The more information that is available for you or networks and hosts the easier it will be when it comes
to Incident Response time profiling data provides a complete view of all of the information the system
has gathered about a network or host in this lecture.
We are going to take a look at different profiling methods that can be used to provide contextual data
to detect and even prevent incidents throughput is the measure of how much data is successfully transferred
between network hosts.
So if you send a file between two computers and the rate of the transfer is 50 megabits per second then
that would be the throughput.
Throughput utilization can be an indicator that there has been a security incident.
If it is monitor network management servers can collect this data historically.
So a baseline can be created if the animous reports that a remote site had an average throughput of
30 megabits per second for a year and then all of a sudden the site spikes to 100 megabits per second
then you would want to investigate that network.
Of course just because there is a large increase in traffic doesn't necessarily mean that there has
been a security incident.
But it is possible
session duration is another important thing to watch out for on the network really long sessions.
Two hosts could be a sign of a misbehaving client on the network.
Most sessions should last past a typical eight hour workday.
But if an attacker has a backdoor to the network then they may stay connected for long periods of time.
One easy way you can check for sation durations is by looking at your firewalls connection statistics.
So here I am logged into my Cisco firepower device that my internet gateway in the lab and just by running
the command show connection detail just like you could on the same platform.
You can see a connection or session details so I can see how long these connections are idle for and
as was their uptime which is what I'm looking for.
Sloyd this one for example is four days long.
That might be what I want to look into.
That seems a little unordinary to me.
It could be legit traffic but I mean any connections or sessions that are up for more than a day straight.
Might be something you want to look at to make sure that you don't have any CNC connections or any type
of back doors connected on your network.
Knowing what wire devices are connected to your network is a big part of network security since most
wired networks do not require authentication or authorization for access.
It isn't easy in for an attacker small low profile devices like Raspberry Pis can be easily tucked away
and remain connected to the network for years without anyone noticing.
There are even devices that can be used that are disguised as equipment like power strips and power
Chargers to control what is plugged into a network.
A knack solution like Cisco IOS can be implemented.
ICE has the ability to profile what types of devices are connected to the network and permit or deny
endpoints based on posture a common ice rule set would be to only like company own devices gain full
network access and then all other devices would only get limited access.
So just to give you a basic idea of what I mean when I talk about Wired authentication and authorization
I'm going to show you a switch por that I have configured for authentication that actually talks to
Cisco IOS to verify if users or devices should be allowed on the network.
So it's quite the long configuration.
But basically all these authentication commands are tweaking the switch poor saying hey when something
plugs into the switch poor I want to authenticate them with doubt when X or MAC address authentication.
So right now I have a phone and a computer that's plugged into the phone plugged into this poor.
So if I run the command show authentication session and then interface 1 0 12
then I can see the authentication and authorization status of my devices.
So let's take a look at the so here this shows the user name of the computer that's plugged into the
back of the phone.
Its MAC address its IP address.
It looks like it's authenticated properly and it received this downloadable access list from mice.
So I don't want to get too crazy into the details here because knowing how to configure this stuff really
isn't required for the cyber ops exam.
I just want to share with you as much information as possible so you have a better understanding of
how this all ties together.
So basically my computer's authenticated and all happy and the Data Domain.
And then I have my phone in the voice domain that has also received this permit any downloadable access
list.
So you saw the switchboard configuration now to actually talk to ice.
We have some Triple-A commands that are set globally.
So for example I have this Triple-A authentication when X and I say hey four down x requests.
I want to talk to this group
and that radius ice group basically has the IP address of my server so that it knows to send radius
requests for Wired authentication to the server.
So here I am in ice server.
I just want to give you a quick look into what the policies look like when someone plugs into a switch
port and the switch sons their username or MAC address twice.
What is it going to do.
So that device is going to deny access to the switch or is it going to push an access list to the switch
to apply to the switch part.
So let's take a look at my wired access policy here
who's just a few examples here.
I have a MAC address list here basically so that if a device like your phone doesn't have the capability
to actually sign like username in information then I just check its MAC address against a list that
I've compiled that doesn't match that then it looks for either Active Directory user credentials or
a certificate or something.
And at this point if it passes authentication and is a valid username and password then how is authorized
to access the network.
So then so you authenticate successfully.
Let me go down here and then yes you can get crazy with authorization policies it's actually one of
the bigger parts of the configuration I could send a user to a guest portal if I wanted to when they
plug into a wired poor give them limited access or if they are a company owned asset and a valid domain
user then give them full access.
So now you can see with a knack solution like ice you can truly sick here.
What is connected to them that works so that a hacker can come in off the street and go plug into a
lobby switch poor to gain access to the network.
Segmenting IP networks and villans based on security levels is obviously a best practice.
For example guess users should not be on the same not work as internal servers that run critical roles
in the environment IP address planning can take a lot of thought to make sure that address space is
allocated for scalability and security.