-: Network vulnerabilities.
So the next category we're gonna talk about
is network vulnerabilities.
And this can be things like missing firmware updates,
SSL and TLS issues, domain name server issues,
internal IP disclosure, and virtual private network issues.
We'll talk about each of these as we go through
all these subsections.
Missing firmware updates.
Network devices have operating systems
just like your hosts do.
Except their hosts rely on the firmware.
And so if that firmware needs patching or upgrades
and you haven't done it,
that's gonna be a missing firmware update.
It's very similar to missing patches as we've talked about
on servers and hosts, and you can see here on the screen,
it's just an example of updating that firmware,
which you'll do over SSH to the network device.
This would be your routers, your switches, your firewalls,
things of that nature.
The next one is SSL and TLS issues.
SSL is secure socket layer
and TLS is transport layer security.
And these are designed to send data over the internet
using a protocol like HTTPS,
which is secure hypertext transfer protocol.
When you go to Facebook, when you go to Bank of America,
when you go to Google, you're using the HTTPS connection.
Now, SSL and TLS are great things.
SSL is older than TLS, though.
And so it does have insecurities.
In fact, SSL version one, two, and three are all considered
outdated now and should not be used.
Instead, you should be using TLS version 1.2 or newer.
If you're using one of the older versions,
as you can see on the screen here, you're gonna get a flag
inside your scan report.
In this case, it was flagging because it detected SSL
version two or version three was being used.
If you remember back a couple years
we had the Heartbleed outbreak?
Well that was based on a flaw
in SSL version two and version three that was exploited.
And that's why we don't use SSL anymore,
because it is still vulnerable today.
Instead, you should be using TLS on all your servers.
Now the next one we're gonna talk about again has to do with
SSL and TLS, but instead of the protocol itself,
we're talking about the encryption mechanism inside of it,
which is the cipher.
The cipher is the encryption algorithm.
And if you can see here on the screen,
I've got three different issues
identified from this scan report.
All of them were medium, based on the SSL issues.
One is that it's using RC4, Rivest Cipher four,
which is an older encryption protocol
and should not be used anymore.
And again, the other two are weak cipher encryption suites,
medium strength cipher encryption suites,
and we need to upgrade to a newer cipher.
To do this, you will configure your server
to use the proper, newer version of the encryption,
and not be using RC4 anymore because
that is too easy to crack in this day and age.
The next one we're gonna talk about is certificate problems.
And this again goes back to SSL and TLS.
Why?
Because so much of our stuff
is done over the internet using those protocols,
so attackers have focused a lot of time on breaking them.
Certificates are gonna identify your servers
and exchange the encryption keys.
And so if you have invalid certificates,
or you have an incorrect certificate,
that can cause problems for you.
And so again here, I have two of them.
I have an SSL certificate with the wrong host name,
and then I have another one that is showing with
a weak hashing algorithm.
And if you have that from a web browser,
what you're gonna see is, "Your connection is not private."
This is from Google Chrome.
When I tried to go to diontraining.com, it's showing you
that that certificate authority is not valid because
that website is not up right now and we have not bought
an SSL or TLS certificate for that particular website yet.
But that gives you an example of what that would look like.
The next one is DNS issues, or domain name server issues.
Now DNS servers make our life easy because they convert
IP addresses into names and names into IP addresses.
Because as a person, it's easier for me to remember
jasondion.com than it is to remember 66.72.52.8,
or whatever IP address it is.
That's not really my IP address, I just made one up.
And so when we do a scan for DNS, we wanna make sure that
we are not allowing those DNS servers to become victims
of reconnaissance and other attacks.
And you can see some of those examples here on the screen
where there's vulnerabilities in the DNS server,
with that critical one there,
there's other vulnerabilities that could allow
remote code execution against the DNS server,
there's ones that can allow snooping of remote information,
and all sorts of things like that.
So again, that next category is DNS issues.
The next one we have here is our internal IP disclosure.
Now if you remember back to some of your earlier
certifications or IT training,
you might have heard of something called NAT,
network address translation.
And that's designed to hide our internal network
from the external world.
So IP addresses that start with 10's or
192.168 dot something dot something
are private IP addresses.
And we use those internally on our network.
But they should never go outside of our network
to the internet.
Well, with internal IP disclosure,
those network addresses are finding their way out,
usually leaked inside of header information
when a server isn't properly configured.
And so here's an example from Facebook servers that were not
configured properly and you can see their internal IP scope
of 192.168.1.103 was one of their servers.
Now, this comes from a screenshot that I got
from datarift's blog, and you'll see the reference there
on the screen, and they actually talk about
all the way through of how this worked
if you're really interested in the nitty gritty details.
But for the CSA+ exam and for our
basic analyst talking points here,
we just want to know the fact that internal IPs
being on the outside world are a bad thing,
and that is a vulnerability that will be identified
by things like Nessus and QualysGuard
and our other vulnerability scanners.
The last one we are going to talk about here are VPN issues.
Virtual private networks consist of application protocols
and some sort of tunneling algorithm, usually TLS nowadays.
In the old days it was SSL as well,
and this'll create and encrypted tunnel from point to point.
Configuration issues and missing firmware patches
can result in things that are going to affect our VPNs,
and again have more vulnerabilities,
they can be scanned again using specialized scanners,
or Nessus and QualysGuard
or other vulnerability scanning products.