Advanced Network Security: Module 2

MSc Cybersecurity — Comprehensive Course Notes

1: INTRODUCTION TO FIREWALLS
1.1 Understanding Firewalls
1.1.1 Definition and Purpose
Firewalls are the essential element of what we call ‘network protectors’ that protect our networks
from hackers, malicious codes and intruders. They filter traffic coming to your computer or
network and depending on the manner in which they have been configured to treat good and bad
traffic. They raise an alarm when they sense a troubled situation.

Core Functions of a Firewall:

Filters incoming and outgoing network traffic
Acts as a barrier between trusted internal networks and untrusted external networks
Enforces security policies at the network boundary
Monitors and logs network activity
Raises alerts when suspicious activity is detected

Why Firewalls are Essential:

Benefit Description

Traffic Filtering Controls what traffic enters and leaves the network

Restricts access to network resources based on security policies

Access Control

Monitoring Provides visibility into network activity

Alerting Raises alarms for suspicious or malicious activity

Network Segmentation
Creates boundaries between different network zones

1.1.2 How Firewalls Work

Firewalls give good control for network administrators to monitor traffic going in and out of
your network, thus minimizing the probability of possible attacks. They operate by examining
network packets and making decisions based on predefined rules.
Firewall Decision Process:
1. Packet Arrival — A packet arrives at the firewall interface
2. Rule Evaluation — The firewall checks the packet against its rule set
3. Decision — Based on the rules, the packet is either:
Allowed — Permitted to pass through
Blocked — Dropped or rejected
Logged — Recorded for audit purposes
4. Action — The firewall takes the appropriate action

Information Examined by Firewalls:

 Information Type Description Purpose

Source Address IP address of the sender Identifies where traffic originates

Destination Address
IP address of the receiver Identifies where traffic is going

Identifies the application sending traffic

Source Port Port number of the sender

Identifies the application receiving

Destination Port Port number of the receiver traffic

Protocol Determines the communication method

TCP, UDP, ICMP, etc.

Indicates the state of TCP connections

TCP Flags SYN, ACK, FIN, RST, etc.

The actual data being transmitted

Packet Payload Enables deep packet inspection

1.2 Types of Firewalls

Firewalls can be categorized into three main types based on how they operate and what level of
inspection they perform.
1.2.1 Proxy Firewalls
Definition: In a proxy firewall type, both incoming and outgoing transmission is stopped at the
firewall. If the connection is allowed, the firewall initiates a connection with the destination host
on behalf of the originating source host.
How Proxy Firewalls Work:
1. A client attempts to connect to a destination
2. The connection is intercepted by the proxy firewall
3. The firewall evaluates the connection request against its policies
4. If allowed, the firewall establishes a connection to the destination
5. The firewall acts as an intermediary, forwarding traffic between the two parties
6. The identity of individual computers in the network is hidden
Key Characteristics:
Connection Interception — All connections are stopped at the firewall
Proxy Initiation — The firewall initiates connections on behalf of clients
Identity Hiding — The internal network structure is hidden
Application Awareness — Can inspect application-layer data

Advantages of Proxy Firewalls:

Provides application-layer protection
Hides internal network structure
Can authenticate users before allowing connections
Provides detailed logging of application activity
Can cache frequently requested content for performance

Disadvantages of Proxy Firewalls:

 Requires more memory and resources to operate
Causes a decrease in the speed of transmission
May not support all protocols
Can be complex to configure

Proxy Firewall Sub-Types:

Application-Level Firewalls
Definition: A proxy server program called application layer gateway, which operates on a firewall
system between two networks, implements the application level firewall.
How Application-Level Firewalls Work:

1. When a client attempts a connection to the destination, it first connects to a proxy or

application gateway and negotiates with it
2. The application gateway establishes the connection with the destination (which is
behind a firewall) on behalf of the client
3. The application gateway hides the identity of individual computers in the network
4. In effect, there are two connections:
One from a client to proxy
One from a proxy to the destination
5. The application gateway decides which packets to forward and which not to
forward
Characteristics:

Operates at the application layer of the OSI model

Understands specific application protocols (HTTP, FTP, SMTP, etc.)
Can inspect application-layer payloads
Provides the highest level of security

Protocol-Specific Gateways:
HTTP Proxy — For web traffic
FTP Proxy — For file transfer traffic
SMTP Proxy — For email traffic
DNS Proxy — For domain name resolution

Disadvantages:
Requires more memory and resources to operate
Causes a decrease in the speed of transmission
Protocol-specific gateways must exist for each application
May not support all applications

Circuit-Level Firewalls
Definition: The circuit level firewall hides the identity of an originating server, but it does this
without a proxy server. This firewall simply creates a circuit between the client and
the server within which it allows the communication via a firewall.

How Circuit-Level Firewalls Work:

1. The firewall maintains a table whose entries determine what connections are allowed
or denied through the firewall
2. It verifies if a client computer is using a valid TCP protocol
3. If valid, it compares the connection with the list in the table
4. If found to be true, the connection is allowed; otherwise, it is not
Characteristics:

Operates at the session layer of the OSI model

Does not require a proxy server
Creates circuits between clients and servers
Maintains connection tables

Advantages:

Less resource-intensive than application-level proxies

Faster than application-level proxies
Can support multiple protocols

Disadvantages:

Less application awareness than application-level proxies

Cannot inspect application-layer payloads
Limited protocol support

Comparison: Application-Level vs. Circuit-Level Firewalls

Aspect Application-Level Firewall Circuit-Level Firewall

OSI Layer Application layer Session layer

Proxy Required Yes No

Resource Usage High Low

Speed Slower Faster

Protocol Understanding Protocol-specific Protocol-agnostic

Security Level Higher Moderate

Application Awareness Yes No

1.2.2 Packet-Filtering Firewalls

Definition: In the process of packet filtering, each packet is verified for certain facts such as source
and destination addresses, source and destination application ports, TCP flags, and which protocol
is used for communication.
How Packet-Filtering Firewalls Work:

1. Each packet is examined individually

2. The firewall checks specific packet header information:
Source and destination IP addresses
Source and destination application ports
TCP flags (SYN, ACK, FIN, RST, etc.)
Protocol type (TCP, UDP, ICMP, etc.)
3. The packet is compared against an Access Control List (ACL)
4. Based on the ACL rules, the packet is allowed or blocked
Access Control Lists (ACLs):

Stored in the firewall

Instruct the firewall which data packets are allowed to enter
Define which packets should be blocked
Can be configured and updated by administrators

How ACLs Work:

Rule Component Description

Sequence Number Order of rule evaluation

Source Address Where traffic originates

Destination Address Where traffic is going

Protocol TCP, UDP, ICMP, etc.

Source Port Port from which traffic originates

Destination Port Port to which traffic is directed

Action Permit or Deny

Logging Whether to log matching packets

Characteristics:
Operates at the network layer of the OSI model
Stateless — does not maintain connection state information
Examines each packet in isolation
Fast and efficient

Advantages of Packet-Filtering Firewalls:

Simple to implement
Fast processing speed
Low resource requirements
Cost-effective
Transparent to users

Disadvantages of Packet-Filtering Firewalls:

Does not maintain state information about active sessions

Vulnerable to IP spoofing attacks
Limited application awareness
Cannot detect attacks that span multiple packets
ACLs must be kept updated

Limiting Feature:

“The limiting feature of the firewall is that it does not maintain the state information about active
sessions.”
This means that packet-filtering firewalls cannot determine if a packet is part of an existing
connection or a new connection attempt.
Security Concern:
 “For packet firewalls to work precisely, the ACL should always be kept updated in an organisation, saying
exactly what the firewall should allow or block into the system.”

1.2.3 Stateful Inspection Firewalls

Definition: Stateful inspection firewalls maintain the state information about active sessions which
are known as ‘dynamic state tables’. This will prevent an attacker from trying to pose as part of an
already existing communication session, from passing through a firewall.
How Stateful Inspection Firewalls Work:

1. When a connection is initiated, the firewall creates an entry in a dynamic state table
2. The state table tracks:
Source and destination IP addresses
Source and destination ports
Connection state (SYN_SENT, ESTABLISHED, etc.)
Sequence numbers
Timers for connection timeouts
3. For subsequent packets, the firewall checks the state table
4. Only packets that match an existing state table entry are allowed
5. When a connection is closed, the state table entry is removed

Dynamic State Tables:

Field Description

Connection ID Unique identifier for the connection

Source IP IP address of the source

Source Port Port of the source

Destination IP IP address of the destination

Destination Port Port of the destination

Protocol TCP, UDP, etc.

State Connection state (SYN_SENT, ESTABLISHED, etc.)

Sequence Numbers TCP sequence numbers

Timer Connection timeout

Application Data Contextual information about the application

State Table Management:
Action Description

Creation New entry added when connection initiated

Update Entry updated as connection progresses

Removal Entry removed when connection ends

Timeouts Entries removed if no activity within timeout period

Connection States in Stateful Inspection:

State Description

LISTEN Server waiting for connection request

SYN_SENT Client sent SYN, waiting for SYN-ACK

SYN_RECEIVED Server received SYN, sent SYN-ACK

ESTABLISHED Connection established

FIN_WAIT Connection closing

CLOSED Connection closed

How Stateful Inspection Prevents Attacks:

Spoofing Prevention — Packets must match existing state entries
Replay Prevention — Sequence numbers are tracked
SYN Flood Protection — Connection timers prevent resource exhaustion

Characteristics:
Maintains state information about active sessions
Uses dynamic state tables
Examines parameters in TCP or higher layers of the OSI model
Provides more security than packet filtering

Advantages of Stateful Inspection Firewalls:

Prevents IP spoofing attacks
Blocks packets that don’t match existing sessions
Provides better security than packet filtering
Can detect anomalies in connection states
Disadvantages of Stateful Inspection Firewalls:

The process is complex in nature

Slows down traffic at the firewall
With a large number of connections, the dynamic state table grows in size
Results in more complexities

“The process is complex in nature and slows down the traffic at the firewall. Also,
with a large number of connections the dynamic state table grows in size, resulting in more
complexities.”
1.2.4 Comparison of Firewall Types
Feature Packet Filtering Stateful Inspection Proxy Firewall

OSI Layer Network Layer Network/Transport Application/Session

State Awareness None Full state tracking Session tracking

Speed Fastest Medium Slowest

Security Level Basic Good Best

Resource Usage Low Medium High

Application Awareness
Limited Limited Full
Spoofing Protection Limited Good Best

Connection Tracking No Yes Yes

Scalability Best Good Limited

2: DMZ (DEMILITARIZED ZONE)

2.1 Introduction to DMZ
2.1.1 Definition
DMZ (Demilitarized Zone) is a computer host or small network inserted as a “neutral zone” between a
company’s private network and the outside public network.
Purpose of DMZ:
Network construct that provides secure segregation of networks
Hosts services for users, visitors, or partners
Provides a multilayered, defence-in-depth approach to security
Key Concept:
“DMZ use has become a necessary method of providing a multilayered, defence-in-depth
approach to security.”

