Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be looking at
commonly used ports.
And so today's objectives are pretty
straightforward. We're really just
going to describe commonly used
ports at a high level.
We're going to jump straight into
mitigation technique and
detection techniques as
well.
So commonly used ports
are essentially the ports that we
typically see when it comes to
networking and things of that
nature.
But threat actors usually
communicate over common ports to
try and bypass firewall
controls and things of that nature
and to blend into normal activity.
And so such ports can be things like
HTP and https,
which are typically open to
allow users to get to the web
and to perform Web based
transactions.
SMTP and DNS,
both on TCP and
UDP point fifty three.
We've got our PC cessation
as well, which can be used by
threat actors and a number of
scenarios to again attempt
to bypass control mechanisms
and to seem like they are blending
in with normal traffic.
Now, if
you want to know more about TCP,
UDP ports, DNS, HTP,
any number of things that we're
mentioning here, there are a number
of other courses and
subject matter areas where they
focus specifically on common
protocols and things of that nature.
I do encourage you to look into
those materials if you're interested
in learning more about networking
and these protocols.
So we're going to jump again
straight into mitigation techniques
here.
Now, network intrusion prevention
can be used to stop some forms
of command and control activity.
It looks for signatures and
some things that are indicators of
compromise, and it will attempt to
block that activity outright.
Network segmentation is also
useful to block traffic or protocols
that do not need access to other
systems. And so we're talking like
Lisse privilege among
systems, hardware software
doesn't do more than it needs to do
to function and communicate.
And any excess protocols
are shut down or are not used
to reduce the capabilities of the
threat would have to circumvent
controls or go unnoticed
on the network.
Now, detection techniques in this
case are going to involve monitoring
network data communications to look
for uncommon data flows
and things of that nature, such as
packet sizes that seem to be
to perfectly sized or shaped
inconsistent activity
that maybe is above and beyond your
baseline that you've got for your
network activity.
And so having some of those things
in place is going to help you to
identify maybe if a threat
actors on your network and
what it is that they're doing
now. Let's do a quick check on
learning. True or false threat.
Actors will not use common ports to
bypass firewall traffic as doing
so is a high risk.
All right, well, if you need
additional time, please pass this
video so threat actors will,
in fact, use common ports
to bypass firewall traffic,
and they do this to try and reduce
the risk that they'll be detected.
And so this is a false
statement.
In most cases, if a network
traffic starts to become anomalous
or starts to use weird port numbers,
things of that nature that aren't
common for that business or those
systems that would likely get
flagged and investigated by
the security staff or the network
administration staff.
Now, in summary of today's
discussion, we described
commonly used ports at a high
level.
We looked at some mitigation
techniques such as network intrusion
prevention and things of that
nature, and we looked at some
detection techniques as
well.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.