CCNA Security
Exam: 210-260 IINS
MARCH 26, 2018ZD1 Academics
Daniel Arapi
TABLE OF CONTENTSTABLE OF CONTENTS....................................................................................1
1 – SECURITY CONCEPTS...............................................................................3
CIA (Confidentiality, Integrity, Availability).......................................................................................................... 3Introduction............................................................................................................................................................3Confidentiality.........................................................................................................................................................3Integrity...................................................................................................................................................................3Availability...............................................................................................................................................................3
SIEM Technology................................................................................................................................................. 4SIEM........................................................................................................................................................................4
Asset Classification............................................................................................................................................. 5Asset........................................................................................................................................................................5
Risk Management............................................................................................................................................... 6
Risk Analysis....................................................................................................................................................... 7Quantitative Risk Analysis Formula.........................................................................................................................7
Security Controls................................................................................................................................................. 8Control Type............................................................................................................................................................8Types of Countermeasures......................................................................................................................................8
Attack Methods***............................................................................................................................................. 9
2 – SECURE ACCESS....................................................................................10
AAA.................................................................................................................................................................. 10ACS (Access Control Server)..................................................................................................................................10ACS Authentication...............................................................................................................................................10ACS Platform.........................................................................................................................................................10ISE (Identity Service Engineer)...............................................................................................................................10
RADIUS & TACACS+........................................................................................................................................... 11RADIUS VS. TACACS+.............................................................................................................................................11RADIUS Packets.....................................................................................................................................................11RADIUS Authentication Process............................................................................................................................11TACACS+ Packets...................................................................................................................................................11TACACS+ Authentication Process..........................................................................................................................11
Configuring TACACS+ ***.................................................................................................................................. 12Cisco Documentation............................................................................................................................................12Enable and Configure AAA Server.........................................................................................................................12AAA Authentication...............................................................................................................................................12Authenticate Logins to Privilege Mode.................................................................................................................12
1
Configure AAA Authorization................................................................................................................................13Verify/Troubleshoot AAA......................................................................................................................................13
2
1 – SECURITY CONCEPTSCIA (Confidentiality, Integrity, Availability)
Introduction The primary objective of security is to establish confidentiality, integrity and availability of data
o Data-at-Rest – data saved on a storage media, e.g. hard drive, server, cloudo Data-in-Motion – data being transmitted across the network
Confidentiality Ensures that data cannot be viewed by unauthorized users; Who is able to see the data? Ensured through access controls and encryption
o Access Controls – physical and logical controls put in place to restrict access to data
Integrity Ensures that data can’t be changed by unauthorized users; Who can make changes to the data? Verified with the use of hash algorithms
Availability Ensures that access to data is always available when needed Is the data available to end users and customers? Redundancy is needed to always maintain availability
CIAConcept ExplanationConfidentiality Ensures that data cannot be viewed by unauthorized usersIntegrity Ensures that data cannot be changed by unauthorized usersAvailability Ensures that data is always available when needed
3
SIEM Technology
SIEM (Security Information and Event Management systems) Collects and displays syslog info of all network devices Can filter logs, remove duplicates, and send triggered notifications to admins E.g. JASK
4
Asset Classification
Asset Anything of value to a company, that must be protected
o E.g. proprietary data, trade secrets, servers
Asset Security ClassificationsGovernmental Private Sector
Top SecretSecret
ConfidentialSBU – Sensitive but Unclassified
Unclassified
ConfidentialPrivate
SensitivePublic
Role ClassificationsTerm DescriptionOwner Group responsible for the data (usually senior management)Custodian Group responsible for implementing policies, as dictated by OwnerUser Those who access the data
Criteria for ClassificationValueAge
Replacement CostUseful Lifetime
5
Risk Management
Risk ManagementTerm DescriptionAsset Item of value of company, that needs must be protectedVulnerability An exploitable security flaw in the system/dataThreat A potential danger to an asset: intentional or not, hacking, or malfunctionThreat Actor Person performing malicious actions against an asset Exploit Taking advantage of a vulernabilityRisk The chances of a threat compromising an assetCountermeasure A security measure put in place to reduce a risk
6
Risk Analysis
Risk Analysis TypesQuantitative Calculation of annual monetary loss on an assetQualitative Probability of a risk and its impact
Quantitative Risk Analysis FormulaALE = SLE*ARO | SLE = AV*EF
Values Description
AV (Asset Value) Value of an asset
EF (Exposure Factor) Percentage of loss of asset if risk occurs
SLE (Single Loss Expectancy) Cost each time risk occurs
ARO (Annualized Rate of Occurrence) Frequency of risk occurrence per year
ALE (Annualized Loss Expectancy) Amount of loss in a single year
7
Security Controls
Control TypeType DescriptionAdministrative Policies, procedures, guidelines, standards, AUP, background checks, etc.Physical Doors, locks, redundancy, man traps, etc.Logical Passwords, firewalls, IPS, ACL, VPN, etc.
