Securing the Local Area Network

Securing the Local Area Network

1. 6.1: Endpoint Security

   • there are two internal LAN elements to secure: •Network infrastructure •Endpoints
   • Traditional Endpoint Protection: •Antivirus software •Host-based firewall •Host-based IPS
   • Modern Endpoint Security: •Advance Malware Protection (AMP) •Email Security Appliance (ESA) • Web Security Appliances (WSA) •Network Admission Control (NAC)
     • Advance Malware Protection (AMP)
       • is a security solution that addresses the full lifecycle of the advanced malware problem. It not only prevents breaches but also gives you the visibility, context, and control to rapidly detect, contain, and remediate threats if they evade front-line defenses, all cost-effectively and without affecting operational efficiency.
       • AMP continuous analysis and retrospective alerting with: •File Reputation •File Sandboxing •File Retrospection. AMP is available in: •AMP for Endpoints •AMP for Networks •AMP for Content Security
     • Cisco Web security Appliance (WSA)
       • Cisco Web Security Applicances: is a mitigation technology for web-based threats that helps organizations address the growing challenges of securing and controlling web traffic
       • The WSA can perform blacklisting, URL-filtering, malware scanning, URL categorization, Web application filtering, and TLS/SSL encryption and decryption.
       • Main features and benefits of Cisco Web Security Appliance : •Talos Security Intelligence •Cisco Web Usage Controls •Advanced Malware Protection (AMP) •Data Loss Prevention (DLP)
     • Cisco Email Security
       • Main features and benefits of Cisco Email Security : •Global threat intelligence •Spam blocking •Advanced malware protection •Outbound message control
     • Network Admission Control (NAC)
       • The purpose of Cisco Network Admission Control (NAC) is to allow only authorized and compliant systems, whether managed or unmanaged, to access the network.
       • two categories of Cisco NAC products:: • NAC Framework •Cisco NAC appliance
     • Cloud Web Security (CWS)
       • Cloud Web Security (CWS): is a cloud-based security service that uses web proxies in Cisco’s cloud environment to scan traffic for malware and policy enforcement.

2. 6.2: Layer 2 Security Considerations

   • common Layer 2 attacks.
     • •CAM Table Attacks •VLAN attacks •DHCP attacks •ARP attacks •Address spoofing attacks •STP attacks
   • Layer 2 solutions
     • •Port Security •disabling DTP and following basic guidelines for configuring trunk ports • DHCP snooping. •Dynamic ARP Inspection (DAI) • IP Source Guard (IPSG) •PortFast, BPDU guard, root guard, and loop guard.
   • Port Security
     • The switch can be configured to learn•Manually configured •Dynamically learned
     • Violations: •Protect •Restric •Shutdown
     • Port Security Aging
       • Two types of aging are supported per port: •Absolute •Inactivity
   • VLAN hopping
     • VLAN hopping attack can be launched: •Spoofing DTP messages •Introducing a rogue switch and enabling trunking
     • A VLAN hopping attack enables traffic from one VLAN to be seen by another VLAN without the aid of a router.
   • CAM Table attack
     • CAM table overflow attacks (also called MAC address overflow attacks) take advantage of this limitation by bombarding the switch with fake source MAC addresses until the switch MAC address table is full.
   • PVLAN (VLAN Private
     • PVLAN (private VLAN) ensures that there is no unicast exchange, broadcast, or multicast traffic between the PVLAN edge ports on the switch
     • Three types of PVLAN ports: •Promiscuous •Isolated •Community
   • DHCP Spoofing Attack
     • occurs when a rogue DHCP server is connected to the network and provides false IP configuration parameters to legitimate clients.
     • can provide: •Wrong default gateway •Wrong DNS server •Wrong IP address
   • DHCP Starvation Attack
     • The goal of this attack is to create a DoS for connecting clients. DHCP starvation attacks require an attack tool such as Gobbler.
   • DHCP snooping recognizes two types of ports: •Trusted DHCP ports •Untrusted ports
   • ARP Spoofing and ARP Poisoning Attack
     • is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network
   • Spanning Tree Protocol
     • is a Layer 2 protocol that runs on bridges and switches. The main purpose of STP is to ensure that you do not create loops when you have redundant paths in your network
   • IP Source Guard
     • is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network