CISSP (8 Domain)

Certified Information Systems

Security Professional

Instructor : Do Duc Huy

CISSP, CISA, CEH, CCSP, CCNP, RSA CSP
huydd79@gmail.com
Module 4

CISSP – COMMUNICATIONS
AND NETWORK SECURITY
Content

 OSI Reference Model

 Network Protocols

 Network Connectivity Devices

 Threats to Network Security

 Firewalls

 Wireless Communications

3
OSI REFERENCE MODEL

4
OSI MODEL

 7 layers A P S T N D P… “All People Seem to Need Data

Processing”
 Application
 Presentation

 Session

 Transport

 Network

 Data link
 LLC
 MAC
 Physical
5
OSI

6
ENCAPSULATION

7
OSI MODEL - LAYER 1 PHYSICAL

 Layer 1 Physical – simply put is concerned with physically sending

electric signals over a medium.
 Is concerned with
 specific cabling,
 voltages and

 Timings

 This level actually sends data as electrical signals that other

equipment using the same “physical” medium

8
OSI REFERENCE MODEL: LAYER 1
(PHYSICAL) TRANSMISSION
MEDIA/CABLING

9
OSI REFERENCE MODEL: LAYER 1
(PHYSICAL) TOPOLOGY

10
OSI REFERENCE MODEL: LAYER 1
(PHYSICAL) CONNECTIVITY DEVICES

11
OSI REFERENCE MODEL: LAYER 1
(PHYSICAL)
 Threats:
 Theft
 Unauthorized Access

 Vandalism

 Sniffing

 Interference

 Data Emanation

12
OSI MODEL – LAYER 2 DATA LINK

 LLC Logical Link Control - Error detection

 Manages connections between two peers.
 It provides error and flow control and control bit sequencing.
 MAC Media Access Control - Physical
 Addressing/Resolution and media access determination
 ARP (Address Resolution Protocol
 RARP (Reverse Address Resolution Protocol)
 Media Access Control
 CSMA/CD Carrier Sense Multiple Access with Collision Detection (IEEE standard)
802.3 Ethernet
 CSMA/CA Carrier Sense Multiple Access with Collision Avoidance(IEEE standard)
802.11 Wireless
 Token Passing

13
MEDIA ACCESS TECHNOLOGIES

 CSMA/CD
 Waits for clear, then starts
talking, detect collisions

14
MEDIA ACCESS TECHNOLOGIES

 CSMA/CA
 Signals intent to talk
 For wireless
communication

15
MEDIA ACCESS TECHNOLOGIES
 Token Passing
 24 bit control frame passed around the network environment with the purpose
of determining which system can transmit data.
 There is only one token and since a system can’t communicate without the
token, there are no collisions.

16
MEDIA ACCESS TECHNOLOGIES

 Collision Domain – where collisions can occur.

17
ETHERNET

 Most common form of LAN networking, has the following

characteristics
 Shares media
 Broadcast and collision domains

 CSMA/CD

 Supports full duplex with a switch

 Defined by IEEE 802.3

18
ARP
 IP to MAC

 Arp table
 arp -a

19
RARP

 MAC to IP

20
SWITCH

 Layer 2
 Uses MAC addresses to direct traffic

 Isolates traffic into collision domains

 Does NOT isolate broadcasts natively

21
OSI MODEL LAYER 3 NETWORK

 Broadcast domain is group of networked systems in which all other members

receive a broadcast signal when one of the members of the group transmits it.
 Routers Isolate traffic into broadcast domains and use IP addressing to direct
traffic

22
VLANS

 Routers are expensive

 To get broadcast isolation
on a switch, a VLAN is
necessary
 Not all switches support
VLANs
 A Layer 2 switch (even with
a VLAN) doesn’t truly
understand Layer 3 IP
Addressing
 A Layer 3 switch is
necessary for inter-Vlan
Communication

23
LAYER 3 PROTOCOLS

 IP
 ICMP – IP “helpers” (like ping)

 IGMP – Internet Group Message Protocol

 Routing (RIP, IGRP, OSPF)

 IPSEC

 IKE

 ISAKMP
 All Protocols that start with the letter “I” except IMAP (which is a layer 7
mail protocol)

