Network Attack Mitigations

Identify general mitigation techniques.

The Defense-in-Depth Approach

• To mitigate network attacks, you must first secure devices including routers, switches, servers, and hosts. Most organizations employ a defense-in-depth approach (also known as a layered approach) to security.
• This requires a combination of networking devices and services working in tandem.

• Several security devices and services are implemented to protect an organization’s users and assets against TCP/IP threats:
• • VPN
  • Cisco ASA Firewall
  • IPS
  • ESA/WSA
  • AAA Server

Keep Backups

• Backing up device configurations and data is one of the most effective ways of protecting against data loss. Backups should be performed on a regular basis as identified in the security policy.
• Data backups are usually stored offsite to protect the backup media if anything happens to the main facility. The table shows backup considerations and their descriptions.

Upgrade, Update, and Patch

• As new malware is released, enterprises need to keep current with the latest versions of antivirus software.
• The most effective way to mitigate a worm attack is to download security updates from the operating system vendor and patch all vulnerable systems.
• One solution to the management of critical security patches is to make sure all end systems automatically download updates.

Authentication, Authorization, and Accounting

Authentication, authorization, and accounting (AAA, or “triple A”) network security services provide the primary framework to set up access control on network devices.

• AAA is a way to control who is permitted to access a network (authenticate), what actions they perform while accessing the network (authorize), and making a record of what was done while they are there (accounting).
• The concept of AAA is similar to the use of a credit card. The credit card identifies who can use it, how much that user can spend, and keeps account of what items the user spent money on.

Firewalls

• Network firewalls reside between two or more networks, control the traffic between them, and help prevent unauthorized access.
• A firewall could allow outside users controlled access to specific services.
• For example, servers accessible to outside users are usually located on a special network referred to as the demilitarized zone (DMZ).
• The DMZ enables a network administrator to apply specific policies for hosts connected to that network.

Types of Firewalls

• Firewall products come packaged in various forms.
• These products use different techniques for determining what will be permitted or denied access to a network.
• They include the following:
• • Packet filtering – Prevents or allows access based on IP or MAC addresses
  • Application filtering – Prevents or allows access by specific application types based on port numbers
  • URL filtering – Prevents or allows access to websites based on specific URLs or keywords
  • Stateful packet inspection (SPI) – Incoming packets must be legitimate responses to requests from internal hosts. Unsolicited packets are blocked unless permitted specifically. SPI can also include the capability to recognize and filter out specific types of attacks, such as denial of service (DoS).

Endpoint Security

• An endpoint, or host, is an individual computer system or device that acts as a network client.
• Common endpoints are laptops, desktops, servers, smartphones, and tablets.
• Securing endpoint devices is one of the most challenging jobs of a network administrator because it involves human nature.
• A company must have well-documented policies in place and employees must be aware of these rules. Employees need to be trained on proper use of the network.
• Policies often include the use of antivirus software and host intrusion prevention.
• More comprehensive endpoint security solutions rely on network access control.

Other related topics

Other useful information

• Full CCNA Course
• CCNA Certificate Information
• 200-301 CCNA Exam Questions and Solutions
• 200-301 CCNA Exam Topics