2.1.2 Why DMZ is Important

Firewalls are essential for the secure segregation of networks. A DMZ provides:

Benefit Description

Isolation Public-facing services are isolated from internal networks

Compromise Containment If a DMZ system is compromised, the internal network remains

protected

Multiple Security Layers

Provides additional layers of protection

Access Control Enables granular control over what services are accessible
 “DMZ has proven to be more secure and to offer multiple layers of protection for the security of the
protected networks and machines.”

2.1.3 DMZ Architecture

Single Firewall Architecture:

Dual Firewall Architecture:

Internet Firewall 1 DMZ Firewall 2 Internal Network

Key Components:

Component Description

External Firewall Protects the DMZ from the internet

Internal Firewall Protects the internal network from the DMZ

DMZ Network Houses public-facing servers (web, email, DNS)

Internal Network Houses internal systems and data

2.1.4 Bastion Host

Definition: The Device in a DMZ that is built to withstand attacks.

Characteristics of a Bastion Host:

Characteristic Description

Operating system is secured and stripped of unnecessary services

Hardened OS

Minimal Services Only required services are running

Strong Authentication
Robust authentication for administrative access

Extensive Logging Comprehensive logging of all activity

Regular Updates Patched regularly

Limited Access Access restricted to authorized administrators

Bastion Host Security Measures:

Remove all unnecessary services
Disable all unnecessary user accounts
Enable comprehensive logging
Install and configure host-based firewall
Apply security patches immediately
 Use strong passwords and authentication

2.1.5 Multi-Tiered Firewall with a DMZ

“A multi-tiered firewall is useful for protection from both internal and external networks.”
Multi-Tiered Architecture:

External Firewall (Tier 1)

DMZ (Public Servers)

Benefits of Multi-Tiered Firewall:

DMZ is established, separated, and protected from both the internal and external networks
Each firewall can have its own security policies
Internal firewall provides protection from internal threats as well

2.1.6 DMZ Designs

“DMZ designs generally consist of firewalls and segments that are protected from
each other by firewall rules and routing as well as the use of RFC 1918 addressing on the internal
network.”
Design Considerations:

Consideration Description

Firewall Rules Define what traffic can flow between zones

Routing Control how traffic is directed between segments

RFC 1918 Addressing Use private IP addresses on internal networks

Network Segmentation Separate logical and physical network segments

RFC 1918 Address Ranges:

Range Class CIDR

[Link] – [Link] Class A /8

[Link] – [Link] Class B /12

[Link] – [Link] Class C /16

“Design of the DMZ is critically important to the overall protection of the internal network.”

2.1.7 DMZ Protocols

“Certain protocols are vulnerable to attack and should be used with caution.”
Common DMZ Services and Protocols:

Service Protocol Port Best Practice

Web HTTP/HTTPS 80, 443 Use HTTPS with valid certificates

Email SMTP, POP3, IMAP 25, 110, 143 Use TLS for secure connections

DNS DNS 53 Limit recursive queries

FTP FTP 20, 21 Use SFTP or FTPS instead

SSH SSH 22 Use strong authentication

VPN IPSec, SSL Various Use strong encryption

Protocol Vulnerability Considerations:

Protocol Vulnerability Recommendation

HTTP Clear text transmission Use HTTPS instead

FTP Clear text credentials Use SFTP or FTPS

Telnet Clear text credentials Use SSH instead

DNS Cache poisoning Use DNSSEC

SNMP Clear text community strings Use SNMPv3 with encryption

2.1.8 Access Control Lists (ACLs) in DMZ

Definition: Access Control Lists (ACLs) determine who is allowed access to an item in a network and
how that item can be used.
ACL Components:

Component Description

Source Who is requesting access

Destination What is being accessed

Protocol How the access is being requested

Port Which service is being accessed

Action Permit or Deny

Logging Whether to log the access attempt

ACL Best Practices:

Default to deny all traffic

 Only permit what is necessary
Order rules from most specific to most general
Log denied traffic for analysis
Review ACLs regularly

3: SECURITY POLICY
3.1 Introduction to Security Policy
3.1.1 Definition
A Security Policy is a set of rules, procedures, and guidelines that define how an organization
protects its information assets. It establishes the framework for security
management and provides direction for security-related decisions.

3.1.2 Components of a Comprehensive Security Policy

“The security policy components constitute: Governing Policies, Technical Policies, and End-
user Policies.”
Policy Hierarchy:

“The hierarchy of a corporate policy structure that is aimed at effectively meeting the needs of all
audiences like partners, customers, managers, etc.”

3.2 Governing Policies

3.2.1 Definition
Governing Policy is a high-level treatment of security concepts that are important to the company.
Managers and technical custodians are the intended audiences.
“The governing policy controls all security-related interaction among business units and
supporting departments in the company. In terms of detail, the governing policy answers the ‘what’
security policy questions.”

3.2.2 Key Characteristics

Characteristic Description

High-Level Focuses on concepts rather than technical details

Broad Scope Covers security across the entire organization

Strategic Aligns with business objectives

Long-Term Provides direction over time

Authoritative Must be approved at the highest levels

3.2.3 Purpose of Governing Policy

1. Controls Security Interactions — It controls all security-related interactions among
business units and supporting departments in the company.
2. Alignment with Existing Policies — It aligns closely with not only existing company policies,
especially human resource policies, but also any other policy that mentions security-
related issues, such as issues concerning email, computer use, or related IT subjects.
 3. Policy Level — It is placed at the same level as all companywide policies.

4. Support for Other Policies — It supports the technical and end-user policies.

3.2.4 Key Components of Governing Policy

“A statement of the issue that the policy addresses. A statement about your position as IT
manager on the policy. How the policy applies to the environment. The roles
and responsibilities of those affected by the policy. What level of compliance to the policy is
necessary. Which actions, activities, and processes are allowed and which are not. What are
the consequences of non-compliance.”
Detailed Components:

Component Description

Issue Statement What problem or issue does the policy address?

Position Statement What is the organization’s position on the issue?

Application Scope How does the policy apply to the environment?

Roles and Responsibilities Who is responsible for what under this policy?

Compliance Requirements What level of compliance is necessary?

Allowed Actions What is permitted under the policy?

Prohibited Actions What is not permitted under the policy?

Consequences What happens when the policy is violated?

3.2.5 Intended Audience of Governing Policy

“The intended audience of Governing Policy is Technical custodians and Managers.”
Why Both Audiences:
Managers — Need to understand security direction and resource requirements
Technical Custodians — Need to understand security requirements for
implementation

3.3 Technical Policies

3.3.1 Definition
Technical policies are used by security staff members as they carry out their security
responsibilities for the system. These policies are more detailed than the governing policy and
are system or issue specific.
“Security staff members use technical policies as they carry out their security responsibilities for the
system. These policies are more detailed than the governing policy and are a system or issue
specific (for example, access control or physical
security issues).”

3.3.2 Level of Detail

“In terms of detail, technical policies answer the ‘what,’ ‘who,’ ‘when,’ and ‘where’ security policy
questions. The ‘why’ is left to the owner of the information.”
Question Coverage:
 Question How Technical Policies Answer It

What What specific technical controls are required?

Who Who is responsible for implementing and maintaining the controls?

When When should the controls be implemented or updated?

Where Where should the controls be applied (which systems)?

Why Left to the owner of the information (business case)

3.3.3 Types of Technical Policies

“Types of policies include Operating Systems, Application, Network, and Mobile Devices.”
Policy Categories:
Category Description Examples

Operating System Policies Password policies, patch management,

Security controls for OS access controls

Application Policies Security controls for Secure development, application access,

applications data handling

Security controls for Firewall rules, VPN policies, network

Network Policies networks segmentation

Mobile Device Policies Security controls for mobile BYOD policies, device encryption, remote
devices wipe

3.3.4 Typical Technical Policy Categories

“General policies, Email policies, Remote-access policies, Personal device and phone policies,
Application policies, Network policies, Wireless communication policy, Document retention
policy.”

Policy Category Description

General Policies Broad technical security policies

Email Policies Email usage, encryption, retention

Remote-Access Policies VPN, remote desktop, teleworking

Personal Device Policies BYOD, smartphones, tablets

Application Policies Application usage, installation, security

Network Policies Network access, segmentation, monitoring

Wireless Communication Policy Wi-Fi security, guest networks

Document Retention Policy Data storage, archiving, deletion

3.4 End-User Policies
3.4.1 Definition
End-user policies are compiled into a single policy document that covers all the topics pertaining to
information security that end users should know about, comply with, and implement.
“End-user policies are compiled into a single policy document that covers all the topics
pertaining to information security that end users should know about, comply with, and
implement.”

3.4.2 Key Characteristics

Characteristic Description

Single Document All end-user policies in one place

User-Friendly Written for non-technical users

Comprehensive Covers all relevant topics

Actionable Provides clear guidance on what to do

“Grouping all the end-user policies together means that users have to go to only one place and read
one document to learn everything that they need to do to ensure
compliance with the company security policy.”

3.4.3 Level of Detail

“In terms of detail level, end-user policies answer the ‘what,’ ‘who,’ ‘when,’ and ‘where’ security policy
questions at an appropriate level of detail for an end user.”
Question Coverage:
Question How End-User Policies Answer It

What What users are expected to do

Who Who these policies apply to

When When users need to follow these policies

Where Where these policies apply (which systems, locations)

3.4.4 Policy Hierarchy and Overlap

“This policy may overlap with the technical policies and is at the same level as technical
policy.”
Why Overlap Exists:
Both technical and end-user policies need to address the same security topics
Technical policies provide implementation details for administrators
End-user policies provide guidance for employees

3.5 Relationship Between Policy Types

3.5.1 Policy Hierarchy
Level Policy Type Audience Level of Detail
 Governing Policy Managers, Technical
Top Custodians High-level (“What”)

Technical System-specific (“What, Who, When,

Middle Policies Security Staff Where”)

End-User User-friendly (“What, Who, When,

Middle Policies All Employees Where”)

3.5.2 How Policies Support Each Other

Governing Policy — Supports technical and end-user policies
Technical Policies — Implement governing policy requirements
End-User Policies — Communicate requirements to employees

4: NETWORK SECURITY TESTING TOOLS AND

TECHNIQUES
4.1 Introduction to Network Security Testing

4.1.1 Definition
Network Testing involves testing Network devices, servers, and DNS for vulnerabilities or threats. It
is the process of evaluating network infrastructure to identify security weaknesses that could be
exploited by attackers.

