foreign [Music]
okay good evening everybody and welcome to this review session on network security part two
so I'm going to start with this question on network design um
there's the questions some answer choices and then a diagram that I'm going to leave visible
after we've gone through this and to uh have a little discussion and figure this one out Okay so
network security part two
your organization needs to allow customer web clients to only access your company's front-end
website while also allowing restricted access to the corporate land and DMZ to only authenticated
employees Network admins and sys admins respectively what are the three technologies that
need to be used for the three unlabeled network devices in the attached Network diagram all right
so I'm going to roll this a little bit so we're going to be labeling based on these choices the
blank areas in the diagram let me roll this up so we can get a good look at the diagram
and I believe you can see that this is pretty simple we have the public untrusted Network here
we have a device here at number three we have a firewall another device at number two
and something that's going to be located at this number one location we have a DMZ with
servers and the corporate land the private trusted Network and the idea here is we want to describe
what technologies exist at location number one number two and number three okay
all right
okay so our choices are here and you can see there are several um in fact there are six
without even or just taking a a minute to look these over okay
a little bit
okay
all right so hopefully everybody can see the choices and part of the diagram
and so we're looking for a technology that would be located first of all at location number one
and you can see here there's kind of a direct connection from the untrusted network
so of the six choices each one of those has a choice listed and separated by commas
these would be the three choices in each of the six answer choices
anybody want to take a stab at what is in location number one is it going to be a Bastion host
a jump post a VPN
VPN okay all right okay
VPN at number one okay great and [Music] looking at the diagram can anybody tell
me of the remaining two label devices that's number two here and number three which of those
would be the best in host number two or number three number three okay and why do you say that
um does the Bastion host not um have the direct correlate color correlation to the internet
well there's a direct connection to the untrusted network yes for the public network and it really
um does refer to um actually a military fortification of Bastion host and you know
it's specifically designed and configured to take what gets thrown out of it let's put it that way
so number three is a representation of the Bastion host and that leaves the jump host at number two
so and we did mention this in um the last session um I think at least once and so
the jump host is a single point of entry between in this case two segments the private or corporate
land as is noted there in the DMZ now between these two different segments of the network
and basically or often privileged resources on the network are kind of
hidden behind the jump post such that users cannot access the resources directly
okay from their workstations so you would need to connect to the jump post to get at these resources
and you know sometimes this is also known as a jump server you can see the terms interchanged
here so given this question answer Choice D would be correct at location one is where
the VPN would be the jump post is location two and the Bastion host is location three
all right
okay so there's a network design question for you and let's see um hi
okay so now we go back into the CTF here and we are going to have another question
on network design okay so let's put this one up
okay
now this question also uses a diagram here which
pretty sure is the same one we just looked at and it is okay
all right so it's this diagram again we have the public untrusted network
we have the corporate or private Network trusted Network and our DMZ
okay in the attached Enterprise Network diagram general internet traffic comes
into the DMC Network through the firewall while authenticated sysadmin access to DMZ systems
is gained through device three Let's uh bring that back here okay that's device three
the main web application running in the DMZ is a lamp stack mainly consisting of a headless Apache
web server a headless Tomcat application server and headless MySQL DB server database server
given these facts what ports should you allow through the firewall for customer use
and what admin ports will most likely be needed to connect to DMZ systems from device three okay so
we're going to take this just a little bit a little piece at a time here the
answer choices do start with the firewall and the ports and then in the second part
of each answer choice is device three and again we have some more port numbers
okay so the first thing we're being asked is what ports should you allow through the
firewall for customer use let's show the picture again okay all right and this is for customer use
okay so everybody take a moment look at this diagram
okay
so we have front-end web servers okay
and as you would expect these are going to be public facing servers
so of the answer choices shown
which of the four do you think identified ports that we would want to allow through the firewall
for customer use I know these are kind of jammed up together but Choice a is ports 22 80 and 443
Choice B is ports 80 and 443. Choice C is just Port 22 and choice D is Port 80 and 443.