24
IPv4

 Internet Protocol version 4, commonly called “IP”

 Fundamental protocol of the Internet

 Designed in the 1970s to support packet-switched networking

 Used for the ARPAnet, which later became the Internet

 IP is a simple protocol, designed to carry data across networks

25
IPv4 Address
 The address is expressed as four octets separated by a dot (.)
 Eg: 216.182.132.237
 Subnet mask using /
 Class full address: A, B, C, D, E
 A: /8
 B: /16
 C: /24

 Classless Inter-Domain Routing (CIDR)

26
RFC 1918

 10.x.x.x
 172.16.x.x-172.31.x.x

 192.168.x.x

27
ICMP

 ICMP – “IP helper”

 Protocol behind echoing utilities like PING and Traceroute

 Frequently exploited
 LOKI: sending data in ICMP headers — covert Channel
 Ping of Death: violates the MTU (maximum transmission unit) size
 Ping Floods: Lots of ping traffic
 SMURF: Uses spoofed source address (Target) and directed broadcasts
to launch a DDos

28
ROUTING PROTOCOL

 Specifies how routers communicate with each other

 Distributing information that enables them to select routes between any two
nodes on a computer network
 Two broad categories
 Distance vector: RIP, IGRP, BGP
 Link state: OSPF
 Gateway Types
 Interior gateway protocols: OSPF, RIP
 Exterior gateway protocols: BGP
 Routing table

29
RIP

 RFC 1058 (RIPv1), RFC 1723 (RIPv2)

 Distance vector algorithms

 Selects the path with the least number of hops

30
OSPF
 RFC 1131 (OSPFv1), RFC 1583 (OSPFv2)
 Link-state routing algorithms
 Calculating the shortest path based on a topography of the Internet constructed by each
node.
 Router sends that portion of the routing table that describes the state of its own links

31
IGMP
 Used to manage multicasting groups, which are a set of hosts anywhere on a
network that are interested in a particular multicast.
 Multicast agents administer multicast groups, and hosts send IGMP messages
to local agents to join and leave groups
 Uses for multicast services such as video on demand

32
IPv6
 Successor to IPv4
 A much larger address field:
 IPv6 addresses are 128 bits, (IPv4?)
 Improved security
 A more concise IP packet header (less time to process)
 Improved quality of service

33
OSI MODEL LAYER 4 TRANSPORT

 OSI Layer 4 Transport –Provides end-to-end data transport services and

establishes a logical connection between 2 computers systems”
 The “pony express”
 Protocols used at layer 4
 ATP – AppleTalk Transaction Protocol
 DCCP – Datagram Congestion Control Protocol
 FCP – Fiber Channel Protocol
 RDP – Reliable Datagram Protocol
 SCTP – Stream Control Transmission Protocol
 SPX – Sequenced Packet Exchange
 SST – Structured Stream Transport
 TCP – Transmission Control Protocol
 UDP – User Datagram Protocol
 UDP Lite – User Datagram Protocol Lite
 μTP – Micro Transport Protocol
34
TCP (TRANSMISSION CONTROL
PROTOCOL)
 Connection oriented “guaranteed” delivery: Has a guaranteed delivery based on the
handshake process
 Advantages
 Easier to program with
 Truly implements a session
 Adds security
 Disadvantages
 More overhead / slower
 SYN Floods

35
TCP SYNC FLOODS

36
UDP (USER DATAGRAM PROTOCOL)

 Connectionless
 Unreliable

 No handshaking

 Desirable when “real time” transfer

is essential
 Media Streaming, Gaming, live time
chat, etc..
 FTP uses TCP

 TFTP uses UDP

37
TCP/UDP PORTS AND SOCKET

38
TCP vs UDP

39
OSI MODEL LAYER 5 SESSION
OSI Layer 5 (Session) – responsible for establishing a connection between two
APPLICATIONS! (either on the same computer or two different computers)
 Create connection

 Transfer data

 Release connection

 Three modes:

 Full Duplex – Both hosts can exchange information simultaneously,

independent of each other.
 Half Duplex – Hosts can exchange information but only one host at a time.

