2019 FRSecure CISSP Mentor Program: Class Seven
2 likes517 views
This document contains notes from a CISSP mentor program session on May 1, 2019. It discusses the agenda for the session, which includes finishing chapter 5 of the book and covering network architecture and design topics like WAN technologies and protocols. A quiz with multiple choice questions is also included to test participants' knowledge.
2019 FRSecure CISSP Mentor Program: Class Seven
- 1. 2019 CISSP MENTOR PROGRAM April 29, 2019 ----------- Class 7 – May 1, 2019 Instructors: • Brad Nigh, FRSecure Director of Professional Services & Innovation • Evan Francen, FRSecure & SecurityStudio CEO
- 2. The last few nights, we’ve been terrible with ending on time. Tonight I get it right! • Check-in. • How many have read Chapter 1 - 5? • Questions? CISSP® MENTOR PROGRAM – SESSION SEVEN 1 ALMOST HALFWAY THERE! Let’s get on it! Only 107 slides tonight, but this part of the book is sort of all over the place. We’ll finish chapter 5!
- 3. The last few nights, we’ve been terrible with ending on time. Tonight I get it right! • Check-in. • How many have read Chapter 1 - 5? • Questions? We’ve had great weather the last few days, now rain. Good time to study! CISSP® MENTOR PROGRAM – SESSION SEVEN 2 ALMOST HALFWAY THERE! Let’s get on it! Only 107 slides tonight, but this part of the book is sort of all over the place. We’ll finish chapter 5! Other Updates: REMINDER: We’ve got a Slack channel setup for all students. • Did you get the invite?! • If not, email cisspmentor@frsecure.com and we’ll get you one ASAP. • Get some Q&A and activity going up in there!
- 4. 1. How many bits compose an IPv6 address? A. 128 bits B. 96 bits C. 32 bits D. 64 bits CISSP® MENTOR PROGRAM – SESSION SEVEN 3 QUIZ… NOT FROM THE BOOK!
- 5. 1. How many bits compose an IPv6 address? A. 128 bits B. 96 bits C. 32 bits D. 64 bits CISSP® MENTOR PROGRAM – SESSION SEVEN 4 QUIZ… NOT FROM THE BOOK!
- 6. 2. Which of the following is used to find the Media Access Control (MAC) address that matches a known Internet Protocol (IP) address? A. Address Resolution Protocol (ARP) B. User Datagram Protocol (UDP) C. Reverse Address Resolution Protocol (RARP) D. Internet Control Message protocol (ICMP) CISSP® MENTOR PROGRAM – SESSION SEVEN 5 QUIZ… NOT FROM THE BOOK!
- 7. 2. Which of the following is used to find the Media Access Control (MAC) address that matches a known Internet Protocol (IP) address? A. Address Resolution Protocol (ARP) B. User Datagram Protocol (UDP) C. Reverse Address Resolution Protocol (RARP) D. Internet Control Message protocol (ICMP) CISSP® MENTOR PROGRAM – SESSION SEVEN 6 QUIZ… NOT FROM THE BOOK!
- 8. 3. A spoofing attack at layer 2 of the OSI model is also known as what? A. DNS Spoofing B. Web Spoofing C. MAC Spoofing D. IP Address Spoofing CISSP® MENTOR PROGRAM – SESSION SEVEN 7 QUIZ… NOT FROM THE BOOK!
- 9. 3. A spoofing attack at layer 2 of the OSI model is also known as what? A. DNS Spoofing B. Web Spoofing C. MAC Spoofing D. IP Address Spoofing CISSP® MENTOR PROGRAM – SESSION SEVEN 8 QUIZ… NOT FROM THE BOOK!
- 10. 4. Below you have a list of protocols on the left side and a list of ports on the right side. Using your mouse, select the proper value listed on the right side, move the values on the right side up and down to properly match them with each of the values listed on the left. CISSP® MENTOR PROGRAM – SESSION SEVEN 9 QUIZ… NOT FROM THE BOOK!
- 11. 4. Below you have a list of protocols on the left side and a list of ports on the right side. Using your mouse, select the proper value listed on the right side, move the values on the right side up and down to properly match them with each of the values listed on the left. CISSP® MENTOR PROGRAM – SESSION SEVEN 10 QUIZ… NOT FROM THE BOOK!
- 12. 5. At which layer does IPSEC operate? A. Session B. Data Link C. Transport D. Network CISSP® MENTOR PROGRAM – SESSION SEVEN 11 QUIZ… NOT FROM THE BOOK!
- 13. 5. At which layer does IPSEC operate? A. Session B. Data Link C. Transport D. Network CISSP® MENTOR PROGRAM – SESSION SEVEN 12 QUIZ… NOT FROM THE BOOK!
- 14. 6. You, as a senior leader in your IT Department are responsible for training up your technicians so they are best prepared to handle their duties. YOU are the lead technician AND manager and if a problem cannot be solved they always come to you for guidance. You keep track of the questions they technicians ask and at the end of each quarter you quiz them on the questions they have asked you about. This technical mentoring has made your network team the best in the business and below are a sample of the questions they asked you for assistance with during the last quarter. At which layer do Network interface cards and drivers convert bits into electrical signals and control aspects of data transmission, including optical, electrical, and mechanical requirements? A. Layer 6 Session Layer B. Layer 2 Physical Layer C. Layer 4 Network Layer D. Layer 1 Physical Layer CISSP® MENTOR PROGRAM – SESSION SEVEN 13 QUIZ… NOT FROM THE BOOK!
- 15. 6. You, as a senior leader in your IT Department are responsible for training up your technicians so they are best prepared to handle their duties. YOU are the lead technician AND manager and if a problem cannot be solved they always come to you for guidance. You keep track of the questions they technicians ask and at the end of each quarter you quiz them on the questions they have asked you about. This technical mentoring has made your network team the best in the business and below are a sample of the questions they asked you for assistance with during the last quarter. At which layer do Network interface cards and drivers convert bits into electrical signals and control aspects of data transmission, including optical, electrical, and mechanical requirements? A. Layer 6 Session Layer B. Layer 2 Physical Layer C. Layer 4 Network Layer D. Layer 1 Physical Layer CISSP® MENTOR PROGRAM – SESSION SEVEN 14 QUIZ… NOT FROM THE BOOK!
- 16. CISSP® MENTOR PROGRAM – SESSION SEVEN 15 LET’S DO THIS! Picking up where we left off. Where we left off…
- 17. CISSP® MENTOR PROGRAM – SESSION SEVEN 16 LET’S DO THIS! Did you know I drove a Range Rover in New York last week?