4.1.2 What Network Testing Covers

“Network Testing involves testing Network devices, servers, and DNS for vulnerabilities or
threats.”
Components Tested:

Component Description

Network Devices Routers, switches, firewalls, access points

Servers Web servers, mail servers, database servers, file servers

DNS Domain Name System configuration and security

Network Protocols TCP/IP, routing protocols, application protocols

4.2 Guidelines for Network Security Testing

4.2.1 Critical Areas Should Be Tested First
“Most critical areas should be tested first – In case of network security, areas which are exposed
to the public are considered to be critical. So focus should be on
firewalls, web servers, routers, switches and systems that are open to mass crowd.”
Priority Order for Testing:

Priority Areas to Test Reason

1 Public-facing systems Most accessible to attackers

2 Firewalls Primary defense mechanism

3 Web servers Common attack targets

4 Routers and Switches Network infrastructure

5 Critical internal systems High-value targets

4.2.2 Up to Date with Security Patches

“System under test should always have the latest security patch installed in it.”

Why Patch Status Matters:

Unpatched vulnerabilities are the most common entry point for attackers
Testing should reflect the current security posture
Identifying patch gaps helps prioritize remediation

4.2.3 Good Interpretation of Testing Results

“Vulnerability Testing sometimes may lead to false positive scores and at times may not be able
to identify the issues beyond the capability of the tool that is being used for testing. In such
cases, testers should be experienced enough to understand,
analyse and take a decision on the outcome.”

Challenges in Interpreting Results:

Challenge Description

False Positives Tools report vulnerabilities that don’t actually exist

False Negatives Tools miss actual vulnerabilities

Tool Limitations Tools can only find what they are programmed to find

Context Results need to be interpreted in the context of the environment

4.2.4 Awareness of the Security Policies

“Testers should be well versed in the security policy or the protocol that is followed. This will
help in effective testing and understanding what is within and beyond the security guidelines.”
Why Policy Awareness Matters:

Helps determine what is expected security behavior

Identifies deviations from security standards
Enables effective compliance testing

4.2.5 Tool Selection

“From a wide range of tools available, make sure you select the tool that provides the features required for
 your testing.”
Tool Selection Criteria:
Criterion Description

Features Does the tool provide the required testing capabilities?

Accuracy Does the tool produce reliable results?

Scope Can the tool test all required areas?

Cost Is the tool within budget?

Ease of Use Can the team effectively use the tool?

Support Is vendor support available?

Updates Are vulnerability signatures kept current?

4.3 Network Security Devices

4.3.1 Firewalls
“Firewall is the protection layer which monitors the connections that can take place within a
network.”
Role of Firewalls in Network Security:
Monitor incoming and outgoing connections
Enforce security policies
Block unauthorized access attempts
Log network activity

4.3.2 VPNs
“VPN Gateways are used to establish a secure connection to the remote systems.”
Purpose of VPNs:
Secure remote access to the network
Encrypt data in transit
Extend the internal network over public infrastructure
Protect data confidentiality

4.3.3 Anti-Virus
“It is used to monitor, identify and filter out all forms of malware.”
Anti-Virus Functions:
Monitor systems for malware
Identify known malware signatures
Quarantine or remove malware
Provide real-time protection

4.3.4 URL Filtering

“URL filtering will keep the end users protected by restricting them to access malicious sites.”
URL Filtering Functions:
Block access to malicious websites
Enforce acceptable use policies
Reduce risk of malware infection
Prevent data leakage
4.3.5 Intrusion Detection Systems (IDS)
“Intrusion detection system monitors for malicious attacks and raises alerts to the admin team.”
IDS Functions:
Monitor network traffic for suspicious activity
Detect potential attacks
Raise alerts for security events
Provide information for incident response

4.4 Network Security Testing Techniques

4.4.1 Network Scanning
“In this technique, a port scanner is used to identify all the hosts connected to the network. Network
Services are also scanned like HTTP and FTP. This finally helps in ensuring whether the ports are
configured to allow only the secured network
services.”

What Network Scanning Identifies:

Element Description

Live Hosts Systems currently connected to the network

Open Ports Services listening on the network

Running Services Applications and services in use

OS Detection Operating systems in use

Network Topology How systems are connected

4.4.2 Vulnerability Scanning

“Vulnerability Scanner helps in finding the weakness of the system or network. It provides
information on the security loopholes which can be improved.”
What Vulnerability Scanning Identifies:

Weakness Type Description

Configuration Issues Misconfigured systems and services

Missing Patches Unpatched vulnerabilities

Default Configurations Default passwords, settings

Weak Security Weak encryption, authentication

Policy Violations Non-compliance with security policies

4.4.3 Ethical Hacking

“This is hacking done to identify potential threats to a system or network. This helps to identify if
unauthorised access or malicious attacks are possible.”
Ethical Hacking Definition:
“Ethical hacking refers to identify potential threats to a system or network.”
Ethical Hacking Process:

Step Description

Reconnaissance Gathering information about the target

Scanning Identifying vulnerabilities

Exploitation Attempting to exploit vulnerabilities

Reporting Documenting findings

Remediation Fixing identified vulnerabilities

Ethical Hacking Principles:

Authorization — Only test with explicit permission
Non-Destructive — Do not cause damage to systems
Confidentiality — Protect sensitive information discovered
Reporting — Share all findings responsibly

4.4.4 Password Cracking

“This method can be used to crack weak passwords. This can help in enforcing a
policy with minimum password criteria which ends up in creating strong passwords and
difficult to crack.”
Password Cracking Methods:

Method Description

Dictionary Attack Using a word list of common passwords

Brute Force Trying all possible combinations

Rainbow Tables Using precomputed hash tables

Hybrid Attack Dictionary with character substitutions

Purpose of Password Cracking:

Test password strength
Enforce password policies
Identify weak passwords
Educate users about password security

4.4.5 Penetration Testing

“Pentest is an attack done on system/network to find out Security flaws. Under Penetration Testing
Technique, the Servers, endpoints, web application, wireless
devices, mobile devices and network devices, are all compromised to identify the vulnerability.”
Definition:
“Penetration testing method can be used to identify attack done on system/network to find out
Security flaws.”
Types of Penetration Testing:

Type Description
 Black Box Tester has no prior knowledge of the system

White Box Tester has full knowledge of the system

Grey Box Tester has partial knowledge of the system

Penetration Testing Methodology:

1. Planning — Define scope and objectives
2. Reconnaissance — Gather information
3. Threat Modeling — Identify potential attack vectors
4. Vulnerability Analysis — Identify vulnerabilities
5. Exploitation — Attempt to exploit vulnerabilities
6. Post-Exploitation — Determine impact of successful exploitation
7. Reporting — Document findings

5: NETWORK SECURITY TESTING TOOLS

5.1 Overview of Testing Tools
Various tools are available for network security testing, each with specific purposes and
capabilities. Understanding these tools helps in selecting the right tool for the right job.

5.1.1 BeEF (Browser Exploitation Framework)

“BeEF (Browser Exploitation Framework) is a tool which focuses on the Web browser.”
Definition: BeEF is a penetration testing tool that focuses on exploiting web browsers. It provides a
framework for testing browser-based vulnerabilities and assessing the
security of web applications.
Key Features:

Browser exploitation
Client-side attack vectors
Browser vulnerability assessment
Session hijacking

5.1.2 BFB Tester

“BFB Tester is a tool for security checks of Binary programmes.”
Definition: BFB Tester is a tool used for security testing of binary programs. It helps identify
vulnerabilities in executable files.
Purpose:
Analyze binary code for vulnerabilities
Test for buffer overflows
Identify memory corruption issues
Assess binary program security

5.1.3 Flaw Finder

“Flaw finder is the programme that scans C/C++ source code and reports potential security flaws.
By default, it sorts its reports by risk level.”
Definition: Flaw Finder is a program that scans C/C++ source code and reports potential security
flaws. It helps developers identify security issues during the development process.
Key Features:

Static code analysis

Risk-level sorting of findings
C/C++ source code scanning
 Security flaw identification

5.1.4 Oedipus
“Oedipus is an open source web application security analysis and testing suite written in
RUBY.”
Definition: Oedipus is an open-source web application security analysis and testing suite written in
Ruby.
Key Features:

Web application scanning

Vulnerability identification
Security testing automation
Open source

6: NETWORK SCANNING AND VULNERABILITY

ANALYSIS
6.1 Introduction to Network Scanning
6.1.1 What is Network Scanning?
Network scanning is the process of identifying active hosts, open ports, running services, and
potential vulnerabilities in a network. It is a fundamental technique for both security assessment
and attack reconnaissance.
What Can Be Scanned:

“Scanning can be performed for following areas: Modems (and other telephone devices), Live
Hosts, TCP ports, UDP ports, Promiscuous NICs.”

Scanning Target Description

Modems and Telephone Devices Identify unauthorized modems

Live Hosts Determine which systems are active

TCP Ports Identify open TCP services

UDP Ports Identify open UDP services

Promiscuous NICs Identify devices in promiscuous mode

Network Topology Map the network structure

6.2 Modem Scanning

6.2.1 War Dialers
“Repeatedly dial phone numbers looking for a modem to answer or other things.”
Definition: War dialers are tools that repeatedly dial phone numbers looking for modems or
other telephone devices.
War Dialing Purpose:
Identify unauthorized modems
Find dial-up access points
Map telephone-based network access
Identify remote access vulnerabilities
Historical War Dialers:

Tool Description Features

ToneLoc 1994 by Minor Threat and Mucho Maas Popular war dialer

THC-Scan 2.0 VanHouser, released by Hackers Choice 100 lines/hour

TBA LOpht Palm-based war dialing

Modern Consideration: While war dialing was more common in the era of dial-up Internet, the
concept still applies to discovering unauthorized or forgotten network access points.

6.2.2 Demon Dialers

“Demon Dialers – once a modem is found repeatedly dial it and guess passwords.”

Purpose: After identifying a modem, demon dialers repeatedly attempt to connect and guess
passwords to gain access.

6.3 Live Host Discovery

6.3.1 ICMP Ping Scanning
“Try pinging (ICMP Echo request) all hosts on a particular subnet to see who replies.”

How Ping Scanning Works:

1. Send ICMP Echo Request to an IP address

2. Wait for ICMP Echo Reply
3. If reply is received, the host is live

Why No Reply May Be Received:

No reply indicates the host is not live

Incoming ICMP messages are blocked (firewall configuration)

“It is a good idea to block incoming ICMP messages at the firewall.”

