-: In this section of the course,
we are going to discuss
troubleshooting network infrastructure.
The troubleshooting network infrastructure section
of the course focuses on Domain Three, security engineering,
specifically Objective 3.3,
which states that given a scenario,
you must be able to troubleshoot
complex network infrastructure security issues.
Effective troubleshooting of network infrastructure
is vital for maintaining a secure
and efficient digital environment,
quickly identifying and resolving issues is essential
to ensure system availability and protect data integrity.
Misconfigurations and security vulnerabilities
can pose significant threats
to both availability and data protection.
Therefore, comprehensive monitoring through analysis
and a deep understanding of potential vulnerabilities
are critical to safeguarding network
and operational security.
As we go through this section,
we will cover many topics related
to troubleshooting network infrastructure,
including observability, network errors,
network misconfiguration, intrusion prevention system,
and intrusion detection system issues, alert analysis,
Domain Name System security, email security, network issues,
cryptographic issues, and public key infrastructure issues.
First, we will look at observability.
Observability is the ability to monitor, understand,
and diagnose the internal states
and performance of a system based on the data it produces.
Observability concepts include monitoring,
understanding, and diagnosing.
Monitoring involves continuously collecting data
from various network components.
These components may include traffic patterns,
error rates, and system logs.
Analysis is then used to track
the network's normal behaviors,
potential issues, and anomalies.
This analysis can provide an understanding and insights
into the underlying causes of problems.
Next, diagnosis is used to locate the exact source
of a problem, enabling targeted troubleshooting
and resolution.
For example, by monitoring network traffic
and understanding the patterns,
an IT team may diagnose a specific misconfiguration
causing latency issues.
This recognition and diagnosis can enable the team
to quickly resolve the problem
and restore optimal network performance.
Next, we will explore network errors.
Network errors are issues that disrupt the normal flow
of data across a network.
Network errors often occur due to faults in configuration,
hardware or software.
Network error source types include switching errors,
routing errors, as well as a virtual private network
and tunnel errors.
Switching errors occur when data packets
are misdirected or dropped.
Switching errors may be due to the result
of incorrect virtual local area network,
or VLAN configurations, or switch port failures.
Routing errors are when incorrect or inefficient paths
are chosen for data transmission across networks.
Routing errors can be caused by misconfigured routing tables
or protocol failures.
Finally, virtual private network and tunnel errors
are failures in establishing
or maintaining secure connections between networks.
Virtual private network and tunnel errors
are often due to incorrect settings,
expired certifications, or issues with encryption protocols.
For example, if users experience connectivity issues
when accessing resources through a virtual private network,
troubleshooting might reveal a routing error combined
with a virtual private network configuration issue,
both of which need to be resolved
to restore seamless and secure network access.
After that, we will look at network misconfigurations.
Network misconfigurations include errors
or incorrect settings within network devices
that can lead to performance issues,
security vulnerabilities, or connectivity failures.
Network misconfiguration concepts
include unsecured routing and configuration drift.
Unsecured routing occurs when routing protocols
or configurations lack proper security measures
such as authentication or encryption.
In this way, unsecured routing makes the network
vulnerable to attacks, like route hijacking or spoofing.
Configuration drift is the gradual
and often unnoticed changes in network configuration
over time.
These changes can lead to inconsistencies, reduced security,
and unexpected network behavior.
For example, an organization might identify
that an outdated and insecure routing protocol,
such as the Routing Information Protocol, or RIP,
has been inadvertently left active
due to configuration drift.
This oversight could expose the network to vulnerabilities
like route injection attacks or spoofing,
where an attacker could manipulate the routing tables
to redirect traffic.
Immediate remediation would involve deactivating
the insecure protocol,
replacing it with a more secure alternative like OSPF,
or the Open Shortest Path First protocol,
with authentication enabled,
and implementing automated configuration management tools
to prevent such drift in the future.