- 18. • Network Architecture and Design • Secure Network Devices and Protocols • Secure Communications CISSP® MENTOR PROGRAM – SESSION SEVEN 17 WHAT ARE WE GOING TO COVER? Agenda – Domain 4: Communication and Network Security Starting on page 253 this evening Great domain for the techies. A little more challenging for the “normal” people…
- 19. WAN Technologies and Protocols - T1s, T3s, E1s, E3s • T Carriers (United States) • E Carriers (Europe) • T1: • Dedicated 1.544-megabit circuit • Twenty-four 64-bit DS0 (Digital Signal 0) channels (such as 24 circuit-switched phone calls) • DS1 (Digital Signal 1) and T1 are often used interchangeably • DS1 describes the flow of bits (via any medium, such as copper, fiber, wireless, etc.); a T1 is a copper telephone circuit that carries a DS1. • T3: • 28 bundled T1s • 44.736-megabit circuit • T3 and DS3 (Digital Signal 3) are also used interchangeably CISSP® MENTOR PROGRAM – SESSION SEVEN 18 NETWORK ARCHITECTURE AND DESIGN Network Architecture and Design
- 20. WAN Technologies and Protocols - T1s, T3s, E1s, E3s • E1: • Dedicated 2.048-megabit circuit • 30 channels • E3: • 24 E1s • 34.368 megabits. • T1 and T3 speeds are often rounded off to 1.5 and 45 megabits • SONET (Synchronous Optical Networking) carries multiple T-carrier circuits via fiber optic cable • SONET uses a physical fiber ring for redundancy. CISSP® MENTOR PROGRAM – SESSION SEVEN 19 LECTURE Network Architecture and Design
- 21. WAN Technologies and Protocols – Frame Relay • Packet-switched Layer 2 WAN protocol • Provides no error recovery • Focuses on speed • Higher layer protocols carried by Frame Relay, such as TCP/IP can be used to provide reliability • Multiplexes multiple logical connections over a single physical connection to create Virtual Circuits • PVC (Permanent Virtual Circuit) is always connected, analogous to a real dedicated circuit like a T1. • SVC (Switched Virtual Circuit) sets up each “call,” transfers data, and terminates the connection after an idle timeout. • Frame Relay is addressed locally via Data Link Connection Identifiers (DLCI, pronounced “delsee”). CISSP® MENTOR PROGRAM – SESSION SEVEN 20 LECTURE Network Architecture and Design
- 22. WAN Technologies and Protocols – Frame Relay • Packet-switched Layer 2 WAN protocol • Provides no error recovery • Focuses on speed • Higher layer protocols carried by Frame Relay, such as TCP/IP can be used to provide reliability • Multiplexes multiple logical connections over a single physical connection to create Virtual Circuits • PVC (Permanent Virtual Circuit) is always connected, analogous to a real dedicated circuit like a T1. • SVC (Switched Virtual Circuit) sets up each “call,” transfers data, and terminates the connection after an idle timeout. • Frame Relay is addressed locally via Data Link Connection Identifiers (DLCI, pronounced “delsee”). CISSP® MENTOR PROGRAM – SESSION SEVEN 21 LECTURE Network Architecture and Design
- 23. WAN Technologies and Protocols – X.25 • An older packet-switched WAN protocol • Provided a cost-effective way to transmit data over long distances in the 1970s though early 1990s • The global packet switched X.25 network is separate from the global IP-based Internet • Performs error correction which can add latency on long links • Can carry other protocols such as TCP/IP CISSP® MENTOR PROGRAM – SESSION SEVEN 22 LECTURE Network Architecture and Design
- 24. WAN Technologies and Protocols – ATM • Asynchronous Transfer Mode (ATM) • WAN technology that uses fixed length cells • ATM cells are 53 bytes long, with a 5-byte header and 48-byte data portion • SMDS (Switched Multimegabit Data Service) is older and similar to ATM, also using 53-byte cells CISSP® MENTOR PROGRAM – SESSION SEVEN 23 LECTURE Network Architecture and Design
- 25. WAN Technologies and Protocols – SDLC and HDLC • Synchronous Data Link Control (SDLC) • Synchronous Layer 2 WAN protocol • Uses polling to transmit data • Polling is similar to token passing; the difference is a primary node polls secondary nodes, which can transmit data when polled • Combined nodes can act as primary or secondary • SDLC supports NRM transmission only (see next slide) CISSP® MENTOR PROGRAM – SESSION SEVEN 24 LECTURE Network Architecture and Design
- 26. WAN Technologies and Protocols – SDLC and HDLC • High-Level Data Link Control (HDLC) • Successor to SDLC • Adds error correction and flow control, as well as two additional modes (ARM and ABM) • The three modes of HDLC are: • Normal Response Mode (NRM)—Secondary nodes can transmit when given permission by the primary • Asynchronous Response Mode (ARM)—Secondary nodes may initiate communication with the primary • Asynchronous Balanced Mode (ABM)—Combined mode where nodes may act as primary or secondary, initiating transmissions without receiving permission CISSP® MENTOR PROGRAM – SESSION SEVEN 25 LECTURE Network Architecture and Design
- 27. WAN Technologies and Protocols – SDLC and HDLC • High-Level Data Link Control (HDLC) • Successor to SDLC • Adds error correction and flow control, as well as two additional modes (ARM and ABM) • The three modes of HDLC are: • Normal Response Mode (NRM)—Secondary nodes can transmit when given permission by the primary • Asynchronous Response Mode (ARM)—Secondary nodes may initiate communication with the primary • Asynchronous Balanced Mode (ABM)—Combined mode where nodes may act as primary or secondary, initiating transmissions without receiving permission CISSP® MENTOR PROGRAM – SESSION SEVEN 26 LECTURE Network Architecture and Design
- 28. Converged Protocols • Traditional non-IP services all provided on Ethernet and IP. • Distributed Network Protocol (DNP3) – open standard, mostly used in the energy industry. • a multilayer protocol, can be carried via TCP/IP • “smart grid technology” • became an IEEE standard in 2010, called IEEE 1815-2010 (now deprecated) • IEEE 1815-2012 is the current standard; it supports Public Key Infrastructure (PKI) CISSP® MENTOR PROGRAM – SESSION SEVEN 27 LECTURE Network Architecture and Design
- 29. Converged Protocols • Traditional non-IP services all provided on Ethernet and IP. • Distributed Network Protocol (DNP3) – open standard, mostly used in the energy industry. • a multilayer protocol, can be carried via TCP/IP • “smart grid technology” • became an IEEE standard in 2010, called IEEE 1815-2010 (now deprecated) • IEEE 1815-2012 is the current standard; it supports Public Key Infrastructure (PKI) CISSP® MENTOR PROGRAM – SESSION SEVEN 28 LECTURE Network Architecture and Design
- 30. Storage Protocols • Fibre Channel over Ethernet (FCoE) • FCoE uses Ethernet • Fibre Channel over IP (FCIP) encapsulates frames via TCP/IP • HBA (Host Bus Adapters) • Internet Small Computer System Interface (iSCSI) • Can access storage across a WAN • Uses Logical Unit Numbers (LUNs) CISSP® MENTOR PROGRAM – SESSION SEVEN 29 LECTURE Network Architecture and Design
