IINS

IINS

1. Security Concepts

   • CIA
     • Confidentiality
     • Integrity
     • Availibility

2. Secure Access

3. VPN

4. Secure Routing and Switching

   • OSPF
   • EIGRP
   • Port SEcurity
     • Protect
       • Shy, no syslog, no alerts
     • CAM ( Content Addressable Memory)
     • Restrict
       • Sends alert messages everywhere
     • Shutdown*
     • Shutdown-VLAN
     • Default max MAC addresses is 1
     • Modes
       • Dynamic
       • Static
       • Sticky
         • Learned MAC and saved to Running config
           • Must write to startup config to be persistent
     • Access mode or Trunk mode
     • Aging
     • Does not work on dynamic switch port
     • Prevent DHCP starvation attack
   • DHCP Snooping
     • DHCP process - DORA
     • Prevent Man-In-The-Middle attack
     • No trusted ports by Default
     • DHCP Trusted port
       • Allow DHCP OFFER
       • Allow DHCP Acknowledge
       • Incoming port from DHCP server
     • Rate-limit DHCP packets
     • show ip dhcp snooping BINDING
     • Statisticks - show ip dhcp snooping database
   • DAI (Dynamic ARP Inspection)
     • ARP poisoning
       • MAN in The Middle attack
     • Relies on DHCP snooping DB
       • OR ARP ACL for static IPs
     • TRUST or NOT to trust
       • All ports untrusted ports pr. VLAN pr DEFAULT
         • Rate-limit 15 PPS
           • Violate - Err. Disabled
           • err disable recovery cause arp-inspection

5. Cisco Firewall Technologies

6. Content and Endpoint Security

7. IDS/IPS

   • IPS
     • Inline
       • can cause DOS
       • should be tolerant (HA)
       • Can prevent attacks
         • Blocks traffic inline
     • Intrusion prevention system
   • IDS
     • "Promiscuous mode"
     • On a stick
     • Instrusion Detection System
     • Actions
     • Actions
   • HW Appliance
     • 42xx
   • Module
     • IOS
     • ASA
       • UTM
     • Blade (IDSM-2)
   • Function
     • True
       • Positive
         • Actual attack
           • Malicious traffic
       • Negative
         • Normal browsing
     • False
       • Positive
         • Un-harmful traffic
           • "Event action filter"
       • Negative
         • Undetected malicious traffic
   • 4 Modes of operation
     • Signature matching
       • Ping sweep
         • Policy
       • Port scan
         • Policy
     • Policy
       • User created rules
         • TCP/23
     • Anomaly
       • Learns what is normal
     • Reputation based
       • Online reputation blocking (known its)
   • Countermeasures
     • BLOCK requests
       • SHUN req. to FW
     • Deny (IPS)
       • Connection
       • IP
     • Capture
       • 1000 packets
     • Alert
       • SDEE
       • Verbose alert
     • TCP-reset
     • SNMP
     • Modify (IPS)
   • Host based
     • Scan HTTPS packets
   • Put after FW
     • Scan filtered data
   • UTM
     • Unified Threat management device
     • AVC
     • URL Filtering
     • Application Filtering
   • Cannot inspect crypto-data
     • Unless proxy

8. FirePower

   • FireSight Management
     • Correlation
     • Impact flag
       • Identify severity / potential severity
   • Based on SNORT
   • AMD (Advanced Malware Protection)
   • Network
     • Appliance
     • Module
   • IPS
   • White/Black listing
   • Application layer analysis
     • SMTP
       • Scan attatchments
   • Session logging
     • Log at the end of the session
       • YAY
     • Log at the beginning of the session
   • Attack prevention
     • Rate based tools
       • Limit incoming TCP SYN req.
         • Flooding
         • BOTNET