- In this lesson, 18.2,
we're gonna be taking a look at TCP/IP,
both v4 and v6,
as well as secure protocols.
Now, IP, Internet Protocol,
is really a set of rules for routing and addressing packets
and it is the language of the Internet.
It wasn't always the language, though,
that we used in our local-area networks
or even our wide-area networks.
But ultimately, over time,
as we all connected together
and we all connect to the Internet,
we needed to have a standardized set of rules
for routing and addressing packets of data, and IP won.
So, IP is the language of the Internet
and the language that we use for data transfer.
But it was originally just designed
for basic data connectivity.
But then it turned out that once we were using IP
for our data transfer,
to go, "Well, why can't we use that protocol
or that set of rules for everything else?"
So, we started to.
Now, IP convergence is a term we use to describe the use
of the Internet Protocol as a standard transport
for transmitting all information,
voice, data, music, video, TV, teleconferencing, and so on.
So, IP convergence, that's a term you wanna remember.
Now, there may have been needed to be
some modifications to make this work,
so extensibility is another term I want you to know.
Extensibility is additional functionality
or the modification of existing functionality
without significantly altering
the original structure or data flow.
A complimentary term is open standard.
Now, open standard is a standard that is publicly available
and can be freely adopted and extended.
Our traditional TCP/IP model is four layers.
We have a link layer, an Internet layer,
a transport layer, and an application layer.
And so, down at our link layer,
that's where we have physical,
Token Ring, Frame Relay, ATM.
This is where electrical signals are
and packets coming on and off the network.
The Internet layer's where we have IP
and we have ARP, ICMP, and IGMP,
and we're gonna go more into detail on those
in just a moment.
The transport layer's where we have
Transmission Control Protocol and User Datagram Protocol.
And up at the application layer,
that's where we have our legacy to begin with,
TCP/IP Protocol Suite.
Now, these apps or utilities were really, again,
designed for data transfer and not for security.
Let's talk about what happens at the Internet layer
and the transport layer and the application layer.
The Internet layer, we have IP.
We have ARP, Address Resolution Protocol.
We have ICMP,
the Internet Control Messaging Protocol,
and IGMP,
which is the Internet Group Management Protocol.
Then, when we go up to the transport layer,
we have TCP, Transmission Control Protocol,
and UDP, User Datagram Protocol.
IP is a set of addressing and routing rules.
The current versions are IPv4 and IPv6.
Our Address Resolution Protocol
is used for IP address to MAC address mapping.
Now, IPv6 doesn't use ARP.
It actually uses what's known
as Neighborhood Discovery Protocol.
Remember we talked earlier about a MAC address,
that every network interface has a unique MAC address
that uniquely identifies that interface or that device?
But we don't talk by MAC address
on the Internet or in our local networks.
We talk by IP.
So, there has to be a way to map a MAC address
to an IP address and an IP address back to a MAC address,
and that's what we use ARP for.
ICMP, Internet Control Messaging Protocol,
we use for error control and troubleshooting.
Now, you've been using it probably without even knowing it,
but every time you run a ping command or a tracert command,
you're really using ICMP.
And then, IGMP is used for multicasting.
Now, we're not using IGMP anymore in v6.
Instead, we're using multicast listener discovery.
Then we go up to the transport layer,
and at the transport layer we have TCP and UDP.
And the difference between the two
is that Transmission Control Protocol, TCP,
is connection-oriented,
where UDP, User Datagram Protocol, is connectionless.
Let me give you an example.
In TCP, before we're really gonna be communicating,
the source and destination do what's known
as a three-way handshake.
The source says to the destination,
"Hey, destination, I wanna talk to you."
The destination says, "Cool, I wanna talk to you."
The source says,
"Confirmed, I'm about to send you a message."
They've set up a connection before they start
the rest of their communication,
so it's connection-oriented.
A connection has been established
before they start really communicating.
User Datagram Protocol is connectionless.
Let's say your machine uses a dynamic IP address
using DHCP,
so you need DHCP server,
Dynamic Host Configuration Protocol server
to give you an IP address.
So, your device comes up and it says,
"Hey, I need a DHCP server."
And if no one answers, again,
"Hey, I need a DHCP server."
It's short, little bursts,
and generally it's being broadcast and it's easy to resend.
There's no connection that gets set up first.
Matter of fact, you can't even set up the connection first
'cause you don't know who that DHCP server is.
You gotta find that DHCP server first.
That would be an example of using UDP.
Now, there are the two versions of IP,
IPv4 and IPv6.
IPv4 was deployed back in 1981
and 4 was the first publicly used version.
There were versions 1, 2, and 3,
but they were experimental.
I know you know all about IPv4.
It's a 32-bit address expressed in a dotted decimal format.
So, why didn't we just keep using IPv4 forever?
Well, it's a 32-bit address,
so we have a limited number of addresses.
IP address scarcity is really an issue.
