Description

Securing the information systems environment is one of the important tasks of the organization IT. This course focuses on the design, analysis, and implementation of enterprise-level security for enterprise and service-providers networks. This course will expose the student to secure networks, cloud and systems concepts, endpoint, and applications security.

This course is the second part of Cyber Security Architect course, in which we talk about network ad Internet applications security.

Prerequisites:

Network and cyber security protocols [SEC-001]

Duration:

30 Hours + exercises

Content

1. Network Protocols – How to Attack and How to Protect – Methodologies and Tools [6 Hours + exercise]

• Layer-2 storms and how to generate them.
• Storm identification, where can it block the network and what to
• Wireless LAN security
  •  Protocols, operation, and implementation – 802.11 versions, operating principles
  •  Security protocols – WEP, WPA, WPA-PSKWPA2, WPA3, 802.11i, TKIP, AES and CCMP, 802.1X and EAP
  •  Common attacks on Wireless networks – adding a fake AP, Eavesdropping, encryption cracking, authentication attacks, MAC spoofing and more.
  •  WLAN security architectures and how to protect your Wireless network.
• IP-based attacks, DHCP starvations, ARP Poisoning
  • ICMP-Based attacks, Teardrops, Ping scans, Ping of death, L3 DDoS
  • MAC and IP Spoofing
  • IP fragmentation attacks
• Deep dive into UDP and TCP protocols data structure and behaviour
  • Syn Flood and SYN stealth scans attacks and countermeasures
  • RST and FIN attacks and countermeasures
  • TCP sequence attacks and session hijacking attacks
  • TCP/TLS attacks and prevention
• Class exercise: Simulation L2/3/4 attack
• Home exercise: Simulation L2/3/4 attack

2. Securing routing networks and protocols [6 Hours + exercise]

• IGP standard protocols – RIP (brief), OSPF and ISIS protocols behaviours
• RIP, OSPF and ISIS data structure
• Potential threats and common attacks – falsification, overclaiming and disclaiming
• Tools and scripts
• DDoS, mistreating, and attacks on routers control plane
• Routing tables poisoning and attacks on management plane.
• Traffic generation and attacks on data plane
• How to configure your routers to protect
• BGP – protocol and operation
• What are the symptoms of BGP hijacking?
• How to protect against BGP hijacking
• Class exercise: Building Linux routers.
• Home exercise: Simulating attacks on Linux routers

3. Internet Protocols Security – DNS, HTTP and Mail Protocols [4 Hours + exercise]

• The DNS protocols, behavior and data structure
• Attacks on service: Domain spoofing and hijacking, Flooding, Cache poisoning
• Using DNS to bypass network controls: DNS tunnelling.
• Attacks on DNS resources: NX records, subdomains
• DNS attacks discovery and protection: tools and analysis
• HTTP and HTTP2 protocol behaviour, data structure and analysis
• SSL/TLS protocol behaviour, data structure and analysis
• HTTP hacking tools – scanners, vulnerability checker and others
• Web hack – URL interceptions, Input validation, SQL injection, Buffer overflow
• Web hacks – HTTP session hijacking and impersonation
• Email protocols, vulnerabilities and how to protect your network and messaging.
• Countermeasures and defence
• Class exercise: Common attacks on application servers
• Home exercise: Attacking application servers.

4. Enterprise Applications Security – Databases, Filesystems and More [6 Hours + exercise]

• Microsoft network protocols – NetBIOS/SMB and LDAP operation and vulnerabilities
• Database network protocols – TDS and SQLNet operation and vulnerabilities
• Attacking DB protocols: tools and methods, DB injection methods
• Protecting NetBIOS and LDAP
• Securing your databases through the network and servers
• Class exercise: Configuring a network firewall.
• Home Exercises: Configuring firewall rules.

5. IP Telephony and Collaboration Services Security

• SIP and RTP – Protocols, operations, and vulnerabilities [4 Hours + exercise]
• Attack and destroy – DoS, Session’s tear down, Fuzzing and more.
• Attack and take – registration manipulation, Man in the Middle, redirects and more.
• Discover and identify attacks.
• Protecting methodology and tools
• Class exercise: Building a SIP server.
• Home exercise: Attacking the SIP network.

6. Using Behaviour Analysis and Anomaly Detection [4 Hours + exercise]

• Collection methods – agents, Netflow/IPFix, Telemetry and packet analysis
• Establishing the baseline – traffic loads, applications, and protocols patterns
• Typical suspicious patterns
• Class exercise: Getting to know anomaly detection tools.
• Home exercise: using tools for anomaly detection.