-: Securing network media.
Network media is the cabling that makes up our network.
This can be copper, fiber optic, or coaxial.
And they're going to be used as a connectivity
method inside of our wired networks.
Now, in addition to all the cables, there's other parts
of the cabling plant we have to think about.
All those intermediate devices
like patch panels, punch-down blocks,
and network jacks all make up this cabling plant
that runs throughout our organization.
And each part of that can be a vulnerability for us.
The first vulnerability I want to discuss is EMI.
This stands for electromagnetic interference.
Electromagnetic interference is a disturbance
that can affect electrical circuits,
devices, and cables due to radiation
or electromagnetic conduction that occurs.
Now, EMI is something that happens normally
inside our businesses and inside our homes.
EMI is caused by all sorts of things, like televisions,
microwaves, cordless phones, baby monitors,
motors like inside your vacuum, and other devices.
Anything that is really a powered device,
even handheld drills, can cause electromagnetic interference.
Now, to minimize EMI, you need to install shielding
around the source, for instance,
your air conditioner lets off a lot of EMI.
You could put shielding around that.
Or you can shield the cable itself
by choosing shielded twisted-pair.
Now, STP cables, or shielded twisted-pair,
have foil around either each twisted-pair in the cable
or around the entire bundle of twisted-pairs
to prevent emanations out of the cable
or interference entering into the cable.
STP gives you double benefit, it keeps
things out, and it keeps things in.
This is good for security and helps
minimize this vulnerability.
Now, the next vulnerability we have
is called radio frequency interference, or RFI.
RFI is just another type of interference like EMI.
Like EMI, it's a disturbance that can affect
your electrical circuits, your devices, and your cables.
But instead of being caused by electrical
waves, it's caused by radio waves.
Most often from AM and FM transmission
towers or cellular phone towers.
Now, cell towers and radio towers near your office
can be a big source of RFI in your wireless networks.
And when you have a significant amount of RFI,
this can cause to network connectivity problems
for your wired networks, as well
as disturbing your wireless networks, too.
Now, this is something that you're going to have to address.
And a lot of it is going to be addressed
by shielding the building or getting stronger devices
that can overcome the radio frequency
interference that's occurring.
Another vulnerability we have is what's known as crosstalk.
Crosstalk occurs when a signal is transmitted
on one copper wire, and it creates
an undesired effect on another copper wire.
So, when we think about having two copper wires,
like inside of a twisted-pair cable,
if the shielding inside that protects
those wires comes off, then we can actually
have crossover from one wire to another.
And that causes interference because
of the data emanations and EMI.
Crosstalk is essentially that, but in very close proximity.
Now, this becomes very common with older
cable network types, things like Cat3 networks,
or even some early Cat5 networks.
Most of our Cat5E and Cat6A networks
aren't really subject to crosstalk nearly as much.
Another place I see crosstalk happen a lot
is if you have punch-down blocks
and you decide to use an older terminal,
like the old 66 blocks that were used for phone lines,
and tried to use that for networks.
Networks should always use a 110 block,
like you learned back in Network+ and A+ because it gives
more spacing and prevents crosstalk from occurring.
The next thing you want to talk about here is STP cables
because STP cables are really helpful to our networks.
They can prevent some of that RFI, they can prevent EMI.
And they can help with crosstalk.
If you use those individual shielded twisted-pair cables,
it's really going to help eliminate
crosstalk altogether for you.
Unfortunately, though, most organizations don't use STP.
They still use unshielded twisted-pair cabling.
The reason is it's a lot cheaper and easier to work with.
Because of this, you're going to see a lot
of organizations favor UTP cabling
as opposed to STP cabling.
Because, again, the cost is about 50% higher to use STP.
Now, data emanations is another issue we have to think about.
When we talked about EMI, we were talking about things
trying to get into our network and causing issues.
Well, data emanation is the opposite.
It comes from inside your cable,
and it starts generating a field around that cable,
that when you're transmitting information
over the network, could be picked up
by somebody who's trying to capture that.
This is things on your network trying to escape.
So, if somebody is nearby, they can actually capture
those data emanations, and they could reconstruct
that data that was traveling over your network.
This is kind of paranoid-level stuff here, right?
