Chapter 14: Implementing Layer 2 and Wireless Security

Implementing network security practices and configurations should be like second nature to a network engineer. As a professional, it's important that you learn about various Layer 2 threats and how a threat actor can take advantage of vulnerabilities found within various Layer 2 network protocols. Our job is to make the organization's network safe and free from cyber attacks.

During the course of this chapter, you will learn about the need to use a defense-in-depth (DiD) approach to secure both your users and devices on a network. Furthermore, you will learn how to identify various Layer 2 threats and attacks that are used to compromise an organization. Lastly, you will gain the knowledge and hands-on experience to implement various Layer 2 security controls to prevent and mitigate such attacks.

In this chapter, we will cover the following topics:

• Types of Layer 2 attacks on a network
• Protecting against...

Technical requirements

To follow along with the exercises in this chapter, please ensure that you have met the following software requirements:

• Cisco Packet Tracer: https://www.netacad.com

The code files for this chapter are available at: https://github.com/PacktPublishing/Implementing-and-Administering-Cisco-Solutions/tree/master/Chapter%2014.

Check out the following video to see the Code in Action:https://bit.ly/3coKE2Q

Types of Layer 2 attacks on a network

Throughout your journey, you will be exposed to many exciting technologies and environments. One such area an IT professional needs to know is cybersecurity and network security. As a network engineer, you won't always be designing and implementing networking technologies, but will also be responsible for the security of the network and its users. Today, newly emerging threats are surfacing – and will continue to – as hackers are developing new strategies and tools to compromise their targets.

Nowadays, hackers don't just hack for fun. Some hackers create sophisticated malware such as ransomware to encrypt all your data on your computer and request you pay a ransom to release your assets (data). Currently, there's a huge shortage of cybersecurity professionals in the world to combat the growing number of cyber threats on the internet. As a network engineer, you also play an important part in helping organizations...

Protecting against Layer 2 threats

Quite often, many organizations think cyber threats and attacks originate from outside of their organization, such as the internet. However, some of these threats and attacks can occur from within. These threats can be in the form of an innocent employee connecting an unauthorized device to the network, such as a switch or even a wireless router, or a disgruntled employee who wants to take down the company's network infrastructure for personal reasons. Your responsibility as a network engineer is not only to design and build networks for connectivity but also to ensure the security of the network.

In this section, you will learn how to implement security controls on your switches to prevent various Layer 2 attacks such as those mentioned in the previous sections.

Port security

Sometimes, when implementing a newly configured switch on a production network, the network engineer may honestly forget to secure any unused interfaces/ports...

Wireless network security

Many organizations implement a wireless network to support the mobility of their users. Implementing a Wireless LAN (WLAN) offers convenience to users with mobile devices, thereby allowing them to roam around the building and work from anywhere. With a WLAN, it is open to anyone within the range of the wireless signal generated by the APs and the correct user credentials to access the corporate network. WLANs create an entire landscape of threats and attacks by threat actors and even disgruntled employees.

The following are some of the threats posed to a wireless network:

• A threat actor can intercept traffic on a wireless network. The threat actor does not need to be within the building, but rather within the range of the wireless signal. It's recommended that all wireless traffic should be encrypted to prevent any eavesdropping.
• An intruder may be present on the wireless network. This is someone who is not authorized to access the wireless...

Summary

During the course of this chapter, you have learned about the need to use a multi-layered approach known as Defense-in-Depth to improve the security posture of your network and organization. Furthermore, you have learned how threat actors can use various Layer 2 threats and attacks to compromise our enterprise network. Next, we covered how to implement Layer 2 security controls on your Cisco IOS switches to prevent and mitigate Layer 2 attacks and wireless security to secure your network.

I hope this chapter has been informative for you and will prove helpful in your journey toward learning how to implement and administer Cisco solutions and prepare for the CCNA 200-301 certification. In the next chapter, Network Automation and Programmability Techniques, you will learn how automation and programmability can improve efficiency in network deployment and management.

Questions

The following is a short list of review questions to help reinforce your learning and help you identify areas that require some improvement:

1. Which of the following is a type of malware that is designed to encrypt your data?

   A. Worm

   B. Ransomware

   C. Polymorphic

   D. Trojan

2. A security professional implements multiple security components to improve the security posture of the organization. What is the security professional trying to do?

   A. Install anti-malware on all devices.

   B. Install host-based firewalls on all end devices.

   C. Implement email security.

   D. Implement Defense in Depth.

3. A threat actor is attempting to force a switch to flood all its inbound traffic out of all other ports. What type of attack is the threat actor performing?

   A. IP spoofing

   B. CAM table overflow

   C. Man-in-the-middle

   D. ARP spoofing

4. Another attacker is attempting to gain unauthorized access to a VLAN. What type of attack is being performed by the attacker?

   A. An 802.1Q attack

   B. A DTP attack

   C...

Further reading

The following links are recommended for additional reading:

• Configuring port security: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html
• Configuring DHCP snooping: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html
• Configuring a DAI: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dynarp.html