Domain 4: Network and Communication Security

OSI Reference Model
7 layers, Allow changes between layers, Standard hardware/software interoperability.

Tip, OSI Mnemonics
All People Seem To Need Data Processing
Please Do Not Throw Sausage Pizza Away
Layer

Data

Security

Application

Data

C, I, AU, N

Presentation

Data

C, AU, Encryption

SessionData

N

Transport

Segment

C, AU, I

Network

Packets

C, AU, I

Data link

FramesC

Physical

Bits

C

C=Conﬁdentiality, AU=Authentication, I=Integrity, N=Non repudiation

Layer (No)FunctionsHardware /Formats

Protocols

Cables, HUB,USB, DSL
Repeaters,
ATM

Electrical signal
Physical (1)Bits to voltage

Data Link
Layer (2)

Networklayer

Transport

Frames setup
Error detection and control
Check integrity of packets
Destination address, Frames
use in MAC to IP address
conversion.

PPP - PPTP - L2TP - - ARP RARP - SNAP - CHAP - LCP MLP - Frame Relay - HDLC ISL - MAC - Ethernet - Token
Ring - FDDI

Routing, Layer 3 switching,segmentation, logicaladdressing. ATM. Packets.

Layer 3
ICMP - BGP - OSPF - RIP - IP Switch BOOTP - DHCP - ICMP
RouterSegment - Connection
orientedTCP - UDP datagrams.
Reliable end to end datatransfer Segmentation - sequencing and error checking

TCP - UDP - NSF - SQL Data, simplex, half duplex, full
RADIUS - and RPC - PPTP dupl Eg. peer connections.
PPP

Session
Layer

Data

Presentation
compression/decompression TCP - UDP messages
layer
and encryption/decryption

TCP - UDP - FTP - TELNET TFTP - SMTP - HTTP CDP SMB - SNMP - NNTP - SSL HTTP/HTTPS.

Application
Data
layer

Layer 2Switch bridges

Routers VPN
concentrato
rs - Gateway
GatewaysPort

Protocol20,21

FTP22SSH

23

TELNET

25

SMTP

53

DNS110POP380

HTTP143

IMAP389

LDAP443

HTTPS

636

Secure LDAP445

ACTIVE DIRECTORY

1433

Microsoft SQL

3389

RDP

137-139NETBIOS

Telnet • SSH • DNS • HTTP • FTP• SNMP • DHCP

TCP 3-way Handshake
SYN - SYN/ACK - ACK

LAN Topologies
ConsBUS• Simple to setup• No redundancy• Single point of failure• Diﬃcult to troubleshootRING• Fault tolerance• No middle pointStart• Fault tolerance• Single point of failureMesh• Fault tolerance• Redundant• Expensive to setup

Types of Digital Subscriber Lines (DSL)
Asymmetric Digital
Subscriber Line(ADSL)• Download speed higher than upload• Maximum 5500 meters distance via telephone lines.
• Maximum download 8Mbps, upload 800Kbps.

Rate Adaptive DSL(RADSL)• Upload speed adjust based on quality of the transmission line
• Maximum 7Mbps download, 1Mbps upload over 5500 meters.

Symmetric Digital
Subscriber Line(SDSL)• Same rate for upstream and downstream transmission rates.
• Distance 6700 meters via copper telephone cables• Maximum 2.3Mbps download, 2.3Mbps upload.
• Higher speeds than standard ADSL
• Maximum 52Mbps download, 16 Mbps upload up to 1200
MetersVery-high-bit-rate DSL(VDSL)High-bit-rate DSL(HDSL)LAN Packet Transmission

Hardware Devices

Proxies

VPNs and VPN
concentrators

Use to create VPN oraggregate VPN
connections provide
using different internetlinks
Capture or monitor
network traﬃc inreal-time ad oﬄine

Uniﬁed threat
management

New generation
vulnerability scanningapplication

VLANs

Create collision
domains. Routersseparate broadcast
domains

IDS/IPS

Intrusion detection andprevention.