 Simplex – Only one host can send information to its peer. Information
travels in one direction only.

40
LAYER 5 PROTOCOLS
 ADSP – AppleTalk Data Stream Protocol
 ASP – AppleTalk Session Protocol
 H.245 – Call Control Protocol for Multimedia Communication
 iSNS – Internet Storage Name Service
 PAP – Password Authentication Protocol
 PPTP – Point-to-Point Tunneling Protocol
 RPC – Remote Procedure Call Protocol
 RTCP – Real-time Transport Control Protocol
 SMPP – Short Message Peer-to-Peer
 SCP – Session Control Protocol
 SOCKS – the SOCKS Internet protocol, see Internet socket
 ZIP – Zone Information Protocol

41
OSI MODEL LAYER 6 PRESENTATION

OSI Layer 6 –present the data in a format that all computers can
understand
This is the only layer of OSI that does NOT have any protocol.

 Concerned with encryption, compression and formatting

 Making sure data is presented in a universal format

 File level encryption

 Removing redundancy from files (compression)

42
OSI MODEL LAYER 7 –APPLICATION

This defines a protocol (way of sending data) that two different

programs or applications understand.

 HTTP, HTTPS, FTP, TFTP, SMTP, SNMP, etc...

 Application Proxies

 Non-Repudiation

 Certificates

 Integration with Directory Services

 Time awareness.

43
TCP/IP MODEL

44
OSI VS. TCP/IP MODEL

45
TCP/IP PROTOCOL SUITE OVERVIEW

46
OSI/TCP…WHAT YOU NEED TO KNOW

47
THREATS TO NETWORK SECURITY

48
COMMON ATTACKS
 Virus: Virus A piece of malicious code that can take many forms and serve
many purposes. Needs a host in which to live, and an action by the user to
spread.
 Worm: Similar to a virus, but does not need a host and is self replicating
 Logic Bomb: A type of malicious code that lays dormant until a logical
event occurs
 Trojan Horse: One program (usually some type of malicious code)
masquerades as another. Common means of distributing Back Door
Programs
 Back Door Programs: A Program that allows access (often administrative
access) to a system that bypasses normal security controls. Examples are
NetBus, Back Orifice, SubSeven

49
COMMON ATTACKS (CONT)
 Salami: Many small attacks add up to equal a large attack
 Data Diddling: Altering/Manipulating data, usually before entry
 Sniffing: Capturing and Viewing packets through the use of a protocol
analyzer. Best defense: Encryption
 Session Hijacking: Where an attacker steps in between two hosts and
either monitors the exchange, or often disconnects one. Session hijacks
are types of Man in the Middle attacks. Encryption prevents sniffing and
mutual authentication would prevent a session hijack
 War dialing: An attack on a RAS (Remote Access Server) where the
attacker tries to find the phone number that accepts incoming calls. RAS
should be set to use caller ID (can be spoofed), callback (best), and
configured so that modem does not answer until after 4 calls.

50
COMMON ATTACKS (CONT)

 Dos Denial of Service: The purpose of these attacks is to overwhelm

a system and disrupt its availability
 DDoS Distributed Denial of Service: Characterized by the use of
Control Machines (Handlers) and Zombies (Bots) An attacker uploads
software to the control machines, which in turn commandeer
unsuspecting machines to perform an attack on the victim. The idea is
that if one machine initiating a denial of service attack, then having
many machines perform the attack is better.
 Ping of Death: Sending a Ping Packet that violates the Maximum
Transmission Unit (MTU) size—a very large ping packet.
 Ping Flooding: Overwhelming a system with a multitude of pings.

