Chapter 11: Exploring Network Security

Designing and implementing a network without security in mind is like leaving all of the windows and doors open at home when you go out. An unauthorized visitor can simply access your personal space and remove your valuables, simply because all points of entry are open. The same concepts should be applied to a network; security is one of the most important factors a network engineer should always remember when designing any network.

During the course of this chapter, we'll look at how to identify various threat actions and attacks, understand the need for network security on an enterprise network, and understand how to develop a security program to improve user awareness and training.

In this chapter, we will cover the following topics:

• Security concepts (threats, vulnerabilities, and exploits)
• Password management
• Vulnerability assessment tools
• Authentication, Authorization, and Accounting (AAA)
• Wireshark 101...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you meet the following hardware and software requirements:

• Cisco Packet Tracer: https://www.netacad.com
• Wireshark: https://www.wireshark.org
• Nessus Essentials: https://www.tenable.com/products/nessus/nessus-essentials

The code files for this chapter are available at https://github.com/PacktPublishing/Implementing-and-Administering-Cisco-Solutions/tree/master/Chapter%2011.

Check out the following video to see the Code in Action:https://bit.ly/361vb7B

Security concepts

As a network professional, our primary responsibility is to ensure all devices have end-to-end connectivity. However, with the rise of cyber-crime, organizations must ensure their assets are well protected from cybercriminals trying to compromise systems and networks.

When designing a security network, it's important to first identify all assets within the organization. An asset is simply anything that is valuable to an organization. Assets are usually broken down into the following categories:

• Tangible
• Intangible
• People

Tangible assets are items that are physically within the organization such as furniture, computers, servers, network devices, and components. These assets usually store data about the organization and sometimes contain system logs that are useful during an incident. Intangible assets are items that are non-physical—these include intellectual property, procedures, data, and anything digital that is worth value...

Authentication, Authorization, and Accounting

Implementing AAA within a network is very important to ensure authorized persons can access a system or network. The appropriate privileges or user rights are granted to the user, and each action performed by the user is accounted for. Let's imagine your organization has multiple network devices such as switches, routers, and firewalls at various remote branches and at headquarters locations. Your team of IT professionals is responsible for ensuring the IT infrastructure of the organization is well maintained and operating efficiently. Since each IT professional may be required to log in to various network devices, a user account containing the appropriate privileges is required for each user.

Creating individual user accounts for each user for each device is a tedious and redundant task. Imagine a user has to change their password; this means the password for the user account has to be manually changed on each individual device...

Elements of a security program

Often when designing a security network, we forget to train all users within the organization on cybersecurity awareness. Not all corporate users are able to identify threats and attacks or perhaps understand what procedures should be taken if their computer gets infected with a virus. Therefore, it's important to design a proper security program to train all users within the organization.

User awareness is a key factor of any security program. This element teaches a user about the importance of confidentiality to keep data safe and secure it from unauthorized persons. Users should be taught about potential threats and attacks and procedures on how to report a security incident within the organization.

Continual user training is important to make sure each user is made aware of any updates to the security training program and ensuring they are familiar with the security policies and procedures within the organization.

Physical access control...

Wireshark 101

Wireshark is one of the most popular network protocol analyzers and sniffers within the networking and cybersecurity industry. This tool allows a network engineer to dissect each message and determine whether it's a frame or packet as it passes through a network, hence allowing network engineers and cybersecurity professionals to perform various tasks such as packet analysis and network forensics.

Tip

To download Wireshark, please visit the URL: https://www.wireshark.org/.

Furthermore, Wireshark allows you to see all the details contained within a message, such as source and destination IP addresses, MAC addresses, and Transport layer information such as ports and protocols. Such information is very useful whether you're troubleshooting an issue on the network or looking for any abnormal behavior on network traffic.

The following is a brief list of how to's with Wireshark:

• To capture network packets between your computer and their...

Summary

In this chapter, you have learned about the importance of information security and the need to protect all assets within an organization. We have covered the various types of threats, vulnerabilities, and attacks. Furthermore, we've discussed the importance of implementing AAA within an organization to help manage user access on a corporate network.

I hope this chapter has been informative for you and is helpful in your journey toward learning how to implement and administrate Cisco solutions and prepare for the CCNA 200-301 certification. In the next chapter, Configuring Device Access Controls and VPNs, you will learn how to secure your network devices and learn about Virtual Private Networks (VPNs).

Questions

The following is a short list of review questions to help to reinforce your learning and identify which areas you might need to work on:

1. Which of the following is an example of an intangible asset?

   A. Computer

   B. Operation procedures

   C. Customer

   D. Employee

2. Ensuring a message is not altered during transmission between a source and destination is referred to as which of the following?

   A. Hashing

   B. Confidentiality

   C. Integrity

   D. Availability

3. Which of the following best describes a person who doesn't fully understand how to perform hacking techniques but follows the instructions given by real hackers?

   A. Hobbyist

   B. Disgruntled employee

   C. Insider threat

   D. Script kiddie

4. A hacker is attempting to trick people into clicking a malicious link with a text message. What type of attack is this?

   A. Smishing

   B. Vishing

   C. Phishing

   D. Spear phishing

5. An attacker decided to compromise a DNS server to redirect all users to a malicious domain in the hope the unsuspecting user...

Further reading

The following links are recommended for additional reading:

• Types of malware: https://www.cisco.com/c/en/us/products/security/advanced-malware-protection/what-is-malware.html
• Configuring AAA: https://www.cisco.com/c/en/us/td/docs/routers/connectedgrid/cgr1000/1_0/software/configuration/guide/security/security_Book/sec_aaa_cgr1000.html
• Wireshark user's guide: https://www.wireshark.org/docs/wsug_html/