- In 11.2, we're gonna talk about network access control
and the devices we use
to ensure and secure network access control.
So network access control,
we're gonna define for our purposes in this lesson
as the process of controlling access,
identifying suspicious behavior
and preventing data exfiltration.
And there is a number of devices that we use to do that.
We use firewalls, IDSs and IPSs,
jump servers, proxy servers,
NAC, network access control devices, not to be confused
with the generic term network access control
and DLP, data loss prevention solutions.
The most basic use of a firewall is to control
ingress and egress traffic.
An IDS and an IPS can both analyze and monitor traffic
and an IPS can actually take an action.
We use a jump server to provide secure access
to another system.
We use proxy servers to filter and fetch or catch client.
We use proxies to filter and fetch or cache client requests.
We use NAC to evaluate endpoints for network access
using pre-admission and post admission policies.
And we use DLP data loss prevention to detect data movement
and to prevent data exfiltration.
So we're gonna dive deeper into each one of these.
Now, the primary objective of a traditional firewall
is to isolate network segments and traffic
by controlling ingress incoming and egress outgoing traffic.
Now there's a lot to talk about firewalls
so we're actually gonna move firewalls
right to our next lesson.
We'll focus on firewalls in lesson 11.3
and have an entire lesson about firewalls so let's move on.
Let's talk about I IDSs and IPSs.
An intrusion detection system or an IDS
can analyze and monitor network traffic.
An IPS is an intrusion prevention system,
can analyze and monitor just like an IDS,
but the difference is
it can proactively deny network traffic.
It can proactively take action.
Now, IDSs or IPSs can be network-based
in which case we refer to them as NIDS and NIPS
or they can be host-based in which we refer to them as,
with the H, HIDS or HIPS.
Now in-band, when we talk about in places in-band,
in-band placement directly in the flow of traffic
and inspects every packet.
Now, NIDS and NIPS can be in-band.
Out of band placement utilizes a passive tap.
We talked about a tap in the last lesson
that can receive a copy of the network traffic
and can process samples.
Now, that only applies to a NIDS, right?
Because NIPS would take action, right?
So only applies to a network IDS, not a network IPS.
So the IDS or the IPS, same device really
when it's making its decisions
has to decide is this good traffic or is this bad traffic?
Is it normal or abnormal?
So it has decision engines
that allow it to make those decisions.
And there are four primary types of decision engines -
pattern matching, rule-based,
behavioral based and heuristic.
Pattern matching decisions are based
on established, known patterns and signatures.
And the signatures must be updated frequently
very much like the debt files for your antivirus.
Rule-based IDSs analyze behavior for violation
of a pre-configured set of rules.
Behavioral-based IDS decision engines
focus on identifying deviations
from normal patterns of behavior
rather than specific attack signatures or rules.
And lastly, heuristic IDSs use a set of predefined rules
and algorithms to identify anomalous behavior and patterns
which can be adapted and can be updated over time.
Now it's possible your IDS only has one of these engines
but many IDSs actually have a combination of these engines.
A jump server, which is also known as a jump host
or a bastion host, is gonna be a hardened computer system
or server that serves to provide secure access
to other computers or other systems within your network.
Now, jump servers are usually deployed in a screen subnet.
Remember, a screen subnet was going to be a zone
that had connections to both the trusted
and untrusted network.
So it's usually deployed in a screen subnet
to provide additional layer of security.
The users can access the jump server
through a secure connection such as SSH or through a VPN,
and then use that jump server as a gateway
to access other systems on the network.
The jump servers can also be used
to enforce security policies
and provide an audit trail of user activity.
A proxy server is an intermediary machine.
It's between a client and a server.
And it's used to either filter requests or fetch requests
or fetch and cache requests that are made by the client.
And those cache requests can be
or those cache responses actually can be reused.
Now, lots of different varieties here are proxy servers.
They can be a single purpose,
supporting let's say just one protocol,
an HTTP proxy server
or they can be multi-purpose, supporting multiple protocols.
And there are three primary proxy configurations:
a forward proxy, a transparent proxy, and a reverse proxy.
