-: SNMP, SNMP is the Simple Network Management Protocol.
It's a TCP protocol that aids in the monitoring
of network-attached devices and computers.
You've learned about this earlier on
when we talked about ports and protocols
and you also learned about this back in Network+.
Just to give you a quick review from Network+,
I want to remind you that SNMP is incorporated
into network management and monitoring systems
and it's heavily used
in the concept of management and monitoring.
SNMP is broken down into three components.
There is the managed devices, the agent,
and the network management systems themselves.
When we talk about managed devices,
this is computers and other network-attached devices
that are monitored through the use of agents
by a network management system.
Agents are software that's loaded onto a managed device
and this allows us to redirect information
to the network management system
that's going to do the monitoring.
And the Network Management System or NMS
is the software that's run on one or more servers
that controls the monitoring of all of the network-attached
devices and computers across the network.
SNMP is the glue that makes all three of these
talk to each other using that SNMP protocol.
So what does this all look like inside the network?
Well, here in the screen, you can see a brief diagram.
We have on the left our Network Management Station
or our NMS which is part of our network management system.
This is going to act as our manager
and it's going to send and receive messages
to all of the managed devices across the network,
your routers, your switches, and your servers, right?
Now when it wants information,
it's going to send a get request
and then those devices will send information back
using a set request.
Now there's also something called a trap request
which is going to receive unsolicited information
from those management devices
where they just send information as needed
at periodic intervals.
Now this again is all review from Network+
and you don't really need to know it for the Security+ Exam
except to know the function of SNMP.
Now when we talk about SNMP from a security standpoint,
we need to think about the three different versions.
There's version one, version two, and version three.
Now version one and version two are considered insecure
because they use community strings to access a device
as you learned back in Network+.
These are default community strings
of public which are read-only
or private which allows read and write access to the devices
and they are considered a fairly big security risk.
For this reason, you should be using SNMP v3.
SNMP v3 is a version of SNMP
that provides integrity, authentication,
and encryption of the messages being sent over the network.
This means that the messages are going to be hashed
before they're transmitted over the network.
It's going to validate the source of the message
to give you authentication of that message
and it's going to use DES encryption
to provide confidentiality and privacy.
Now when we get to the encryption section next,
we're going to talk about the fact
that DES is not really that secure anymore,
but it is still better than version one
or version two of SNMP.
And so you want to be able to use this
'cause it gives you the best security
out of the three options you have.
So when you conduct all this network management using SNMP,
you have two options where the data can be sent.
You can send it over the network that you're using
which is known as in band communication
or you can send it out of band.
Now when you do in band,
that means you're going to send this management data
over the same network that's carrying
your corporate information and normal data.
This is cheaper, easier, but it is less secure.
Now to be more secure,
you should create an out-of-band network.
This is a secondary network where all the management occurs,
but you still have that primary in band network
where all of the data
that the user is going to get is going to occur.
Management should always be conducted
on an out-of-band network because it increases security
and takes that management function out of the place
where users can touch it or see it.