When ICMP is Blocked:

If no reply, a hacker would try connecting to a commonly open port (TCP port 80) or
sending a UDP packet to a commonly open port
ICMP in Java:
In Java (which does not do ICMP), send a ping using JNI to execute the ping
command as an OS command line command
6.3.2 TCP SYN Scanning
When ICMP is blocked, attackers may use TCP SYN scanning:

1. Send TCP SYN packet to a port

2. If SYN-ACK received, the host is live
3. If RST received, the port is closed

6.4 Network Topology Mapping

6.4.1 Traceroute/Tracert
“Once the live hosts are known, a map of your network can be arrived at by determining how
the hosts are connected together.”
Traceroute Function:
traceroute (Unix/Linux) / tracert (Windows 2000)
Shows the path packets take to reach a destination
Reveals network topology
Example Traceroute Output:

C:\users>tracert [Link]

Trace complete.

6.4.2 Network Mapping Tools

“By doing repetitive traceroutes to the hosts discovered in the host scan the network topology can be
discovered.”
Automated Mapping Tools:
Tool Description

Cheops Linux-based network mapping tool

Nmap Network discovery and security scanning

Zenmap Graphical frontend for Nmap

6.4.3 Operating System Identification

“Another way to do this is by using a mapping program like Cheops. Runs on Linux and
automates the process of inventorying a network. Does operating system
identification by using TCP Stack Fingerprinting.”

6.5 Port Scanning

6.5.1 Introduction to Port Scanning
“Once the attacker knows the topology of your network the tedious task of identifying open ports
and services. TCP and UDP scans are fine if you are scanning your own network looking for
vulnerabilities but are too easily detectable for a hacker.”
Why Port Scanning Matters:

Identifies services running on the network

Reveals potential entry points for attackers
Enables vulnerability assessment
Supports network inventory
6.5.2 Nmap (Network Mapper)
“Nmap most versions of Unix, ported to W/NT by eEye does many types of scans.”
Nmap Capabilities:

Capability Description

Host Discovery Identify live hosts on the network

Port Scanning Identify open ports on hosts

Service Detection Identify running services

OS Detection Identify operating systems

Version Detection Identify software versions

Script Scanning Run automated vulnerability scripts

6.5.3 Nmap Scan Types

TCP Connect Scan
Completes 3-way handshake (SYN, SYN-ACK, ACK)
Most reliable but most detectable
Establishes a full connection with the target

TCP SYN Scan (Half-Open Scan)

Sends only initial SYN and waits for SYN-ACK
Does not complete the handshake
Less detectable than Connect scan
Requires raw socket access

TCP FIN Scan

Send TCP FIN to each port

Reset indicates the port is closed
Violates protocol specifications
Used to bypass some firewalls

TCP Xmas Tree Scan

Sends packet with FIN, URG, PUSH set

Reset indicates the port is closed
No response may mean the port is open
Violates protocol specifications
Does not work on Windows machines (MS did not follow the RFC)

NULL Scan

Send packet with no code bits set

Reset indicates port closed
Violates protocol specifications

TCP ACK Scan

 Send packet with ACK bit set
Helps determine a packet filter’s rules
Does not determine if ports are open

Window Scan

Similar to ACK scan but focuses on TCP window size

Determines if ports are open or closed

FTP Bounce Scan

Bounces a TCP scan off of an FTP server

Obscures the originator of the scan
Exploits FTP’s proxy capabilities

RPC Scanning

Scans for Remote Procedure Call (RPC) services

Sends an RPC null command
Determines if an RPC program is listening

6.6 Windows-Specific Services

6.6.1 NetBIOS (TCP Ports 137, 138, 139)

Purpose: Used for Windows networking to connect clients to file and print servers.

Security Concern: Should never be allowed through the Firewall except through an encrypted tunnel
(as in a VPN).

6.6.2 RPC Locator (TCP Port 135)

Purpose: Used by Windows networking to locate network services that use the RPC protocol.
Security Concern: Should never be allowed through the Firewall.

6.6.3 Terminal Services (TCP Port 3389)

Purpose: Gives the connecting user complete control over the host machine.
Security Concern: Should never be allowed through the Firewall except through an encrypted tunnel
(as in a VPN).

6.7 Standard UNIX Services

Unix Services Commonly Scanned:

Service Port Description

Chargen TCP/UDP 19 Character generator

Daytime TCP/UDP 13 Day and time service

Discard TCP/UDP 9 Discard service

Echo TCP/UDP 7 Echo service

Finger TCP 79 User information service

 NFS TCP/UDP 2049 Network File System

Quote UDP 17 Quote of the day

RPC UDP 111 Remote Procedure Call

RSH TCP 514 Remote Shell

SSH TCP 22 Secure Shell

6.8 Platform Neutral Services

Common Services Across Platforms:

Service Port Description

Telnet TCP 23 Remote terminal access

TFTP UDP 69 Trivial File Transfer Protocol

Bootp UDP 67 Bootstrap Protocol

DHCP UDP 68 Dynamic Host Configuration Protocol

LDAP TCP/UDP 389 Lightweight Directory Access Protocol

SNMP UDP 161 Simple Network Management Protocol

VNC TCP 5800+, 5900+ Virtual Network Computing

HTTP TCP 80 Hypertext Transfer Protocol

HTTPS TCP 443 HTTP Secure

6.9 UDP Scanning

6.9.1 Characteristics of UDP Scanning
“Because UDP is a much simpler protocol than TCP is it is inherently less reliable for scanning.”
How UDP Scanning Works:
1. A UDP packet is sent to each UDP port
2. If an ICMP “Port Unreachable” message is received, the port is closed
3. Otherwise, assume the port is open
Challenges:
False positives are very common
No reliable way to confirm open UDP ports
Rate limiting on ICMP responses
6.9.2 UDP Scan Issues
Issue Description

No ACK UDP has no acknowledgment mechanism

 Slow Waiting for ICMP responses takes time

Unreliable Many false positives

Rate Limited ICMP responses may be rate-limited

6.10 TCP Stack Fingerprinting

6.10.1 How OS Fingerprinting Works
“The TCP RFC defines how TCP should respond under normal conditions (not protocol violations) but
not how to act in response to protocol violation.”
Basic Principle:
1. Send protocol violation packets to a target
2. Record the responses
3. Responses are always the same for specific operating systems/versions
4. These responses can be treated as fingerprints
5. Determine what OS is being addressed

6.10.2 OS Fingerprinting Tools

Tool Description

Nmap Maintains a database of known OS fingerprints

Queso OS identification tool

xprobe OS fingerprinting tool

“Nmap maintains a rather complete database of known operating system fingerprints and
can pretty reliably identify most major operating systems.”

6.11 Defenses Against Port Scanning

6.11.1 System Hardening
“Harden your systems. Make sure all OS patches are installed. Close all ports not needed. Delete all
programs associated with closed ports.”
Hardening Steps:

Step Description

Patch Management Install all OS security patches

Port Control Close all unnecessary ports

Remove Unneeded Software Delete programs associated with closed ports

Disable GUI If comfortable with CLI, disable GUI

Remove Unneeded Services Remove all unneeded software from servers

6.11.2 Regular Scanning

“Scan your systems before the hackers do, find your vulnerabilities before they do.”
Proactive Scanning Benefits:

Identify vulnerabilities before attackers find them

Prioritize remediation efforts
Ensure compliance with security policies
Continuously improve security posture

6.11.3 Stateful Packet Filtering

“Use stateful packet filtering so that not only the current packet is taken into consideration.”
Why Stateful Filtering Helps:

Intruders can scan right past a standard packet filter

Stateful filtering tracks connection state
Blocks packets that don’t match existing sessions

6.11.4 Proxy-Based Firewall

“Use a proxy-based firewall. Gives application layer protection. Requires complete
connections. SYN Scans and ACK Scans cannot get through.”
Benefits of Proxy Firewalls:

Provides application layer protection

Requires complete connections
SYN Scans and ACK Scans cannot get through
Hides internal network structure

6.12 Firewalk and Firewall Rule Determination

6.12.1 Firewalk
“Allows you to determine what packets are allowed through a firewall.”
Definition: Firewalk is a tool that allows you to determine what packets are allowed through a
firewall.
How Firewalk Works:
Similar to traceroute
Works off of the TTL field in the IP header
Sends packets through a packet filtering device
Determines what packets are allowed
Comparison with Nmap:
Nmap checks what is happening at the end-point machines
Firewalk allows you to send packets through a packet filtering device
Determines what the firewall is set up to pass

6.13 Vulnerability Scanning

6.13.1 Definition and Purpose
“Connect to a host and automatically detect if a vulnerability exist. Common configuration errors.
Default configuration weaknesses. Well-known system vulnerabilities.”
What Vulnerability Scanners Detect:

Category Examples

Common Configuration Errors Misconfigured services, permissions

Default Configuration Weaknesses Default passwords, settings

 Well-Known System Vulnerabilities Known CVEs, unpatched issues

Compliance Issues Policy violations, regulatory requirements

6.13.2 Vulnerability Scanner Components

“The knowledge base of current active scan. Results repository and Report Generator.”
Vulnerability Scanner Components:

Component Description

Vulnerability Database Knowledge base of current vulnerabilities

User Configuration Tool Interface for configuring scans

Scanning Engine Performs the actual scanning

Results Repository Stores scan results

Report Generator Creates reports from scan results

6.13.3 Types of Vulnerability Scanners

Free Scanners:

Tool Description

SARA Security Auditor’s Research Assistant

SAINT Security Administrator’s Integrated Network Tool

VLAD Vulnerability scanner

Nessus Comprehensive vulnerability scanner

Commercial Scanners:

Tool Description Vendor

CyberCop Scanner Commercial scanner McAfee

ISS Internet Scanner Internet Security Scanner ISS

eEye Retina Scanner Comprehensive scanner eEye

QualysGuard Subscription-based scanner Qualys

SecureScan Subscription-based scanner Vigilante

Module Qustions:
Q1. Discuss firewall evolution from packet filtering to NGFW, compare three firewall types with
strengths, weaknesses, and deployment scenarios, analyze stateful inspection's impact, and evaluate
application-layer awareness in modern firewall design.

Q2. Define DMZ, explain single and dual-firewall architectures, describe security benefits, services
placed in DMZ, critical controls required, and provide e-commerce DMZ implementation example.

Q3. Explain hierarchical security policy framework, differentiate governing, technical, and end-user
policies with examples, describe governing policy components, and analyze intended audience and
detail level for each policy type.

Q4. Describe complete network security testing process with pre/during/post guidelines, differentiate
vulnerability scanning, penetration testing, and ethical hacking with purpose and methodology, and
discuss tool selection and result interpretation importance.

Q5. Explain Nmap operation, describe six scanning techniques (SYN, Connect, FIN, NULL, Xmas,
UDP) with working, use cases, and detection methods, and discuss TCP stack fingerprinting for OS
identification.