Next, we will explore intrusion prevention system
and intrusion detection system issues.
Intrusion prevention system
and intrusion detection system issues
involve challenges related to the correct deployment,
configuration, and effectiveness of these security system.
Intrusion prevention system
and intrusion detection system issues
include poor placement, lack of rules,
and rule misconfiguration.
Placement refers to where the intrusion prevention system
or intrusion detection system is located within the network.
An incorrect placement can lead to either missed threats
or unnecessary alerts.
Next, a lack of rules
means that the intrusion prevention system
or intrusion detection system
is not equipped with the necessary policies or signatures
to identify potential threats.
Finally, rule misconfigurations occur when the rules
that define the intrusion prevention system
or intrusion detection system should flag as suspicious
are set incorrectly.
Rule misconfigurations can lead to either too many,
or too few alerts.
For example, if an intrusion prevention system
is deployed without a proper rule set
for the specific traffic patterns of the network,
it might fail to detect data exfiltration attempts
using encrypted traffic.
Alternatively, if the intrusion prevention system
is configured to overly aggressive rules,
it could mistakenly block legitimate
business critical applications,
leading to unnecessary network disruption
and operational delays.
Following that, we will look at alert analysis.
Alert analysis is reviewing and interpreting security alerts
to distinguish between genuine threats and benign activity.
Alert analysis concepts include false positives
and false negatives.
False positives occur when a system incorrectly flags
harmless activity as a security threat.
False positives lead to unnecessary alarms
and wasted resources investigating non-issues.
False negatives on the other hand,
happen when a system fails to detect real security threats.
False negatives allow malicious activities
to go unnoticed and unmitigated.
So, effective alert analysis is crucial
for accurately identifying genuine security threats,
while minimizing the impact of false positives
and false negatives on resource allocation
and threat detection.
Then we will explore Domain Name System, or DNS security.
Domain Name System security
is used to protect the system from attacks
and misconfigurations that could disrupt
or manipulate network traffic.
Domain Name System security concepts
include Domain Name System Security Extensions, or DNSSEC,
zone transfers, Domain Name System poisoning,
and sinkholing.
Domain Name System Security Extensions
add a layer of security to the name resolution process
by digitally signing Domain Name System data
to ensure its integrity and authenticity.
In this way, Domain Name System Security Extensions
prevent attackers from tampering
with Domain Name System responses.
Next, zone transfers are a normal and expected mechanism
used to replicate Domain Name System databases
across servers.
However, if zone transfers are not properly secured,
they can be exploited to gain unauthorized access
to Domain Name System data.
Next, Domain Name System poisoning, or cache poisoning,
is an attack where false Domain Name System data
is injected into a Domain Name System resolver's cache.
This false Domain Name System data may redirect users
who conduct valid queries to malicious sites.
Finally, sinkholing is a defense technique
that redirects malicious traffic,
such as that resulting from Domain Name System poisoning,
to a safe destination for analysis or mitigation.
In practice,
implementing Domain Name System Security Extensions
can prevent Domain Name System poisoning
by ensuring that Domain Name System responses
are authenticated.
While sinkholing can mitigate the impact
of any successful attack
by diverting malicious traffic
away from its intended target.
Next, we will explore email security.
Email security protects email communications from threats
like phishing, spoofing, and unauthorized access.
Email security is implemented by ensuring the authenticity,
integrity and confidentiality of messages.
Email security concepts include Sender policy Framework,
or SPF, Domain Keys Identified Mail, or DKIM,
Domain-based Message Authentication Reporting
and Conformance, or DMARC,
and Secure/Multipurpose Internet Mail Extensions, or S/MIME.
Sender Policy Framework is an email validation protocol
that allows domain owners to specify which mail servers
are permitted to send emails on their behalf,
preventing email spoofing.
Domain Keys Identified Mail adds a digital signature
to emails, allowing recipients to verify
that the message has not been altered,
and that it truly comes from the legitimate sender.