51
COMMON ATTACKS (CONT)
 Tear Drop: Sending Malformed packets which the Operating System does not know how
to reassemble. Layer 3 attack
 Buffer Overflow: Attacks that overwhelm a specific type of memory on a system—the
buffers. Is best avoided with input validation
 Bonk : Similar to the Teardrop attack. Manipulates how a PC reassembles a packet and
allows it to accept a packet much too large.
 Land Attack: Creates a “circular reference” on a machine. Sends a packet where source
and destination are the same.
 Syn Flood: Type of attack that exploits the three way handshake of TCP. Layer 4 attack.
Stateful firewall is needed to prevent
 Smurf: Uses an ICMP directed broadcast. Layer 3 attack. Block distributed broadcasts
on routers
 Fraggle: Similar to Smurf, but uses UDP instead of ICMP. Layer 4 attack. Block
distributed broadcasts on routers
52
FIREWALLS, PROXIES, AND NAT

53
FIREWALLS AND THE OSI

 Firewalls: Allow/Block traffic

 Rules to Allow or Deny Traffic. Can be HW or SW

 Layer 3: Static Packet Filters: Base decisions on Source/Destination

IP Address and Port
 Layer 5 Stateful inspection. Knowledge of who initiated the session.
Can block unsolicited replies. Protocol Anomaly firewalls—can block
traffic based on syntax being different than the RFC would specify
 Layer 7: Application Proxies/Kernel Proxies: Make decisions on
Content, Active Directory Integration, Certificates, Time

54
FIREWALLS

55
FIREWALLS

 Enforce network policy.

 Usually firewalls are put on the perimeter of a network and allow or
deny traffic based on company or network policy.
 MUST have IP forwarding turned off
 Firewalls are often used to create a DMZ.
 Generally are dual/multi homed
 Types of firewalls
 Packet filtering
 State full
 Proxy
 Dynamic packet filtering

56
PACKET FILTER

 Uses Access control lists (ACLs), which are rules that a firewall
applies to each packet it receives.
 Not state full, just looks at the network and transport layer packets
(IP addresses, ports, and “flags”)
 Do not look into the application, cannot block viruses etc...
 Generally do not support anything advanced or custom

57
PACKET FILTER

 Packet filters keep no state

 Each packet is evaluated own it’s own without regard to previous traffic
 Advantages
 Simple
 Transparent to users
 High speed
 Disadvantages
 Fragments: may got problem on filtering fragment traffic
 Lack of authentication
 Rule based access control
 Packet filters are still used on the edge of the network before a
statefull firewall for performance reasons.
58
STATEFULL FIREWALL

 Router keeps track of a connections in a table.

 It knows which conversations are active, who is involved etc...
 It allows return traffic to come back where a packet filter would have to
have a specific rule to define returned traffic
 Disadvantage:
 More complex
 Can be a victim of DoS attack by trying to fill up all the entries in the
state tables/use up memory.
 If rebooted can disrupt conversation that had been occurring.

 Context dependent access control

59
DYNAMIC PACKET FILTERING

 Like a state full firewall but more advanced.

 Can actually rewrite rules dynamically.
 Some protocols such as FTP have complex communications that
require multiple ports and protocols for a specific application, packet
and statefull filter cannot handle these easily, however dynamic
packet filter can as they can create rules on the fly as needed.

60
PROXY FIREWALLS

 Two types of proxies

 Circuit level
 Application

 Both types of Proxies hide the internal hosts/addressing from the

outside world

61
CIRCUIT LEVEL PROXIES

62
APPLICATION PROXIES

 Like circuit layer proxies, but actually understand the

application/protocol they are proxying.
 This allows for additional security as they can inspect the data
for protocol violations or content.

63
APPLICATION PROXIES

 Advantages
 Application proxies understand the protocol, so they can add
extra security
 Can have advanced logging/auditing and access control features
 Ex. Restrict users to only allowed websites
 Ex. Inspect data for protocol violations
 Ex. Inspect data for malware (viri etc..)
 Disadvantages
 Extra processing requires extra CPU (slower)
 Proxies ONLY understand the protocols they were written to
understand. So you generally have a separate application proxy
for EACH protocol you want to proxy
64
APPLICATION PROXIES

 Examples:
 Internet Security and Acceleration Server (MS web proxy)
 SMTP proxies

 FTP proxies

65
SECURITY ZONES

It is common practice in network and physical security to group

different security levels into different areas or zones. Each zone is
either more or less trusted then the other zones. Interfaces between
zones have some type of access control to restrict movement between
zones (like biometric and guard stations) or firewalls.)
In Network security there is often a median zone between the Internet
and internal network called a DMZ.