Q6. Describe vulnerability analysis principles, explain scanner components (database, engine,
reporting), compare three vulnerability scanning tools, and explain how scanning differs from and
complements penetration testing.

Q7. Explain ACLs and their role in firewall rule bases, describe rule structure components, discuss rule
ordering, first-match principle, Stealth and Cleanup rules, and provide example rule base for small
organization.

Q8. Discuss defenses against network scanning, explain system hardening (patch management, port
control, service removal), describe stateful filtering and proxy firewalls in preventing scanning, and
explain proactive self-scanning benefits.

Q9. Describe war dialing process and relevance, explain live host discovery via ICMP ping and TCP
SYN scanning, discuss network topology mapping using traceroute/tracert and automated tools, and
explain reconnaissance use by attackers and security professionals.

Q10. Explain relationship between network scanning and vulnerability analysis, describe how scan data
(hosts, ports, services, OS) feeds into vulnerability analysis, and explain how scanners use this for
targeted checks and prioritization.
Answer to Question 1
Evolution of Firewall Technology
The evolution of firewall technology represents a continuous response to the increasing
sophistication of network attacks. From simple packet filters to modern next-generation firewalls
(NGFWs), each generation has built upon the strengths and addressed the limitations of its
predecessors.

Packet Filtering Firewalls:

Packet filtering firewalls represent the earliest form of firewall technology. These firewalls operate
at the network layer of the OSI model and examine each packet in isolation,

making decisions based solely on header information.

How Packet Filtering Works:

1. Each packet is examined individually as it arrives at the firewall interface
2. The firewall checks specific header information including source and destination IP
addresses, source and destination ports, TCP flags, and protocol type
3. The packet is compared against an Access Control List (ACL) containing predefined rules
4. Based on the ACL rules, the packet is either permitted or denied

Characteristics of Packet Filtering Firewalls:

Feature Description

OSI Layer Network Layer (Layer 3)

State Awareness None - stateless operation

Speed Fastest processing

Security Level Basic

Resource Usage Low

Application Awareness None

Strengths:
Simple to implement and maintain
Fast processing speed due to minimal inspection
Low resource requirements
Cost-effective
Transparent to users
Weaknesses:
Does not maintain state information about active sessions
Vulnerable to IP spoofing attacks
Cannot detect attacks that span multiple packets
Limited to header-based decisions
ACLs must be kept updated

Limitation: Packet filtering firewalls cannot determine if a packet is part of an existing connection
or a new connection attempt, making them vulnerable to various attacks that exploit this lack of
context.

Stateful Inspection Firewalls:

Stateful inspection firewalls represent a significant advancement over packet filtering. Check
Point first developed stateful inspection in the late 1990s, referring to a firewall that can zoom
out from individual packets to assess the wider context of network communications.

How Stateful Inspection Works:

1. When a connection is initiated, the firewall creates an entry in a dynamic state table
2. The state table tracks key information about each connection:
Source and destination IP addresses
Source and destination ports
Connection state (SYN_SENT, ESTABLISHED, CLOSED, etc.)
Sequence numbers
Timers for connection timeouts
3. For subsequent packets, the firewall checks the state table
4. Only packets that match an existing state table entry are allowed
5. When a connection is closed, the state table entry is removed

Stateful Inspection Characteristics:

Feature Description

OSI Layer Network and Transport Layers (Layers 3-4)

State Awareness Full connection state tracking

Speed Medium

Security Level Good

Resource Usage Medium

Application Awareness Limited

Stateful inspection firewalls extend the functionality of packet filtering firewalls by storing and
using state data for their access decisions. They are more secure because the
firewall tracks client ports individually rather than opening all high-numbered ports for external
access, adding Layer 4 or higher awareness to the standard packet filter architecture.

How Stateful Inspection Prevents Attacks:

Attack Type Prevention Mechanism

IP Spoofing Packets must match existing state entries

Replay Attacks Sequence numbers are tracked

SYN Flood Connection timers prevent resource exhaustion

Strengths:
Prevents IP spoofing attacks
Blocks packets that don’t match existing sessions
Provides better security than packet filtering
Can detect anomalies in connection states

Weaknesses:
More complex than packet filtering
Slower processing than packet filtering
Dynamic state tables grow with connections
Limited application-layer awareness

Proxy Firewalls:
Proxy firewalls represent a further evolution, operating at the application layer to provide deep
inspection of application-layer traffic. In a proxy firewall, both incoming and outgoing
transmission is stopped at the firewall. If the connection is allowed, the firewall initiates a
connection with the destination host on behalf of the originating source host.

Application-Level Proxy Firewalls:

A proxy server program called an application layer gateway operates on a firewall system between
two networks. When a client attempts a connection to the destination, it first connects to a proxy
or application gateway and negotiates with it. The application gateway then establishes the
connection with the destination on behalf of the client but hides the identity of individual
computers in the network.

How Application-Level Proxies Work:

1. Client initiates connection to destination
2. Connection is intercepted by the proxy firewall
3. Firewall evaluates the connection request against its policies
4. If allowed, the firewall establishes a connection to the destination
 5. The firewall acts as an intermediary, forwarding traffic between the two parties
6. The identity of individual computers in the network is hidden

Characteristics of Application-Level Proxies:

Feature Description

OSI Layer Application Layer (Layer 7)

State Awareness Full session and application tracking

Speed Slowest

Security Level Highest

Resource Usage Highest

Application Awareness Full

Protocol-Specific Gateways:

HTTP Proxy - For web traffic

FTP Proxy - For file transfer traffic
SMTP Proxy - For email traffic
DNS Proxy - For domain name resolution

Circuit-Level Proxy Firewalls:

Circuit-level firewalls hide the identity of an originating server without using a proxy server.
They simply create a circuit between the client and the server within which communication is
allowed through the firewall. They maintain a table whose entries determine what connections
are allowed or denied.

Comparison: Application-Level vs. Circuit-Level Firewalls:

Aspect Application-Level Circuit-Level

OSI Layer Application Layer Session Layer

Proxy Required Yes No

Resource Usage High Low

Speed Slower Faster

Protocol Understanding Protocol-specific Protocol-agnostic

Security Level Higher Moderate

Strengths of Proxy Firewalls:
Provides application-layer protection
Hides internal network structure
Can authenticate users before allowing connections
Provides detailed logging of application activity
Can cache frequently requested content

Weaknesses of Proxy Firewalls:

Requires more memory and resources
Causes decrease in transmission speed
May not support all protocols
Complex to configure

Next-Generation Firewalls (NGFWs):

Modern firewalls combine multiple technologies into integrated security platforms. NGFWs
typically include:

Capability Description

Stateful Inspection Traditional firewall functionality

Intrusion Prevention Signature and behavioral-based detection

Application Control Identification and control of applications

URL Filtering Web content filtering

Threat Intelligence Integration with threat intelligence feeds

Advanced Malware Protection Sandboxing and behavioral analysis

Answer to Question 2
Demilitarized Zone (DMZ) Architecture and Implementation
Definition and Purpose:
A Demilitarized Zone (DMZ) is a computer host or small network inserted as a “neutral zone”
between a company’s private network and the outside public network. DMZ is a
network construct that provides secure segregation of networks that host services for users,
visitors, or partners.

Core Purpose:
The primary purpose of a DMZ is to provide secure segregation of networks that host services for
users, visitors, or partners. By isolating public-facing services from the
internal network, a DMZ creates a buffer zone that protects internal systems even if the DMZ
services are compromised.

Benefits of DMZ Implementation:

Benefit Description

Isolation Public-facing services are isolated from internal networks

Compromise Containment If a DMZ system is compromised, the internal network remains

protected

Multiple Security Layers Provides additional layers of protection as part of defense-in-

depth

Access Control Enables granular control over what services are accessible

Risk Reduction Reduces the attack surface of the internal network

DMZ Architectural Designs:

Single-Firewall Architecture (Three-Legged Firewall):

In this design, a single firewall with three network interfaces is used:

DMZ Network

Key Components:
External Interface - Connects to the Internet
Internal Interface - Connects to the internal network
DMZ Interface - Connects to the DMZ network

Traffic Flow Rules:

 Direction Typical Policy

Internet to DMZ Allow only necessary services (HTTP, HTTPS, SMTP, DNS)

DMZ to Internal Generally blocked or strictly controlled

Internal to DMZ Allow management access, application updates

Internal to Internet Allowed with NAT, subject to filtering

Dual-Firewall Architecture:
In this design, two separate firewalls are used for enhanced security:

Internet Firewall 1 DMZ Network Firewall 2 Internal Network

Benefits of Dual-Firewall Architecture:

Benefit Description

Defense in Depth Two separate firewalls must be breached

Different Security Policies

Each firewall can have different policies

Public services and internal services are completely separated

Service Isolation

Failover Can provide redundancy

Typical DMZ Services:

Service Protocol Port Purpose

Web Server HTTP/HTTPS 80, 443 Host public website

Mail Server SMTP 25 Receive and forward email

DNS Server DNS 53 Domain name resolution

FTP Server FTP 20, 21 File transfer services

Proxy Server Various Various Web content filtering

Security Controls for DMZ:

1. Inbound Access Control:

“Inbound Access Control Firewall allows authorized inbound interactions while preventing
attacks from…”

Only allow necessary services to reach DMZ hosts

Block all other inbound traffic
Implement strict access control lists

2. Firewall Protection:

“DMZ firewalls are essential for protecting the company’s internal network from potential
intrusions originating from the DMZ”

Firewall between DMZ and internal network

Firewall between Internet and DMZ
Dual-firewall protection where feasible

3. Pre-infection Threat Prevention:

“Pre-infection Threat Prevention IPS blocks exploitation of known application vulnerabilities”

Intrusion Prevention System (IPS) for threat detection

Vulnerability scanning of DMZ services
Regular patching of DMZ systems

4. Fine-grained Access Control:

“Implement fine-grained access control”

Define specific rules for each service

Use principle of least privilege
Implement logging and monitoring

5. Network Segmentation:
“The first best practice is to segment your network into zones. Basic network segments for a
perimeter-based network firewall in a small organization are
designed to isolate it from external networks, maybe creating a demilitarized zone (DMZ) and
internal network.”

