1. Chapter 11 Securing Network Components
CISSP Study Guide
BIS 4113/6113

2. Stack Layer Models PAGES 428-429 Broad Purpose Hybrid TCP/IP-OSI OSI
Communication
between
applications
Application
(Layer 5)
Application
Application
Presentation
Session
Internetworking
Transport (Layer 4)
Transport
Transport
Internet (Layer 3)
Network
Internet
Transmission
within a single
LAN or WAN
Data Link (Layer 2)
Data Link
Network
Interface
Physical (Layer 1)
Physical

3. Application Layer PAGE 436 Creates the Message Nothing but Data
Now that we have seen the three basic parts, we will look more closely at the header and trailer.
This figure shows that the header is divided into smaller sections called fields.
The most important header field is the destination address field.
This is like the address on a postal letter.
Switches and routers use this field to decide how to forward an incoming message back out.
Trailers can also be divided into fields.

4. Presentation Layer PAGE 435
Formats the message for networking use (video, text, HTML, etc.)
Message with Encapsulating Header
Now that we have seen the three basic parts, we will look more closely at the header and trailer.
This figure shows that the header is divided into smaller sections called fields.
The most important header field is the destination address field.
This is like the address on a postal letter.
Switches and routers use this field to decide how to forward an incoming message back out.
Trailers can also be divided into fields.

5. PAGE 435
Session Layer
Establishes direction of communication with remote computer
Simplex
Half-Duplex
Full-Duplex
More Header Added
Now that we have seen the three basic parts, we will look more closely at the header and trailer.
This figure shows that the header is divided into smaller sections called fields.
The most important header field is the destination address field.
This is like the address on a postal letter.
Switches and routers use this field to decide how to forward an incoming message back out.
Trailers can also be divided into fields.

6. Transport Layer PAGE 434 Segments message into frames/packets
Sequencing for reassembly at destination
Error Checking
Footer
Data Field
Header
Now that we have seen the three basic parts, we will look more closely at the header and trailer.
This figure shows that the header is divided into smaller sections called fields.
The most important header field is the destination address field.
This is like the address on a postal letter.
Switches and routers use this field to decide how to forward an incoming message back out.
Trailers can also be divided into fields.

7. Network Layer PAGE 433 Addresses and routes packets e.g. IP addressing
Between-network transmission
Footer
Data Field
Header
Now that we have seen the three basic parts, we will look more closely at the header and trailer.
This figure shows that the header is divided into smaller sections called fields.
The most important header field is the destination address field.
This is like the address on a postal letter.
Switches and routers use this field to decide how to forward an incoming message back out.
Trailers can also be divided into fields.

8. PAGES
Data Link Layer
Handles the hardware addressing of the transmission
e.g. MAC addresses
Within-network transmission
Footer
Data Field
Header
Now that we have seen the three basic parts, we will look more closely at the header and trailer.
This figure shows that the header is divided into smaller sections called fields.
The most important header field is the destination address field.
This is like the address on a postal letter.
Switches and routers use this field to decide how to forward an incoming message back out.
Trailers can also be divided into fields.

9. PAGES
Physical Layer
Converts frame/packet for appropriate medium
Eth
Ftr
Data Field
TCP
Hdr IP
Hdr
Eth
Hdr
Now that we have seen the three basic parts, we will look more closely at the header and trailer.
This figure shows that the header is divided into smaller sections called fields.
The most important header field is the destination address field.
This is like the address on a postal letter.
Switches and routers use this field to decide how to forward an incoming message back out.
Trailers can also be divided into fields.
Modulation (Wireless Media)
Signaling (Guided Media)

10. Simplified Stack Layer Model

11. Application
Presentation
Session
Transport
Network
Data Link
Physical
Away
Pizza
Sausage
Throw
Not Do
Programmers
Alligator
Pet
Steve’s
Touch
Not Do
Please
All
People
Seem To
Need
Data
Processing
Anytime
Passwords
Secret
Tell
Not Do
Please
All
People
Standing
Totally
Naked
Don’t
Perspire