Types of CountermeasuresType DescriptionPreventative Before the attack
E.g. Proper hiring process prevents HR issuesDeterrent During the attack
E.g. Security guard scares robber awayDetective After the attack
E.g. IDS alerts admin after the attack
8
Network Security Zones
Security Zones Segmented parts of the network with specific security restrictions Trusted, Untrusted, and DMZ
Inside Zone Connects to the internal network
Outside Zone Connects to the outside public
DMZ (Demilitarized Zone) In between the inside and outside zones Includes services that need access to both e.g. web server, mail server, application server, etc
9
Attack Methods***
Vulnerability Classification Method Description
Reconnaissance Scanning devices on network for open ports, IP addresses, vulnerabilitiesSocial Engineering Manipulating people; e.g. phishing, pharming, shoulder surfing, etc.Privilege Escalation Obtaining greater level of access; e.g. global-exec access, root access, etc.
Back Doors Installed on system go gain access in the futureCode Execution Code put on device to compromise confidentiality, integrity, availability
Botnet Collection of infected computers, to which attacker has backdoor accessDoS Utilizes a device’s resources until it becomes unavailable
DDoS A DoS carried out by multiple sourcesReflected DDoS
Direct DDoS Covert Channel Misusing a communication channel;
e.g. tunneling malicious traffic through a legitimate communication Trust Exploitation
Brute Force
10
11
2 – SECURE ACCESSAAA
AAA Explanation- Authentication Determines who has access to a resource- Authorization Determines what a user is allowed to do- Accounting Keeps track of what a user has done and when
ACS (Access Control Server) Server that manages administrative access to network devices; e.g. switches, routers, firewalls Network devices turn to the ACS for authentication and authorization decisions ACS Protocols:
o RADIUSo TACACS+
ACS Authentication ACS authenticates users against a database containing user info such as username/password
o Local Database – saved locally on the ACSo Remote Database – queries an external database such as Active Directoryo Local/Remote – attempts external database first, if none found, then local database
ACS Platform Dedicated hardware device (from Cisco) with ACS software preinstalled Installed on a Windows Server Virtualized via virtual machine on VMware ESXi
ISE (Identity Service Engineer) May be used in conjunction with ACS, but does not replace it Validates that endpoint devices meet security policy requirements
o E.g. virus definition files, service pack files, etc.
12
RADIUS & TACACS+
RADIUS VS. TACACS+RADIUS TACACS
Open standard Cisco proprietaryUDP port 1645 for authenticationUDP port 1812 for authorization
TCP port 49
Combines authentication & authorization Each component of AAA is separateEncrypts only passwords Encrypts entire packet
Better at accounting Better at authorizationLimited support for some protocols Full multiprotocol support
RADIUS PacketsPacket DescriptionACCESS-REQUEST Contains username/password; sent from client to serverACCESS-ACCEPT Username/password is correct; sent from server to clientACCESS-REJECT Username/password is incorrect; sent from server to clientACCESS-CHALLANGE Additional authentication info; sent from server to client
RADIUS Authentication Process1. User attempts to access router2. Router requests username; client then enters username3. Router requests password; client the enters password4. Router sends ACCESS-REQUEST to RADIUS server5. Server responds with ACCESS-ACCEPT or ACCESS-REJECT
TACACS+ PacketsPacket DescriptionACCEPT Username/password is correctREJECT Username/password is incorrectERROR Error in communication, unrelated to authenticationCONTINUE Additional authentication info
TACACS+ Authentication Process1. User attempts to login to router2. Router requests username prompt from TACACS+ | Server provides username prompt3. Router prompts user to enter username | User enters username4. Router forwards username to TACACS+ server5. Router requests password prompt from TACACS+ | Server provides password prompt 6. Router prompts user to enter password | User enters password7. Router forwards password to server which responds with: ACCEPT, REJECT, ERROR, CONTINUE
13
Configuring TACACS+ ***
Cisco Documentation https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/
configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_0101.html#reference_7937862B2E894598BA48416EC5ACF362
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/ configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_0110.html
Enable and Configure AAA Server! Enable AAA, or else router will not accept AAA commandsaaa new-model
! Configure IP address to RADIUS/TACACS+ server + passwordradius-server host [ip_address] key [password]tacacs-server host [ip_address] key [password]
AAA Authentication! Create AAA method-list for logins:aaa authentication login [method_list_name] group [radius/tacacs+] [local] [method]
! Apply AAA method-list to Console Lineline console 0 login authentication [Name] exit
! Apply AAA method-list to VTY Lineline vty 0 15 login authentication [Name] exit
Authenticate Logins to Privilege Mode! Default AAA method applied to enableaaa authentication enable default group [radius/tacacs+] [local] [method]
14
Configure AAA Authorization! Default AAA method applied to enableaaa authentication exec [Name] group [radius/tacacs+] [local] [method]
! Apply AAA method-list to VTY Lineline vty 0 15 authorization exec [Name] exit
Verify/Troubleshoot AAAdebug tacacsdebug radiusdebug aaa authenticationdebug aaa authorization
! For testing purposes, attempts to authenticate with server using username provided:test aaa group [radius/tacacs+] [username] [password] legacy
15
16
Top Related