and we're just dealing with the first question here about ports
that we should allow through the firewall for customer use okay and again I'm confused okay
can you ask a question or do you need to see the diagram again would that help
okay your response in the chat foreign
okay all right so we're dealing only with the first part which is what ports should you allow
through the firewall for customer use bring the diagram back our front-end servers okay
so what is Port 22
yeah yes that's correct so is that typical no customer access to the DMZ the answer is no
so that means as far as that first part the first question goes we can eliminate answer Choice C
you can also eliminate answer Choice a and that leaves ports 80 and 443 when answer choice is
B and D so 80 as hopefully everybody knows is HTTP that's the protocol n443 https okay
so looking now at the next question what admin ports will most likely be needed to connect to DMZ
systems from device three and then at this point we'd have to figure out what these ports are and
can we eliminate either a or D no or excuse me um a or c um we we already kind of looked
at these and said Port 22 was not an acceptable answer so actually those have been eliminated so
that is going to get us down to answer choices b or d and one of those two could be eliminated
okay is everybody understand why why I'm saying A and C are eliminated
yes okay good because in the first part the first question
we had already determined and said that Port 22 was not appropriate for use right
for customer use through DMZ so we eliminated ANC based on that first
choice and the first question that leaves B and D and now we're interested in admin ports
will most likely be needed to connect to the DMZ from device three here's the diagram again
okay all right so let's see what we have under oh we have D in the response okay all right so
if we look at the answer choices for B we see that at device three we have ports 25
80 443 and 33.89 and an answer Choice d we have Port 22 80. 443 and 3306.
so is there anything in these two choices that point either to b or d for any reason
uh I believe RDP is 33.89 yeah it is so I would say
that's another one of those Dangerous Ones and after a while you know you start to see the number
of port 3389 and you go oh remote desktop protocol though hmm yeah you probably don't want to um
to take advantage of that yeah so yeah by the process of elimination we get to answer Choice d
and 3306 is the default port for the classic my sequel okay um so knowing again something
about the port numbers and protocols associated with them really can help you narrow down the
answer to a question and that's why I wanted to present it to you this way because you can see
that based on the first question we were able to eliminate answer choices A and C pretty quickly
now that doesn't mean it's always going to be like this but you know the procedure can be
used even with five or possibly six answers um uh let's see other things that you should know
uh lamp stack so lamb is an acronym big surprise there huh what does this stand for
then of course there's going to be variations on it but does anybody know
okay so Linux Apache my sequel and PHP as in the programming language okay all right
let's move on to the next question
okay pinging an IP address Alice and Bob are practicing the Ping command using
both of their own PCS Alice is able to Ping Bob's computer using his actual IP address
but Bob is not able to Ping Alice's computer using her actual IP address what is the most logical
explanation for this scenario okay look over the answer choices and let's see what you're thinking
okay we have a couple of responses in the chat
okay a b and d ude okay
okay so does anything come to mind in terms of being able to eliminate pretty quickly
foreign
if we are considering intrusion prevention systems okay and based upon the question the
scenario given to us you know I would be thinking about host intrusion prevention system okay
and so you know the hips inserts itself between software applications and the kernel
and it focuses on Behavior okay
so does this scenario sound like we are trying to monitor some type of behavior
I mean intrusion prevention systems are concerned with attack Behavior foreign
sound like that's what we're talking about okay we got some more responses here no okay now really
we're talking about testing for connectivity we're talking about pinging now the question
and I I think this this comes up somewhat I I will say this I will say that in my experience
test designers have learned to become more specific over the years and have gotten really
good about the descriptions being you know correct and not being open to Too Much interpretation and
I I you know kind of think this is too so in this context pinging is not an attack and if I
look at it that way that kind of eliminates choice and answer choices C and D for me
um now I just have to read the scenario again and think about it
and that is you know they're both practicing the use of the Ping command
Alice can ping Bob using his actual IP but Bob can't ping Alice using her actual IP
okay so of the choices A and B which do you think is the correct choice
okay lots of responses that's great and B yeah Alice is going to have more than likely than
that Gateway configured on her her network um when they talk about you know her actual IP
um from her point of view it sounds like inside local okay
from Bob's point of view that's outsider not his point I mean from his point of view
to her remote Network it's an outside address and network address translation will hide
her inside the local address which more than likely is going to be a private IP
address okay and it's translated as you should know um to a public or routable IP address
okay so B answer Choice B is the correct one here all right let's go on to the next one