Now, it's interesting,
because when we started first using it,
it wasn't a big deal.
And then after we'd been using it for a while,
we all got a little bit nervous and said,
"Oh, my God, we're gonna run out of addresses!"
So, we started using NAT, Network Address Translation,
or PAT, Port Address Translation, in our networks,
meaning we would use private addresses inside our network
and public addresses external to our network.
And NAT, we do our translation.
And then we were like, "Phew, okay.
Now we don't have to worry about
IP address scarcity anymore."
But voila, here we are today.
Think of all of the devices
that connect directly to the Internet.
All the embedded devices, all the IOT devices,
all of our smartphones, all of our mobile devices
that connect directly to the Internet
and do need a public address.
So, IP address scarcity as an issue raised its head again.
And there were just very limited security options
because IPv4 was really designed for data transfer
and not for security.
So, IPv6 came out in 1999,
and what's really crazy
is we are still in the adoption phase.
But I think adoption will begin to escalate.
It is a 128-bit address expressed in a hexadecimal format.
You can see an example,
the number that starts with 2001 and ends with 7334.
That's an example of how we express it in hexadecimal,
four numbers separated by a colon.
Because it's a 128-bit address,
our address space is two to the 128th addresses,
which equates roughly to 340 trillion trillion addresses.
I hate to say we're never gonna run out of something,
but I'm pretty confident in my lifetime
we probably won't run out of IP addresses.
Now, IPv6 did introduce some security options.
It has stateful and stateless
auto configuration capabilities
and it does have integrated IPsec.
Now, scans are,
vulnerability scans are less effective
because of a larger address space,
and sniffing is more difficult because of mandated IPsec.
So, from an adversary trying to do reconnaissance on us,
IPv6 really offers some security.
Now, QoS, or quality of service,
is a feature of our network devices
which prioritize traffic.
QoS controls and manages network resources
by setting priorities for certain types of data
on our network.
And measurements of concern to QoS
are bandwidth, which we think of as throughput,
latency, which we think of as delay,
jitter, which is a variance in latency,
and an error rate.
An IPv6 packet header provides for fields
that facilitate the support for QoS, or quality of service.
Now, let's move up to the application layer.
The path of communication
from the transport layer to the application layer
is through a port.
Now, a port is nothing more than an identifier.
It's how an application listens.
So, a port's an identifier
for an application within a computer,
and applications that need to talk to other applications
or hosts that need to talk to other hosts
listen for connections on a port dedicated to that service.
So, you know that when you go out port 80, HTTPS,
it's gonna be an HTTPS service that's listening,
"Oh, something's coming in port 80.
That must be for me."
Or, "Something's coming in port 443.
That must be for me.
I'm an HTTPS application."
Now, ports associated with either UDP or TCP,
there are a total of 65,535 available ports.
They're broken into three ranges.
Ports 1 to 1,023, which were assigned by the IANA,
is the Internet Assigned Numbers Authority,
and those are often referred to as the well-known ports.
The next grouping, 1,024 to 49,151,
can be registered with the IANA.
And the upper ports, 49,151
'til the very last one, 65,535,
are known as dynamic or private ports.
Sometimes an application will use those,
sometimes you'll start on a well-known port
and then you will move to a dynamic or private port.
It really behooves you to be able to recognize
some of the more common ports.
You may or may not need to have this for your exam,
but in general, really understanding ports,
because ports come up in a lot of places.
If you're doing any troubleshooting, ports will come up.
If you're doing any network sniffing and analyzing,
you're gonna be looking at packets by port.
If you are looking at firewall rules
or designing firewall rules
or auditing firewall rules
or implementing firewall rules,
it's gonna be all about ports.
If you're looking at log files, there's gonna be ports.
Being able to recognize the more common ports
is really useful,
so here's a list of some of the more common ports.
There may others that you wanna add to that list.
Let's move up to the protocol suite.
And I mentioned at the beginning of this lesson
that the protocols that are in that current protocol suite
in that picture that you see
are considered insecure protocols.
The original protocols, again,
not designed for security,
had very basic authentication,
and on the most part,
transmitted everything in cleartext.
HTTP, cleartext.
FTP, cleartext.
Doing things you don't even see here, like Telnet,
cleartext and basic authentication.
So, what we wanna do is transition
from these older, insecure protocols
to more secure protocols.
And the function of a secure protocol
is to ensure confidentiality, integrity,
authentication, non-repudiation,
or any combination of them.
And our secure protocols are commonly used
in network management and communication,
as I just said,
often replacing our older, insecure protocols.
But if we're talking about secure protocols,
we really have to start with just a quick refresher
on SSL and TLS.
SSL was developed back in 1995 by Netscape.
It was used to establish
a secure communication channel by negotiation.
It used port 443.
We don't use it anymore.
In 2015, it was deprecated
because a number of vulnerabilities were found.
New vulnerabilities continue to be discovered.
Most of our browsers no longer support SSL.