Example: E-commerce DMZ Implementation

An e-commerce organization hosting web, mail, and DNS servers would typically implement:
Single-Firewall DMZ Configuration:

Web Server (80, 443) - DMZ

Mail Server (25) - DMZ
DNS Server (53) - DMZ

Firewall Rules for DMZ Protection:

Rule Source Destination Service Action

1 Any Web Server HTTP, HTTPS Accept

2 Any Mail Server SMTP Accept

3 Any DNS Server DNS (UDP) Accept

4 Web Server Internal Management Deny

5 Mail Server Internal Database Deny

6 Internal DMZ SSH Accept (Admin)

7 Any Any Any Deny

Best Practices for DMZ:

1. Use RFC 1918 Addressing - Use private IP addresses on internal networks
2. Bastion Host Hardening - DMZ hosts should be hardened against attacks
3. Minimal Services - Only necessary services should be running
4. Regular Updates - Apply security patches promptly
5. Monitoring and Logging - Comprehensive logging of all DMZ activity
6. Network Address Translation - Hide internal IP addresses
7. Access Control Lists - Define specific rules for each service

Answer to Question 3
Security Policy Framework: Hierarchy and Components
Definition:
A security policy is a set of rules, procedures, and guidelines that define how an organization
protects its information assets. It establishes the framework for security management and provides
direction for security-related decisions.

Policy Hierarchy:

Governing Policy
(High-level "What" questions)
Audience: Managers, Technical Custodians

Technical End-User
Policies Policies
("What, Who,

Security Staff All Employees

Governing Policies:

Definition:

A governing policy is a high-level treatment of security concepts that are important to the
company. Managers and technical custodians are the intended audiences.

Purpose and Scope:

The governing policy controls all security-related interaction among business units and supporting
departments in the company. In terms of detail, the governing policy answers the “what” security
policy questions.

Key Characteristics:

Characteristic Description
 High-Level Focuses on concepts rather than technical details

Broad Scope Covers security across the entire organization

Strategic Aligns with business objectives

Long-Term Provides direction over time

Authoritative Must be approved at the highest levels

Alignment with Existing Policies:

The governing policy aligns closely with not only existing company policies, especially human
resource policies, but also any other policy that mentions security-related issues, such as issues
concerning email, computer use, or related IT subjects.

Key Components of Governing Policy:

Component Description

Issue Statement What problem or issue does the policy address?

Position Statement What is the organization’s position on the issue?

Application Scope How does the policy apply to the environment?

Roles and Responsibilities Who is responsible for what under this policy?

Compliance Requirements What level of compliance is necessary?

Allowed Actions What is permitted under the policy?

Prohibited Actions What is not permitted under the policy?

Consequences What happens when the policy is violated?

Intended Audience:
The intended audience of governing policy includes:

Technical Custodians - Need to understand security requirements for

implementation
Managers - Need to understand security direction and resource requirements

Technical Policies:
Definition:
Technical policies are used by security staff members as they carry out their security
responsibilities for the system. These policies are more detailed than the governing policy and
are system or issue specific.

Level of Detail:
Technical policies answer the “what,” “who,” “when,” and “where” security policy questions.
The “why” is left to the owner of the information.

Question How Technical Policies Answer It

What What specific technical controls are required?

Who Who is responsible for implementing and maintaining the controls?

When When should the controls be implemented or updated?

Where Where should the controls be applied (which systems)?

Types of Technical Policies:

Category Description Examples

Operating System Policies Password policies, patch

Security controls for OS
management

Security controls for Secure development, application

Application Policies
applications access

Security controls for networks

Network Policies Firewall rules, VPN policies

Mobile Device Policies Security controls for mobile BYOD policies, device encryption
devices

Typical Technical Policy Categories:

General Policies - Broad technical security policies

Email Policies - Email usage, encryption, retention
Remote-Access Policies - VPN, remote desktop, teleworking
Personal Device Policies - BYOD, smartphones, tablets
Application Policies - Application usage, installation, security
Network Policies - Network access, segmentation, monitoring
Wireless Communication Policy - Wi-Fi security, guest networks
Document Retention Policy - Data storage, archiving, deletion
End-User Policies:

Definition:

End-user policies are compiled into a single policy document that covers all the topics pertaining
to information security that end users should know about, comply with, and implement.

Key Characteristics:

Characteristic Description

Single Document All end-user policies in one place

User-Friendly Written for non-technical users

Comprehensive Covers all relevant topics

Actionable Provides clear guidance on what to do

Level of Detail:
End-user policies answer the “what,” “who,” “when,” and “where” security policy questions at an
appropriate level of detail for an end user.

Policy Overlap:
End-user policies may overlap with technical policies and are at the same level as
technical policy. Both technical and end-user policies need to address the same security topics, but
technical policies provide implementation details for administrators while
end-user policies provide guidance for employees.

Answer to Question 4
Network Security Testing: Process, Techniques, and Tools
Definition:
Network testing involves testing network devices, servers, and DNS for vulnerabilities or threats. It
is the process of evaluating network infrastructure to identify security weaknesses that could be
exploited by attackers.

Guidelines for Network Security Testing

1. Most Critical Areas Should Be Tested First:

Areas which are exposed to the public are considered to be critical. Focus should be on firewalls,
web servers, routers, switches, and systems that are open to mass crowds.

Priority Order for Testing:

Priority Areas to Test Reason

1 Public-facing systems Most accessible to attackers

2 Firewalls Primary defense mechanism

3 Web servers Common attack targets

4 Routers and Switches Network infrastructure

5 Critical internal systems High-value targets

2. Up to Date with Security Patches:

Systems under test should always have the latest security patch installed. Unpatched vulnerabilities
are the most common entry point for attackers.

3. Good Interpretation of Testing Results:

Vulnerability testing sometimes may lead to false positive scores and at times may not be able to
identify the issues beyond the capability of the tool that is being used for testing. In such cases,
testers should be experienced enough to understand, analyze, and take a decision on the outcome.

Challenges in Interpreting Results:

Challenge Description

False Positives Tools report vulnerabilities that don’t actually exist

False Negatives Tools miss actual vulnerabilities

Tool Limitations Tools can only find what they are programmed to find

Context Results need to be interpreted in the context of the environment

4. Awareness of the Security Policies:

Testers should be well versed in the security policy or the protocol that is followed. This will help
in effective testing and understanding what is within and beyond the security
guidelines.

5. Tool Selection:
From a wide range of tools available, make sure you select the tool that provides the features
required for your testing.

Tool Selection Criteria:

Criterion Description

Features Does the tool provide the required testing capabilities?

Accuracy Does the tool produce reliable results?

Scope Can the tool test all required areas?

Cost Is the tool within budget?

Ease of Use Can the team effectively use the tool?

Support Is vendor support available?

Updates Are vulnerability signatures kept current?

Network Security Testing Techniques

1. Network Scanning:

In this technique, a port scanner is used to identify all the hosts connected to the network.
Network services are also scanned like HTTP and FTP. This finally helps in ensuring whether
the ports are configured to allow only the secured network services.

What Network Scanning Identifies:

Element Description

Live Hosts Systems currently connected to the network

Open Ports Services listening on the network

Running Services Applications and services in use

OS Detection Operating systems in use

Network Topology How systems are connected

2. Vulnerability Scanning:
Vulnerability Scanner helps in finding the weakness of the system or network. It provides
information on the security loopholes which can be improved.

What Vulnerability Scanning Identifies:

Weakness Type Description

Configuration Issues Misconfigured systems and services

Missing Patches Unpatched vulnerabilities

Default Configurations Default passwords, settings

Weak Security Weak encryption, authentication

Policy Violations Non-compliance with security policies

3. Ethical Hacking:
This is hacking done to identify potential threats to a system or network. This helps to identify if
unauthorized access or malicious attacks are possible.

Ethical Hacking Process:

Step Description

Reconnaissance Gathering information about the target

Scanning Identifying vulnerabilities

Exploitation Attempting to exploit vulnerabilities

Reporting Documenting findings

Remediation Fixing identified vulnerabilities

Ethical Hacking Principles:

Authorization — Only test with explicit permission

Non-Destructive — Do not cause damage to systems
Confidentiality — Protect sensitive information discovered
Reporting — Share all findings responsibly

4. Password Cracking:
This method can be used to crack weak passwords. This can help in enforcing a policy with
minimum password criteria which ends up in creating strong passwords and difficult to crack.

Password Cracking Methods:

Method Description

Dictionary Attack Using a word list of common passwords

Brute Force Trying all possible combinations

Rainbow Tables Using precomputed hash tables

Hybrid Attack Dictionary with character substitutions

5. Penetration Testing:
Pentest is an attack done on system/network to find out security flaws. Under penetration testing
technique, the servers, endpoints, web application, wireless devices, mobile devices and network
devices, are all compromised to identify the vulnerability.

Types of Penetration Testing:

Type Description

Black Box Tester has no prior knowledge of the system

White Box Tester has full knowledge of the system

Grey Box Tester has partial knowledge of the system

Penetration Testing Methodology:

1. Planning — Define scope and objectives

2. Reconnaissance — Gather information
3. Threat Modeling — Identify potential attack vectors
4. Vulnerability Analysis — Identify vulnerabilities
5. Exploitation — Attempt to exploit vulnerabilities
6. Post-Exploitation — Determine impact of successful exploitation
7. Reporting — Document findings

Network Security Devices

 Device Description Purpose

Protection layer monitoring connections

Firewalls Filter traffic, enforce security

Secure connections to remote systems Encrypt remote communications

VPNs

Anti-Virus Monitor, identify and filter malware Protect against malware

URL Prevent access to harmful content

Restrict access to malicious sites
Filtering

IDS Monitor for malicious attacks Detect and alert on threats

Answer to Question 5
Nmap: Network Scanning Techniques and Operations
Introduction to Nmap:
Nmap (Network Mapper) is a powerful network scanning tool used for network discovery and
security auditing. It supports numerous scanning techniques, each with different characteristics,
advantages, and detection profiles.

Scanning Techniques

1. TCP Connect Scan (-sT)

The TCP Connect scan completes the full three-way handshake (SYN, SYN-ACK, ACK) with each
target port.

How It Works:
1. Nmap sends a SYN packet to the target port
2. If the port is open, the target responds with SYN-ACK
3. Nmap completes the handshake by sending ACK
4. The connection is then closed

Characteristics:

Feature Description
 Reliability Most reliable scan type

Detection Most visible and likely to be picked up by IDS

Privileges Works without root/superuser privileges

Speed Slower than SYN scan

Use Case: When raw packet privileges are not available (non-root user on Unix systems).

2. TCP SYN Scan (-sS)

The TCP SYN scan, also known as “half-open” scanning, sends SYN packets but does not complete
the handshake.

How It Works:
1. Nmap sends a SYN packet to the target port
2. If the port is open, the target responds with SYN-ACK
3. Nmap responds with RST to tear down the connection
4. If the port is closed, the target responds with RST

Characteristics:

Feature Description

Stealth Less detectable than Connect scan

Speed Faster than Connect scan

Privileges Requires root/superuser privileges

Reliability Very reliable

Advantages: Does not complete the full connection, making it harder to detect and log.