- 31. Storage Protocols • Fibre Channel over Ethernet (FCoE) • FCoE uses Ethernet • Fibre Channel over IP (FCIP) encapsulates frames via TCP/IP • HBA (Host Bus Adapters) • Internet Small Computer System Interface (iSCSI) • Can access storage across a WAN • Uses Logical Unit Numbers (LUNs) CISSP® MENTOR PROGRAM – SESSION SEVEN 30 LECTURE Network Architecture and Design
- 32. Voice over Internet Protocol (VoIP) • Carries voice via data networks, Lower cost and resiliency • Replaced analog POTS (Plain Old Telephone Service) • Real-time Transport Protocol (RTP), designed to carry streaming audio and video • Session Initiation Protocol (SIP), a signaling protocol • Secure Real-time Transport Protocol (SRTP), provides secure VoIP using AES and SHA-1 • Without SRTP (RTP only), calls are prone to sniffing. IPSec can also be used. CISSP® MENTOR PROGRAM – SESSION SEVEN 31 LECTURE Network Architecture and Design
- 33. Wireless Local Area Networks • Transmit information via electromagnetic waves (such as radio) or light • The most common form of wireless data networking is the 802.11 wireless standard • The first 802.11 standard with reasonable security is 802.11i DoS & Availability • WLANs have no way to assure availability • An attacker with physical proximity can launch a variety of Denial-of-Service attacks, including polluting the wireless spectrum with noise • Critical applications that require a reliable network should use wired connections CISSP® MENTOR PROGRAM – SESSION SEVEN 32 LECTURE Network Architecture and Design
- 34. Wireless Local Area Networks Unlicensed Bands • A “band” is a small amount of contiguous radio spectrum • Industrial, Scientific, and Medical (ISM) bands are set aside for unlicensed use (no license from an organization such as the Federal Communications Commission (FCC) require to use them) • Many wireless devices such as cordless phones, 802.11 wireless, and Bluetooth use ISM bands • Different countries use different ISM bands: two popular ISM bands used internationally are 2.4 and 5 GHz CISSP® MENTOR PROGRAM – SESSION SEVEN 33 LECTURE Network Architecture and Design
- 35. Wireless Local Area Networks FHSS, DSSS, and OFDM • Frequency Hopping Spread Spectrum (FHSS) • Method of sending traffic via a radio band • Designed to maximize throughput while minimizing the effects of interference • Uses a number of small frequency channels throughout the band and “hops” through them in pseudorandom order • Direct Sequence Spread Spectrum (DSSS) • Method of sending traffic via a radio band • Designed to maximize throughput while minimizing the effects of interference • Uses the entire band at once, “spreading” the signal throughout the band • Orthogonal Frequency-Division Multiplexing (OFDM) • A newer multiplexing method • Allows simultaneous transmission using multiple independent wireless frequencies that do not interfere with each other CISSP® MENTOR PROGRAM – SESSION SEVEN 34 LECTURE Network Architecture and Design
- 36. Wireless Local Area Networks IEEE Network Standards CISSP® MENTOR PROGRAM – SESSION SEVEN 35 LECTURE Network Architecture and Design
- 37. Wireless Local Area Networks 802.11 abgn CISSP® MENTOR PROGRAM – SESSION SEVEN 36 LECTURE Network Architecture and Design
- 38. Wireless Local Area Networks Managed, Master, Ad-Hoc and Monitor modes • Managed Mode (aka client mode) – clients cannot connect to anyone other than the access point when connected. • Master Mode (aka infrastructure mode) – can only connect with clients in managed mode. • Ad-Hoc Mode – peer-to-peer communication without a central accesspoint. • Monitor Mode – read-only for sniffing WLAN traffic (Kismet & Wellenreiter) CISSP® MENTOR PROGRAM – SESSION SEVEN 37 LECTURE Network Architecture and Design
- 39. Wireless Local Area Networks SSID and MAC Address Filtering • 802.11 WLANs use a Service Set Identifier (SSID), which acts as a network name • Wireless clients must know the SSID before joining the WLAN • SSIDs are normally broadcasted; some WLANs are configured to disable SSID broadcasts • Relying on the secrecy of the SSID is a poor security strategy: a wireless sniffer in monitor mode can detect the SSID used by clients as they join WLANs: this is true even if SSID broadcasts are disabled • MAC addresses are exposed in plaintext on 802.11 WLANs: trusted MACS can be sniffed, and an attacker may reconfigure a nontrusted device with a trusted MAC address in software CISSP® MENTOR PROGRAM – SESSION SEVEN 38 LECTURE Network Architecture and Design
- 40. Wireless Local Area Networks WEP • Wired Equivalent Privacy protocol • Has proven to be critically weak: new attacks can break any WEP key in minutes • Provides little integrity or confidentiality protection • Its use is strongly discouraged. 802.11i and/or other encryption methods such as VPN should be used in place of WEP • Has 40 and 104-bit key lengths, and uses the RC4 cipher • Frames have no timestamp and no replay protection CISSP® MENTOR PROGRAM – SESSION SEVEN 39 LECTURE Network Architecture and Design
- 41. Wireless Local Area Networks WEP has been widely criticized for a number of weaknesses. • Weakness: Key Management and Key Size. • Weakness: The Initialization Vector (IV) is Too Small. • Weakness: The Integrity Check Value (ICV) algorithm is not appropriate. • Weakness: WEP's use of RC4 is weak. • Weakness: Authentication Messages can be easily forged. CISSP® MENTOR PROGRAM – SESSION SEVEN 40 LECTURE Network Architecture and Design
- 42. Wireless Local Area Networks 802.11i • The first 802.11 wireless security standard • Provides reasonable security • Describes a Robust Security Network (RSN), which allows pluggable authentication modules • RSN allows changes to cryptographic ciphers as new vulnerabilities are discovered • RSN is also known as WPA2 (Wi-Fi Protected Access 2), a full implementation of 802.11i • By default, WPA2 uses AES encryption to provide confidentiality, and CCMP (Counter Mode CBC MAC Protocol) to create a Message Integrity Check (MIC), which provides integrity • WPA2 may (optionally) use the less secure RC4 (Rivest Cipher 4) and TKIP (Temporal Key Integrity Protocol) ciphers to provide confidentiality and integrity, respectively. CISSP® MENTOR PROGRAM – SESSION SEVEN 41 LECTURE Network Architecture and Design The less secure WPA (without the “2”) was designed for access points that lack the power to implement the full 802.11i standard, providing a better security alternative to WEP. WPA uses RC4 for confidentiality and TKIP for integrity. Usage of WPA2 is recommended over WPA.
