Endpoint Security

Endpoint Security

1. Introducing Endpoint Security

   • Securing LAN Elements
     • examples of such attacks:
       • DoS attacks an organization’s network to degrade or even halt public access to it
       • Breach of an organization’s Web server to deface their web presence
       • Breach of an organization’s data servers and hosts to steal confidential information
     • internal LAN elements to secure
       • Endpoints - laptops, desktops, servers, and IP phones which are susceptible to malware-related attacks.
       • Network infrastructure - LAN infrastructure devices interconnect endpoints and typically include switches,
   • Traditional Endpoint Security
     • Endpoint Protection
       • Antivirus/Antimalware
       • Host-Based Firewall
       • Host-Based IPS
   • The Borderless Network
     • There are some problems with the traditional method of securing endpoints. In many networks, the network-based devices are disparate and typically do not share information among themselves.
   • Securing Endpoints in the Borderless Network
     • Organizations must also protect their endpoints from new threats and provide the protection
   • Modern Endpoint Security Solutions
     • Antimalware Protection (AMP)
     • Email Security Appliance (ESA)
     • Web Security Appliances (WSA)
     • Network Admission Control (NAC)
   • Hardware and Software Encryption of Local Data
     • The solution is to locally encrypt the disk drive with a strong encryption algorithm such as 256-bit AES encryption.

2. Layer 2 Security Considerations

   • Layer 2 Security Threats
     • protect the elements in Layer 3 up through Layer 7 using VPNs, firewalls, and IPS devices
     • The first step in mitigating attacks on the Layer 2 infrastructure is to understand the underlying operation of Layer 2 and the threats posed by the Layer 2 infrastructure.
   • CAM Table Attacks
     • The CAM table binds and stores MAC addresses and associated VLAN parameters that are connected to the physical switch ports.
     • use the show mac-address-table privileged EXEC command,
     • If the intruder does not maintain the flood of invalid source MAC addresses, the switch eventually ages out the older MAC address entries from the table and begins to act like a switch again.
   • Mitigating CAM Table Attacks
     • enable port security.
       • Port security allows an administrator to statically specify MAC addresses
     • switchport port-security interface configuration command
   • Mitigating CAM Table Attacks
     • Absolute - The secure addresses on the port are deleted after the specified aging time. Inactivity - The secure addresses on the port are deleted only if they are inactive for the specified aging time.
   • Mitigating VLAN Attacks
     • Spoofing DTP messages from the attacking host to cause the switch to enter trunking mode. From here, the attacker can send traffic tagged with the target VLAN,
     • Another type of VLAN hopping attack is a double-tagging (or double-encapsulated) attack.
     • PVLAN Edge
   • Mitigating DHCP Attacks
     • Wrong default gateway
     • Wrong DNS server
     • Wrong IP address
   • Mitigating ARP Attacks
     • host broadcasts an ARP Request to other hosts to determine the MAC address
     • To prevent ARP spoofing or poisoning, a switch must ensure that only valid ARP requests and replies are relayed.
   • Mitigating Address Spoofing Attacks
     • IP address spoofing is when a rogue PC hijacks a valid IP address of a neighbor, or a uses a random IP
   • Spanning Tree Protocol
     • Spanning Tree Protocol (STP) is another Layer 2 technology that is vulnerable in the Layer 2 infrastructure. For this reason, it is important to understand the role and operation of STP.
     • A BPDU is a messaging frame exchanged by switches for STP. Each BPDU contains a BID that identifies the switch that sent the BPDU.