A forward proxy is when the clients,
so really your browser are configured to send your request
to the proxy server.
So the proxy server receives a request, fetches the content
and then stores a copy for future use.
So let's say you had a proxy server
to go out to the internet.
So you do your request, I wanna go to www.someplace.com.
It goes to the proxy server.
The proxy server on your behalf goes out
and fetches that content and returns it to you.
And if the content is static,
meaning it's not being dynamically updated,
it will actually keep a copy.
So if two minutes later one of your colleagues says,
I wanna go to that same place, they make the request,
the proxy server catches it and responds from its cache.
It doesn't have to go back out to the internet
to get that information.
Now, obviously on sites that dynamically change
or updating all the time, that information can't be cached.
Then we have a transparent proxy.
A transparent proxy is really the same as a forward proxy
except the client,
the browser doesn't need to be configured.
In a forward proxy server,
we actually have to tell our browser
to go talk to the proxy server,
but in a transparent proxy,
we don't have to configure the browser at all.
The proxy server just resides on the gateway
and it on its own intercepts requests.
And then we have a reverse proxy.
Now, a reverse proxy isn't on the client side,
it's actually out on the web server side.
A reverse proxy appears to the client
just like an ordinary web server.
But the reverse proxy caches all static answers
from the web server and replies to the clients
from its cache with the goal
of reducing the load on the web server.
Of course, that's also gonna be limited by dynamic content.
So three types of proxy servers:
forward, transparent, and reverse.
Next, we have a network access control system
or a NAC system.
This is a pretty cool system.
This system uses agents to evaluate our endpoint connections
prior to allowing them admission onto the network
and then enforces access privileges
based on what's known as pre-admission
and post admission policies.
So I want you to imagine that you
come into your corporate office, you've got your laptop,
you go to connect either wired or wireless,
before you're actually going to be allowed to authenticate
the NAC system is gonna say,
wait a minute, I need to evaluate your system
and decide if we're even gonna let you on our network.
Now it does that first
using what's known as pre-admission policies.
Pre-admission policies determine
if a device is gonna be allowed on the network
and if so, what segment based on host health compliance.
So for example, are you running antivirus?
Are your dev files up-to-date?
How about your patches?
Are you all patched up?
Do you have a host firewall?
Do you have an IDS?
Or how is your system configured?
All of those things can be
in the pre-admission policy, right?
And the NAC system evaluates your system and says,
okay, based on how you meet those pre-admission policies
I'm gonna determine where you can go on the network.
Am I gonna let you just do a next step of authenticating
and go wherever you can go
by based on rights and permissions
or maybe going to not allow you to be on the network
or are we going to move you to a maybe a segmented area
or a segregated area of the network?
Or maybe we'll move you to a remediation area
where we'll update your dev files
or we'll get you the patches you need
before we're gonna allow you on the network?
And then that post admission policies just regulate
and restrict access once the connection is allowed.
Next up, we have a DLP.
DLP stands for data loss prevention
and DLP solutions are designed to detect data movement
and to prevent data exfiltration.
The exfiltration we define as unauthorized
or inadvertent or accidental release or removal of data.
So it doesn't have to necessarily be malicious.
Very often, data exfiltration is really just happens
because someone doesn't even understand that
they shouldn't be sending that data out.
So exfiltration just means that data leaves your control,
leaves your environment.
So the DLP says, I can look for unauthorized or accidental
release or removal of data.
So how do they work?
Well, DLP technologies, locate and catalog sensitive data,
of course based on predefined rules and criteria
that you're gonna set up.
So maybe, one of the criteria is
you're looking for social security numbers.
Well, here in the US,
that's gonna be three numbers, a dash,
two numbers, a dash and four numbers.
So that's the predefined criteria, we're looking for that.
Maybe you're in a financial institution
and you wanna look for account numbers
and your account numbers are 18 characters long
or 18 numbers long.
That would be the predefined characteristics.
Maybe we're looking for things like date of birth
or other type of records that we can catalog.
So we can either catalog them by a sensitivity
or have this predetermined criteria what it might look like.