Running ﬁber over Ethernet network.

Multiprotocol
LabelSwitching(MPLS)

Transfer data based on the short path labels
instead of the network IP addresses. No need ofroute table lookups.

Internet Small Standard for connecting data storage sites such
Computeras storage area networks or storage arrays.
Interface (ISCI) Location independent.
Encryption and different protocols at different
levels. Disadvantages are hiding coveted channels
and weak encryptions.

Voice overAllows voice signals to be transferred over theInternet
public Internet connection.
Protocol (VoIP)
Packet switching technology with higher
Asynchronousbandwidth. Uses 53-byte ﬁxed size cells. On
transfer modedemand bandwidth allocation. Use ﬁber optics.
(ATM)
Popular among ISPs
X25

PTP connection between Data terminal equipment(DTE) and data circuit-terminating equipment(DCE)

Frame Relay

Use with ISDN interfaces. Faster and use multiple
PVCs, provides CIR. Higher performance. Need tohave DTE/DCE at each connection point. Performerror correction.

Synchronous
IBM proprietary protocol use with permanent
Data Link
dedicated leased lines.
Control (SDLC)
High-level Data
Use DTE/DCE communications. ExtendedLink Control
protocol for SDLC.
(HDLC)
Domain namesystem (DNS)

Encapsulating Security Payload (ESP)

Encrypted IP packets and preserve integrity.
Shared security attributes between twonetwork entities.

Security Associations (SA)Transport Mode

Payload is protected.

Tunnel Mode

IP payload and IP header are protected.

Internet Key Exchange (IKE)

Exchange the encryption keys in AH or ESP.

Remote Authentication Dial-In User Service Password is encrypted but user
(RADIUS)authentication with cleartext.
SNMP v3

Encrypts the passwords.

Dynamic Ports49152 - 65535

Remote Access ServicesTelnet

Username /Password authentication. No encryption.

Remote login (rlogin)

No password protection.

SSH (Secure Shell)

Secure telnet

Terminal Access Controller
Access-Control System(TACACS)

User credentials are stored in a server known as a
TACACS server. User authentication requests arehandled by this server.

TACACS+

More advanced version of TACACS. Use two factor
authentication.

Remote Authentication Dial-In
User Service (RADIUS)

Client/server protocol use to enable AAA services forremote access servers.

Virtual private network (VPN)

Secure and encrypted communication channel
between two networks or between a user and anetwork. Use NAT for IP address conversion. Secured
with strong encryptions such as L2TP or IPSEC.

VPN encryption options
Point-to-Point Tunneling Protocol(PPTP)• PPP for authentication• No support for EAP• Dial in• Connection setup uses plaintext• Data link layer• Single connection per session

Layer 2 Tunneling Protocol (L2TP)• Same as PPTP except more secure• Commonly uses IPsec to secure L2TP packets

Internet Protocol Security (IPsec)• Network layer• Multiple connection per session• Encryption and authentication• Conﬁdentiality and integrity

Communication Hardware Devices
Concentrator

Divides connected devices into one input signal for transmission over
one output via network.

Multiplexer

Combines multiple signals into one signal for transmission.

Hubs

Retransmit signal received from one port to all ports.

Repeater

Ampliﬁes signal strength.

WAN Transmission Types
Circuit-switchednetworks• Dedicated permanent circuits or communication paths required.
• Stable speed. Delay sensitive.
• Mostly used by ISPs for telephony.

Packet-switchednetworks• Fixed size packets are sending between nodes and sharebandwidth.
• Delay sensitive.
• Use virtual circuits therefore less expensive.

