Cyber Security Chapter 4

CYBER SECURITY
CHAPTER 4
FIREWALL TYPES
• FIRE WALL :Control or filter incoming or outgoing communications on a network or device.
Network Layer source and destination IP addresses
Firewall
Transport Layer source and destination data ports, connection states
Firewall
Application Layer application, program or service
Firewall
Context Aware user, device, role, application type, and threat profile
Application Firewall
Proxy Server web content requests
Reverse Proxy protect, hide, offload, and distribute access to web servers
Server
Network Address hides or masquerades the private addresses of network hosts
Translation (NAT)
Firewall
Host-based Firewall – filtering of ports and system service calls on a single computer
operating system
PORT SCANNING :-
• Process of probing a computer, server or other network host for open ports.
• Port numbers are assigned to each running application on a device.
• Reconnaissance tool to identify running OS and services • Nmap – A port scanning tool
Common responses:-
Open or Accepted -a service is listening on the port.
Closed, Denied, or Not Listening – connections will be denied to the port.
Filtered, Dropped, or Blocked – no reply from the host.

SECURITY APPLIANCES :-
• Security appliances fall into these general categories :
Routers can have many firewall capabilities: traffic filtering, IPS,

encryption, and VPN.
Firewalls may also have router capability, advanced network management
and analytics.
IPS dedicated to intrusion prevention.
VPN designed for secure encrypted tunneling.
Malware/Antivirus Cisco Advanced Malware Protection (AMP) comes in next generation

Cisco routers, firewalls, IPS devices, Web and Email Security
Appliances and can also be installed as software in host computers.
Other Security includes web and email security appliances, decryption devices, client
Devices access control servers, and security management systems.
DETECTING ATTACKS IN REAL TIME:-
• A hacker exploits a flaw in a piece of software before the creator can fix it.
Real Time Scanning from Edge to Endpoint:-

• Actively scanning for attacks using firewall and IDS/IPS network device
• detection with connections to online global threat centers
• detect network anomalies using context-based analysis and behavior detection
DDoS Attacks and Real Time Response:-

• DDoS, one of the biggest attack threats, can cripple Internet servers and network availability.
• DDoS originates from hundreds, or thousands of zombie hosts, and the attacks appear as legitimate traffic.
SECURITY BEST PRACTICES:-
Some published Security Best Practices:
Perform Risk Assessment – Knowing the value of what you are protecting will help in justifying security expenditures.
Create a Security Policy – Create a policy that clearly outlines company rules, job duties, and expectations.
Physical Security Measures – Restrict access to networking closets, server locations, as well as fire suppression.
Human Resource Security Measures – Employees should be properly researched with background checks.
Perform and Test Backups – Perform regular backups and test data recovery from backups.
Maintain Security Patches and Updates – Regularly update server, client, and network device operating systems and
programs.
Employ Access Controls – Configure user roles and privilege levels as well as strong user authentication.
Regularly Test Incident Response – Employ an incident response team and test emergency response scenarios.
Implement a Network Monitoring, Analytics and Management Tool - Choose a security monitoring solution that integrates with
other technologies.
Implement a Comprehensive Endpoint Security Solution – Use enterprise level antimalware and antivirus software.
Educate Users – Educate users and employees in secure procedures.
Encrypt data – Encrypt all sensitive company data including email.
BOTNET
• A group of bots connect through the Internet
• Controlled by malicious individuals or groups
Bot
• Typically infected by visiting a website,
• opening an email attachment,
• or opening an infected media file

THE KILL CHAIN IN CYBERDEFENSEP:-
• Kill Chain is the stages of an information systems attack.
1. Reconnaissance – Gathers information
2. Weaponization - Creates targeted exploitand malicious payload
3. Delivery - Sends the exploit and maliciouspayload to the target
4. Exploitation – Executes the exploit
5. Installation - Installs malware and backdoors
6. Command and Control - Remotecontrol from a command and control channelor server.
7. Action – Performs malicious actionsor additional attacks on other devices

BEHAVIOR-BASED SECURITY
Honeypots
• Lures the attacker by appealing to the attackers’ predictable behavior
• Captures, logs and analyze the attackers’ behavior
• Administrator can gain more knowledge and build better defense
Cisco’s Cyber Threat Defense Solution Architecture
• Uses behavior-based detection and indicators
• Provide greater visibility, context and control
Netflow:-
• Gather information about data flowing through a network.
• Important components in behavior-based detection and analysis.
• Establish baseline behaviors.
CSIRT
Computer Security Incident Response Team:-
• help ensure company, system, and data preservation by performing comprehensive investigations into
computer security incidents

• provides proactive threat assessment, mitigation planning, incident trend analysis, and security
architecture review
SECURITY PLAYBOOK
• Collection of repeatable queries against security event data sources that lead to incident detectionand response:-
What does it need to accomplish?

• Detect malware infected machines.
• Detect suspicious network activity.
• Detect irregular authentication attempts.
• Describe and understand inbound and outbound traffic.
• Provide summary information including trends,
statistics, and counts.
• Provide usable and quick access to statistics and metrics.
• Correlate events across all relevant data sources.

TOOLS FOR INCIDENT PREVENTION ANDDETECTION
SIEM – Security Information and Event Management:-
• Software that collects and analyzes security alerts, logs and other real time and historical data fromsecurity devices on the network
DLP – Data Loss Prevention:-
• Stops sensitive data from being stolenor escaped from the network
• Designs to monitor and protect datain three different states
Cisco Identity Services Engine (Cisco ISE)and TrustSec:-
• Uses role-based access control policies

IDS AND IPS
IDS – Intrusion Detection System
• Usually placed offline
• Does not prevent attacks
• Detect, log, and report
IPS – Intrusion Prevention System
• Ability to block or deny traffic based on a positive rule or signature match
IDS/IPS system
• Snort
• Sourcefire (Cisco)

Cyber Security Chapter 4

Uploaded by

Copyright:

Available Formats

Cyber Security Chapter 4

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cyber Security Chapter 4

Uploaded by

Copyright:

Available Formats

CYBER SECURITY

Closed, Denied, or Not Listening – connections will be denied to the port.

Filtered, Dropped, or Blocked – no reply from the host.

Routers can have many firewall capabilities: traffic filtering, IPS,

VPN designed for secure encrypted tunneling.

Malware/Antivirus Cisco Advanced Malware Protection (AMP) comes in next generation

Real Time Scanning from Edge to Endpoint:-

• detection with connections to online global threat centers

• detect network anomalies using context-based analysis and behavior detection

DDoS Attacks and Real Time Response:-

• Controlled by malicious individuals or groups

• opening an email attachment,

• or opening an infected media file

• Kill Chain is the stages of an information systems attack.

1. Reconnaissance – Gathers information

2. Weaponization - Creates targeted exploitand malicious payload

3. Delivery - Sends the exploit and maliciouspayload to the target

4. Exploitation – Executes the exploit

5. Installation - Installs malware and backdoors

7. Action – Performs malicious actionsor additional attacks on other devices

computer security incidents

What does it need to accomplish?

• Detect suspicious network activity.

• Detect irregular authentication attempts.

• Describe and understand inbound and outbound traffic.

• Provide summary information including trends,

statistics, and counts.

• Provide usable and quick access to statistics and metrics.

• Correlate events across all relevant data sources.

DLP – Data Loss Prevention:-

• Designs to monitor and protect datain three different states

Cisco Identity Services Engine (Cisco ISE)and TrustSec:-

• Uses role-based access control policies

You might also like