Define key security concepts (threats, vulnerabilities, exploits, and mitigation techniques)

The CIA triad

Before we talk about attacks, we need to know what we are protecting. Security professionals summarize the goals of security with three words, remembered as the CIA triad:

• Confidentiality: only authorized people can read the data. Encryption, passwords, and access controls protect confidentiality. If an attacker sniffs your unencrypted Wi-Fi traffic and reads your email, confidentiality has been broken.
• Integrity: the data has not been changed by an unauthorized party, either in storage or in transit. Hashes and digital signatures protect integrity. If an attacker sits between you and your bank and changes the account number in a transfer, integrity has been broken.
• Availability: the data and services are reachable when authorized users need them. Redundant links, backups, and denial-of-service protection protect availability. If an attacker floods your web server so customers cannot reach it, availability has been broken.

Every attack you learn about in this section breaks at least one leg of the triad, and every mitigation protects at least one leg. When an exam question describes an attack and asks what it affects, ask yourself “did the attacker read something, change something, or block something?”

Threat, vulnerability, exploit, risk, mitigation

These five words are used loosely in everyday speech but have precise meanings on the exam. Think of a house:

• A vulnerability is a weakness that could be taken advantage of. Example: your back door has a cheap lock. In networking: a router running old software with a known bug, a switch port left in DTP “dynamic auto” mode, a default password that was never changed.
• A threat is a potential danger that could take advantage of a vulnerability. Example: a burglar in the neighborhood. In networking: an attacker, a piece of malware, or even a careless employee. A threat that has a real, specific way to hurt you is sometimes called a threat actor or threat vector.
• An exploit is the actual tool or technique used to take advantage of a vulnerability. Example: the lock-picking kit and the act of picking the lock. In networking: a script that sends a malformed packet to crash the old router software, or the act of sending DTP frames to form a rogue trunk.
• Risk is the likelihood that a threat will exploit a vulnerability, combined with the damage that would cause. Example: cheap lock plus active burglar plus expensive jewelry inside equals high risk. Risk is what managers actually care about, because it tells them what to spend money on first.
• Mitigation (or a mitigation technique, or a countermeasure) is anything that reduces risk, either by removing the vulnerability, blocking the threat, or reducing the damage. Example: replacing the lock, installing a camera, moving the jewelry to a safe. In networking: patching the router, hard-coding the port as switchport mode access, changing the default password.

Common attacks: denial of service

A denial-of-service (DoS) attack tries to make a system unavailable by exhausting its resources. A classic example is a TCP SYN flood: the attacker sends thousands of TCP SYN segments (the first step of the three-way handshake) but never completes the handshake. The victim keeps a half-open connection in memory for each one, until its connection table is full and real users cannot connect. Another example is simply sending more traffic than a link can carry.

A distributed denial-of-service (DDoS) attack is the same idea launched from many machines at once, typically a botnet, which is a collection of compromised computers under the attacker’s remote control. DDoS is far harder to stop because the traffic comes from thousands of legitimate-looking source addresses.

A reflection attack is a trick used to hide the attacker and amplify the flood. The attacker sends requests to an innocent third-party server (the reflector) with the source IP address forged to be the victim’s address. The reflector sends its replies to the victim. When the reply is much larger than the request, for example a small DNS or NTP query that produces a large response, it is called an amplification attack. A 60-byte request that triggers a 3,000-byte reply gives the attacker roughly 50 times the bandwidth they actually own.

Common attacks: spoofing

Spoofing means pretending to be someone or something else by forging an identifier. Several types appear on the exam:

• IP spoofing: forging the source IP address in a packet. Used in reflection attacks (so replies go to the victim) and to bypass simple source-address filters.
• MAC spoofing: changing the source MAC address of frames. Used to impersonate another host, to fill a switch’s MAC address table (a MAC flooding attack, which forces the switch to flood unicast frames like a hub so the attacker can sniff them), or to bypass port security that is checking for a specific address.
• DHCP spoofing: an attacker runs a rogue DHCP server on the LAN. Because clients accept the first DHCP OFFER they receive, the rogue server can hand out a lease with itself as the default gateway or DNS server. Traffic then flows through the attacker, who can read or modify it before forwarding it on. This is a form of man-in-the-middle attack. Related is a DHCP starvation (exhaustion) attack, where the attacker sends thousands of DISCOVER messages with fake MAC addresses to use up every lease in the real server’s pool, so that only the rogue server has addresses left to offer.

Common attacks: man-in-the-middle and ARP poisoning

A man-in-the-middle (MITM) attack places the attacker in the traffic path between two parties who believe they are talking directly. The attacker can silently read (breaking confidentiality) or alter (breaking integrity) the traffic. DHCP spoofing is one way in; ARP poisoning (also called ARP spoofing) is the most common way on a LAN.

Recall how ARP works: a host that wants to reach 10.1.1.1 broadcasts “who has 10.1.1.1?” and the owner replies with its MAC address. ARP has no authentication, and hosts will happily accept a gratuitous ARP, which is an unsolicited ARP reply, and update their ARP cache with it. An attacker sends gratuitous ARP replies claiming “10.1.1.1 (the gateway) is at my MAC address.” Every host on the segment now sends gateway-bound traffic to the attacker, who forwards it to the real gateway so nobody notices. The attacker also poisons the gateway’s cache so return traffic comes back through it. The mitigation is Dynamic ARP Inspection, covered in 5.7.