- 43. Wireless Local Area Networks Bluetooth • Described by IEEE standard 802.15 • A Personal Area Network (PAN) wireless technology, operating in the same 2.4 GHz frequency as many types of 802.11 wireless • Can be used by small low-power devices such as cell phones to transmit data over short distances • Versions 2.1 and older operate at 3 mbps or less; Versions 3 (announced in 2009) and higher offer far faster speeds CISSP® MENTOR PROGRAM – SESSION SEVEN 42 LECTURE Network Architecture and Design
- 44. Wireless Local Area Networks Bluetooth • Three classes of devices • Class 3: under 10 meters • Class 2: 10 meters • Class 1: 100 meters • Uses the 128-bit E0 symmetric stream cipher • Cryptanalysis has proven it to be weak; attacks show the true strength to be 38 bits or less • Sensitive devices should disable automatic discovery by other Bluetooth devices CISSP® MENTOR PROGRAM – SESSION SEVEN 43 LECTURE Network Architecture and Design
- 45. Wireless Local Area Networks RFID • Radio Frequency Identification (RFID) • A technology used to create wirelessly readable tags for animals or objects • There are three types of RFID tags… CISSP® MENTOR PROGRAM – SESSION SEVEN 44 LECTURE Network Architecture and Design
- 46. Wireless Local Area Networks RFID • Radio Frequency Identification (RFID) • A technology used to create wirelessly readable tags for animals or objects • There are three types of RFID tags… • Active • Have a battery • An active tag broadcasts a signal • Can operate via larger distances • Devices like toll transponders • Semi-passive • Have a battery • Semi-passive RFID tags rely on a RFID reader’s signal for power • Passive • Have no battery • Rely on the RFID reader’s signal for power • Tracking inventory in a warehouse CISSP® MENTOR PROGRAM – SESSION SEVEN 45 LECTURE Network Architecture and Design
- 47. Wireless Local Area Networks RFID • Signals may be blocked with a Faraday Cage • Cage can be as simple as aluminum foil wrapped around an object • Instructions for building a Faraday Cage wallet (designed to protect smart cards with RFID chips) from aluminum foil and duct tape are available at: http://howto.wired.com/wiki/Make_ a_Faraday_Cage_Wallet CISSP® MENTOR PROGRAM – SESSION SEVEN 46 LECTURE Network Architecture and Design
- 48. Network devices and protocols Repeaters and Hubs • Layer 1 devices • Repeater receives bits on one port, and “repeats” them out the other port • Repeater has no understanding of protocols; it only repeats bits • Repeaters are often used to extend the length of a network • A hub is a repeater with more than two ports • Hubs receive bits on one port and repeat them across all other ports • No traffic isolation and no security: all nodes see all traffic sent by the hub • Half-duplex devices: they cannot send and receive simultaneously • One “collision domain”: any node may send colliding traffic with another • Unsuitable for most modern purposes CISSP® MENTOR PROGRAM – SESSION SEVEN 47 LECTURE Network Architecture and Design
- 49. Network devices and protocols Repeaters and Hubs • Layer 1 devices • Repeater receives bits on one port, and “repeats” them out the other port • Repeater has no understanding of protocols; it only repeats bits • Repeaters are often used to extend the length of a network • A hub is a repeater with more than two ports • Hubs receive bits on one port and repeat them across all other ports • No traffic isolation and no security: all nodes see all traffic sent by the hub • Half-duplex devices: they cannot send and receive simultaneously • One “collision domain”: any node may send colliding traffic with another • Unsuitable for most modern purposes CISSP® MENTOR PROGRAM – SESSION SEVEN 48 LECTURE Network Architecture and Design
- 50. Network devices and protocols Bridges • Layer 2 devices • Has two ports and connects network segments together • Provides traffic isolation and makes forwarding decisions by learning the MAC addresses of connected nodes. • Two collision domains CISSP® MENTOR PROGRAM – SESSION SEVEN 49 LECTURE Network Architecture and Design
- 51. Network devices and protocols Bridges • Layer 2 devices • Has two ports and connects network segments together • Provides traffic isolation and makes forwarding decisions by learning the MAC addresses of connected nodes. • Two collision domains CISSP® MENTOR PROGRAM – SESSION SEVEN 50 LECTURE Network Architecture and Design
- 52. Network devices and protocols Switches • A bridge with more than two ports • Best practice to only connect one device per switch port • Provides traffic isolation by associating the MAC address of each computer and server with its port • Shrinks the collision domain to a single port • Trunks are used to connect multiple switches CISSP® MENTOR PROGRAM – SESSION SEVEN 51 LECTURE Network Architecture and Design
- 53. Network devices and protocols Switches (VLANs) • Virtual LAN, which can be thought of as a virtual switch • Inter-VLAN communication requires layer 3 routing. CISSP® MENTOR PROGRAM – SESSION SEVEN 52 LECTURE Network Architecture and Design
- 54. Network devices and protocols Switches (SPAN ports) • Mirroring traffic from multiple switch ports to one “SPAN port” • SPAN is a Cisco term; HP switches use the term “Mirror port” • Typically used for Intrusion Detection and/or Prevention • One drawback to using a switch SPAN port is port bandwidth overload CISSP® MENTOR PROGRAM – SESSION SEVEN 53 LECTURE Network Architecture and Design
- 55. Network devices and protocols Switches (TAPs) • “Test Access Port” • Provides a way to “tap” into network traffic, and see all unicast streams on a network • The preferred way to provide promiscuous network access to a sniffer or Networked Intrusion Detection System. • Can “fail open,” so that network traffic will pass in the event of a failure: this is not true for hubs or switch SPAN ports CISSP® MENTOR PROGRAM – SESSION SEVEN 54 LECTURE Network Architecture and Design
- 56. Network devices and protocols Routers • Layer 3 devices • Route traffic from one LAN to another • IP-based routers make routing decisions based on the source and destination IP addresses. NOTE: In the real world, one chassis, such as a Cisco 6500, can be many devices at once: a router, a switch, a firewall, a NIDS, etc. The exam is likely to give more clear- cut examples: a dedicated firewall, a dedicated switch, etc. If the exam references a multifunction device, that will be made clear. Regardless, it is helpful on the exam to think of these devices as distinct concepts. CISSP® MENTOR PROGRAM – SESSION SEVEN 55 LECTURE Network Architecture and Design