okay screen Sunday
which of the following is not true regarding a screened subnet
okay take a moment and look over your choices
okay
clearly this question depends on understanding the meaning of the term screen subnet
and let's see what people are thinking
okay so C and D okay
okay so remember we are looking for which of the following is not true and sometimes just by
putting this sort of the negative spin you know asking what if something is not
can make question more difficult for reasons of what human nature I suppose um or maybe it's just
the way we're taught we're always taught to you know figure out what the correct answer is okay
so it looks like we have a lot of votes for answer Choice C communication between hosts in the DMZ
and hosts on the land does not need to go through a firewall and this in fact is the correct choice
this is not true regarding a screen subnet the other items are true and basically a screen subnet
could also be known as a triple homed firewall it's a network architecture that uses single
firewall with three interfaces typically the public interface you have the connection to the
DMZ into the intranet okay so a screen subnet offers two layers of firewall restrictions
between the Lan and the internet yeah when users connect to a corporate Network through vpns the
VPN appliances should be placed in a screen subnet and a screen subnet divides the network into three
networks so these are all characteristics of the screen sign in leaving answer Choice C okay
we're ready
next question hierarchical tracing
the network Security administrator frequently audits certificate
infrastructure to ensure that only valid certificates are being issued and trusted
what method are they practicing if they trace each CA that signs the
certificate up through the hierarchy to the root CA what do we call this
okay response is in the check d d d okay very good so that was uh that one I guess
was pretty easy certificate chaining is the correct answer what is credential harvesting
in just a word or two what would you call that
anyone
so it sounds like we're yeah attack sure sometimes it's called password harvesting
okay stateful inspection does not really fit this situation
and the certificate Authority is the trusted organization that issues
digital certificates so yeah certificate chaining is the correct answer here okay
okay next question there we go what does the md5 sum operation provide foreign
so clearly this depends on your knowledge of md5 what is it
um what stands out as obviously incorrect or answers that can be easily eliminated
A and B yes A and B okay and so that leaves us with c and d so encoding or unidirectional hashing
well pretty sure by now it and everybody knows that md5 is a very
you know old hashing algorithm um and is quite easily broken there are apps
all over the place that can you know break an md5 hash pretty quickly so the correct
answer here is D unidirectional hashing and that's pretty much what it is okay
let's go on to the next question
all right Port mapping SSH traffic you need to add a rule to your corporate Network firewall
to portmap SSH traffic Court 22 from specific admin home IPS what part of the firewall will
you be modifying okay take a few seconds and let's get your responses and see what you think
I think this is uh fairly easy one and judging by the responses coming in I think you do too
okay yeah so the answer is D here Access Control lists all right
well it's nice to get an easy question now and again
especially when there are lots of them okay all right let's go on to the next
okay stateless firewall which of the following describes a stateless type of firewall
okay a few moments look over your answer choices
okay so what can be fairly quickly eliminated
and it's got a vote for d as the answer let's go back to answers that are easily eliminated
what do you think
I would eliminate A and B yep sure this is stateless operation there
is no tracking of individual sessions no monitoring leaving us with c and d
um see a firewall that filters and can restrict what users on the network May access
or d a firewall that tracks individual packets without preserving previous Network sessions
and so the best answer the one that fits the best
is the firewall that tracks individual packets without preserving previous Network sessions okay
all right let's go on to the next one
okay
TCP Port 636 which statement below is true regarding TCP port
636 okay take a second flip this over I think you can eliminate some answers pretty quickly
foreign which of the answers do you think is the correct
choice
Okay so we've got two choices two uh responses and looks like d so far another one per D okay
I think it's pretty obvious here that we can eliminate Choice a FTP um ftps
should also be in your repertoire port numbers
um just curious does anybody know which port number is associated typically with that TPS
okay so it's nine nine zero nine ninety okay
all right so that leaves us with ldap and L.S okay so again you know we're going to be sort of left
with the the game of how well DNA report numbers uh lightweight directory access protocol ldap
typically TCP over port 389 and secure is TCP Port 636 so answer Choice D is the correct answer
okay and let's move on to the next one
okay okay Wi-Fi security your it manager has asked you to verify the security profile of the
Wi-Fi access points in your office so you plan to look at several aspects of your wireless networks
what are some of the top common vulnerabilities you should First Look for as to choose two
I would expect by now that this is a pretty simple one for most of us
common vulnerabilities
okay all right so we've got several responses B and C B and C B and C two and three okay so
default admin passwords definitely an open Wi-Fi networks okay
