Essentials of network security.
The elements of network security are
security controls, key controls, countermeasures, safeguards,
all synonymous, network security protocols, and network security devices.
The controls are things we put in place to minimize access issues, things like that.
The protocols generally are used to
protect our data in transit, a little bit more than that.
And security devices themselves are
implementations of authentication, data filtration, etc.
The goal of network defense is you have network defense, you have network
offense, you have incident response, you have forensics, you have web application
assessments and penetration testing and risk management and analysis and
policy writing and all these different areas of information security.
Network defense is what you can do proactively to prevent breaches from
occurring and prevent data loss and money loss and so forth versus reactively.
Anything you do proactively is always better than reactively.
The ultimate goal of network defense is to
protect the organization's information systems, network infrastructure.
From unauthorized access, misuse,
modification, service, denial, degradation, disruptions.
It's a pretty complete definition.
Organizations rely on information
assurance principles to attain defense in depth security.
We'll talk about that.
Also acts as enablers for the organization security activities to prevent and defend
the organizational network from security attacks.
The goal is to prevent things from happening.
Do what you can ahead of time.
Some principles, confidentiality, integrity, availability.
Just talked about this.
Unauthorized disclosure, available when and where needed, and
ensure that it hasn't been improperly modified.
Now, notice they've got man in the middle in two scenarios here.
Man in the middle, which we mentioned in a
previous chapter, is where the authorized user sends through the man in the middle
of the server, which that allows them to intercept data and vice versa.
I could potentially just eavesdrop on
that, or I could tamper with it before forwarding it on.
There you go.
Generally, man in the middle attacks are more passive, collect information, and
provide some access to useful information, sensitive information.
Sometimes you're actually modifying things in transit.
Nonremediation. Just talked about nonremediation.
Again, not being able to argue, I didn't send a message.
Authentication, not the same thing as authenticity.
We just thought we saw this about three or
four slides back, but that was authenticity.
So authenticity can be achieved through a digital signature.
Authentication is achieved by verifying the identity of an individual.
So for example, I am Eric.
Well, anybody can say their Eric.
Authentication is prove it.
Tell me something Eric would know.
Show me something Eric would have, show me
something that Eric is by a metric or physical characteristic.
We believe you.
We're going to come back to the different types of authentication factors.
The network defends benefits, protect
information assets, comply with government and industry
specific regulations, ensure secure communication with clients
and suppliers, reduce the risk of being attacked, gain competitive edge over
competitor by providing more secure services.
We've been breached less.
Now, at the end of the day, everybody is
going to get attacked in some way, shape or form.
You may not even know it, but the severity of that attack can vary tremendously
depending on what you put in place ahead of time.
So get proactive, better than reactive.
Network defense challenges.
Distributed computing environments.
In a distributed environment, data is exchanged between multiple entities at any
point, it can be compromised, intercepted, impersonated, etc.
All of these devices have listeners and
the ability to send and receive data, which means it can be attacked.
Emerging threats.
New attacks are discovered every day.
New vulnerabilities are discovered every day.
We talked about that and the zero day threats and how that works.
Then lack of network security skills.
A lot of times network security staff is
overworked and underpaid and under trained.
You have to wear every hat in your network, which you're supposed to have a
proper separation of responsibilities and division of duties and so forth.
Let's face it, in a smaller scale
environment, you're going to have to wear all the hats.
That means you're constantly rushing around to do this, this, and this.
You're also trying to achieve opposing objectives.
Like administrators, their whole thing is about being functional.
Security administrators, their whole thing
is about being secure, which is opposing functional.
You might have conflicts of interest.
Again, it's a juggling act.
Our lack of network security skills, a lot of times we're self taught.
We do things the way we do it because that's the only way we've ever known.
There might be some better ways to do it.
Hopefully, this course is going to lay out some of that for you.
But practices, procedures, security frameworks, best practices,
you benefit since they've all been developed over time through lots of
different iterations and revisions, hopefully improving each stage.
We'll talk about plenty of security
standards and enterprise security initiatives and that thing.
Our types of network defense approaches.
You've got preventative or preventive, you'll see both.
Sometimes I'll throw an extra symbol in there.
You have a Retrospective, you have a Reactive and Proactive.
Preventive, make sure it doesn't happen to begin with.
Reactive, once it does happen, what do you do to remediate?
Retrospect, techniques to examine the causes, contain, eradicate or recover from
the damage caused by the network or the target attack.
Then again, proactive
methods or techniques that are used to make informed decisions on potential
attacks in the future of the target network.
Continual adaptation security strategy.
An organization should adopt an adaptive
security strategy which is an ongoing cycle.
Protect, detect, respond, predict, lather, rinse, repeat.
Protect, again, a set of prior counter
measures taken towards eliminating all possible vulnerabilities of the network.
That is a strong statement.
Eliminating all possible vulnerabilities.
You never eliminate all possible vulnerabilities, right?
You try to.
Detect involves continuous monitoring of
the network and identifying abnormalities in their origins.