- 57. Network devices and protocols Routers (Static and Default Routes) • Static routes • Routes to other networks • Manually entered into the routing table • Good for simple routing needs and fixed networks with little or no redundancy • Default routes • A route to other networks that are not known. • If no other routes to a network exist, the default route is used. CISSP® MENTOR PROGRAM – SESSION SEVEN 56 LECTURE Network Architecture and Design
- 58. Network devices and protocols Routing Protocols • Automatic routing based upon the protocol used. • Convergence – when all the routers are in agreement on the state of routing (routing tables are in sync and/or topology is set). • Interior Gateway Protocols (IGP) – Routing Information Protocol (RIP), Open Shortest Path First (OSPF), and Enhanced Interior Gateway Routing Protocol (EIGRP) • Exterior Gateway Protocols (EGP) – Border Gateway Protocol (BGP) is king. CISSP® MENTOR PROGRAM – SESSION SEVEN 57 LECTURE Network Architecture and Design
- 59. Network devices and protocols Routers (Distance Vector Routing Protocols) • Metrics are used to determine the “best” route across a network • Simplest metric is hop count – number of routers to a destination network • Does not account for link speed between networks • Prone to routing loops CISSP® MENTOR PROGRAM – SESSION SEVEN 58 LECTURE Network Architecture and Design
- 60. Network devices and protocols Routers (RIP) • A distance vector routing protocol • Uses hop count as its metric • Does not have a full view of a network: it can only “see” directly connected routers • Convergence is slow • Sends routing updates every 30 seconds, regardless of routing changes • Maximum hop count is 15; 16 is considered “infinite.” • RIPv1 can route classful networks only • RIPv2 added support for CIDR • Uses split horizon to help avoid routing loops - means that a router will not “argue back” • Uses a hold-down timer to avoid “flapping” (repeatedly changing a route’s status from up to down) CISSP® MENTOR PROGRAM – SESSION SEVEN 59 LECTURE Network Architecture and Design
- 61. Network devices and protocols Routing Protocols • Automatic routing based upon the protocol used. • Link State Routing Protocols – additional metrics for determining best route. • OSPF is an example. • Can use bandwidth, congestion, and other metrics for routing decisions. CISSP® MENTOR PROGRAM – SESSION SEVEN 60 LECTURE Network Architecture and Design
- 62. Network devices and protocols Routers (OSPF) • OSPF • Open Shortest Path First (OSPF) • An open link state routing protocol • Routers learn the entire network topology for their “area” (the portion of the network they maintain routes for, usually the entire network for small networks) • Routers send event-driven updates • Far faster convergence than distance vector protocols such as RIP CISSP® MENTOR PROGRAM – SESSION SEVEN 61 LECTURE Network Architecture and Design
- 63. Network devices and protocols Routers (Static and Default Routes) CISSP® MENTOR PROGRAM – SESSION SEVEN 62 LECTURE Network Architecture and Design
- 64. Network devices and protocols Routers (BGP) • Border Gateway Protocol • The routing protocol used on the Internet • Routes between autonomous systems, which are networks with multiple Internet connections • Has some distance vector properties, but is formally considered a path vector routing protocol CISSP® MENTOR PROGRAM – SESSION SEVEN 63 LECTURE Network Architecture and Design Note - The exam strongly prefers open over proprietary standards, which is why proprietary routing protocols like Cisco’s EIGRP are not covered.
- 65. Network devices and protocols Firewalls • Filter traffic between networks • TCP/IP packet filter and stateful firewalls make decisions based on layers 3 and 4 (IP addresses and ports) • Proxy firewalls can also make decisions based on layers 5-7 • Firewalls are multi-homed: they have multiple NICs connected to multiple different networks CISSP® MENTOR PROGRAM – SESSION SEVEN 64 LECTURE Network Architecture and Design
- 66. Network devices and protocols Firewalls • Filter traffic between networks • TCP/IP packet filter and stateful firewalls make decisions based on layers 3 and 4 (IP addresses and ports) • Proxy firewalls can also make decisions based on layers 5-7 • Firewalls are multi-homed: they have multiple NICs connected to multiple different networks CISSP® MENTOR PROGRAM – SESSION SEVEN 65 LECTURE Network Architecture and Design
- 67. Network devices and protocols Firewalls (Packet Filter) • A simple and fast firewall • No concept of “state”: each filtering decision must be made on the basis of a single packet • No way to refer to past packets to make current decisions • Lack of state makes packet filter firewalls less secure, especially for session less protocols like UDP and ICMP CISSP® MENTOR PROGRAM – SESSION SEVEN 66 LECTURE Network Architecture and Design
- 68. Network devices and protocols Firewalls (Packet Filter) • A simple and fast firewall • No concept of “state”: each filtering decision must be made on the basis of a single packet • No way to refer to past packets to make current decisions • Lack of state makes packet filter firewalls less secure, especially for session less protocols like UDP and ICMP CISSP® MENTOR PROGRAM – SESSION SEVEN 67 LECTURE Network Architecture and Design
- 69. Network devices and protocols Firewalls (Stateful) • A state table that allows the firewall to compare current packets to previous ones • Slower than packet filters, but are far more secure CISSP® MENTOR PROGRAM – SESSION SEVEN 68 LECTURE Network Architecture and Design
- 70. Network devices and protocols Proxy Firewalls • Firewalls that act as intermediary servers • Proxies terminate connections CISSP® MENTOR PROGRAM – SESSION SEVEN 69 LECTURE Network Architecture and Design
- 71. Network devices and protocols Proxy Firewalls Application-Layer Proxy Firewalls • Operate up to Layer 7 • Can make filtering decisions based on application-layer data, such as HTTP traffic, in addition to layers 3 and 4 • Must understand the protocol that is proxied, so dedicated proxies are often required for each protocol: an FTP proxy for FTP traffic, an HTTP proxy for Web traffic, etc. • Allows tighter control of filtering decisions CISSP® MENTOR PROGRAM – SESSION SEVEN 70 LECTURE Network Architecture and Design
