CCNA 3 - Capitulo 3.5

CCNA 3 - Capitulo 3.5

1. NETWORK SECURITY CONCEPTS

   • IP VULNERABILITIES AND THREATS (IPV4 & IPV6)
     • CONTEXT
       • IP DOES NOT VALID THE SOURCE IP CONTAINED IN A PACKET ACTUALLY THAT FROM SOURCE
         • THEREFORE THREAT ACTOR USING A SPOOFED SOURCE IP ADDRESS
     • IP ATTACK TECHNIQUE
       • ICMP ATTACKS
         • ICMP MESSAGE USED BY HACKERS
           • ECHO REQUEST
             • DISCOVER SUBNETS & HOSTS
             • FLOOD ATTACKS
             • ALTER ROUTING TABLES
             • FINGERPRINT (OS )
           • ECHO REQUEST & ECHO REPLY
             • HOST VERIFICATION
             • DoS ATTACK
           • ICMP UNREACHABLE
             • RECONNAISSANCE AND SCANNING ATTACK
           • REDIRECT ICMP
             • CREATE MITM ATTACK
           • ICMP ROUTER DISCOVERY
             • INJECT BOGUS ROUTE ENTRIES
           • ICMP MASK REPLY
             • MAP INTERNAL NETWORK
         • THREAT ACTOR USES A ICMP WITH PURPOSE
           • DETERMINE STATE FIREWALL
           • DISCOVER SUBNETS AND HOSTS ON A PROTECTED NETWORK , HOSTS ACTIVE (REACHABLE )
           • GENERATE FLOD DoS FLOOD ATTACKS
           • ALTER HOST ROUTING TABLES
           • RECONAISSANCE AND SCANNING ATTACKS
           • LAUCH INFORMATION-GATHERING ATTACKS TO MAP OUT A NETWORK TOPOLOGY
           • OS FINGERPRINT (IDENTIFY OPERATION SYSTEM )
           • DOS ATTACK
         • SPOOFING ADDRESS
           • WHATS IS PURPOSE ?
             • THREAT ACTOR CREATE PACKETS FALSE SOURCE IP
               • TO POSE AS ANOTHER LEGITIME USER
             • HIDE THE IDENTITY
           • TWO TYPES
             • NON BLIND SPOOFING
               • THREAT ACTOR CAN SEE
                 • TRAFFIC BETWEN HOST AND TARGET
                 • REPLY PACKET FROM THE TARGET VICTIM
               • THIS ATTACK DETERMINES
                 • STATE FIREWALL
                 • SEQUENCE NUMBER (ISN) - TCP
               • CAN ALSO HIJACK AN AUTHORIZED SESSION
             • BLIND SPOOFING
               • CANNOT SEE TRAFIC BETWEN ORIGIN AND DESTINATION , IS USED IN DDOS ATTACK
           • IS USUALLY INCORPORATED INTO ANOTHER ATTACK SUCH AS SMURF STTACK
         • BEST PRACTICES ?
           • NETWORK ADMIN SHOULD HAVE STRICT ICMP ACL FILTERIG
             • ICMP PROBING FROM THE INTERNET
       • AMPLIFICATION ATTACKS REFLECTION ATTACK
         • AMPLIFICATION IS WHEN THREAT ACTOR FORWARDS ICMP REQUEST MANY HOSTS
           • CONTAIN SOURCE IP VICTIM
         • PREVENT LEGITIME USER CAN ACCESSIG INFORMATION USING DoS DDoS
         • REFLECTION
           • IS WHEN ALL HOSTS REPLY TO SPOOFED IP OF THE VICTIM
       • MITM ATTACK
         • MONITOR , CAPTURE AND CONTROL COMMUNICATION BETWEEN SOURCE AND DESTINATION ,
       • SESSION HIJACKING
         • THREAT ACTOR GAIN ACCESS TO THE PHYSICAL AND USE MITM TO HIJACK A SESSION
       • ATTACKS
         • MANY HOSTS REPLY
           • IP VICTIM