66
DMZ

 A buffer zone between an unprotected network and a protected

network that allows for the monitoring and regulation of traffic
between the two.
 Internet accessible servers (bastion hosts) are placed in a DMZ
between the Internet and Internal network

67
DMZ

68
DMZ ARCHITECTURES

 Multi-homed Firewall
 Screened Subnet

69
MULTI HOMED FIREWALL

 Multi-homed firewalls may be used to setup a DMZ with a single

firewall. (see next slide)
 On any multi-homed machine, Ip forwarding (routing) should be
disabled.

70
MULTI HOMED FIREWALL

71
SCREENED SUBNET

 In a screen subnet, there is a separate firewall on both sides of the

DMZ.
 When using this model it is recommended that each firewall be a
different vendor/product.
 Diversity of defense

72
SCREENED SUBNET

73
NAT/PAT

 A proxy that works without special software and is transparent to the

end users.
 Remaps IP addresses, allowing you to use private addresses internally
and map them to public IP addresses
 NAT allows a one-to-one mapping of IP addresses

 PAT allows multiple private address to share one public address

74
NAT
 Computer 10.0.0.1 sends a packet to 175.56.28.3
 Router grabs packet, notices it is NOT addressed to it. Modifies the src address to one
from it’s pool (215.37.32.202), then sends the packet on it’s way to the destination*
 The end machine accepts the packet as it’s addressed to him.
 End machine creates response, src = itself (172.56.28.3) dest = 215.37.32.202
 Router grabs packet, notices the dest address, and looks up in it’s NAT table, rewrites
the dest to 10.0.0.1 and sends it on its way*
 Originating machine grabs response since it’s addressed to him, he processes it.

75
NAT / PAT

 Advantages
 Allows you to use private addresses Internally, you don’t need to get real
public IP addresses for each computer
 Protects the network by stopping external entities from starting
conversations to internal machines
 Hides internal network structure

 Transparent, doesn’t require special software

 Disadvantages
 Single Point of Failure / Performance Bottleneck
 Doesn’t protect from bad content

76
OVERALL FIREWALL ISSUES

 Potential bottleneck
 Can restrict valid access

 Often mis-configured

 Except for application proxies firewalls generally do not filter out

malware or improper content.
 Don’t protect against internal attacks!

77
OVERALL FIREWALL BEST
PRACTICES
 Block un-necessary ICMP packets types.
 (Be careful though, know your environment)
 Keep ACLS simple
 Use Implicit deny*
 Disallow source routed packets*
 Use least privilege*
 Block directed IP broadcasts
 Perform ingress and egress filtering*
 Block traffic leaving the network from a non-internal address (indicates the network is
possibly being used as zombie systems in a possible DDoS attack.
 Block all traffic entering the network from an internal address (indicates a potential
spoofing attack)
 Enable logging
 Drop fragments or re-assemble fragments

78
LAN/WAN TECHNOLOGY

79
LAN, WAN, MAN

 LAN –local area network

 High speed
 Small physical area

 WAN –wide area network

 Used to connect LANS
 Generally slow, using serial links

 MAN –metropolitan area network

 Connect sites together within a medium range area (like a city)
 PAN
 Personal (Bluetooth, Infrared, ad-hoc wifi)

80
CIRCUIT SWITCHING

81
CIRCUIT SWITCHING TECHNOLOGIES

 PSTN
 ISDN

 DSL

 T-carriers

82
DIAL UP (REMOTE ACCESS)
 Disadvantages
 Back door into networks (bypass firewall)
 Often forgotten about
 Slow
 Attacks*
 War dialing
 Defenses*
 Dial Back /
 Caller ID restrictions
 Use authentication
 Answer after 4 or more rings (why/war dialing)
 Use a different numbering convention for RAS

83
ISDN

 Uses same lines as phone lines, directly dial into company or ISP
 BRI
 2 B Channels (64Kbits x 2)
 1 D Channel (control channel) Out of Band

 PRI
 23 B Channels
 1 D Channel

 Not for personal use

84
ADSL

 MUCH faster than IDSN (6-30 times faster)

 Must live very close to the DSL equipment

 Symmetric and Asymmetric

 Always on (security concerns)

85
PACKET SWITCHING

86
PACKET SWITCHING TECHNOLOGIES

 X.25
 Frame Relay

 ATM

 VOIP

 MPLS

 Cable Modems

87
CABLE MODEM

 High speed access up to 50Mbps via cable TV lines.