And you probably aren't going to deal with this much
in your organization, unless you're a contractor
for something like the military or the government
who holds really valuable information,
and they have these top secret military defensive plans,
that's when you have to start thinking
about data emanations as a real threat.
So, if you're like most people,
and you're working for a corporation,
though, you're probably not nearly
as worried about data emanations.
But something else the attackers can do
is tap into your communications doing
it locally using physical connections.
Now, what do I mean by this?
Well, if they can get physical access to your space,
and get into your network closet,
and touch your punch-down panel,
they could actually tap into it there
and get a copy of the network traffic.
For example, this was very common with phone networks.
If I was an attacker, I could get into your office building
and find your patch panel, I could use
a telephone technician's butt set like the one shown here,
and attach it to the patch panel,
and listen to all of the phone calls that were being made.
Now, if you're trying to tap into the network itself,
the easiest thing to do here is to find
an RJ45 port somewhere in the building.
Once you get into the building, and you've gotten
into one of those jacks, you can plug your laptop in.
And if they're not using MAC filtering,
you're already connected.
If they are using MAC filtering, you're going to have
to bypass that, but that's not too hard to do either.
Now, to prevent this, you want to use things
like Network Access Control, and some other things
like network segmentation and VLANs.
So, if an attacker does get onto your network,
they're stuck into one corner of it,
and they can't spread out across the whole thing.
Now, if you can't find an open jack
but you still want to collect things
completely passively, you can do this
by splitting the wires of a twisted-pair connection.
You can open up the cable in an area that nobody is seeing.
You can cut the wire and solder on additional wires
to each of the twisted-pair's internal cables.
This will give you a copy of the data and you can plug it
back in and give the network a copy of the data.
This lets you capture the data as it transmits
back and forth over the network
completely passively, and no one's going to see it.
But, again, you've got to get physical access to the network
and get close enough to be able to do this.
Now, I mentioned data emanations earlier,
but we really didn't talk about how you can capture them.
To capture them, you'll use a spectrum analyzer.
This is going to capture all of the radio frequencies
that are openly available in the area.
You can then dial it in for that particular network itself
and dump that amount of radio frequency
into a program that will convert it
back to the ones and zeroes of the network.
Load that into a packet analyzer like Wireshark,
and you now have data from the network.
To prevent data emanations from happening,
you should switch your networks to fiber optic cables
because they don't have any emanation at all.
Because fiber optic cables work with light
instead of electricity, there's no radiation
outside of the cable, and they're not affected
by EMI or radio frequency either.
Now, are fiber optic cables completely safe?
Well, no, of course not because attackers are smart people.
And they always come up with creative
ways of bypassing security.
In fact, they've created what's called
a fiber optic splitter, where they can attach the device
to a fiber port on one side, and get two copies
of every piece of communication, one that will go
into their machine, and one that will go into your network.
That way, you don't even know they're there.
And it's a completely passive way to tap the network.
So, how do we prevent all of these
type of issues from happening?
Well, you may have noticed that most
of these attacks are occurring by the person
physically touching the network to tap it.
To prevent this, you can install
a protected distribution system, or a PDS.
A PDS is a secured system of cable management to ensure
that the wired network remains free from eavesdropping,
tapping, data emanations, and other threats.
They are kind of expensive, though,
because they add locks to every network closet.
They enclose every cable distribution point.
And they run cables through a protected conduit
that runs throughout the ceiling.
Because of this expense, I've only really seen this used
in very large organizations that are really worried
about security, government buildings, or the military.
Most small businesses and most medium-sized businesses
aren't going to use a protected distribution system.
Now, I know we covered a lot in this lesson.
And the exam isn't going to focus on much
of the information we covered, so don't worry too much.
Now, I just wanted to expose you
to all these concepts to ensure that you've heard it
at least once during your studies.
The biggest questions you're going to see on the exam
from this lesson are going to be about EMI, RFI,
and the concept of wire tapping a network.
That said, in the real world, you do need to think
about these things from an attacker's point of view,
so you can determine what is a real threat
that you should put money against,
and what you can decide is an unlikely risk.
And you're going to just accept it the way it is,
and not spend money to mitigate it.