- 72. Network devices and protocols Proxy Firewalls Circuit-Level Proxies Including SOCKS • Operate at Layer 5 (session layer) - allows circuit-level proxies to filter more protocols: there is no need to understand each protocol; the application- layer data is simply passed along • Most popular example of a circuit-level proxy is SOCKS • SOCKS uses TCP port 1080 • Some applications must be “socksified” to pass via a SOCKS proxy • SOCKS5 is current version of the protocol • Cannot make filtering decisions based on application layer data, such as explicit Web content CISSP® MENTOR PROGRAM – SESSION SEVEN 71 LECTURE Network Architecture and Design
- 73. Network devices and protocols Fundamental Firewall Designs – Dual-Homed Host • Two network interfaces: one connected to a trusted network, and the other connected to an untrusted network, such as the Internet • Host does not route: a user wishing to access the trusted network from the Internet, would log into the dual-homed host first, and then access the trusted network from there • Common design before modern firewalls in the 1990s CISSP® MENTOR PROGRAM – SESSION SEVEN 72 LECTURE Network Architecture and Design
- 74. Network devices and protocols Fundamental Firewall Designs – Screened Host Architecture • An older flat network design using one router to filter external traffic to and from a bastion host via an access control list (ACL) • The bastion host can reach other internal resources, but the router ACL forbids direct internal/external connectivity CISSP® MENTOR PROGRAM – SESSION SEVEN 73 LECTURE Network Architecture and Design
- 75. Network devices and protocols Fundamental Firewall Designs – DMZ Networks and Screened Subnet Architecture • An older flat network design using one router to filter external traffic to and from a bastion host via an access control list (ACL) • The bastion host can reach other internal resources, but the router ACL forbids direct internal/external connectivity CISSP® MENTOR PROGRAM – SESSION SEVEN 74 LECTURE Network Architecture and Design
- 76. Network devices and protocols Fundamental Firewall Designs – DMZ Networks and Screened Subnet Architecture • DMZ is “Demilitarized Zone” network • Hosts that receive traffic from untrusted networks such as the Internet should be placed on DMZ networks • Designed with the assumption that any DMZ host may be compromised: the DMZ is designed to contain the compromise, and prevent it from extending into internal trusted networks • Hosts on a DMZ should be hardened CISSP® MENTOR PROGRAM – SESSION SEVEN 75 LECTURE Network Architecture and Design
- 77. Network devices and protocols Fundamental Firewall Designs – DMZ Networks and Screened Subnet Architecture A “classic” DMZ uses two firewalls (shown below) - called a screened subnet dual firewall design: two firewalls screen the DMZ subnet. CISSP® MENTOR PROGRAM – SESSION SEVEN 76 LECTURE Network Architecture and Design
- 78. Network devices and protocols Fundamental Firewall Designs – DMZ Networks and Screened Subnet Architecture A single-firewall DMZ uses one firewall (shown at side) - sometimes called a “three-legged” DMZ. CISSP® MENTOR PROGRAM – SESSION SEVEN 77 LECTURE Network Architecture and Design
- 79. Network devices and protocols Fundamental Firewall Designs – DMZ Networks and Screened Subnet Architecture • Single firewall design requires a firewall that can filter traffic on all interfaces: untrusted, trusted, and DMZ • Dual-firewall designs are more complex, but considered more secure • The term “DMZ” alone implies a dual-firewall DMZ. CISSP® MENTOR PROGRAM – SESSION SEVEN 78 LECTURE Network Architecture and Design
- 80. Network devices and protocols Modem • Modulator/Demodulator • Binary data is modulated it into analog sound that can be carried on phone networks designed to carry the human voice • Receiving modem then demodulates the analog sound back into binary data • Asynchronous devices: they do not operate with a clock signal CISSP® MENTOR PROGRAM – SESSION SEVEN 79 LECTURE Network Architecture and Design
- 81. Network devices and protocols Modem • Modulator/Demodulator • Binary data is modulated it into analog sound that can be carried on phone networks designed to carry the human voice • Receiving modem then demodulates the analog sound back into binary data • Asynchronous devices: they do not operate with a clock signal CISSP® MENTOR PROGRAM – SESSION SEVEN 80 LECTURE Network Architecture and Design
- 82. Network devices and protocols DTE/DCE and CSU/DSU • DTE (Data Terminal Equipment) is a network “terminal” • Any type of network-connected user machine, such as a desktop, server, or actual terminal • DCE (Data Circuit-Terminating Equipment, or sometimes called Data Communications Equipment) • A device that networks DTEs, such as a router • The circuit carried via DCE/DTE is synchronous (it uses a clock signal) • Both sides must synchronize to a clock signal, provided by the DCE • The DCE device is a modem or a CSU/DSU (Channel Service Unit/Data Service Unit) CISSP® MENTOR PROGRAM – SESSION SEVEN 81 LECTURE Network Architecture and Design
- 83. Network devices and protocols DTE/DCE and CSU/DSU • The most common use of these terms is DTE/DCE, and the meaning of each is more specific: • DCE marks the end of an ISP’s network, connecting to: • Data Terminal Equipment (DTE), which is the responsibility of the customer • The point where the DCE meets the DTE is called the demarc: the demarcation point, where the ISP’s responsibility ends, and the customer’s begins CISSP® MENTOR PROGRAM – SESSION SEVEN 82 LECTURE Network Architecture and Design
- 84. Secure Communications Authentication Protocols and Frameworks • Authenticates an identity claim over the network • Good security design assumes that a network eavesdropper may sniff all packets sent between the client and authentication server: the protocol should remain secure CISSP® MENTOR PROGRAM – SESSION SEVEN 83 LECTURE Network Architecture and Design
- 85. Secure Communications PAP & CHAP • PAP (Password Authentication Protocol) • Very weak authentication protocol • Sends the username and password in cleartext • Insecure and should not be used CISSP® MENTOR PROGRAM – SESSION SEVEN 84 LECTURE Network Architecture and Design
- 86. Secure Communications PAP & CHAP • CHAP (Challenge-handshake Authentication Protocol) • A more secure authentication protocol • Does not expose the cleartext password • Not susceptible to replay attacks • Relies on a shared secret: the password • Password is securely created (such as during account enrollment) and stored on the CHAP server • Since both the user and the CHAP server share a secret (the plaintext password), they can use that secret to securely communicate • The server stores plaintext passwords of each client (weakness) CISSP® MENTOR PROGRAM – SESSION SEVEN 85 LECTURE Network Architecture and Design