Wireless Networking
Wireless personal area network (WPAN) standards
IEEE 802.3

Ethernet

ATM155Mbps

IEEE 802.11

Wi-Fi

ISDN

64 or 128 Kbps REPLACED BY xDSLIEEE 802.20

LTE

1024-49151

BRI B-channel

64 Kbps

BRI D-channel

16 Kbps

PRI B & D channels

64 KbpsTime or condition locked virus
Code and/or executables that act as legitimate software, but are not legitimate and aremalicious
Unauthorized code execution entry
A series of small attacks and network intrusions that culminate in a cumulative large
scale attack
Alteration of raw data before processing
Unauthorized monitoring of transmitted data
Monitor and capture of authentication sessions with the purpose of ﬁnding and hijacking
credentials

DDoS (Distributed Denial of Overloading a server with requests for data packets well beyond its processing capacityService)
resulting in failure of service
SYN Flood

Provide authentication and integrity, noconﬁdentiality.

Authentication Header (AH)

45Mbps via telephone line

Self propagating viruses

Session Hijacking

Use with IPsec for encryption.

T3

Worms

SniﬃngLayer 2 Tunneling Protocol (L2TP)

Bluetooth

Malicious software, code and executables

Data diddling

Encrypt username/password andre-authenticate periodically. Use in PPP.

IEEE 802.15

Virus

TrojanChallenge-Handshake Authentication
Protocol (CHAP)

1.544Mbps via telephone line

Network Attacks
Logic Bomb

Point to Point Tunneling Protocol (PPTP)

Authentication methods:• PAP=Clear text, unencrypted• CHAP=unencrypted, encrypted• MS-CHAP=encrypted, encrypted

T1

Reserved

Bastion Host - Dual-Homed - Three-Legged Screened Subnet - Proxy Server - PBX - Honey
Pot - IDS/IPS

Port Ranges

Map domain names /host names to IP Address
and vice versa.

Leased Lines

DMZ
Secure network between(Demilitarized external internet facing andzone)
internal networks.

Salami, salami slicing

Sender sends only if polling system is free for thedestination.

Decoupling the network control and theforwarding functions.
Features -Agility, Central management,
Programmatic conﬁguration, Vendor neutrality.

Fibre Channelover Ethernet(FCoE)

Firewall and Perimeter
Security

Source packet send to all the destinations.

PollingSoftwaredeﬁnednetworking(SDN)

Multilayer
Protocols

Hide internal public IP
address from external
public internet/Connection caching andﬁltering.

Protocol analyzers

Networking Methods & Standards

Converged
Transfer voice, data, video, images, over single
protocols fornetwork.
media transfer

Layer 1 device forward
frames via all ports

HUB

BroadcastUpon detecting a busy transmission, pauses and thenre-transmits delayed transmission at random interval tominimise two nodes re-sending at same time.

A private internal network

PhysicalSingle source send to multiple destinations

CSMA with Collision
Avoidance (CSMA/CA)

Intranet

Signal Jamming Wiretapping

MulticastTerminates transmission on collision detection. Used byEthernet.

Interconnect LANs over large geographic areasuch as between countries or regions.

Data link

Backdoor

CSMA with Collision
Detection (CSMA/CD)

Wide Area
network (WAN)

Collision - DOS /DDOS- Eavesdropping

Single source send to single destination

One workstations retransmits frames until destination
workstation receives.

Metropolitan network span within cities

NetworkUnicast

Carrier-sense Multiple
Access (CSMA)

Metropolitan
Area Network(MAN)

Public network

T1 speed for two copper cables for 3650 meters

Committed
Minimum guaranteed bandwidth provided by service provider.
Information Rate (CIR)

Multiple buildings connected over ﬁber orwirelessInternetLoad balancers

Convert data into readable
formatCampus Area
Network (CAN)

smurﬁng ﬂooding ICMP spooﬁng - DOS

Share network traﬃcload by distributing
traﬃc between twodevices

Application

Geographic Distance and are is limited to one
building. Usually connect using copper wire or
ﬁber optics

connects external authorized persons access tointranet

Frame forward in localnetwork.

