Welcome to Network Analysis With pfSense.
My name is Joe Abraham,
and in this course we're going to see how you can secure your environment
better using this great tool. pfSense was a tool that was created to be a
free network firewall distribution that can expand its capabilities through
packages and is great at helping us stop threats by blocking communications
based on configured rule sets.
It helps us reduce some of the artificial limitations of common
commercial products and with packages can have many of the same
features of other enterprise next‑gen firewall products today. It
was created by Scott Ullrich and Chris Buechler around 2004 and was
first released in 2006.
Have I mentioned that pfSense is a free firewall distribution?
It requires no UNIX or CLI knowledge to operate at all.
It can be downloaded here at pfsense.org.
And not only is it open source,
but the packages are too, meaning we can freely expand its capabilities
to doing things like providing DNS or DHCP services,
network monitoring, and IPS capabilities.
We'll be exploring some of these expanded capabilities in the course.
If we look at the NIST Cybersecurity Framework,
which shows us five different functions, we could say that pfSense
is mostly in line with at least two of them.
The first one would be Protect, because it helps us block
traffic that we don't want in our networks and helps us secure
additional services and communications.
The other one is Detect,
since we're using it to monitor the network for potential
threats. For the purposes of this course, we'll be
focusing on the Protect function.
A lot of the functionality of pfSense,
at least at its core, centers around data security and protective technology.
If we add on some integrations and user‑based services like VPNs,
it can cover identity management, authentication, and access control as well.
If we look at the data security as an example,
pfSense will help you make sure that you cover PR.DS‑5,
Protections against data leaks that are implemented,
and we'll do this in a very particular way to align with another framework.
It will also let you fulfill PR‑PT‑4, Communications and
control networks are being protected.
It'll do that by making sure that our communications are protected inbound and
outbound as needed, through the rule sets that we create.
If we looked at this tool from the perspective of MITRE ATT&CK,
we see that it allows us to gather and see network information, which
would classify into the Network Analysis data type.
Now, it can also be considered infrastructure as well.
Both of these classifications depend on what additional
packages we install. For the purposes of this course, we'll
focus on the network analysis piece.
It'll help us prevent attacks using the following techniques from
being executed, like T1133, using external remote services, or
T1048, Exfiltration Over Alternate Protocols.
We'll also use it to protect against proxies by using a DNS blocking package.
And if we dive into the sub‑techniques,
we would be defending against multi‑hop proxies, specifically.
Now,
we can break this tools mappings down even further into the
MITRE classifications using MITRE SHIELD.
These active defense techniques are what we'll be demonstrating
throughout this course for the prevention of TTPs that we're
mapping them to from the attack framework.
So we'll be doing things like setting up a decoy VPN server to
see if valid accounts are used to authenticate. We'll block the
use of alternate protocols for exfiltration by blocking unused
and unnecessary ports.
And we'll also block traffic to known anonymity networks and C2
infrastructure using block lists. In an enterprise environment, we have
firewalls and all of the services that they're using or providing
typically scattered in multiple places. For the purposes of this course,
we'll say that our pfSense is here controlling access in and out of the
network and providing logs and maybe some net flow or raw packet captures
to our SIEM device.
We have our security suite of management tools that we can
use to analyze a lot of this information.
So what we're going to end up doing in this course is installing and
configuring this firewall to block and log some of the activities that we're
looking for and use that information gained to validate that the controls we
put in place are working. The users and systems generate traffic and send it
through the firewall or an external VPN username may be remotely connecting
into it for corporate access.
We'll see how we can use pfSense to help us accomplish our goals here.
The first step in this is to get pfSense installed and ready to go.