segmentation means dividing a network into smaller, isolated segments, or subnets 3.3.B.1.
• Isolating traffic means an attack on one subnet can be kept from affecting devices on other subnets 3.3.B.2.
• Each segment can get its own security policies and controls, creating higher and lower security zones 3.3.B.3.
• On switches, port security limits how many MAC addresses any single port can have, which prevents MAC flooding 3.3.B.4. Try that in the MAC flooding simulator in 3.1.

Prevent: put the most valuable data in the smallest, most tightly controlled segment.

1. Types of network firewalls (3.4.A)

A firewall allows or denies network traffic coming into or leaving a network. It is software, which can run on a standalone device or be built into another network device such as a router 3.4.A.1.

2. Access control lists (3.4.B)

Network administrators write a set of rules called an access control list (ACL). The firewall uses it to permit or deny inbound and outbound traffic 3.4.B.1.

• Rules are checked in order. The first rule that matches is executed 3.4.B.2.

• A typical rule states the direction (inbound or outbound), the criterion (IP address, logical port, service or application) and the action (permit or deny) 3.4.B.3.

How to read it: TCP is the transmission control protocol. Port 443 carries Hypertext Transfer Protocol Secure (HTTPS) web traffic. Port 3389 carries remote desktop connections. A range such as 198.51.100.0/24 means every address from 198.51.100.0 to 198.51.100.255.

# read top to bottom, first match wins
1  DENY   inbound  TCP 443  from 198.51.100.0/24   # known bad range
2  ALLOW  inbound  TCP 443  from ALL                # HTTPS for everyone else
3  ALLOW  inbound  TCP 3389 from 10.0.5.0/24       # remote desktop, admin subnet only
4  DENY   inbound  ALL      from ALL                # default deny

3. Where firewalls go (3.4.C)

• Each network segment should have a firewall controlling the flow of data in and out of it 3.4.C.1.
• Segments have different security needs, so each firewall’s security level is set independently 3.4.C.2.
• Every point of data ingress and egress between the internal network and the public internet needs a firewall 3.4.C.3.

This is why the screened subnet in topic 3.3 sits between two firewalls: a looser one facing the internet and a stricter one facing the internal network.

4. Writing firewall rules (3.4.D)

• Start from the requirements: which types of traffic, from which sources or to which destinations, should be allowed or denied 3.4.D.1.
• Rules can allow or deny inbound or outbound traffic by source or destination port or IP address, service, protocol or application 3.4.D.2.
• Order changes the result. Changing the order of the same rules can change which traffic gets through, so think about precedence: specific rules usually go before broad ones 3.4.D.3.

In the ACL above, swap rules 1 and 2 and the “known bad range” gets in: rule 2 allows all port 443 traffic first, and rule 1 is never reached. Test that in the simulator.

1. Automated detection tools (3.5.A)

Detection tools analyze data collected from switches, routers, servers, firewalls and user computers, usually stored in log files 3.5.A.1.

2. AI in threat detection (3.5.B)

• Computers log every user action, and firewalls, IDSs, intrusion prevention systems (IPSs) and other sensors log all traffic. A medium-sized organization logs millions, even tens of millions, of data points a day: far too many for any human team 3.5.B.1.
• Threat detection teams build AI algorithms that analyze this data and classify patterns as malicious or normal 3.5.B.2.
• The models are probabilistic: they report a percentage for how likely something is malicious 3.5.B.3.
• Each organization sets its own alert threshold 3.5.B.4:

3. Choosing a detection method (3.5.C)

4. Evaluating a detection method (3.5.D)

• Faster detection means faster response 3.5.D.1. Tools and running costs must fit the budget 3.5.D.2.
• A high false positive rate wastes time and resources on harmless activity and causes alert fatigue, when responders assume alerts are false before investigating 3.5.D.3.
• A false negative is when an adversary gets past the detection system, which can lead to loss, harm, disruption or destruction of data and systems 3.5.D.4.

5. Indicators of each network attack (3.5.E)

Network-based IoCs are found by analyzing traffic, often in packet capture files, looking at source and destination IP addresses, ports and protocols 3.5.E.7:

• connections to known malicious IP addresses
• unauthorized network scans
• unusual spikes or slowdowns in traffic
• mismatched port and application traffic, such as web traffic on a port meant for something else

The primer and 3.1 simulators already let you play defender for ARP poisoning, MAC flooding and DNS poisoning. Below, hunt for IoCs in a network log.