3. TCP FIN Scan (-sF)

The FIN scan sends a TCP packet with the FIN flag set, which is used to gracefully close a
connection. Sending FIN to a closed port should result in an RST response according to RFC 793.

How It Works:
1. Nmap sends a packet with FIN flag to the target port
2. If the port is closed, the target responds with RST
3. If the port is open, there may be no response (RFC-compliant systems)
Characteristics:

Feature Description

Stealth More stealthy than SYN scan

Firewall Evasion Can bypass non-stateful firewalls

Reliability Can be unreliable with Windows systems

Advantage Clears SYN bit, bypassing certain rules

4. NULL Scan (-sN)

The NULL scan sends a TCP packet with no flags set (all flags turned off).

How It Works:
1. Nmap sends a packet with no TCP flags set
2. If the port is closed, the target responds with RST
3. If the port is open, there may be no response

Characteristics:

Feature Description

Stealth Highly stealthy

Firewall Evasion Can bypass non-stateful firewalls

Reliability Inconsistent across operating systems

Protocol Violates TCP specification

5. Xmas Tree Scan (-sX)

The Xmas scan sends a packet with FIN, PSH, and URG flags set simultaneously—an invalid
combination under normal TCP behavior.

How It Works:
1. Nmap sends a packet with FIN, PSH, and URG flags set
2. If the port is closed, the target responds with RST
3. If the port is open, there may be no response

Characteristics:
 Feature Description

Stealth Highly stealthy

Firewall Evasion Can bypass non-stateful firewalls

Name Origin Named for the pattern of lights on a Christmas tree

Protocol Violates TCP specification

Comparison of FIN, NULL, and Xmas Scans:

These three scan types are functionally equivalent but vary in how they trigger firewalls or IDS
systems. They can sneak through certain non-stateful firewalls and packet filtering routers.

Scan Type Flags Set Advantage

FIN Scan FIN Bypasses some firewall rules

NULL Scan None Highly stealthy

Xmas Scan FIN, PSH, URG Can bypass different firewall rules

6. UDP Scan (-sU)

UDP scanning is inherently less reliable than TCP scanning due to UDP’s connectionless nature.

How It Works:
1. Nmap sends a UDP packet to each UDP port
2. If an ICMP “Port Unreachable” message is received, the port is closed
3. Otherwise, the port is assumed to be open (or filtered)

Characteristics:

Feature Description

Reliability Less reliable than TCP scans

Speed Slower

False Positives Very common

Rate Limiting ICMP responses may be rate-limited

TCP Stack Fingerprinting
TCP stack fingerprinting is a technique used to identify the operating system of a target host by
analyzing how its TCP/IP stack responds to specific probes.

How OS Fingerprinting Works:

1. Send protocol violation packets to the target
2. Record the responses
3. Responses are always the same for specific operating systems and versions
4. These responses can be treated as fingerprints
5. Compare against a database of known fingerprints

Fingerprinting Techniques:

Technique Description

TCP Initial Window Size Different OSes use different initial window sizes

TCP Options Different OSes support different TCP options

IP TTL Different OSes use different default TTL values

ICMP Response Different OSes handle ICMP differently

FIN Handling Different OSes respond differently to FIN packets

Nmap OS Fingerprinting:
Nmap maintains a rather complete database of known operating system fingerprints and can
reliably identify most major operating systems.

Answer to Question 6
Vulnerability Analysis: Principles, Tools, and Techniques
Definition:
Vulnerability analysis is the process of identifying, classifying, and prioritizing vulnerabilities in
computer systems, networks, and applications. It involves systematic examination of systems to
find security weaknesses that could be exploited by attackers.
Vulnerability Scanner Components:
A typical vulnerability scanner consists of several key components:

Scanning
Engine
(Known CVEs,
Signatures) actual scan)

(Define scan parameters)

Results Repository
(Store scan results)

(Create reports from results)

1. Vulnerability Database:
Contains knowledge of known vulnerabilities, including:

Common Vulnerabilities and Exposures (CVEs)

Security patches and updates
Configuration weaknesses
Default configuration issues

2. Scanning Engine:
Performs the actual scanning of target systems:

Connects to target systems

Probes for vulnerabilities
Uses various detection techniques
Handles authentication when required

3. User Configuration Tool:

Allows administrators to configure scans:

Define target scope

Select scan profiles
Set authentication credentials
Schedule scans

4. Results Repository:
Stores scan results for analysis:

Historical data storage

Trend analysis
Compliance reporting

5. Report Generator:
Creates reports from scan results:

Executive summaries
Technical details
Remediation recommendations
Compliance reports

Comparison of Vulnerability Scanning Tools Free

Scanners:

Tool Description Key Features

Nessus Comprehensive vulnerability scanner Wide vulnerability coverage, regular updates,

policy compliance

Security Auditor’s Research Assistant

SARA Open source, comprehensive scanning

Security Administrator’s Integrated Network discovery, vulnerability assessment

SAINT
Network Tool
 Open Vulnerability Assessment Free alternative to commercial scanners
OpenVAS
System

Nessus is widely regarded as one of the most trusted vulnerability scanners in the industry. It
provides comprehensive vulnerability assessment and helps identify potential
security weaknesses.

Commercial Scanners:

Tool Description Vendor

CyberCop Scanner Commercial vulnerability scanner McAfee

ISS Internet Scanner Internet Security Scanner ISS

eEye Retina Scanner Comprehensive scanner eEye

QualysGuard Subscription-based scanner Qualys

SecureScan Subscription-based scanner Vigilante

Vulnerability Scanning vs. Penetration Testing

Aspect Vulnerability Scanning Penetration Testing

Identify potential Exploit vulnerabilities to demonstrate

Purpose
vulnerabilities impact

Method Automated Manual (with automated tools)

Scope Broad coverage Targeted exploitation

Output List of vulnerabilities Proof of exploitation, impact analysis

False Positives Common Less common

Frequency Regular (weekly/monthly) Periodic (quarterly/yearly)

Cost Lower Higher

Expertise Required
Moderate High
How They Complement Each Other:

1. Vulnerability Scanning as a Starting Point: A vulnerability scan can quickly and efficiently
identify a broad range of potential issues. This provides a roadmap for the pen tester.

2. Penetration Testing Validates and Prioritizes: A vulnerability scan might

produce hundreds of findings. The pen test validates the most critical findings and shows
which ones pose a real risk to the organization.

Best Practices for Vulnerability Management:

Practice Description

Regular Scanning Scan regularly to identify new vulnerabilities

Prioritization Focus on critical and high-severity vulnerabilities

Patch Management Apply patches for identified vulnerabilities

Configuration Review Review system configurations for weaknesses

Asset Inventory Maintain accurate inventory of all systems

Compliance Checking Verify compliance with security policies

Remediation Tracking Track progress of remediation efforts

Answer to Question 7
Firewall Rule Base and Access Control Lists
Definition:
An Access Control List (ACL) is a set of rules that determine who is allowed access to an item in
a network and how that item can be used. In the context of firewalls, ACLs form the rule base
that defines which traffic is permitted and which is blocked.

Rule Base Concept:

A Rule Base is a collection of rules that determine which communication traffic is
permitted and which is blocked. The main principle of the Rule Base is that all actions that are
not explicitly permitted are prohibited.
Rule Processing:
The Check Point Security Gateway applies the rules inside the Rule Base in a sequential manner. It
is important to understand that the first matching rule applies to the database, not necessarily
the best matching rule. If no applicable rule is found inside the Rule Base, the packet will be
blocked.

Rule Base Processing

Packet Arrives Check Rule 1 Match? Yes Apply

Check Rule 2 Match? Yes

No
Check Rule 3 Match? Yes
No
...

No Match Block Packet (Cleanup Rule)

Rule Structure:
Each rule in the Rule Base consists of the following components:

Component Description

Number Rule sequence number

Name Descriptive name for the rule

Source Source of the traffic (network, host, user)

Destination Destination of the traffic

Service Protocol or service (HTTP, FTP, etc.)

Action Accept, Drop, Reject

Track Logging settings

Install On Which gateways apply this rule

 Time Time-based restrictions

Basic Rules in the Rule Base

1. Stealth Rule:

All traffic that is NOT from the internal company network to one of the Security Gateways is
dropped. When a connection matches the Stealth rule, an alert window opens in SmartView
Monitor.

Best Practice:
“Stealth rule that prevents direct access to the Security Gateway”

2. Cleanup Rule:
Drops all traffic. All traffic that is allowed matched one of the earlier rules.

Best Practice:
“Have an explicit cleanup rule as the last rule in each Inline Layer and Ordered Layer”

3. DNS Server Rule:

Allows UDP traffic to the external DNS server. This traffic is not logged.

4. Mail and Web Servers Rule:

Allows incoming traffic to the mail and web servers that are located in the DMZ. HTTP, HTTPS,
and SMTP traffic are allowed.

Example Firewall Rule Base

# Name Source Destination Service Action Track

1 Stealth Rule !Internal_Net FW_Object Any Drop Log

2 Allow DNS Internal_Net DNS_Server DNS Accept None

3 Allow Web Any Web_Server HTTP, HTTPS Accept Log

4 Allow Mail Any Mail_Server SMTP Accept Log

5 Allow Internal Internal_Net Any Any Accept Log

6 Cleanup Rule Any Any Any Drop Log

Example Rule Analysis:

Rule 1 (Stealth Rule):

Source: All networks except the internal network

Destination: Firewall object
Service: Any
Action: Drop (block traffic)
Track: Log

Rule 2 (DNS Server Rule):

Source: Internal network
Destination: DNS server
Service: DNS (UDP port 53)
Action: Accept
Track: None

Rule 3 (Web Server Rule):

Source: Any
Destination: Web server
Service: HTTP (80), HTTPS (443)
Action: Accept
Track: Log

Rule 4 (Mail Server Rule):

Source: Any
Destination: Mail server
Service: SMTP (25)
Action: Accept
Track: Log

Rule 5 (Internal Network Rule):

Source: Internal network
Destination: Any
Service: Any
Action: Accept
Track: Log

Rule 6 (Cleanup Rule):

Source: Any
 Destination: Any
Service: Any
Action: Drop
Track: Log

Best Practices for Rule Base Design

Practice Description

Default Deny Block all traffic not explicitly permitted

Specific Rules First Place most specific rules at the top

Stealth Rule Protect the firewall itself

Cleanup Rule Always have a final drop rule

Logging Enable logging on critical rules

Regular Review Review rules regularly for cleanup

Principle of Least Privilege Allow only necessary traffic

Rule Documentation Document the purpose of each rule

Answer to Question 8
Defenses Against Network Scanning and Reconnaissance
Introduction:
Network scanning and reconnaissance are the first steps attackers take to identify vulnerabilities.
Organizations must implement defenses to make these activities more difficult and to detect them
when they occur.

