Network Protocols for Security Professionals: Probe and identify network-based vulnerabilities and safeguard against network protocol breaches

Network Protocols for Security Professionals: Probe and identify network-based vulnerabilities and safeguard against network protocol breaches
1 Data Centers and the Enterprise Network Architecture and its Components
    Exploring networks and data flows
    The data center, core, and user networks
    Switching (L2) and routing (L3) topologies
        Switching (L2) and routing (L3)
        L2 and L3 architectures
        L2 and L3 architecture data flow
        L2 and L3 architecture data flow with redundancy
        L2 and L3 topologies with firewalls
        L2 and L3 topologies with overlays
    The network perimeter
    The data, control, and management planes
        The data plane
        The control plane
        The management plane
    SDN and NFV
        Software-defined networking (SDN)
        Network function virtualization (NFV)
    Cloud connectivity
    Type of attacks and where they are implemented
        Attacks on the internet
        Attacks from the internet targeting the organization network
        Attacks on firewalls
        Attacks on servers
        Attacks on local area networks (LANs)
        Attacks on network routers and routing protocols
        Attacks on wireless networks
    Summary
    Questions
    Answers
2 Network Protocol Structures and Operations
    Data network protocols and data structures
    Layer 2 protocols –STP, VLANs, and security methods
        The Ethernet protocols
        LAN switching
        VLANs and VLAN tagging
        Spanning tree protocols
    Layer 3 protocols – IP and ARP
    Routers and routing protocols
        Routing operations
        Routing protocols
    Layer 4 protocols – UDP, TCP, and QUIC
        UDP
        TCP
        QUIC
        Vulnerabilities in layer 4 protocols
    Encapsulation and tunneling
    Summary
    Questions
    Answers
3 Security Protocols and Their Implementation
    Security pillars – confidentiality, integrity, and availability
    Encryption basics and protocols
        Services provided by encryption
        Stream versus block ciphers
        Symmetric versus asymmetric encryption
    Public key infrastructure and certificate authorities
    Authentication basics and protocols
        Authentication types
        Username/password with IP address identification authentication
        Encrypted username/password authentication
        Extensible authentication protocol (EAP)
    Authorization and access protocols
    Hash functions and message digests
    IPSec and key management protocols
        Virtual Private Networks (VPNs)
        IPSec principles of operation
        IPSec tunnel establishment
        IPSec modes of operation
        IPSec authentication and encryption protocols
        IPSec authentication header (AH) protocol
        IPSec encapsulation security payload (ESP) protocol
    SSL/TLS and proxies
        Protocol basics
        The handshake protocol
    Network security components – RADIUS/TACACS+, FWs, IDS/IPSs, NAC, and WAFs
        Firewalls
        RADIUS, NAC, and other authentication features
        Web application firewalls (WAFs)
    Summary
    Questions
)4Using Network Security Tools, Scripts, and Code
    Commercial, open source, and Linux-based tools
        Open source tools
        Commercial tools
    Information gathering and packet analysis tools
        Basic network scanners
        Network analysis and management tools
        Protocol discovery tools
    Vulnerability analysis tools
        Nikto
        Legion
    Exploitation tools
        Metasploit Framework (MSF)
    Stress testing tools
        Windows tools
        Kali Linux tools
    Network forensics tools
        Wireshark and packet capture tools
    Summary
    Questions
    Answers
5 Finding Protocol Vulnerabilities
    Black box, white box, and gray box testing
    Black box and fuzzing
        Enterprise networks testing
        Provider networks testing
        Fuzzing phases
    Common vulnerabilities
        Layer 2-based vulnerabilities
        Layer 3-based vulnerabilities
        Layer 4-based vulnerabilities
        Layer 5-based vulnerabilities
        Layer 6-based vulnerabilities
        Layer 7-based vulnerabilities
    Fuzzing tools
        Basic fuzzing
        Breaking usernames and passwords (brute-force attacks)
        Fuzzing network protocols
    Crash analysis – what to do when we find a bug
    Summary
    Questions
    Answers
6 Finding Network-Based Attacks
    Planning a network-based attack
        Gathering information from the network
        Stealing information from the network
        Preventing users from using IT resources
    Active and passive attacks
        Active attacks
        Passive attacks
    Reconnaissance and information gathering
        Listening to network broadcasts
        Listening on a single device/port-mirror
    Network-based DoS/DDoS attacks and flooding
        Flooding through scanning attacks
        Random traffic generation flooding
        Generating and defending against flooding and DoS/DDoS attacks
    L2-based attacks
        MAC flooding
        STP, RSTP, and MST attacks
    L3- and ARP-based attacks
        ARP poisoning
        DHCP starvation
    Summary
    Questions
7 Finding Device-Based Attacks
    Network devices’ structure and components
        The functional structure of communications devices
        The physical structure of communications devices
    Attacks on the management plane and how to defend against them
        Brute-force attacks on console, Telnet, and SSH passwords
        Brute-force attacks against SNMP passwords (community strings)
        Brute-force attacks against HTTP/HTTPS passwords
        Attacks on other ports and services
        SYN-scan and attacks targeting the management plane processes’ availability
    Attacks on the control plane and how to defend against them
        Control plane-related actions that influence device resources
    Attacks on the data plane and how to defend against them
        Protection against heavy traffic through an interface
    Attacks on system resources
        Memory-based attacks, memory leaks, and buffer overflows
        CPU overload and vulnerabilities
    Summary
    Questions
    Answers
9 Using Behavior Analysis and Anomaly Detection
    Collection and monitoring methods
        SNMP
        NetFlow and IPFIX
        Wireshark and network analysis tools
    Establishing a baseline
        Small business/home network
        Medium-size enterprise network
    Typical suspicious patterns
        Scanning patterns
    Summary
    Questions
    Answers