Notes - MIECT
Segurança Em Redes De Comunicações
Notes - MIECT
Segurança Em Redes De Comunicações
  • Segurança Em Redes De Comunicações
  • Corporate Networks Topics
    • Objectives of Network Design
    • Equipments
    • Hierarchical Network Model
    • Modular Network Design
    • Designing the Access Layer
    • Designing the Core Layer
    • Virtual LANs
      • VLANs on Access Points
    • Spanning Tree Protocol
    • IP Routing Overview
  • Introduction to Network Security
    • Type of Attacks
    • Attacks Phases
      • Infiltration Phase
      • Propagation Phase
      • Aggregation and Exfiltration Phase
    • Defenses
    • Security Metrics
  • Network Access Control
    • AAA Architecture
      • TACACS+
      • RADIUS
      • DIAMETER
    • IEEE 802.11 services
    • Joining a BSS
      • WLAN Frames
      • Joining BSS with AP
    • WPA and 802.11i (WPA2)
  • Network Flow Control
    • Network Security Systems
    • Firewalls
    • High-Availability
    • Load Balancing Firewall Load
    • Best Practices and Recommendations
    • IP Spoofing
    • Half-Open TCP Connection Problem
    • DDoS Mitigation at Source
    • Cisco’s Access Control Lists (ACL)
    • Linux IPTables
    • Control By Analysis of Higher Layers
  • Secure Communications
    • Public Key Infrastructure (PKI)
    • X.509 Certificate Contents
    • Traffic Tunnel Concept
      • Next Hop Resolution Protocol (NHRP)
      • Hub-Spoke vs. Spoke-Spoke
    • IPSec
    • Establishing SA and Cryptographic Keys
    • Virtual Private Networks (VPN)
    • Management of Asymmetric Keys
  • Remote Access
    • Remote Access
    • IPsec NAT Transversal
    • Integration with Flow Control
  • Intrusion Detection and Prevention
    • Intrusion Detection and Prevention
    • Host-Based vs. Network-Based
    • Signature vs. Anomaly Based
    • Network Deployment
  • Network Monitoring SIEM
    • Core and End-to-End Monitoring
    • Node Monitoring
    • End-User/Host/App Monitoring
    • Server/Service/Cloud Monitoring
    • Per-Service Detailed Monitoring
    • Data Sources
      • SNMP
      • NetFlow
    • Network Passive Probing Packet Capturing
    • Remote CLI Access
    • Log Files Access
      • Log Management Systems (LMS)
      • Security Information and Events Management (SIEM)
Powered by GitBook
On this page
  • Objectives
  • Technical objectives
  • Disruption Attacks
  • Distributed DoS
  • Denial of service by physical signal jamming
  1. Introduction to Network Security

Type of Attacks

Objectives

Some of the most common are:

  • Fun and/or hacking reputation.

  • Political purposes.

  • Military purposes.

  • Economical purposes.

Technical objectives

  • Operation disruption.

    • (Distributed) Denial-of-Service.

  • Resource hijack.

    • Spam,

    • Crypt-currency mining/mastermodes,

    • Platform to other attacks!

  • For data interception.

    • Personal data.

      • As the final goal,

      • As a tool to achieve more valuable information.

    • Technical data.

      • Usually used to achieve more valuable information.

    • Commercial data.

      • Digital objects, financial and/or engineering plans, ...

  • All.

    • Disruption to intercept!

    • Intercept to disrupt!

Disruption may be used to achieve interception!

Interception may be used to achieve disruption (operational or commercial).

Disruption Attacks

Distributed DoS

  • Multiple slow/small devices generating traffic to a target.

    • TCP vs. UDP.

Solution at target.

  • Load-balancers.

  • For TCP, maybe it's possible to survive making active (with licit client validation) session resets (server/ firewalls).

    • White list solution, for completed session negotiation.

  • For UDP/DNS, block requests for known external relay/redirection DNS servers (blocks attack amplification, IP target spoofing).

    • Doesn't work with large botnets and direct requests to target.

Solution at source

  • Anomalous behaviors detection.

    • Low traffic variations are hard to detect.

    • Destinations of traffic changes.

    • With "really low" data rates is impossible to detect.

Denial of service by physical signal jamming

  • Pure disruption, or

  • Disruption to activate secondary channels (more easily compromised).

  • Solution.

    • Detect, localized source, and physically neutralize.

PreviousIP Routing OverviewNextAttacks Phases

Last updated 2 years ago