- In this lesson, 17.2,
we're gonna focus in on three tools, specifically:
SNMP, NetFlow, and SCAP.
Are you ready? All right, let's do it.
So starting with SNMP,
which stands for Simple Network Management Protocol.
Now, Simple Network Management Protocol, or SNMP,
is a widely used network management protocol
that allows administrators to monitor and to manage devices.
Now, what does SNMP do for us?
Well, SNMP provides a standardized framework
for collecting and organizing information
about our network devices and their performance.
Now, the most current version is version three.
It's not just the most current,
but it's also the most secure version.
SNMPv3 incorporates features
like authentication, encryption, and access control,
which we didn't have in earlier versions,
providing a much more robust security platform
for SNMP communications.
Now, there are three primary SNMP components:
the managed devices, the devices we wanna manage,
SNMP agents, and SNMP managers.
Now, managed devices are the network devices
that are being monitored and managed using SNMP.
So for example, a router, a switch, a server, a printer,
or other network appliances.
An Agent are software modules
that we install on the managed devices.
Now, those Agents are responsible
for collecting and storing information
about the device's performance
and responding to queries or questions
from the SNMP management systems.
And then we have the SNMP managers
and they're really part of the management system, right?
They send SNMP queries to agents to retrieve information
and they can also issue configuration commands
to the device.
So three pieces:
our device, our agents, and our managers or management.
Lemme walk you through an example of network monitoring
with SNMP.
So a network administrator sets up SNMP agents
on router, switches, and other network devices.
SNMP management systems are configured
to send periodic queries, in this case, GET requests,
to the SNMP agents.
And the GET request is asking
to retrieve network performance data and device status.
The management system will collect that SNMP data,
such as interface utilization, error rates, CPU usage
and memory usage, right,
to really monitor that the health and the performance
of the network.
Thresholds and alarms can then be set
to trigger notifications,
those are known as SNMP traps,
when certain conditions are met,
such as excessive bandwidth usage or device failures.
So that's how we're gonna do network monitoring
with SNMP.
Next up is NetFlow.
NetFlow is a network protocol
developed by Cisco Systems that allow the collection
and analysis of network traffic data.
NetFlow enables the monitoring of network traffic
by capturing and analyzing flow data.
So what's flow?
Well, a flow represents a sequence of packets
that share common characteristics,
such as source and destination IP address, port, protocol,
or other attributes.
NetFlow-capable devices, such as a router and a switch,
generate flow records containing information
about those network flows.
IPFIX is an industry-standard protocol
based on NetFlow version nine
that does provide vendor-agnostic format.
So let's look at some NetFlow use cases.
We can use it for traffic analysis, capacity planning,
bandwidth utilization, malicious sources,
and to detect anomalies.
So traffic analysis,
giving us visibility into network traffic patterns.
Capacity planning, insights into source volume,
and help us identify bottlenecks.
Bandwidth utilization to track
and trend bandwidth utilization.
Malicious sources to identify sources
of malicious traffic, as well as DDoS attempts
and any unauthorized access,
and to detect anomalies or suspicious network activities.
So let me give you an example of using NetFlow
and SNMP together for capacity planning.
An organization wants to assess its current
and future capacity.
NetFlow data provides insights into traffic patterns,
peak usage periods, and application usage trends,
allowing the company to identify
potential bandwidth bottlenecks.
The SNMP monitoring tracks the performance
and the utilization of network devices such as CPU,
memory and interface statistics
to determine if upgrades
or additional resources are going to be needed.
Now, by analyzing the NetFlow and the SNMP data,
the company can make informed decisions
about network updates, equipment provisioning,
and resource utilization.
A third tool we're gonna look at is SCAP,
Security Content Automation Protocol.
SCAP is a collection of open standards
developed by the National Institute
of Standards and Technology, or NIST,
to help organizations automate the process
of managing and evaluating security configurations
and vulnerabilities in computer systems.
The SCAP provides a standardized approach
for expressing and sharing security-related information,
including configuration settings,
vulnerability data, and patch management.
