CCNA 3 - Capitulo 3.3

CCNA 3 - Capitulo 3.3

1. NETWORK SECURITY CONCEPTS

   • COMMOM NETWORK ATTACKS
     • ACCESS ATTACK
       • PASSWORD ATTACKS
         • THC HYDRA
       • PORT REDIRECTIONS (PIVOTING)
         • THREAT ACTOR USES A COMPROMISSED SYSTEM AS BASE FOR ATTACKA AGAINST OTHER TARGETS
           • EX : IT COMPROMISES SYSTEM A, WHICH HAS A RELATIONSHIP OF TRUST WITH SYSTEMS B, C, D, AND E.
       • BUFFER OVERFLOW
         • CREATING A DOS ATTACK
         • EXPLOITS THE BUFFER MEMORY
       • WHATS PURPOSE ?
         • EXPLOIT KNOWN VULNERABILITIES IN AUTHENTICATION SERVICES SUCH
           • WEB SERVICES
           • FTP SERVICES
         • RETRIEVE DATA
         • GAIN ACESS
         • ESCALATE PRIVILAGES TO ADMINISTRATOR
       • TRUST EXPLPOTATION
         • UNAUTHORIZED PRIVILEGES TO GAIN ACCESS TO A SYSTEM
       • SOCIAL EGINNEERING ATTACKS
         • PRETEXTING
           • THREAT ACTOR PRETENDS TO NEED
             • PERSONAL OR FINANCIAL DATA TO CONFIRM IDENTITY
         • PHISHING
           • EX : FRAUDULENT EMAIL
             • EXAMPLE : THEY BOUGHT A DOMAIN ON GOOGLE AND PRETENDED TO BE SOME COMPANY.
         • SPEAR PHISHING
           • PHISHING TAILORED FOR SPECIFIC INDIVIDUAL OR ORGANIZATION
         • SPAM
           • UNSOLICITED EMAIL
             • HARMFUL LINKS , MALWARE ETC
         • SOMETHING FOR SOMETHING (QUID PRO QUO)
           • REQUEST PERSONAL INFORMATION EXCHANGE FOR SOMETHING SUCH AS GIFT
         • BAITING
           • THREAT ACTOR LEAVES A MALWARE INFECTED FLASH DRIVE
             • IN A PUBLIC LOCATION
               • A VICTIM FINDS DRIVE AND INSERTS IT INTO THEIR LAPTOP
         • IMPERSONATION
           • PRETENDS TO BE SOMEONE
         • TALGATING
           • QUICKLY FOLLOWS AUTHORIZED PERSON
             • TO GAIN ACCESS TO A SECURE AREA
         • SHOULDER SURFING
           • LOOKS OVER SOMEONE’S SHOULDE
         • DUMPSTER DIVING
           • THROUGH TRASH BINS TO DISCOVER CONDIFENTIAL DOCUMENTS
         • SOCIAL ENGINNERING TOOLKIT (SET)
           • DESIGNED TO HELP WHITE HACKERS CREATE ENGINNERING ATTACK TO TEST THEIR OWN NETWORKS
         • HOW DOES IT WORK ?
           • MANIPULATE INDIVIDUALS
           • HOW CAN IT BE DONE?
             • PERFORMED IN PERSON ; TELEPHONE OR INTERNET
           • PEOPLE WEAKNESSES
           • URGENT PROBLEM THAT REQUIRE IMMEDIATE RESOLUTION
           • APPEL TO EMPLOYEE VANITY OR INVOKE AUTHORITY
       • SPOOFING
         • ATTEMPTS TO POSE AS ANOTHER DEVICE BY FALSIFYING DATA
           • MAC SPOOFING
           • IP SPOOFING
           • DHCP SPOOFING
       • MAN IN THE MIDDLE
         • THREAT ACTOR IS POSITIONED IN BETWEEN TWO LEGITIME ENTITIES