12. Security at Each Layer Layer Breach / Disruption Control Application
Malware / Trojan Horses
Anti-virus
Presentation
SQL Poisoning
Data Validation
Session
Man in the Middle
SSL
Transport
Port Scanning
Firewall
Network
Unauthorized Network Traffic
IP Filtering
Data Link
Unauthorized Device
MAC Filtering
Physical
Power Outage
Packet Sniffing (WiFi)
UPS
VPN
Source: SANS Institute
Note: Some disruptions may pertain to multiple layers

13. Threats Across Layers Example: ARP Cache Poisoning in LANs A Z
To communicate:
Computer A needs the MAC Address of Computer Z
If the address is not in its cache, it asks other computers
Only Computer Z can reply
Control: Enhance Physical Security

14. Threats Across Layers Example: DNS Poisoning
Control(s): Restrict access to your DNS
Randomizing characters of domain names stored in cache
(AmaZ0n.com)

15. Wireless (Wi-Fi) Network Types
Standard
Frequency
Potential
Speed
Range
Spectrum
802.11b
2.4 GHz
11 Mbps
50 m
DSSS
(Spread across range)
802.11a
5 GHz
54 Mbps m
OFDM
(Orthogonal Freq. MP)
802.11g
802.11n
(2009)
2.4 and 5 GHz
(MIMO)
600 Mbps
200 m
802.11ac
(2013)
1.3 Gbps
Wide channel

16. Types of WLAN Security Service Set Identifier (SSID)
PAGES
Service Set Identifier (SSID)
Transmitted by “beacon frame”
Included as plain text Easy to break
Wired Equivalent Privacy (WEP)
Requires that user enter a key manually (to NIC and AP)
Short key ( bits)  Easy to break by “brute force”
Extensible Authentication Protocol (EAP)
WEP keys created dynamically after correct login
Requires a login (with password) to a server
Wi-Fi Protected Access (WPA) – new standard
A longer key, changed for every packet
Still requires a passphrase, could be guessed

17. Packet Sniffing / Eavesdropping

18. WiFi Security Procedure
PAGE 462
1. Change admin default password
2. Disable SSID broadcast
3. Change default SSID
4. Enable MAC filtering (whitelist if less than 20 clients)
5. Enable highest form of authentication/encryption available
6. Monitor traffic using firewall and/or IDS
7. Require VPN connections

19. Wi-Fi broadcasting Note: In the 2.4 GHz range
14 channels for 11b, 11g, and low-freq 11n
11 channels usable (13 in Europe)
Three “non-overlapping” channels: 1, 6, 11
5 MHz between center frequencies
Signal requires 30 MHz

20. Physical Ethernet Media Types
1.       
PAGES
Physical Ethernet Media Types
Name
Maximum Data Rate
 Cables
10Base-5
10 Mbps
Coaxial
10Base-2
10Base-T
UTP cat 3, UTP cat 5
100Base-T
100 Mbps
UTP cat 5, fiber
1000Base-T
1 Gbps
UTP cat 5, UTP cat 5e,
UTP cat 6, fiber
10 GbE
10 Gbps
UTP cat 5e, UTP cat 6, UTP cat 7, fiber
40 GbE
40 Gbps
fiber

21. Network Taps

22. Firewalls First Generation
PAGES
Firewalls
First Generation
Static Packet Filtering at Layer 3 (source/dest IP)
Easily fooled by spoofing
Second Generation
Layer 7 filtering by port
Require higher processing power
Layer 5 filtering by “handshake”
Layer 3 & 4 filtering by “stateful inspection”
Much match expected protocols (TCP, UDP, etc.)

23. A Network Design Using Firewalls
For initial screening
Permits web access
Denies FTP requests
When firewalls fail
The Eigenvalue is off
Enhance