System Hardening

1. Patch Management:

Make sure all OS patches are installed. Unpatched systems are the primary target for attackers.

Best Practices:
Install security patches promptly
Automate patch deployment where possible
Test patches before deployment
Maintain patch inventory
2. Port Control:
Close all ports not needed. Each open port is a potential entry point for attackers.

Best Practices:
Conduct regular port audits
Close unnecessary ports
Use port knocking for sensitive services
Monitor for unexpected open ports

3. Remove Unneeded Software:

Delete all programs associated with closed ports. Remove all unneeded software from servers.

Best Practices:
Remove unused applications
Disable unnecessary services
Use minimal installations
Regular software inventory

4. Disable GUI:

If comfortable with CLI, disable GUI interfaces on servers.

5. Remove Compilers:
A production web server shouldn’t need software development software. Remove all compilers to
prevent attackers from compiling malicious code on the system.

Scanning Your Own Systems Proactive

Approach:

Scan your systems before the hackers do. Find your vulnerabilities before they do.

Benefits of Proactive Scanning:

Identify vulnerabilities before attackers find them
Prioritize remediation efforts
 Ensure compliance with security policies
Continuously improve security posture

Stateful Packet Filtering

Use stateful packet filtering so that not only the current packet is taken into consideration
but also the state of the connection.

Why Stateful Filtering Helps:

Intruders can scan right past a standard packet filter
Stateful filtering tracks connection state
Blocks packets that don’t match existing sessions
Prevents IP spoofing attacks

Proxy-Based Firewall
Use a proxy-based firewall which gives application layer protection and requires complete
connections.

Benefits of Proxy Firewalls:

Provides application layer protection
Requires complete connections
SYN Scans and ACK Scans cannot get through
Hides internal network structure
Can authenticate users before allowing connections

Anti-Spoofing Protection
Anti-spoofing protection verifies that packets originate from and are destined to the correct
interfaces on the gateway.

How Anti-Spoofing Works:

A packet coming from an external interface, even if it has a spoofed internal IP
address, is blocked
The firewall detects that the packet arrived from the wrong interface
Configure anti-spoofing on every interface

Anti-Spoofing Actions:

Action Description

Prevent Drops spoofed packets

Detect Allows spoofed packets but logs the event

 “It is recommended to use the Detect option to monitor traffic.”

Intrusion Detection Systems (IDS)

Intrusion Detection Systems monitor for malicious attacks and raise alerts to the admin team.

IDS Functions:
Monitor network traffic for suspicious activity
Detect potential attacks
Raise alerts for security events
Provide information for incident response

Defense Against Specific Scan Types:

Scan Type Defense

TCP SYN Scan Stateful inspection, SYN cookies

TCP FIN/NULL/Xmas Scan Stateful inspection, protocol anomaly detection

UDP Scan Rate limiting, ICMP filtering

OS Fingerprinting OS modification, IDS detection

Answer to Question 9
Modem Scanning, Live Host Discovery, and Network Topology Mapping
Introduction:
Reconnaissance techniques are used to identify potential targets and map network infrastructure.
Both attackers and security professionals use these techniques.

Modem Scanning (War Dialing)

War dialing is the practice of repeatedly dialing phone numbers looking for a modem to answer or
other telephone devices.

Historical Context:

Tool Description Era

ToneLoc By Minor Threat and Mucho Maas 1994

THC-Scan 2.0 By VanHouser, released by Hackers Choice Late 1990s

TBA By LOpht Late 1990s

War Dialing Purpose:

Identify unauthorized modems
Find dial-up access points
Map telephone-based network access
Identify remote access vulnerabilities

Demon Dialers:
Once a modem is found, demon dialers repeatedly attempt to connect and guess passwords to gain
access.

Modern Relevance:
While war dialing was more common in the era of dial-up Internet, the concept still applies to
discovering unauthorized or forgotten network access points.

Live Host Discovery

ICMP Ping

Scanning:

Try pinging (ICMP Echo request) all hosts on a particular subnet to see who replies.

How Ping Scanning Works:

1. Send ICMP Echo Request to an IP address
2. Wait for ICMP Echo Reply
3. If reply is received, the host is live

Why No Reply May Be Received:

No reply indicates the host is not live
Incoming ICMP messages are blocked (firewall configuration)
 “It is a good idea to block incoming ICMP messages at the firewall.”

Alternative Methods When ICMP is Blocked:

Try connecting to commonly open ports (TCP port 80)
Send UDP packets to commonly open ports

TCP SYN Scanning:

When ICMP is blocked, attackers may use TCP SYN scanning:

1. Send TCP SYN packet to a port

2. If SYN-ACK received, the host is live
3. If RST received, the port is closed

Network Topology Mapping Traceroute/Tracert:

Once the live hosts are known, a map of your network can be arrived at by determining how the
hosts are connected together.

Traceroute Function:
traceroute (Unix/Linux) / tracert (Windows)
Shows the path packets take to reach a destination
Reveals network topology

Example Traceroute Output:

C:\users>tracert [Link]

Trace complete.

Automated Mapping Tools:

Tool Description

Cheops Linux-based network mapping tool

Nmap Network discovery and security scanning

Zenmap Graphical frontend for Nmap

Operating System Identification:
Automated mapping tools can identify operating systems using TCP Stack Fingerprinting. By
analyzing responses to protocol violations, these tools can determine what OS is being addressed.

Scanning Areas:
Scanning can be performed for the following areas:

Area Description

Modems Telephone devices

Live Hosts Active systems on the network

TCP Ports Open TCP services

UDP Ports Open UDP services

Promiscuous NICs Devices in promiscuous mode

Defenses Against Reconnaissance:

Defense Description

ICMP Blocking Block incoming ICMP messages at the firewall

Port Filtering Block unnecessary ports

Network Address Translation Hide internal IP addresses

Intrusion Detection Detect scanning activities

Honeypots Deceive attackers

Answer to Question 10
Relationship Between Network Scanning and Vulnerability Analysis
Introduction:
Network scanning and vulnerability analysis are complementary processes in a
comprehensive security assessment. Network scanning provides the foundational information
about what exists on the network, while vulnerability analysis identifies what is wrong with those
Systems. The Security Assessment Pipeline:

Security Assessment Pipeline

Network Vulnerability

Scanning Analysis

(What exists?) (What's wrong?)

Hosts, Ports, Services, OS

Vulnerabilities, Severity, Remediation

Prioritized Remediation Recommendations

Network Scanning Outputs:

Output Description Use in Vulnerability Analysis

Live Hosts Active IP addresses Target selection for scanning

Open Ports Listening services Identify attack surface

Service names and versions Match against vulnerability database

Running Services

Operating System OS type and version OS-specific vulnerability checking

Network
How hosts connect Understand attack paths
Topology

How Network Scanning Feeds Vulnerability Analysis:

1. Target Identification:
Network scanning identifies which hosts are live and should be included in vulnerability
analysis. Without this step, vulnerability scanners would waste time scanning non-existent IP
addresses.

2. Port and Service Discovery:

Network scanning identifies open ports and running services. Vulnerability scanners use this
information to perform targeted checks only on services that are actually running, making the scan
more efficient and reducing false positives.

3. Version Identification:

Network scanning can identify service versions and operating systems. Vulnerability scanners use
version information to check for known vulnerabilities specific to that version.

4. Attack Surface Mapping:

Network scanning maps the attack surface of the network. Vulnerability analysis focuses on
vulnerabilities within that attack surface.

Vulnerability Scanner Components:

Component Function How It Uses Network Scan Data

Vulnerability Database Contains known

Matches services and versions
vulnerabilities

Performs vulnerability Uses target information from network

Scanning Engine
checks scan

Results Repository Stores findings Organizes vulnerabilities by host

Report Generator Creates reports Prioritizes based on severity

The Vulnerability Analysis Process:

Step 1: Asset Inventory

Network scanning provides a complete inventory of assets on the network. This includes all live
hosts, their IP addresses, and the services they provide.

Step 2: Service Enumeration

Network scanning enumerates all running services and their versions. This information is critical
for identifying known vulnerabilities.

Step 3: Vulnerability Detection

Vulnerability scanners use the information from network scanning to perform targeted checks.
They connect to identified services and test for known vulnerabilities.
Step 4: Risk Assessment
Vulnerabilities are assessed for risk based on:

Severity of the vulnerability

Exposure of the system
Sensitivity of the data
Business impact

Step 5: Prioritization
Vulnerabilities are prioritized for remediation based on risk level. Critical and high-
severity vulnerabilities on exposed systems are addressed first.

Step 6: Remediation
Vulnerabilities are fixed through:

Patching
Configuration changes
Network segmentation
Additional controls

Network Scanning in Vulnerability Scanning Tools:

Modern vulnerability scanners like Nessus, Nmap, and OpenVAS integrate network scanning
capabilities as part of their workflow.

Scanner Network Scanning Capabilities

Nmap Host discovery, port scanning, OS detection, version detection

Nessus Comprehensive scanning including network discovery

OpenVAS Includes network scanning functionality

Nmap Integration:
Nmap is often used as a first step in security assessments to discover hosts, ports, services, and
operating systems. The results from Nmap are then used to guide more detailed vulnerability
scanning.

Advanced Scanning Techniques:

Nmap supports advanced scanning techniques including:

TCP SYN Scanning (-sS) for stealthy port discovery

UDP Scanning (-sU) for UDP service detection
OS Fingerprinting (-O) for operating system identification
Service Version Detection (-sV) for identifying service versions
Service Fingerprinting:
Granular service fingerprinting involves full-scale TCP/UDP port scanning to extract
daemon versions and OS types. This information is critical for vulnerability analysis
because different versions of the same service have different vulnerabilities.

Automated Vulnerability Assessment Workflow:

Modern security assessments often follow an automated workflow:

1. Reconnaissance: Use Nmap for network discovery and scanning

2. Vulnerability Scanning: Use Nessus or similar tools for comprehensive assessment
3. Exploitation: Use Metasploit for validation
4. Reporting: Generate comprehensive reports

Benefits of Integrated Scanning:

Benefit Description

Efficiency Network scanning reduces vulnerability scanning time

Accuracy Targeted checks reduce false positives

Completeness Ensures all assets are covered

Prioritization Vulnerabilities can be prioritized by exposure

Best Practices for Integrated Scanning:

Practice Description

Regular Scanning Perform both network and vulnerability scans regularly

Comprehensive Coverage Ensure all network segments are scanned

Version Tracking Maintain accurate version information

Prioritization Focus on critical vulnerabilities on exposed systems

Remediation Tracking Track remediation of identified vulnerabilities

Re-scanning Verify remediation through re-scanning