TCP • UDPLocal Area
Network (LAN)

Extranet

SwitchFlow control and integrity

Network Types

SYN ﬂood - fraggle

Inbound/outbound data
entry points for networks

Transport

128 bit hexadecimalTransport

Gateways

IP • RARP • ARP • IGMP • ICMP

IPv6

Session hijack

Gateways

Internet

32 bit octets

SessionInterconnect networks inEthernet

Create small data chunks called
datagrams to be transferred via
network access layer

IPv4

Presentation

BridgeToken ring • Frame Relay • FDDI
• Ethernet • X.25

Subnet Masks• Class A: 255.0.0.0• Class B: 255.255.0.0• Class C: 255.255.255.0

Phishing - Worms Trojans

Interconnect networks

Data transfer done at this layer• Class A: 10.0.0.0 – 10.255.255.255• Class B: 172.16.0.0 – 172.31.255.255• Class C: 192.168.0.0 – 192.168.255.255

Application

Routers

Network accessPrivate IPv4
address space

Phishing - Worms Trojans

Gateways
JPEG - TIFF MID - HTML

Example Protocols• Class A: 0.0.0.0 – 127.255.255.255• Class B: 128.0.0.0 – 191.255.255.255• Class C: 192.0.0.0 – 223.255.255.255

Attackdigital to analog
conversion

ActionPublic IPv4
address space

Layer

ModemLayers

Pros

IP Addresses

Attacks in OSI layers

TCP/IP ModelTopology

CISSP Cheat Sheet Series

Common TCP Protocols

Combination of a DDoS attack and TCP 3-way handshake exploit that results in denial ofservice

Wi-FiStandard

Speed

Frequency (GHz)802.11a54 Mbps

5802.11b11 Mbps

2.4

802.11g

54 Mbps2.4

802.11n200+ Mbps

2.4 & 5802.11ac

1Gbps

5• 802.11 use CSMA/CA protocol as DSSS or FHSS
• 802.11b uses only DSSS

Wireless Security Protocols
Directly connects peer-to-peer mode clients without acentral access point.

Ad-hoc Mode
Infrastructure Mode

Clients connect centrally via access point.

WEP (Wired EquivalentPrivacy)

Conﬁdentiality, uses RC4 for encryption.

WPA (Wi-Fi ProtectedAccess)

Uses Temporal Key Integrity Protocol (TKIP) for dataencryption.

WPA2

Uses AES, key management.

WPA2-Enterprise Mode

Uses RADIUS

TKIP (Temporal Key Integrity
Uses RC4 stream cipher.
Protocol)EAP (ExtensibleAuthentication Protocol)

Utilizes PPP and wireless authentication. Compatible withother encryption technologies.

Sender can send only when token received indicating free tosend.

Smurf

Particular kind of DDoS attack using large numbers of Internet Control Message
Protocol (ICMP) packets

Broadcast Domain

Set of devices which receive broadcasts.

FraggleSmurf with UDP instead of TCP

PEAP (Protected Extensible Encapsulates EAP within an encrypted and authenticatedAuthentication Protocol) TLS tunnel.

Collision Domain

Set of devices which can create collisions during
simultaneous transfer of data.

LOKI

Uses the common ICMP tunnelling program to establish a covert channel on the network

Port Based Authentication 802.1x, use with EAP in switching environment

Layer 2 Switch

Creates VLANs

Layer 3 Switch

Interconnects VLANs

Token-passing

LAN / WAN MediaTwisted Pair

Pair of twisted copper wires. Used in ETHERNET. Cat5/5e/6. Cat5
speed up to 100Mbps over 100 meters. Cat5e/6 speed 1000Mbps.

