Nowadays, it seems as if you need a password for everything. I have so many passwords that I find it hard to keep track. Although it might sound like a good idea to keep your passwords simple or to write them down, both practices are highly discouraged. The goal is to make it harder for someone to find or guess your password; therefore, password integrity is necessary. That being said, an attacker might attempt a login with false credentials. It is also important to note that not all attackers are external users. Many recorded instances of attempted and/or successful attacks have come from internal company employees.

There are alternatives to passwords, such as Terminal Access Controller Access Control System (TACACS) or Remote Authentication Dial-In User Service (RADIUS), both of which manage access to network hardware. Passwords are fast becoming as obsolete as rabbit-ear antennas or dialup Internet connections.

Cisco equipment is shipped from the factory with a standard configuration. When the device is turned on, the setup program prompts for a password and leaves all but the enable secret password in plain text. It is the responsibility of the recipient to update the password information before deploying the device on a network. Changing passwords every time an employee leaves the company or in a given time period (every 90 days) would also help protect login credentials.

Trust exploitation can occur in one of two ways:

For example, most companies have a part of their network that lies between the wide-open Internet and the corporate internal network. This in-between part of the network is called the demilitarized zone (DMZ). Servers that communicate from the DMZ and the internal network may have a trust relationship established. The internal devices may be set up to trust information that is received from a DMZ server. An attacker can then compromise the DMZ server and initiate a connection to the internal network. This is an example of phishing. When the trust that the server has in a client is exploited, this is an example of session hijacking.

Port redirection is a form of trust exploitation in which the untrustworthy source uses a machine with access to the internal network to pass traffic through a port on the firewall or access control list (ACL). The port in question normally denies traffic, but with redirection the attacker can bypass security measures and open a tunnel for communication.

A man-in-the-middle attack happens when a hacker eavesdrops or listens for network traffic and intercepts a data transmission. After the transmission is intercepted, the untrustworthy host can position itself between the two communicating hosts, interpret the data, and steal information from the packets sent. The hacker can also take over the session and reformat the packets to send information to either or both communicating parties. In this situation, it is possible for the hacker to capture credentials, hijack a session, or instigate a DoS attack.

Data sessions are more vulnerable when the packets are left in clear-text format and can be read without additional decryption by the human eye. Proper data encryption, with the use of an encryption protocol, makes the captured data useless.

A packet sniffer may also be called a network analyzer, packet analyzer, or Ethernet sniffer. The packet sniffer may be either a software program or a piece of hardware with software installed in it that captures traffic sent over the network, which is then decoded and analyzed by the sniffer. Network administrators install monitors on dedicated machines or on their workstations when needed. A common software program available today is Wireshark, formerly known as Ethereal.

As you may recall, ping enables you to validate that an IP address exists and can accept requests by sending an echo request and then waiting for an echo reply. A ping sweep tool can send an echo request to numerous host IP addresses at the same time to see which host(s) respond(s) with an echo reply.

A port scanner is a software program that surveys a host network for open ports. Because ports are associated with applications, the hacker can use the port and application information to determine a way to attack the network. As mentioned, these programs can be used by a third party to audit a network as well as being used by a hacker for malicious intent.

As mentioned in Chapter 1, it is extremely important that you know the prevalent applications and their matching port numbers. Table 4.1 reviews the applications that use TCP, and Table 4.2 reviews UDP-based applications.

Information queries can be sent via the Internet to resolve hostnames from IP addresses or vice versa. One of the most commonly used queries is nslookup. You can use nslookup by opening a Windows or Linux command prompt (CMD) window on your computer and entering nslookup followed by the IP address or hostname that you are attempting to resolve.

Here are a couple sample CMD commands:

C: nslookup www.cisco.com
C: nslookup 198.133.219.25

A multitude of websites offer an nslookup tool.

With distributed DoS, multiple systems are compromised to send a DoS attack to a specific target. The compromised systems are commonly called zombies or slaves. As a result of the attack, the targeted system denies service to valid users. Figure 4.1 illustrates a DDoS attack.

Figure 4.1. DDoS attack.

You may recall from Chapter 1 that a TCP session is established with the use of a three-way handshake, which involves the following steps:

Figure 4.2 illustrates a proper TCP session.

Figure 4.2. TCP session establishment.

In a TCP SYN attack, a SYN request is sent to a device with a spoofed source IP address. The attacking system does not acknowledge the resulting SYN-ACK, which causes the session connection queues to fill up and stop taking new connection requests. TCP intercept can be configured on a router to block a TCP SYN attack. This enables the router to terminate any sessions that have not been established within an allotted time frame.

With a smurf attack, multiple broadcast ping requests are sent to a single target from a spoofed IP address. Figure 4.3 illustrates a smurf attack. Adding the no ip directed-broadcast command to a router might help mitigate a potential smurf attack.

Figure 4.3. Smurf attack.

SSH is a data transmission protocol that uses strong authentication and an encrypted tunnel to ensure secure communications between an SSH client and the SSH server. SSH uses TCP port number 22 for connectivity.

SNMP is a management protocol that monitors the network and manages configurations by collecting statistics to analyze network performance and ensure network security. It is best to use SNMP version 3, which provides cryptographic authentication and management traffic encryption. SNMP uses UDP port number 161 for connectivity.

With syslog, log messages are collected from the Cisco device and are sent to a syslog server to keep record of any network occurrences. For syslog to work properly, NTP must be configured. Each logged message has an associated severity level. Syslog uses UDP port number 514 for connectivity. Table 4.3 lists the severity levels in order, with 0 representing the most critical message.

NTP is a protocol that synchronizes clocks on the local network to provide accurate local time on the user system. As with SNMP version 3, NTP version 3 is preferred because of the ability to provide cryptographic authentication and management traffic encryption. NTP uses UDP port number 123 for connectivity.

Based on the Cisco-provided exam objectives, you may need to “explain general methods to mitigate common security threats to network devices, hosts, and applications” on the CCNA exam. In this exercise, list the eleven mitigation methods that were covered in this chapter, and write a brief description of each one. You may refer to Table 4.4 to check your answers.

Estimated Time: 20 minutes