 Shared bandwidth
 Always on (security concerns)

88
MPLS (MULTI PROTOCOL LABELED SWITCHING)

 MPLS is used to create cost effective, private Wide Area Networks

(WANs) faster and more secure than regular routed “public” IP networks
like the internet.
 More secure than the public internet, because a “virtual” private network
(end-to-end circuit)can be built just for your organization
 Since it’s a private network, we don’t have to configure and maintain
traditional encryption based Virtual Private Networking (VPN) equipment
anymore, and can also avoid the latency and delay inherent in this
technology.
 Provides QoS for VOIP and other high priority traffic
 Purely Layer 3 technology

89
MPLS

90
VOIP VOICE OVER IP

 Converts analog to digital through use of

Telephony adapter or smartphone
 Data is channeled though gateways
(often lacking in authentication
mechanisms leading to TOLL FRAUD)
 At the end of a VOIP connection the
smartphone or TA converts the signal
back to analog

91
VOIP SECURITY ISSUES

 Security
 Eavesdropping (greatest threat)—Enable S/RTP
 Toll Fraud

 Vishing

 SPIT (SPam over Internet Telephony)

 Performance Issues
 Latency
 Jittering

92
REMOTE ACCESS PROTOCOLS

93
DIAL-UP

 PPP Point to Point Protocol: Provides Layer 2 framing for dial-up.

Needs other protocols for security
 Encryption: MPPE (Microsoft Point-to-Point Encryption)
 Authentication:
 PAP (Password Authentication Protocol): Clear Text
 CHAP (Challenge Handshake Authentication Protocol) Client responds to a
challenge from the server. The only way the client can answer correctly is if
the correct password had been entered.
 EAP (Extensible Authentication Protocol) Extends capabilities beyond
passwords (smart cards, biometrics, token devices, etc..)

94
PAP

 Password Authentication Protocol

 The oldest authentication protocols.
 Authentication is initialized by client/user by sending packet with
credentials (username and password) at the beginning of the connection.
 Vulnerable even to the most simple attacks like Eavesdropping and man-
in-the-middle based attacks.

95
CHAP

 Challenge Handshake Authentication Protocol

 Initialized by the server/host and can be performed anytime during the session, even
repeatedly.
 Server sends a random string (usually 128B long).
 Client uses his password and the string received as parameters for MD5 hash
function and then sends the result together with username in plain text.
 Server uses the username to apply the same function and compares the calculated
and received hash.

96
EAP
 Extensible Authentication Protocol
 EAP peer Computer that is attempting to access a network, also known as an access client.
 EAP authenticator An access point or network access server (NAS) that is requiring EAP authentication prior to
granting access to a network.
 Authentication server A server computer that negotiates the use of a specific EAP method with an EAP peer,
validates the EAP peer's credentials, and authorizes access to the network. Typically, the authentication server is
a Remote Authentication Dial-In User Service (RADIUS) server.

97
TUNNELING

 A function of VPNs -Tunnel encapsulates one protocol within another

protocol to create a virtual network.
 Can encrypts original IP headers
 Can encrypts data

 Allows for routing non routable protocols and IP addresses

 Can provide remote/internal IP addresses

98
VPN PROTOCOLS

Different protocols
 PPTP
 L2TP

 IPSEC

99
PPTP

 Point to Point Tunneling Protocol

 Based on PPP (uses MPPE for encryption and PAP, CHAP or EAP
for authentication)
 Lead by Microsoft protocol for a tunneling VPN
 Only works across IP networks

 Remote user connects to ISP, gets an Internet Address

 Establishes VPN connection to work VPN server, get’s Internal IP

address.
 Sends private IP packets encrypted within other IP packets

100
PPTP

101
L2TP

 Layer 2 Tunneling Protocol

 Cisco designed L2F to break free of dependence on IP networks, but
kept it proprietary.
 L2TP was a combination of L2F and PPTP