It consists of several components standards
that work together.
I'm gonna show you those in just a sec.
Now, if you're really interested in SCAP,
you can learn much more about it at the NIST SCAP project.
So you can go out to nist.gov, you can search for SCAP,
or you can follow the link that you see
on the bottom of your screen.
So what are all the components that feed into SCAP?
Well, we have the Common Vulnerabilities & Exposures,
CVEs, Common Configuration Enumeration, CCE,
Common Platform Enumeration, CPE,
the Common Vulnerability Scoring System, the CVSS,
and Open Vulnerability and Assessment Language, OVAL.
Now, we've already talked about two of them, right?
We've talked about Common Vulnerabilities & Exposures,
CVE, and the Common Vulnerability Scoring System, CVSS.
So we will do a refresh on those
but then we've got three new ones to look at.
Remember that the CVEs are common identifiers
for publicly known security vulnerabilities.
Common Configuration Enumeration, CCE,
is common identifiers for system configurations.
CPE, Common Platform Enumeration, is a naming convention
for identifying software applications,
operating systems and hardware devices.
The CVSS, which we looked at earlier,
is a framework for assessing
the severity of software vulnerabilities.
And lastly, Open Vulnerability and Assessment Language,
or OVAL, is a standardized language
for expressing vulnerability assessments
and configuration checks.
So let's take a look at how we can use SCAP
in our vulnerability management.
An organization uses a SCAP-compliant
vulnerability scanning tool
to periodically scan their network devices and systems.
The tools leverage SCAP's standardized
vulnerability definitions, the CVEs,
and the scoring system, the CVSS,
to identify vulnerabilities
and assign severity levels.
The scan results are presented in a unified format,
allowing administrators to prioritize
and remediate vulnerabilities based on their severity.
And then SCAP content,
such as security benchmarks and checklists,
is used to assess the compliance
of the system configuration with industry standards
and best practices.
So three really interesting tools, right,
SNMP, NetFlow, and SCAP.
And that, my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each.
You know what to do?
Network management protocol that allows administrators
to monitor and manage network devices.
One, two, three.
It's gonna be SNMP,
Simple Network Management Protocol.
Number two, SNMP software modules that are installed
on a managed device.
One, two, three.
That's an agent. SNMP Agent.
Number three, industry-standard protocol
based on NetFlow version nine
that provides a vendor-agnostic format.
One, two, three.
That's IPFIX.
Number four, a standardized approach
for expressing and sharing security-related information.
One, two, three.
That's gonna be our Security Content Automation Protocol,
or SCAP.
And lastly, number five, a standardized language
for expressing vulnerability assessments
and configuration checks.
One, two, three.
You gonna get it? I hope so.
That's OVAL, or Open Vulnerability and Assessment Language.
So that brings us to a security in action.
And this one's about monitoring tools.
Now, your company employs SNMP, NetFlow and SCAP.
But you are convinced that the company isn't using the tools
to their full potential,
and you're exploring ways to integrate them
with management processes.
Your first initiative is incident response.
So I want you to explain to me
or actually to your colleagues, right,
how SNMP, NetFlow, and SCAP can be practically be applied
for incident response.
So put me on pause.
This definitely, this might take a little bit of time.
Think about how you're going to use those three tools
in an incident response scenario.
Well, during a security incident,
the NetFlow data can be used
to reconstruct network activities,
trace the source and the spread of the attack,
and understand the impact.
SCAP can be employed to assess affected systems
for vulnerabilities, check configurations,
and identify potential security weaknesses
that might've been exploited.
And SNMP traps and SNMP management systems play a role
in the actual real-time incident detection and alerting,
providing notification for critical security events.
So all three of them really have a role to play
in incident response.
And you were right on target when you thought,
you know what,
we could probably make better use of these tools
rather than looking at them each discreetly,
how can we use all of them together, right,
to really address some management processes.
Being able to do that, definitely security in action.
There's your word cloud.
You know what to do.
And when you're ready,
I'm gonna see you at our next deep dive quiz.