We don't wanna be using it
and we wanna make sure that we are disabling SSL 2.0 and 3.0
so that we're not vulnerable to a downgrade attack.
As we already talked about, what was SSL replaced with?
Well, TLS, Transport Layer Security.
Introduced in 1999,
it's used to establish a secure communication channel
using a cryptographic key exchange.
But it uses the same port as SSL, it uses port 443.
And I think, as I mentioned earlier,
a lot of times when people are talking about TLS,
they still use the term SSL
'cause it's just a term that was used for so long.
So, current state.
TLS is a successor
and the recommended replacement for SSL.
It provides confidentiality, integrity, authenticity.
It uses a block cipher and some advanced algorithms.
Current version right now is TLS 1.3.
That's what you should be using,
but higher versions as they come out.
And the IETF has officially declared
that both TLS 1.0 and 1.1 are deprecated,
meaning weak and vulnerable,
and should not be used.
So, what do we wanna use instead?
Well, let's talk about some secure communications
and management protocols.
HTTPS, FTPS, Secure Shell, SFTP,
SRTP, S/MIME, and DNSSec.
HTTPS is really HTTP plus TLS
to give us a secure communication channel.
FTP, File Transfer Protocol.
Well, FTPS is FTP, File Transfer Protocol,
which was a cleartext protocol
which included cleartext for your authentication,
layered with TLS becomes FTPS.
Secure Shell, or SSH.
Secure Shell creates a secure channel
between a local and a remote device.
It's really not just a protocol.
It's considered a protocol suite
'cause it does have some additional components.
So, Secure Shell, or SSH, on port 22,
absolutely 100% our Telnet replacement.
We don't wanna use Telnet for creating
a communication channel
either between two systems or to manage a system,
because Telnet, basic authentication, cleartext.
Well, SSH, or Secure Shell,
again, is a protocol suite.
And one of the protocols
that's actually packaged with SSH
is SFTP running on port 22, also.
It's Secure File Transport Protocol.
SRTP is used for securely delivering
audio and video messages over an IP network.
S/MIME is used to send digitally signed
and encrypted email messages.
And then, DNSSec,
which runs on the same port as DNS, 53,
is an extension of the DNS protocol
that enables origin authentication,
authenticated denial of existence,
and data integrity.
In other words, it allows us to secure our zone files.
So, those are the secure communication
and management protocols
that you wanna be using on a day-to-day basis,
replacing those older, insecure protocols.
And that, my friends, brings us to a 3-Second Challenge.
Let's do it.
Question one, protocol that uses a three-way handshake
to establish a connection.
One, two, three.
That's gonna be TCP, Transmission Control Protocol.
Number two, format for an IPv6 address.
What's the format?
One, two, three.
It's gonna be hexadecimal.
Remember, it's a 128-bit hexadecimal address.
Number three, networking technology that sets priorities
for specific types of data on the network.
One, two, three.
That's gonna be QoS, or quality of service.
Number four, term used to describe
a standard that is publicly available
and can be freely adopted and extended.
One, two, three.
That's gonna be an open standard.
Number five, term used to describe the modification
of existing functionality without significantly altering
the original structure or data flow.
One, two, three.
That's gonna be extensibility.
And often, when you'll see a protocol
that's extensible, that's been extended,
it'll have the letter X in it.
Okay, let's do a Security-in-Action,
this time about an IPv6 deployment.
You've been asked to investigate and report back
on why and how to start the transition
from IPv4 to IPv6.
What key points should your report touch on?
Okay, so pretty simple.
You've been asked to investigate and report
on how you're gonna move
or how you're gonna transition from IPv4 to IPv6.
Put me on pause,
get out a piece of paper, write down your key points,
and come on back.
Well, IPv6 is designed
to meet the future demands of the Internet,
ensuring that there's gonna be ample address space
for continued growth.
And importantly, IPv6
incorporates several security features.
The transition really should be transparent
to our user community.
So, step one, really invest in education and training
for our network and security engineers
so they know what they're working with.
Step two, we should verify that our ISPs,
our Internet service providers, support IPv6.
I would be stunned if they didn't,
but you should always check.
Step three, we wanna determine
if your current equipment is IPv6-ready.
Now, it should be,
assuming that you've got good refresh policies
and you're turning over your devices on a regular basis.
But you do wanna make sure that your current equipment
is IPv6-ready.
And then, this is a big transition,
so you're definitely gonna wanna make a project plan,
and if your organization uses them,
assign a project manager.
Being able to think about how to make this transition
and create this plan,
especially one that's really transparent
to our user community,
that, my friends, is definitely security in action.
Wow, that's a big word cloud.
All right, take your time, go through all of these terms.
Make sure that you understand the terms, the concepts,
you can explain them, you can teach them.
If not, go back into the lesson.
This was a long lesson.
We covered a lot of material.
And when you're ready, head to the next lesson.
I'll be waiting for you there.