Common attacks: reconnaissance

Reconnaissance is the information-gathering phase before an attack. It is not damaging by itself but it is the precursor to almost every targeted attack. Examples include looking up public DNS and WHOIS records, scanning a range of IP addresses with ping sweeps to find live hosts, and running a port scan (for example with the tool Nmap) against those hosts to learn which services are listening. Discovering that a server listens on TCP 23 tells the attacker that Telnet, which sends passwords in clear text, is enabled.

Common attacks: malware

Malware is malicious software. The exam expects you to distinguish a few types:

A botnet, mentioned above, is not a malware type by itself but the result of malware (often a trojan or worm) that turns many computers into remotely controlled “bots” or “zombies.”

Common attacks: social engineering

Social engineering attacks target people instead of technology. The attacker manipulates a person into giving up information or access. These are extremely common and cheap, which is why user awareness (5.2) is so important. The exam expects you to recognize each variety by name:

Common attacks: password attacks

• Brute force: trying every possible combination of characters until the password is found. Works against short passwords; each extra character multiplies the time enormously.
• Dictionary attack: trying a list of likely passwords (words, common passwords, leaked password lists, and variants like Password1!). Much faster than brute force and effective against human-chosen passwords.
• Password guessing: manual attempts using knowledge about the user (pet names, birthdays) or defaults such as cisco/cisco.
• Password spraying: trying one common password against many accounts to avoid triggering per-account lockouts.

Mitigations are long, complex passwords, account lockout after a few failures, multifactor authentication, and, on Cisco devices, the login block-for command shown in 5.3.

Common attacks: buffer overflow

A buffer overflow is a software vulnerability where a program writes more data into a memory buffer than it was sized to hold. The excess overwrites adjacent memory, and a carefully crafted input can overwrite the program’s instructions so that it executes the attacker’s code. Many worms and remote-code-execution exploits rely on buffer overflows. The mitigation is patching (vendors fix the bug), input validation in software, and modern operating system protections. For the CCNA you need to recognize the term and know that keeping software updated is the primary defense.

Common attacks: VLAN hopping

VLAN hopping lets an attacker on one VLAN send traffic into another VLAN without going through a router, which bypasses any Layer 3 access controls. Two techniques exist:

Switch spoofing. Cisco switch ports default to DTP mode dynamic auto (on most modern switches) or dynamic desirable (older models). Either way, if an attacker’s PC sends DTP frames pretending to be a switch, the port negotiates itself into a trunk. The attacker now receives and can send traffic tagged for every VLAN. Mitigation: hard-code every user-facing port with switchport mode access and disable DTP with switchport nonegotiate; put unused ports in an unused VLAN and shut them down.

Double tagging. This attack exploits the 802.1Q native VLAN. The attacker, who is on the native VLAN of a trunk (say VLAN 1), sends a frame with two VLAN tags: an outer tag for VLAN 1 and an inner tag for the victim VLAN (say VLAN 20). The first switch strips the outer tag because it matches the native VLAN (native VLAN frames are sent untagged on the trunk) and forwards the frame across the trunk with the inner tag still present. The second switch sees a frame tagged VLAN 20 and delivers it into VLAN 20. The attack is one-way (the victim cannot reply back through the same trick) but is enough for DoS or for injecting packets. Mitigations: change the native VLAN on trunks to an unused VLAN (switchport trunk native vlan 999), never assign user access ports to the native VLAN, and optionally force tagging of the native VLAN with the global vlan dot1q tag native command.

! Hardening an access port against switch spoofing
SW1(config)# interface GigabitEthernet1/0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# switchport nonegotiate
! Hardening a trunk against double tagging
SW1(config)# interface GigabitEthernet1/0/24
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 999
SW1(config-if)# switchport nonegotiate

Mitigation techniques

The blueprint groups the defenses under “mitigation techniques.” The main families:

• Firewalls: devices (or software) that permit or deny traffic between zones based on policy. A traditional stateful firewall tracks connections so that return traffic for an inside-initiated session is allowed automatically. A next-generation firewall (NGFW) adds application awareness (recognizing Facebook versus Salesforce regardless of port), user identity, URL filtering, and integrated intrusion prevention. Cisco’s firewall products include the ASA and Secure Firewall (Firepower).
• Intrusion prevention systems (IPS): inspect traffic for known attack signatures or anomalous behavior and drop the offending packets inline. An intrusion detection system (IDS) only alerts; an IPS sits in the path and blocks.
• Access control lists (ACLs): packet filters on routers and switches, covered in depth in 5.6.
• AAA: centralized authentication, authorization, and accounting, covered in 5.8.
• Patching: applying vendor software updates to remove known vulnerabilities. Most successful exploits target vulnerabilities for which a patch already existed.
• Segmentation: splitting the network into zones (VLANs, subnets, firewall zones) so that a compromise in one area cannot spread freely. A guest VLAN that cannot reach the servers is segmentation.
• Encryption: protects confidentiality and integrity in transit (VPNs, SSH, HTTPS, WPA2/WPA3) and at rest.
• Layer 2 protections: DHCP snooping, Dynamic ARP Inspection, port security (5.7).
• Hardening: disabling unused services and ports, changing defaults, using SSH instead of Telnet, limiting management access with access-class.