-: Network probes and attacks.
When we start looking at these network attacks and probes
we have to consider that much of our incident handling
is going to involve network probes and attacks.
Why?
Because the first step of a network attack for a hacker
is to find a way in.
They're going to be scanning your network
and probing your network to find a way in,
and then attacking to execute on that way in.
Network probes are usually part of the
reconnaissance efforts,
and they're usually pretty easy to detect,
because things like port scans are very pattern-based
and easy to detect
for intrusion detection systems
and our intrusion protection systems.
The first one I want to talk about is a Denial of Service.
This is a type of attack that's going to occur.
The detection of this is based on the attack
on a given network, system, or service
from a single source.
And this is gonna attempt to overwhelm your system
with things like the Ping of Death
or other Denial of Service techniques.
The prevention of this
is blocking the attacker
using your intrusion protection system
or your firewall,
because again,
this is coming from a single source.
So if you just block that source,
they can't get to you anymore,
it's not an issue.
Ones that it becomes more complicated
is when you get a DDoS attack,
or a Distributed Denial of Service attack.
The way this works is
when an attack is given on a given system
or network or service
from many different sources.
So you're being attacked not just from one place,
but from hundreds or thousands of places.
The attempt here is to overwhelm your system or network
just like it was before,
but it's really a lot harder to block,
because if I block one,
I still have 9,000 other people coming after me.
And that's the idea here with a DDoS attack.
So how are you gonna detect it
and how are you gonna prevent it?
You're gonna detect it because you're gonna be seeing
the traffic coming from known botnet IPs,
or you're gonna monitor your traffic and usage patterns
and see that there is this unusual spike in bandwidth
or unusual spike in network activity.
That's the detection part.
How do you overcome it or prevent it?
You can use things like Akamai.
Akamai is designed with a distributed network
of content providers across the globe
so that if one is being attacked,
the others can still carry the load.
This ensures that your networks can scale upwards,
and if you use scalable infrastructure like the Cloud
that has elasticity,
you can overcome a DDoS attack
unless they take down the entire Cloud,
which most people don't have the resources to do,
even with a DDoS.
The next one we're gonna talk about
is Detecting Rogue Devices.
How do you detect rogue devices on your network?
There's many different ways,
but let's talk about MAC Address Validation first.
The first thing you're gonna do
is you're gonna look across your logs
and you're gonna ensure that all devices
are known to you.
The way we identify devices
is based off of their MAC address,
because that is a "physical" label for the hardware.
Now, granted, MAC Addresses can be changed very easily,
but if they are changed,
they're not gonna match the vendor codes you're expecting.
So you wanna check your MAC Addresses
against the known vendor codes.
If you remember from your Network+ days
or your Security+ days,
that MAC Address is the first six hexadecimal digits
of that 12 digit number
is the vendor code.
If you're expecting to see
all Apple computers on your network,
and you start having things showing up as Dell,
then that might be an issue for you.
Because that MAC Address would give that away.
You wanna scan the network
to identify your devices,
and make sure you understand
what devices are on your network.
That will help you detect rogue devices.
You also want to conduct physical site inspections.
What this involves is literally
going into every single one of your network closets
and looking at the gear.
Is this the switch I'm expecting?
Is there any extra gear hanging off of your switch?
That's one way to detect it.
And then the last way
is to analyze traffic for irregular behavior,
because again,
if somebody's putting on a rogue device
to give additional access or additional systems,
that might be using more IP space than you're used to
in your DHTP scope.
That may be using more bandwidth
or other things like this.
All of these are hints and clues.
Nothing is gonna singly come out and say,
"This is a rogue device,"
but these are all different things you can do
to figure it out
and start analyzing it and putting it together.
When we start talking about Rogue Wired Devices,
this is where you plug something into your switch.
This usually occurs when an employee or an attacker
connects some sort of wired device onto your network.
The most common one that I see
is adding a switch or a hub to your network.
Some of this is done maliciously,
and some of this is just done
by employees who don't know any better.
For example, there might be an employee that decided,
"Hey, I need to be able to hook up my desktop
"and my laptop in the same office,
"but there's only one port in here."
So they'll just buy a hub,
plug it into the port,
and now they've got four ports.
They've put a rogue device onto your network
without realizing that they did it.
The way you can do this and stop this
is by using Network Access Control
and Port Security to prevent this from occurring.
When we talk about Network Access Control,
that's going to be something like using 802.1x,
which is gonna do a MAC Address validation,
it might do a scan to verify that
it's the type of hardware that it expects,
it might check to make sure your antivirus is up to date
and other things like that.
Port Security would be using things like
MAC Addresses that are known and white-listed
to be allowed to connect to the network.
The other way you'll see things done
is rogue wireless devices.
And the wireless side makes this a little bit harder,
because you're gonna have to find those devices
and because they're wireless.
The easiest way you can do this
is by mapping the area
and doing wireless surveys.
This is often done to create an Evil Twin
to trick users to connect to them
and steal their information.
You might have a rogue wireless device
put on by an attacker,
let's say you're at Starbucks,
and they put a new device there called StarbucksFreeWifi,
and they're trying to get the customers to connect to them
instead of connecting to your network.
If you're doing this in your office setting,
this might be an attacker
trying to get your employees to connect
to their wireless device
to give up their usernames and passwords.
It's something you have to be concerned with
and something you need to look for,
and again, some easy ways to detect those devices
is by searching by MAC Address,
doing wireless scans,
and doing wireless surveys as you map the area
to determine if there's extra access points
that you're not aware of.