Chapter 7: Delving into Network and Security Concepts

There are many network components and topologies (layouts) that we need to know about to maintain a secure environment. We are going to look at each of these in turn. We need to know how each device is configured and which device is the most appropriate to use in different scenarios.

In this chapter, we will look at the following topics:

• Installing and Configuring Network Components
• Remote Access Capabilities
• Secure Network Architecture Concepts
• Network Reconnaissance and Discovery
• Forensic Tools
• IP Addressing

Installing and Configuring Network Components

There are many different network components and we are going to look at each of these. For the Security+ exam, we need to know which device can be used in different scenarios, so let's first look at firewalls that prevent unauthorized access and then the other devices.

Firewall

A firewall prevents unauthorized access to the corporate network, and in the Security+ exam, we tend to use a back-to-back configuration, as shown here:

Figure 7.1 – Back-to-back firewall configuration

You can see that each of these firewalls is not letting traffic pass through them; this is because we need to open only the ports that we need. If the firewall on the right is traversed, then the firewall on the left will hopefully prevent access to the internal network, known as the Local Area Network (LAN). To enable applications to pass through the firewall, we must open the port number for each application. Each application...

Remote Access Capabilities

With the increased use of cloud technology and remote sales workforces, there has been an increase in employees who require remote access capabilities. At the time of writing this book, most companies are working from home using remote access due to the COVID-19 pandemic. Let's look at the different types of remote access technologies in this section.

There are times when people who are working remotely need to access the company's network to access resources. There are two main types of remote access: the old-fashioned remote access server, using a modem, and the more modern Virtual Private Network (VPN) solutions. Let's look at these in turn:

• Remote Access Server (RAS): A legacy server where dial-up networking is used, which is expensive as you need to pay the same cost as a telephone call. The server is located in the company network and the client has the software installed to allow communication. Each side has a modem that...

Secure Network Architecture Concepts

We are going to look at secure network architecture and we will begin by looking at network appliances, starting with software-defined networks.

Software-Defined Network

Traditional networks route packets via a hardware router and are decentralized. However, in today's networks, more and more people are using virtualization, including cloud providers. A Software-Defined Network (SDN) is where packets are routed through a controller rather than traditional routers, which improves performance.

Securing networks and protecting them is vital to protecting a company's assets. We use different zones and topologies, network separation and segmentation, and install firewalls to prevent unauthorized access to the network.

First of all, let's look at the different zones and topologies. There are three main zones: LAN, WAN, and screened subnet:

• Local Area Network (LAN): A secure network with very fast links and a web server...

Network Reconnaissance and Discovery

Command-line tools are used every day by security professionals for network discovery and reconnaissance. Therefore, for the Security+ exam, you must be familiar with them, and so I have provided a screenshot for many of them. We are going to see when we would use each of them in turn:

• Footprinting: This is the process of capturing your network traffic and mapping all of the network devices, protocols, and IP address ranges so that they have information that will help an attacker get an idea of how your network is laid out.
• Fingerprinting: This is looking at the network and gathering as much information as you can. It will identify hosts and their operating system, the patch level versions, and the vulnerabilities within a company that can be used as an attack vector. Nmap is a good tool to perform fingerprinting.
• Internet Control Message Protocol (ICMP): ICMP brings back the replies when you use command-line tools. Therefore, if...

Forensic Tools

A forensics team may need to use tools to copy data or check the hash values to prove to the judge that the data has not been tampered with during the investigation. When a criminal's laptop arrives at the police station, the first thing a forensics team will do is to take a system image from a computer or a forensic copy of a removal drive. Let's look at some of the tools to begin with by cloning a disk:

• How to Clone a Disk Using Third-Party Software: In a Windows 10 environment, it is possible to capture a system image using backup tools, but many IT security professionals prefer to use a third-party imaging product such as Acronis. Please read the following article at https://www.acronis.com/en-us/products/disk-director-home/. Another alternative is Clonezilla. Please read the article at https://clonezilla.org/
• How to Clone a Disk Using the 'dd' Command: When the forensics team is going to investigate an image on a desktop or laptop...

IP Addressing

Everyone using the TCP/IP protocol for connectivity and every device has a unique IP address. In this section, we are going to look at the differences between the two types of IP addresses: IP version 4 and IP version 6. First, let's look at the purpose of an Internet Protocol (IP) Schema.

IP Schema

When you have a large network, you will split it down into smaller segments called subnets so that you are not flooded with a vast amount of broadcast traffic. Broadcast traffic slows your network down. What would happen if you were not allowed to sell any cars that you had owned but you had to store them on the road outside of your house? There would be no space for parking and it might get that bad that it causes traffic jams. The same can be said for broadcast traffic. It will slow down your network. Let us look at the purpose of subnets and reserved IP Addresses.

Subnets: This is where you divide your network into smaller segments. Each segment would have...

Review Questions

Now, it's time to check your knowledge. Answer the questions, and then check your answers, which can be found in the Solutions section at the end of the book:

1. What is the purpose of a web application firewall, and where is it normally placed?
2. What is Implicit Deny, and which two devices does it affect?
3. What is the firewall that does content filtering, URL filtering, and malware inspection?
4. Which network device connects two networks?
5. Which type of internal device connects users on the same network?
6. Which type of device hides the internal network from hackers on the internet?
7. What does an inline NIPS do?
8. Which type of IPS protects virtual machines from attack?
9. Which type of IPS is placed behind the firewall as an additional layer of security?
10. If you don't have a NIDS on your network, which device can passively monitor network traffic?
11. What is the difference between a signature and anomaly-based NIDS?
...