W2-2/3 Network Mapping (7/5)


On Thursday we covered network mapping. The process of network mapping usually consists of four phases: identify the space of IP addresses you are monitoring and partition the space into different categories (1). Examine the IP space (2), identify blind and confusing traffic (3), and identify clients and servers (4).

   During phase one the mapping of the inventory is undetermined and remains to be IP space. A security inventory should monitor every resource's address (that it is able to) on the network (i.e. anything within or on the network an attacker can access), what resources a service is running on, at the very minimum. During phase two cyber security personal should also consider enumerating roles to make searching easier; identifying VPNs, NATs, DHCP, and proxies; keep centrality or volume metrics (e.g. monthly ephemeral summaries); per-host white lists; and monitoring the versions of all services on a particular resource. Ask what addresses make up the network? What sensors do I have? How are the sensors related to traffic? What ports are your sensors watching? What do they watch for in these ports?

   In phase three one should ask. Is there unmonitored router (gaps in vantage)? What IP space is dark? Which IP addresses are network appliances? Gaps in vantage are usually in any environment caused by asymmetric traffic which can be checked by comparing internal and external IP pairs via passive collection. Dark space can be monitored by routine hourly comparison of configuration of dark and light addresses. Network appliances can be found by using protocols like traceroute.

  In phase four you should ask are there NATs? Are there proxies, reverse proxies, or caches? Is there VPN traffic? Are there dynamic addresses? To identify NATs, pull the User-Agent strings from web sessions; to avoid false positives (e.g. safari). Look for redundant logins on services used by your network. Check if TTL values are below the initial TTL values for an OS (this maybe evidence of suspicious traffic). Proxies can be identified by viewing their traffic pattern if you can see both client to proxy and proxy to server communications. If you can't you can use connectivity by checking for hosts acting as clients (i.e. multiple ephemeral ports). Then identify clients acting as servers (i.e. using flow tools that distinguish the initial flags of packets from the rest of the body [not for udp] and looking at the spread of a port) protocol combination regularity in communication patterns determines it is more likely to be a host. By network mapping you can track coverage.

  I feel confident in its theoretical application as well and I'm not as confident in the hands-on application. I just need some experience actually doing it in order to grasp at that better level. Although to be honest I don't feel as confident with network mapping as I do application identification. ID seems to be more objective or at least more definite in general practice. It is also much more difficult, I would imagine to get physical application of network mapping from internships must be more difficult to obtain. Similar monitoring may occur during an internship, but actual mapping is usually more prevalent only around the beginning of a network or new additions (dependent upon what SAD model is implemented where one is working). I realize just like any type of education (as far as the modern age is concerned) that it is more a gateway than a tour. The internship fulfills employment history and some practice, but it doesn't ensure adequate knowledge of that subject for necessarily just any future employment nor does it in tandem with any form of academic education. If one counts solely on their teachers, tutors, and supervisors for everything upon their profession or study then they risk putting their future at risk. Personal study, accountability, action, practice, and application are important to really get anywhere near the potential prosperity/success of one's own opportunities and resources available to them. I will continue to practice personal study in any subject matter which I hope to draw practical utility from.


Comments

Post a Comment

Popular posts from this blog

W7-2/3 On Being Prepared & Further Recommendations (8/11)

   One can never be fully prepared. There is always more that a person can do to prepare themselves. I wish that before starting this internship that I would have had a better understanding of the basic concepts of cyber security (e.g. passive and active defense, vulnerability factors, etc.). I also wish that I had prior experience with all the tools and software I used. If you can find out the tools used at an internship, then it’s a good idea to try and learn some of those tools. Your internship will require less training and more application which will make the experience more productive for you. If you cannot find out what tools your internship will use, then it isn’t a bad idea to browse freeware related to that field (e.g. Maltego and Zed Attack Proxy for digital forensics and pen testing respectively). Most places are trying to save money, so they probably use freeware to some capacity. The most popular freeware is your best bet and even if they don’t use it, the...
Read more

W1-2/3 Prioritization (6/27)

   On Wednesday we covered prioritization. What is the most important thing to respond to first? How do we determine what is and what isn't more important? How do we assess the risk being taken? How much risk is too much risk? While some matters may be more general, a lot of prioritization will be based upon what the establishment is doing, who would target them, what resources does the establishment have for defense, etc. The effectiveness of cyber response teams is determined by how appropriate the prioritization of incidents is. Randomly responding and less formalized response protocols/orders (e.g. stacks/LIFO or queues/FIFO) will hinder the potential security capabilities of an establishment. One cannot prioritize for random or abstract orders and expect any type of long-term success. It is best to make decision making and risk taking as formalized as possible. What you do is just as important as what you do first. Basically, some things are more important to attend to ri...
Read more