 Designed to be implemented in software solutions

 THERE IS NO SECURITY with L2TP. It MUST use IPSec to secure

102
WIRELESS

10
WIRELESS COMPONENTS

 Access points are like wireless hubs, they create a infrastructure

WLAN
 If you use just wireless cards of computers to communicate together
that is called an ad-hoc* network.
 Wireless devices must use the same channel

 Devices are configured to use a specific SSID (often broadcasted)

104
802.11 FAMILY
 802.11a
 54Mbps
 5Ghz
 8 channels
 802.11b
 11Mbs
 2.4Ghz (same as other home devices)
 802.11g
 54Mbs
 2.4Ghz
 802.11i : Wireless with security. First standard to require WPAII
 802.11n
 100Mbs
 2.4Ghz or 5Ghz
 802.11ac: published in December 2013
 500Mbps (1Gbps for multistation)
 5Ghz

105
WIRELESS SECURITY PROBLEMS

 Unauthorized access
 Sniffing

 War driving

 Unauthorized access points (Man in the middle)

106
AIRSNARFING (WIRELESS MITM)

107
TRANSMISSION ENCRYPTION
 There are many different types of wireless encryption protocols
 WEP
 Shared authentication passwords
 Weak IV (24 bits)
 IV transmitted in clear text
 RC-4 (stream cipher)
 Easily crackable
 Only option for 802.11b

 WPA WEP Attack

 Stronger IV
 Introduced TKIP
 Still used RC-4
108
TRANSMISSION ENCRYPTION

 WPA2
 AES
 CCMP

 NOT backwards compatible

 WPA and WPA2 Enterprise

 Uses 802.1X authentication to have individual passwords for individual
users
 RADIUS

109
WPA2 KRACK
 Key Reinstallation Attacks – WPA2 issue

Normal KRACK

https://papers.mathyvanhoef.com/ccs2017.pdf
110
BLUETOOTH

Bluetooth is a Personal Area Network protocol designed to free

devices from physical wires.

 Bluetooth Modes
 Discovery Mode
 Automatic Pairing

111
BLUETOOTH ATTACKS

 Blue jacking
 Sending SPAM to nearby Bluetooth devices
 Blue Snarfing
 Copies information off of remote devices
 Blue bugging
 More serious
 Allows full use of phone

 Allows one to make calls

 Can eavesdrop on calls

112
BLUETOOTH COUNTERMEASURES

 Disable it if you’re not using it

 Disable auto-discovery

 Disable auto-pairing

113
WAP

 Wireless Application Protocol –a protocol developed mainly to allow

wireless devices (cell phones) access to the Internet.
 Requires a Gateway to translate WAP <-> HTML (see visual)
 Uses WTLS to encrypt data (modified version of TLS)

 Uses HMAC for message authentication

 WAP GAP* problem (see visual and explain)

 A lot of wireless devices don’t need WAP anymore.

114
Cloud Computing
 A new paradigm in computing that involves the provision and hosting of
services over the Internet, modeled after a pay-as-you-go approach.
 It allows organizations to extend their existing computing capabilities and
also easily scale up.
 As of now three variety of services are provided, namely, Software as a
Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a
Service (IaaS).
 There are also four different types of deployment approaches, namely,
Private Clouds, Public Clouds, Community Clouds, and Hybrid Clouds.
 Cloud computing can offer useful extensions to enterprise Architectures,
on demand without any additional capital investment.
 Many organizations are concerned with security in the cloud and are
hesitating going into the cloud.

115
MODULE REVIEW
TELECOMMUNICATIONS AND NETWORK SECURITY REVIEW

 OSI Reference Model

 Network Protocols

 Network Connectivity Devices

 Threats to Network Security

 Firewalls

 WAN Technology

 Wireless Communications

117
REMEMBER…

 Senior management is responsible for the physical safety of their

employee
 Focus on prevention, not correction

 Human life should always supersede other assets

 Physical security is the first line of defense in protecting a company’s

assets

118
MODULE SELF CHECK
Module self check

120