Teardrop

A type of DDoS attack that exploits a bug in TCP/IP fragmentation reassembly bysending fragmented packets to exhaust channels

Zero-dayExploitation of a dormant or previously unknown software bug

Land Attack
Bluejacking, Bluesnarﬁng

Caused by sending a packet that has the same source and destination IP
Anonymously sending malicious messages or injecting code via bluetooth tounprotected devices within range

Unshielded Twisted
Pair (UTP)

Less immune to Electromagnetic Interference (EMI)

Shielded Twisted
Pair (STP)DNS Spooﬁng, DNS
Poisoning

The introduction of corrupt DNS data into a DNS servers cache, causing it to serve
corrupt IP results

Similar to UTP but includes a protective shield.

Session hijacking(Spooﬁng)

Change TCP structure of the packet to show the source as trusted to gain access totargeted systems.

Coaxial Cable

Thick conduit instead of two copper wires. 10BASE-T, 100BASE-T,
and 1000BASE-T.

Fiber OpticUses light as the media to transmit signals. Gigabit speed at longdistance. Less errors and signal loss. Immune to EMI. Multimodeand single mode. Single mode for outdoor long distance.

Frame Relay WAN

Over a public switched network. High Fault tolerance by relaying
fault segments to working.

Secure Network Design - Components
Network addresstranslation (NAT)

Hide internal public IP address from external internet

Port Address
Translation (PAT)

Allow sharing of public IP address for internal devices andapplications using a given single public IP address assigned by ISP

Stateful NAT

Keeps track of packets transfer between source and destinations

Static NAT

One to one private to public IP address assigned between two enddevices

Dynamic NAT

Pool of internal IP maps one or several public IP address

A TCP sequence prediction A successful attempt to predict a TCP number sequence resulting in an ability to/ number attack
compromise certain types of TCP communications

Email Security
LDAP (Lightweight Directory AccessProtocol)

Active directory based certiﬁcate management for email authentication.

SASL (Simple Authentication andSecurity Layer)

Secure LDAP authentication.

Orthogonal Frequency-Division Multiplexing

Firewall Generation Evolution
First GenerationFirewalls• Packet Filter Firewalls: Examines source/destination address,
protocol and ports of the incoming packets. And deny or permit
according to ACL. Network layer, stateless.

Second Generation • Application Level Firewall / Proxy Server: Masks the source
Firewalls
during packet transfer. Operating at Application layer, stateful.

Fourth Generation
Firewalls

Technique for checking authenticity of original message.

Fifth Generation
Firewalls• Kernel Proxy Firewall: Analyzes packets remotely using virtualnetwork

An open protocol to allow secure authorization using tokens instead ofpasswords.

Next-generation
Firewalls (NGFW)• Deep packet inspection (DPI) with IPS: Integrated with IPS/IDS

Used for signed and encrypted emails in single sign on (SSO)OAuth

OFDM (Orthogonal
Frequency-DivisionMultiplexing)

Parallel use of all the available frequencies leads to higher
throughput of rate compared to FHSS.

• Dynamic Packet Filtering Firewall: Dynamic ACL modiﬁcation• Packet Filtering Routers: Located in DMZ or boundary networks.
Includes packet-ﬁlter router and a bastion host. Packet ﬁltering andproxy• Dual-homed Host Firewall: Used in networks facing both internaland external• Screened-subnet Firewall: Creates a Demilitarized Zone (DMZ) network between trusted and untrusted

S/MIME Certiﬁcates

DKIM (Domainkeys Identiﬁed Mail)

DSSS (Direct Sequence
Spread Spectrum)• Stateful Inspection Firewall: Faster. State and context of thepackets are inspected.

Client side certiﬁcate to authenticate against a server.

PEM (Privacy-Enhanced Mail)

FHSS (Frequency Hopping Uses all available frequencies, but only a single frequencySpectrum System)
can be used at a time.

Third GenerationFirewallsClient SSL Certiﬁcates

MOSS (MIME Object Security Services)

Wireless Spread Spectrum

Uses the multipart/signed and multipart/encrypted framework to apply
digital signatures.
A sequence of RfCs (Request for Comments) for securing message
authenticity.