- 87. Secure Communications PAP & CHAP • CHAP (Challenge-handshake Authentication Protocol) • To authenticate, the client first creates an initial (unauthenticated) connection via LCP (Link Control Protocol). The server then begins the three-way CHAP authentication process: • Server sends a challenge, which is a small random string (also called a nonce). • The user takes the challenge string and the password, uses a hash cipher such as MD5 to create a hash value, and sends that value back to the CHAP server as the response. • The CHAP server also hashes the password and challenge, creating the expected response. It then compares the expected response with the response received from the user. • If the responses are identical, the user must have entered the appropriate password, and is authenticated. If they are different, the user entered the wrong password, and access is denied. CISSP® MENTOR PROGRAM – SESSION SEVEN 86 LECTURE Network Architecture and Design
- 88. Secure Communications 802.1X and EAP 802.1X is: • “Port Based Network Access Control” • Includes EAP (Extensible Authentication Protocol) • An authentication framework that describes many specific authentication protocols • Designed to provide authentication at Layer 2, before a node receives an IP address • Protects against the “roaming infected laptop” • Available for both wired and wireless, but is most commonly deployed on WLANs • An EAP client is called a supplicant, which requests authentication from an authenticator CISSP® MENTOR PROGRAM – SESSION SEVEN 87 LECTURE Network Architecture and Design
- 89. Secure Communications 802.1X and EAP EAP Types • LEAP (Lightweight Extensible Authentication Protocol) • Cisco-proprietary protocol released before 802.1X was finalized • Has significant security flaws, and should not be used • EAP-TLS (EAP-Transport Layer Security) • Uses PKI, requiring both server-side and client-side certificates • Establishes a secure TLS tunnel used for authentication • Very secure due to the use of PKI, but is complex and costly for the same reason CISSP® MENTOR PROGRAM – SESSION SEVEN 88 LECTURE Network Architecture and Design
- 90. Secure Communications 802.1X and EAP EAP Types • EAP-TTLS (EAP Tunneled Transport Layer Security) • Developed by Funk Software and Certicom • Simplifies EAP-TLS by dropping the client-side certificate requirement, allowing other authentication methods (such as password) for client-side authentication • Easier to deploy than EAP-TLS, but less secure when omitting the client- side certificate • PEAP (Protected EAP) • Jointly developed by Cisco Systems, Microsoft, and RSA Security • Similar to (and may be considered a competitor to) EAP-TTLS, including not requiring client-side certificates CISSP® MENTOR PROGRAM – SESSION SEVEN 89 LECTURE Network Architecture and Design
- 91. Secure Communications VPN • Secure data sent via insecure networks such as the Internet • Goal is to provide the privacy provided by a circuit such as a T1, virtually SLIP and PPP • SLIP (Serial Line Internet Protocol) • A Layer 2 protocol • Provides IP connectivity via asynchronous connections such as serial lines and modems • First introduced in 1988 • Allowed routing packets via modem links for the first time (previously, modems were primarily used for nonrouted terminal access) • Provides no built-in confidentiality, integrity, or authentication • Largely replaced with PPP CISSP® MENTOR PROGRAM – SESSION SEVEN 90 LECTURE Network Architecture and Design
- 92. Secure Communications VPN • Secure data sent via insecure networks such as the Internet • Goal is to provide the privacy provided by a circuit such as a T1, virtually SLIP and PPP • PPP (Point-to-Point Protocol) • A Layer 2 protocol that pretty much replaced SLIP. • Based on HDLC • Adds confidentiality, integrity, and authentication via point-to-point links • Supports synchronous links (such as T1s) in addition to asynchronous links such as modems CISSP® MENTOR PROGRAM – SESSION SEVEN 91 LECTURE Network Architecture and Design
- 93. Secure Communications VPN • PPTP (Point-to-Point Tunneling Protocol) • Tunnels PPP via IP • Developed by a consortium of vendors, including Microsoft, 3COM, and others • Uses GRE (Generic Routing Encapsulation) to pass PPP via IP, and uses TCP for a control channel (using TCP port 1723) • L2TP (Layer 2 Tunneling Protocol) • Combines PPTP and L2F (Layer 2 Forwarding, designed to tunnel PPP) • Focuses on authentication and does not provide confidentiality • Frequently used with IPSec to provide encryption • L2TP can also be used on non-IP networks, such as ATM CISSP® MENTOR PROGRAM – SESSION SEVEN 92 LECTURE Network Architecture and Design
- 94. Secure Communications VPN • IPv4 has no built-in confidentiality • IPSec (Internet Protocol Security) was designed to provide confidentiality, integrity, and authentication via encryption for IPv6 • IPSec has been ported to IPv4 • IPSec is a suite of protocols: • Major two are Encapsulating Security Protocol (ESP) and Authentication Header (AH) • Each has an IP protocol number: ESP is protocol 50; AH is protocol 51. CISSP® MENTOR PROGRAM – SESSION SEVEN 93 LECTURE Network Architecture and Design
- 95. Secure Communications VPN • IPv4 has no built-in confidentiality • IPSec (Internet Protocol Security) was designed to provide confidentiality, integrity, and authentication via encryption for IPv6 • IPSec has been ported to IPv4 • IPSec is a suite of protocols: • Major two are Encapsulating Security Protocol (ESP) and Authentication Header (AH) • Each has an IP protocol number: ESP is protocol 50; AH is protocol 51. CISSP® MENTOR PROGRAM – SESSION SEVEN 94 LECTURE Network Architecture and Design
- 96. Secure Communications VPN IPSec Architectures IPSec has three architectures: • Host-to-gateway • Also called client mode • Used to connect one system which runs IPSec client software to an IPSec gateway • Gateway-to-gateway • Also called point-to-point • Connects two IPSec gateways, which form an IPSec connection that acts as a shared routable network connection • Host-to-host • Connects two systems (such as file servers) to each other via IPSec • Many modern operating systems, such as Windows 7 or Ubuntu Linux, can run IPSec natively, allowing them to form host-to-gateway or host-to-host connections CISSP® MENTOR PROGRAM – SESSION SEVEN 95 LECTURE Network Architecture and Design