um now the question says what are some of the topic common vulnerabilities you should First
Look for okay so you know it's not that MAC address filtering couldn't be a problem okay
um but it's definitely going to require more work to get in and look at Mac filtering lists
um the easiest and quickest things to see are going to be default admin passwords
and open Networks all right let's go on to the next question foreign
domain name a startup business thinks that they have found a way to cut some costs by
registering a domain name for a short period and then deleting it repeatedly so that they
can avoid paying for the domain name expenses in this example what term is being described
so we're gonna give you the definition you give us
the term that's the game here okay all right what are you thinking A B C or D
okay d d I have some choices for d okay
all right see what other choices we have here the C okay so the correct answer
is C domain kiting okay hijacking type of attack poisoning or DNS cash poisoning you know we're
again an attack domain squatting the practice of buying a domain name for the sole purpose of
preventing someone else from getting it that's domain squatting so domain kiting this is where
you're taking advantage of the grace period okay so that is the correct answer for this question
okay
open source firewall which of the following describes a
characteristic of an open source Network firewall
okay all right let's say your response is in the chat c c c c okay so inexpensive sure that's the
correct answer ineffective that's that's wrong wired open source firewalls can function as
lapse that can be deployed on Hardware platforms there's a software-based solution okay so yes the
answer here is C inexpensive okay it's really good all right next question pki certificate attributes
which of the following are included within a pki SSL TLS certificate choose all that apply okay
take a few moments look at the choices let's see which ones you're thinking
okay all right so we have some responses in the chat and two three four ABC all okay
all right let's take a few more and then we'll go through these
okay all right see we got here two three and all okay so in the certificate
yes URL domain name or common name okay
what do you think yes or no certificate Authority reference is that part of a certificate
yeah it is okay great expiration date kind of another important piece of information to know
private key
what do you think yes or no
okay maybe no private key is not stored in the certificate okay so it's all but
answer Choice D here okay all right that's good okay let's move on to the next one
okay Federated identity management control
which of the following describes a Federated identity management control
okay so this depends on knowing what identity Federation is or involves as I look at these
responses and we look at the last one D an authentication Service that grants Federal access
okay so what we're seeing here is uh somebody's sense of humor
so I'm going to eliminate this choice right out of hand okay so of the first three choices
which do you think we're looking at for the correct answer
is federal Federated identity management concerned with audit specifications
no no so that leaves us with b or c a virtual item that contains
authorization data and is commonly used in multi-factor really Authentication
yeah that's pretty suspicious an authentication process that
trusts a third-party Network authenticator to Grant access to another or different Networks
this is the answer that sounds a lot like um what what do you think
one of the the big capabilities that Federated
identity management provides and we we like it generally speaking
um
single sign-on Bravo absolutely single sign-on capability okay
all right let's go on to the next question
okay land Court Access
the network administrator for your organization needs to configure a security method that allows
only specific devices to a port on the land what method should they administer
okay
what method should they administer
okay got some responses here b c and b okay so we have votes for Mac filtering and firewall
more from Mac filtering okay so Mac filtering is the correct answer um nmap and firewalls are tools
more than methods Mac filtering is a method Source IP affinity it's also known as simple persistence
so the best answer for this question is Mac filtering all right
here we have one more
okay
Network Edge security solution you've been tasked with setting up a secure
fast multi-homed Network Edge security solution that controls access to various
types of traffic into your network which type of solution should you employ
okay without a few responses let's get a few more okay good let's see what you're thinking here
so when everybody's thinking hey okay
all right so it doesn't look like anybody chose C all right so that's good C is not correct
B is not correct it is being fact between a and d
a Bastion host provides remote access to private networks from an external network
and I suspect that you understand what a hardware firewall is and does
so what do you think we're talking about answer a or D
it still looks like a okay we've got a D One D in there
okay so the correct Choice here is D Hardware firewall okay secure fast and multi-honed
controls access to various types of traffic into your network okay all right
um the other thing to note about let's see everybody a lot of people said hey Bastion hosts
old remote access technology that doesn't really work in sort of today's decentralized Networks
okay so it basically runs as a kind of a a lockdown single purpose system if you will
so definitely not as usable or easily fitted to the different types of situations that we
would find in modern networks okay so the answer here again the hardware firewall
all right so that does it for this session on network security part two