Domain 4 Communication and Network Security

Domain 4 – Communication and Network
Security
 Secure network architecture design (IP and non-IP protocols, segmentation) –
Firewall and DMZ questions appear on the test
 Secure network components
 Secure communication channels – Encrytion like TLS vs SSL all the way to
which way to point satellite dishes
 Network attacks – know of ping of death, tear drop, and every other DOS attack
Secure Network Design and Components
 Bastion host
 Exposed to the internet
 Hardened – You expect an attack, it’s your front line
 Screened subnet
 A bastion host between an internal and an external firewall
 MOST SECURE
 Proxy Server
 Can be used outbound or inbound to mask a client’s identity
Secure Network Design and Components
 Honeypots
 Lure bad people into doing bad things
 Lets you watch or monitor them
 Entice:
 Attract by temptation
 Does not mean someone downloads a file
 Entrap:
 Catch someone in a trap
 Downloads a payroll file
Firewalls
 Stateless:
 Stateless firewalls watch network traffic and restrict or block packets based on source
and destination addresses or other static values. They are not aware of traffic patterns
or data flows. A stateless firewall uses simple rule-sets that do not account for the
possibility that a packet might be received by the firewall “pretending” to be
something you asked for. Typically faster and perform better under heavy loads.
 Stateful:
 Stateful firewalls can watch traffic streams from end to end. They are aware of the
communication paths and can implement various IP security (IPSec) functions such as
tunnels and encryption. In technical terms, this means that stateful firewalls can tell
what stage a TCP connection is in (Open, Open sent, synchronized, synchronization
acknowledge or established), it can tell if the MTU has changed, whether packets have
fragmented, etc. Better at identifying unauthorized and forged communications.
Firewalls
 Stateless:
 Stateless firewalls watch network traffic and restrict or block packets based on source
and destination addresses or other static values. They are not aware of traffic patterns
or data flows. A stateless firewall uses simple rule-sets that do not account for the
possibility that a packet might be received by the firewall “pretending” to be
something you asked for. Typically faster and perform better under heavy loads.
 Stateful:
 Stateful firewalls can watch traffic streams from end to end. They are aware of the
communication paths and can implement various IP security (IPSec) functions such as
tunnels and encryption. In technical terms, this means that stateful firewalls can tell
what stage a TCP connection is in (Open, Open sent, synchronized, synchronization
acknowledge or established), it can tell if the MTU has changed, whether packets have
fragmented, etc. Better at identifying unauthorized and forged communications.
IDS/IPS
 Intrusion Detection
 A device or application that analyzes whole packets looking for known events. A log is
generated detailing these events.
 Intrusion Prevention
 A device or application that analyzes whole packets, both header and payload, looking
for known events. When a known event is detected the packet is rejected (inline mode
only).
Secure Communication channels
 TLS/SSL – TLS is newer

 Resource for satellite dish technology:
http://resources.infosecinstitute.com/hacking-satellite-look-up-to-the-sky/
Satellite Principle Threats
 Tracking – Tracking over web data and software

 Listening – Listening with the right equipment, frequencies, and locations.
 Interacting – Protocols and authentication used, radio transmissions need official license.
 Using – Take over a bird or a TT&C [Use payloads, make pictures, transmit something]
 Scanning/Attacking – Anonymous proof of concept in 2010, scanning, DOS, spoofing possible
 Breaking – Old technologies used (x.25, GRE)
 Jamming- jamming well known frequencies for satellites
 Mispositioning/Control – transponder spoofing, direct commanding, command reply, insertion
after confirmation but prior to execution
 Grilling – activating all solar panels when exposed to sun, overcharging energy system
 Collision
Network Attacks
 SYN Flood
 A SYN flood is a form of DOS attack in which an attacker sends a succession of SYN requests to a target’s
system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.
 Fraggle Attack
 A fraggle attack is a DOS attack that involves sending large amount of spoofed UDP traffic to a router’s
broadcast address within a network. It is very similar to a smurf attack, which uses spoofed ICMP traffic rather
than UDP traffic to achieve the same goal.
 Land Attack
 A land attack is a layer 4 DOS attack in which the attacker sets the source and destination of a TCP segment to
be the same. A vulnerable machine will crash or freeze due to the packet being repeatedly processed by the
TCP stack.
 Teardrop attack
 A teardrop attack is a DOS attack that involves sending fragmented packets to a target machine. Since the
machine receiving such packets cannot reassemble them due to a bug in the TCP/IP fragmentation reassembly,
the packets overlap one another, crashing the target network device.

Domain 4 Communication and Network Security

Uploaded by

Copyright:

Available Formats

Domain 4 Communication and Network Security

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Domain 4 Communication and Network Security

Uploaded by

Copyright:

Available Formats

What are some secure network design components discussed?

What are the differences between stateless and stateful firewalls?

Domain 4 – Communication and Network

 TLS/SSL – TLS is newer

 Tracking – Tracking over web data and software

You might also like