Respond, which you do as much scripting out of this ahead of time as possible.
Your incident response procedures,
so you're not thinking about how to react when something happens.
Involves a set of actions taken to
contain, eradicate, mitigate, and recover from the impact or tax of the network.
Predict identifying most likely tax
targets and methods prior to materialization of a potential attack.
All right, control s.
Controls, countermeasures, safeguards.
It's all synonymous.
Network security controls, administrative in nature.
An administrative control is sometimes called a soft control.
They're directives of management.
Examples are framework compliance,
monitoring and supervising, crafting security policy, information
classification, security awareness and training.
They are directives of management.
We will do this.
Physical security controls are the most tangible.
Concrete, you got a picture of them in your head because most people have used a
lock before, have seen a fence before, know what lighting is, etc.
These are all tangible physical things you can touch, you can feel.
They're implemented to prevent physical access.
Badge system, security guards, man trap
doors, alarms, closed circuit TVs, motion detectors, biometric systems.
Then technical security controls are the
application of technology to control access.
That would be things like access controls that implement
authentication, authorization, auditing, security protocols, network security
devices, encryption, any use of technology falls in the technical category.
And sometimes they're here referred to as logical technical controls.
They are pretty much one and the same.
Again, we're going to talk about authorization and auditing.
Let's go ahead and lay these out so we have the initial definition.
The authentication is proving your identity.
Authorization is once you've proved your
identity, what are you actually authorized to access?
That's typically put in place
by a central authority or there's different access control models for that.
But once you've been identified, what are you allowed to access?
Auditing is tracking that access which gives us accountability.
We're going to talk more about identification, authentication,
authorization, and accounting in a later module.
The network defense elements to take
technology and people and operations all to be considered for network defense.
Our technology, appropriate selection of technology, well defined operations, and
skilled people are required for effective implementation of security strategies.
Things like what type of firewalls, IDS
and antivirus we're going to use, what type of encryption algorithm, is it
centralized, what type of password complexity should be adopted, should
critical servers be placed on separate segments.
Operations are day to day activities.
Technological implementations by themselves are not sufficient.
They should be supported by well defined operations.
When you have an operating procedure, you
lay out specifically step by step, how to accomplish a specific task.
The idea there is you've set out a series
of steps to give you an optimal repeatable result consistent every time.
As long as everybody follows those steps properly in order, the desired outcome
would always be achieved and you shouldn't have any laps in security.
But remember, people still have to
complete procedures and people skip steps, they miss things and so forth.
Again, at the end of the day, the human is typically the weakest link in the security
chain and that's not the last time we're going to mention that.
Examples of operations,
creating and enfor security policies, planning business continuity, control
management, disaster recovery, security awareness and training, etc.
Then people.
People are a crucial element of any organization's network security.
We've already mentioned they're generally the weak link in the chain.
We don't always get programmed correctly.
We don't always act as programmed.
Appropriate technology cannot replace skilled people, at least not yet, who are
required to implement the technology and manage well defined operations.
At the end of the day, we're still driving the technology.
The people involved in network security
are things like the network defense team, the incident handling and response team,
and the computer forensics investigation team.
Sometimes we'll call the network defense team the blue team.
Incident handling and response and forensics are intertwined.
Forensics is typically a escalation from an incident response.
We'll talk about those briefly here in just a second.
The network defense team might include individuals such as the network
administrator, network security administrator,
network security engineer, security architect,
analyst, network technician, and those are just a few job role labels.
You'll see a lot of differences from
environment to environment on job titles and what they actually do.
Take this with a grain of salt, if that doesn't match your current environment,
every environment is a little bit different.
All right, incident handling and response team.
Again, you may or may not have all these job roles.
Information security officer, incident manager, coordinator, forensic
investigator, threat researcher, system administrator, network administrator,
internal auditor, financial auditor, human resources representative, and then public
relations, which again, you may be wearing multiple hats, but you can definitely read
up on the definitions and the responsibilities.
Right now, again, at this stage of the
game, we just want to get a comprehensive view of everything.
You don't want to walk away from this
first pass knowing every specific nuance that every job role has to perform.
You want to have a general awareness of here's the different categories, the
different areas of concern, and the different potential job roles.
The computer forensics investigation team.
Forensics is becoming more and more mainstream.
The forensics process is the application of science to
prove or disprove a given set of facts or circumstances.
It's really important that the forensic
team follows proper procedure to get consistent, repeatable results,
especially if it's going to be a legal proceeding.
Now, for the full discussion on computer incident response, come back for ECIH.
For the full discussion on forensics, come back for CHFI.
This team plays a major role in solving the case.
The team is responsible for evaluating the crime, evidence, and criminals and
individuals involved in a forensic investigation, photographer, incident
responder, incident analyzer, evidence examiner or investigator,
evidence documenter, evidence manager, evidence witness, and attorney.
All right, so pretty short, lightweight module, but that wraps us up for Module 3.
So stand by for Module 4.