Domain-based Message Authentication Reporting
and Conformance, or DMARC,
provides a framework for email authentication
and policy enforcement
to protect against email-based attacks
based on the results of Sender Policy Framework
and Domain Keys Identified Mail checks.
Secure/Multipurpose Internet Mail Extensions, or S/MIME,
enhances email security by enabling encryption
and digital signatures in email messages.
Secure/Multipurpose Internet Mail Extensions
ensure that only the intended recipient
can read the content of a message,
and that the message itself has not been tampered with.
For example, by implementing Sender Policy Framework
to verify sending mail servers,
Domain Keys Identified Mail to ensure email integrity,
and Domain-based Message Authentication Reporting
and Conformance to enforce policies
and report fraudulent activity,
an organization can significantly reduce the risk
of email spoofing.
Additionally, using Secure/Multipurpose Internet
Mail Extensions to encrypt sensitive emails
ensures that even if a message is intercepted,
the contents remain secure and accessible
only to the intended recipient,
providing a comprehensive end-to-end protection
for email communications.
Then we will explore network issues.
Network issues include problems that disrupt the normal flow
of network data and affect connectivity,
performance, or security.
Network issues include Network Access Control List issues,
resource exhaustion,
and Distributed Denial of Service attacks.
Network Access Control List issues arise
when incorrectly configured rules
allow inappropriate network traffic,
or block legitimate network traffic.
Resource exhaustion is the depletion of critical resources
like bandwidth, memory, or processing power.
Resource exhaustion is often caused by excessive demand
or poor resource management,
and leads to degraded network performance or even outages.
Distributed Denial of Service attacks
involve overwhelming a network or service
with a flood of traffic from multiple sources
with the goal of resource exhaustion,
and making the targeted services unavailable
to legitimate users.
For example, if a Distributed Denial of Service attack
targets a network improperly configured,
Network Access Control List might fail
to block the malicious traffic,
resulting in resource exhaustion
and significant network downtime.
Following that, we will look at cryptographic issues.
Cryptographic issues are problems related
to the implementation and functioning of encrypted protocols
that secure data.
Cryptographic issues include
Transport Layer Security errors, cipher mismatches,
and issues with cryptographic implementation.
Transport Layer Security or TLS errors,
occur when there are problems with the negotiation
or establishment of a secure connection.
Transport Layer Security errors
are often due to expired certificates,
incorrect configurations, or unsupported protocol version.
Cipher mismatch occurs when the client and server
cannot agree on a cipher suite
during the Transport Layer Security handshake,
leading to a failed or insecure connection.
A cipher suite is a set of algorithms that define
how encryption, authentication, and key exchange
are implemented in a secure communication session.
Next, issues with cryptographic implementation are flaws
or vulnerabilities in the way
that cryptographic algorithms are applied
and include weak encryption methods
or improper key management.
Issues with cryptographic implementation
can result in data being inadequately protected.
Finally, we will look at Public Key Infrastructure issues.
Public Key Infrastructure, or PKI issues,
are problems related to the management,
deployment and functioning of the Public Key Infrastructure.
Public Key Infrastructure issues undermine the security
of encrypted communications and digital certificates,
and can include misconfigured Certificate Authorities,
expired or improperly issued certificates,
and challenges in the certification revocation process.
Each of these Public Key Infrastructure issues
can lead to failures in establishing trust
between communicating parties.
Additionally, improper key management or distribution
can result in unauthorized access or data breaches
as keys may be compromised or used incorrectly.
For example, if a certificate expires
and is not renewed in time,
clients may be unable to establish secure connections,
highlighting the need
for effective Public Key Infrastructure management
to ensure continuous trust
and secure communication within the network.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course.
And we will review each of those quiz questions fully
to ensure you can explain why the right answers were right,
and the wrong answers were wrong.
So let's get ready
to dive into troubleshooting network infrastructure
in this section of the course.