LAN Security Concepts

LAN Security Concepts

1. Endpoints Security

   • Network Security Devices
     • VPN-Enabled Router
     • NGFW
     • NAC
   • Network Attacks Today
     • Distributed Denial of Service (DDoS)
     • Data Breach
     • Malware
   • Endpoint Protection
   • Cisco Email Security Appliance
     • Block known threats
     • Remediate against stealth malware that evaded initial detection
     • Dicared emails with bad links
     • Block access to newly infected sites
     • Encrypt content in outgoing email to prevent data loss
   • Cisco Web Security Appliance
     • The Cisco WSA combines advanced malware protection, application visibility and control, acceptable use policy controls, and reporting.

2. Access Control

   • Authentication with a Local Password
   • AAA Components
     • AAA provides the primary framework to set up access control on a network device.
   • Authentication
     • Local AAA Authentication
       • Local AAA stores usernames and passwords locally in a network device such as the Cisco router.
     • Server-Based AAA Authentication
       • 1.- The client establishes a connection with the router.
       • 2.- The AAA router prompts the user for a username and password.
       • 3.- The router authenticates the username and password using a AAA server.
       • 4.- The user is provided access to the network based on information in the remote AAA server.
   • Authorization
     • AAA authorization is automatic and does not require users to perform additional steps after authentication.
   • Accounting
     • AAA accounting collects and reports usage data.
   • 802.1X
     • The IEEE 802.1X standard is a port-based access control and authentication protocol.

3. Layer 2 Security Threats

   • Layer 2 Vulnerabilities
   • Switch Attack Categories
     • MAC Table Attacks
     • VLAN Attacks
     • DHCP Attacks
     • ARP Attacks
     • Adress Spoofing Attacks
     • STP Attacks
   • Switch Attack Mitigation Techniques
     • Port Security
     • DHCP Snooping
     • Dynamic ARP Inspection
     • IP Source Guard

4. MAC Address Table Attack

   • MAC Address Table Flooding
     • All MAC tables have a fixed size and consequently, a switch can run out of resources in which to store MAC addresses.
     • Traffic is flooded only within the local LAN or VLAN. The threat actor can only capture traffic within the local LAN or VLAN to which the threat actor is connected.
   • MAC Address Table Attack Mitigation
     • A tool such as macof can flood a switch with up to 8,000 bogus frames per second; creating a MAC address table overflow attack in a matter of a few seconds.
     • To mitigate MAC address table overflow attacks, network administrators must implement port security.
     • Port security will only allow a specified number of source MAC addresses to be learned on the port.

5. LAN Attacks

   • VLAN Hopping Attacks
     • A VLAN hopping attack enables traffic from one VLAN to be seen by another VLAN without the aid of a router.
   • VLAN Double-Tagging Attack
     • A threat actor in specific situations could embed a hidden 802.1Q tag inside the frame that already has an 802.1Q tag.
   • DHCP Messages
     • DHCP servers dynamically provide IP configuration information including IP address, subnet mask, default gateway, DNS servers, and more to clients.
   • DHCP Attacks
     • DHCP Starvation Attack
     • DHCP Spoofing Attack
   • ARP Attacks
     • Normal State with Converged MAC Tables
     • ARP Spoofing Attack
     • ARP Poisoning Attack with Man-in-the-Middle Attack
   • STP Attack
     • Attackers can make their hosts appear as root bridges; and therefore, capture all traffic for the immediate switched domain.
   • CDP Reconnaissance
     • The Cisco Discovery Protocol (CDP) is a proprietary Layer 2 link discovery protocol.
     • CDP can automatically discover other CDP-enabled devices and help auto-configure their connection.