- 97. Secure Communications VPN SSL and TLS • Secure Sockets Layer (SSL) was designed to protect HTTP (Hypertext Transfer Protocol) data • HTTPS uses TCP port 443 • TLS (Transport Layer Security) is meant to replace SSL. SSL v3.0 was deprecated in June, 2015. • The current version of TLS is 1.2, described in RFC 5246 (see: http://tools.ietf.org/html/rfc5246); TLS 1.3 is in draft. • Can be used to tunnel other IP protocols to form VPN connections • SSL VPNs can be simpler • SSL client software does not require altering the operating system • IPSec is difficult to firewall; SSL is much simpler. CISSP® MENTOR PROGRAM – SESSION SEVEN 96 LECTURE Network Architecture and Design
- 98. Secure Communications VPN SSL and TLS • Secure Sockets Layer (SSL) was designed to protect HTTP (Hypertext Transfer Protocol) data • HTTPS uses TCP port 443 • TLS (Transport Layer Security) is meant to replace SSL. SSL v3.0 was deprecated in June, 2015. • The current version of TLS is 1.2, described in RFC 5246 (see: http://tools.ietf.org/html/rfc5246); TLS 1.3 is in draft. • Can be used to tunnel other IP protocols to form VPN connections • SSL VPNs can be simpler • SSL client software does not require altering the operating system • IPSec is difficult to firewall; SSL is much simpler. CISSP® MENTOR PROGRAM – SESSION SEVEN 97 LECTURE Network Architecture and Design
- 99. Remote Access ISDN • Integrated Services Digital Network (ISDN) • An earlier attempt to provide digital service via “copper pair,” the POTS (Plain Old Telephone Service) • Devices are called terminals • Basic Rate Interface (BRI) service provides two 64K digital channels (plus a 16K signaling channel) via copper pair • PRI (Primary Rate Interface) provides twenty-three 64K channels, plus one 16K signaling channel CISSP® MENTOR PROGRAM – SESSION SEVEN 98 LECTURE Network Architecture and Design
- 100. Remote Access DSL • Digital Subscriber Line (DSL) • “last mile” solution similar to ISDN: use existing copper pairs to provide digital • As a general rule, the closer a site is to the Central Office (CO), the faster the available service CISSP® MENTOR PROGRAM – SESSION SEVEN 99 LECTURE Network Architecture and Design
- 101. Remote Access DSL • Digital Subscriber Line (DSL) • “last mile” solution similar to ISDN: use existing copper pairs to provide digital • As a general rule, the closer a site is to the Central Office (CO), the faster the available service Common types of DSL are • Symmetric Digital Subscriber Line (SDSL, with matching upload and download speeds) • Asymmetric Digital Subscriber Line (ADSL, featuring faster download speeds than upload) • Very High Rate Digital Subscriber Line (VDSL, featuring much faster asymmetric speeds) • HDSL (High-data-rate DSL), which matches SDSL speeds using two pairs of copper; HDSL is used to provide inexpensive T1 service CISSP® MENTOR PROGRAM – SESSION SEVEN 100 LECTURE Network Architecture and Design
- 102. Remote Access DSL • Digital Subscriber Line (DSL) • “last mile” solution similar to ISDN: use existing copper pairs to provide digital • As a general rule, the closer a site is to the Central Office (CO), the faster the available service Common types of DSL are • Symmetric Digital Subscriber Line (SDSL, with matching upload and download speeds) • Asymmetric Digital Subscriber Line (ADSL, featuring faster download speeds than upload) • Very High Rate Digital Subscriber Line (VDSL, featuring much faster asymmetric speeds) • HDSL (High-data-rate DSL), which matches SDSL speeds using two pairs of copper; HDSL is used to provide inexpensive T1 service CISSP® MENTOR PROGRAM – SESSION SEVEN 101 LECTURE Network Architecture and Design
- 103. Remote Access Cable Modems • Used by Cable TV providers to provide Internet access via broadband cable TV • Broadband, unlike baseband, has multiple channels (like TV channels) • Dedicating bandwidth for network services requires dedicating channels for that purpose • Unlike DSL, Cable Modem bandwidth is typically shared with neighbors on the same network segment CISSP® MENTOR PROGRAM – SESSION SEVEN 102 LECTURE Network Architecture and Design
- 104. Remote Access Callback & Caller ID • Callback • Modem-based authentication system • User connects via modem and authenticates. The system hangs up, and calls the user back at the preconfigured number. • Caller ID • Similar method: in addition to username and password, it requires calling from the correct phone number • Caller ID can be easily forged: many phone providers allow the end user to select any Caller ID number of their choice. This makes Caller ID a weak form of authentication. CISSP® MENTOR PROGRAM – SESSION SEVEN 103 LECTURE Network Architecture and Design
- 105. Remote Access Instant Messaging • Allows two or more users to communicate with each other via real-time “chat” • Chat may be one-to-one, or many-to-many via chat groups • In addition to chatting, most modern instant messaging software allows file sharing, and sometimes audio and video conferencing • Other chat protocols and networks include AOL Instant Messenger (AIM), ICQ (short for “I seek you”), and Extensible Messaging and Presence Protocol (XMPP) (formerly known as Jabber). • Organizations should have a policy controlling the use of chat software and technical controls in place to monitor and, if necessary, block their usage. CISSP® MENTOR PROGRAM – SESSION SEVEN 104 LECTURE Network Architecture and Design
- 106. Remote Access Instant Messaging • IRC (Internet Relay Chat) • A global network of chat servers and clients created in 1988 • Still very popular even today • IRC servers use TCP port 6667 by default, but many IRC servers run on nonstandard ports • IRC can be used for legitimate purposes, but is also used by malware, which may “phone home” to a command-and-control channel via IRC (among other methods) CISSP® MENTOR PROGRAM – SESSION SEVEN 105 LECTURE Network Architecture and Design
- 107. Remote Access Remote Desktop Console Access • Been around for a long, long time. • rlogin and rsh, *nix operating systems, poor security (clear text), TCP 513 and 514 • Virtual Network Computing (VNC), typically TCP 5900 • Remote Desktop Protocol (RDP), TCP 3389 CISSP® MENTOR PROGRAM – SESSION SEVEN 106 LECTURE Network Architecture and Design
- 108. Remote Access Remote Desktop Console Access • Been around for a long, long time. • rlogin and rsh, *nix operating systems, poor security (clear text), TCP 513 and 514 • Virtual Network Computing (VNC), typically TCP 5900 • Remote Desktop Protocol (RDP), TCP 3389 CISSP® MENTOR PROGRAM – SESSION SEVEN 107 LECTURE Network Architecture and Design
- 109. Technical, but not too technical. Please try to catch up in your reading. • We left off on page 293 in the book. • Monday (5/6) we’ll start: Chapter 6: Identity and Access Management. • Brad’s leading this one!!! • Come with questions! CISSP® MENTOR PROGRAM – SESSION SEVEN 108 WE MADE IT THROUGH SESSION #7!