The DLP tools can monitor that target data in use,
in motion and at rest.
So DLPs might be at different locations in your network.
They might be network-based, storage-based,
endpoint based or they could even be in the cloud.
So a network-based DLP, which could be hardware
or virtual appliance deals with data in motion.
And it's usually located on the network perimeter.
Storage based, which is going to be software
operates on long-term storage, like our archives.
Endpoint based, again, is gonna be software
operates on a local device and focuses on data in use.
And then cloud-based protects in-cloud data in use,
in motion, and in rest.
That was a lot of different network appliances
and and what they can do to secure your enterprise.
So that brings us to a three second challenge.
Five challenge questions, three seconds each,
you know what to do.
This device is used to control ingress and egress access.
1, 2, 3. I know you know what this is.
This is a firewall. Good work!
Number two, this passive device can analyze
and monitor network traffic.
1, 2, 3.
That's gonna be an IDS because it's passive.
Number three, this server can be used to gain secure access
to other computers and systems within a network.
1, 2, 3.
It's gonna be a jump server.
Number four, this type of proxy server appears to a client
just like an ordinary web server.
1, 2, 3.
And that's a reverse proxy.
And lastly, number five,
this type of NAC policy is used to determine
if a device should be allowed to connect to the network.
1, 2, 3.
And that's gonna be a pre-admission policy.
Awesome. Great work!
So that brings us to a security and action,
putting your knowledge into play.
This one's about data exfiltration.
The buzz in your industry
is that foreign competitors are willing to pay big money
for insider information.
And your boss is concerned that a particular employee
might be tempted, especially,
especially if they thought the likelihood
of being caught was low.
So she's come to you and she's asked you for recommendations
of how to mitigate this risk.
And my question to you is, what are your recommendations?
Okay, so the buzz here is that a foreign competitor, right?
Really willing to pay big, big money
for insider information.
And we've got this particular employee
who he's worried might be tempted,
especially if the likelihood of being caught was low.
So come to you for recommendations,
What are you gonna do?
Great time to put me on pause, write down some notes,
tell me what your recommendations are.
Come on back and we'll do these together.
Well, the first thing we wanna do is we wanna identify
what type of information or data sets
are being sought, right?
So what does that foreign competitor want
so that we can catalog them, right?
We need to know what it is we're trying to protect.
Then we can assess access rights and permissions
to those data sets.
So who has rights and permissions to them?
And whenever possible, reduce the exposure.
That means implementing the principle of least privilege.
Remember least privileges,
assigning the least rights and permissions
to get a job done.
So let's not give anybody any more rights
or permissions to those data sets than they need.
And then we can implement a DLP,
a data loss prevention solution
that can monitor that target data
while it's in use and in motion, including email.
But we have to start
with identifying what the type of information is
'cause we don't want the DLP to have to look at everything
that happens and be making decisions, right?
We wanna really be able to target the DLP solution
to specifically the types of data sets
that we think that foreign competitor is trying to extract.
We'll then configure the DLP to quarantine
any suspicious activity.
And we can also use endpoint DLP
to restrict use of removable media.
So we've got two things happening here.
We're gonna configure the DLP to quarantine or stop, right?
So note, we're not gonna let that file go out.
We're gonna be look at it first
before it's allowed to go anywhere
or that email before it's allowed to go anywhere,
if it's the email based.
And then we're gonna use endpoint data loss protection
to restrict the use of removable media
because what we don't want is that employee to say,
okay, well I can't get it out through the firewall.
I can't get it out through email.
What if I just put in a USB device?
I plug one in and I just put it there,
put it in my pocket and walk out.
And we don't want that to happen either.
So we wanna be able to restrict the use of removable media
and we can do that with a DLP.
All right, how'd you do?
Lots of, lots of great ideas here, right,
of ways that we can really secure our data
and keep that foreign competitor
from getting their hands on it.
Doing that, well, definitely security and action.
All right, there's your word cloud, quite a bit, right?
Make sure that you really understand everything that's here.
You can speak to it, you're confident before you move on.
Once you're ready, I'll see you at the next lesson.