Cram

8.1Linux Basics

Why a SOC runs on Linux, what the root user can do, and the tool types an analyst works with.

Linux

open source OS (1991) anyone may modify and recompile; distros bundle the kernel with tools: Debian, Red Hat, Ubuntu, CentOS, SUSE.

Security Onion

open source suite of network security analysis tools; Sguil is its analyst console.

SOC tools

Wireshark captures packets, IDS acts on rule matches, firewall allows or blocks, SIEM analyzes IDS and firewall logs live, plus ticketing.

PenTesting

finding vulnerabilities by attacking; tools are packet generators, port scanners, exploits. Kali Linux bundles them.

8.2Working in the Linux Shell

The commands the quiz names by job: man, pwd, ps, chmod, sudo and the rest.

man

shows a command's documentation. The path is the list of directories the shell searches for a typed command.

Basic commands

pwd: current directory, ps: running processes, chmod: permissions, chown: owner, dd: copy input to output, cat: show file.

su vs sudo

su simulates logging in as another user or superuser; sudo runs one command as superuser (superuser do).

ifconfig

shows or sets NIC config, deprecated for ip address; iwconfig does wireless; passwd changes password; grep searches text.

File commands

ls lists, cd changes dir, mkdir creates dir, cp copies, mv moves or renames, rm removes.

nano

keyboard-only CLI editor, vital over SSH; CTRL+O saves, CTRL+W searches, CTRL+G help.

Configuration files

text files of option = value settings, # for comments; edits need superuser and a service restart. /etc/hosts maps names to IPs.

8.3Linux Servers and Clients

Servers listen on ports and clients talk to them. Learn the well-known port numbers.

Ports

20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67/68 DHCP, 69 TFTP, 80 HTTP, 110 POP3, 123 NTP, 143 IMAP, 161/162 SNMP, 443 HTTPS.

Client vs server

the server provides a service and listens on a port; the client (e.g. a web browser) requests it.

8.4Basic Server Administration

Services read config files, devices get hardened, and every event lands in a log file.

Hardening

physical security, fewer packages, disable unused services, SSH without root login, updates, no USB auto-detect, strong rotated passwords.

Daemon

background process that needs no user interaction; e.g. SSSD handles remote access and single sign-on.

Log files

/var/log/messages: generic activity (syslog on Debian); auth.log: Debian/Ubuntu logins; secure: RedHat/CentOS sudo and SSH logins.

More logs

boot.log: startup; dmesg: kernel ring buffer, hardware and drivers; kern.log: kernel; cron: scheduled jobs; mysqld.log or mysql.log.

8.5The Linux File System

File system types, reading rwx permissions from ls -l, and hard versus symbolic links.

ext2 / ext3 / ext4

ext2 no journal, best for flash; ext3 adds a journal for crash recovery, 32 TB max file; ext4 extends ext3, can run journal-less.

Other file systems

NFS: network, open standard; CDFS: optical discs; swap: disk used when RAM runs out; HFS+ and APFS: Apple (APFS current).

MBR

first sector of a partitioned disk, holds file system layout and hands control to the OS loader. Mounting assigns a directory to a partition.

ls -l permissions

type (- file, d dir) then User, Group, Other; -rwxrw-r-- is owner rwx, group rw-, others r--. Only root can override.

Octal permissions

r=4, w=2, x=1: 7 rwx, 6 rw-, 5 r-x, 4 r--; chmod 754 gives rwxr-xr--.

Hard link

ln; same inode as the original, survives deleting it, cannot cross file systems or link to directories.

Symbolic link

ln -s; shows name -> target, can cross file systems and link directories, breaks if the original is deleted.

8.6Working with the Linux GUI

X Window draws the desktop; Gnome 3 is the default Ubuntu interface.

X Window System (X11)

GUI framework that draws windows and can show a remote app locally; window managers like Gnome and KDE define the look.

8.7Working on a Linux Host

Installing and updating packages, managing processes, and finding rootkits.

Package managers

pacman (Arch), dpkg and apt (Debian/Ubuntu); apt-get update refreshes the package list, apt-get upgrade updates all installed.

Processes

fork is the only way to make one (child: new PID, same code); ps lists, top lists live (q quits), kill removes, restarts or pauses.

Rootkit

gains hidden access by changing kernel code; detect by booting trusted media, fix by reinstalling the OS; scan with chkrootkit.

9.1Defending Systems and Devices

Hardening an OS: patches, antimalware, host-based tools, encryption, secure boot and locks.

OS hardening

remove unneeded programs and services, patch promptly, compare to a baseline; updates: monitor, evaluate, plan, install by a documented plan.

Antimalware types

antivirus: quarantines viruses; adware: popup ads; phishing: blocks phishing IPs; spyware: keyloggers; trusted sources: unsafe sites.

Rogue antivirus

fake Windows-style warning popup; clicking it installs malware instead of cleaning.

Fileless malware

runs in memory via legitimate tools like PowerShell, leaves no footprint, ends on reboot. Scripts (Python, Bash, VBA) can be malware too.

Patches

code updates against new malware; a service pack combines patches and upgrades. Also patch third-party apps (Acrobat, Java, Chrome).

Automated patch service

admins approve or decline, force by date, get reports, serve from a local server; users cannot disable updates.

Host encryption

EFS encrypts files, folders or drives; BitLocker does full disk encryption with a TPM; BitLocker To Go encrypts removable drives, no TPM.

TPM

motherboard chip storing encryption keys, certificates and passwords; enabled in BIOS for BitLocker. Self-encrypting drives encrypt all data.

BIOS vs UEFI

BIOS is the first program at power-on; UEFI is the newer standard interface and preferred because it runs in 64-bit mode.

Secure Boot vs Measured Boot

Secure Boot checks each boot component's signature; Measured Boot logs each in the TPM for remote verification, stronger.

Apple security

Secure Enclave AES chip; Find My Mac locates, erases; XProtect blocks by signature; MRT removes malware; Gatekeeper allows only notarized apps.

Device threat countermeasures

password and lockout policy, screen lock, no admin rights, patching, disable CD/DVD/USB, content filtering, approved app list.

Physical protection

cable locks, locked telecom rooms, Faraday cages; RFID tags track assets with radio waves and need no battery.

Door locks

keyed entry lock is most common but easy to force; deadbolt adds security; cipher lock uses a button code, time limits and an access record.

9.2Antimalware Protection

Why endpoints are the weak spot, and the network and host tools that protect them.

Endpoint

any host that can access or be accessed by other hosts, including IoT devices and VPN clients; cloud and IoT widen the challenge.

Internal LAN elements

endpoints (malware attacks) and network infrastructure such as switches (MAC table overflow, spoofing, DHCP, STP, VLAN attacks).

Detection approaches

signature-based: known malware characteristics; heuristics-based: general shared features; behavior-based: suspicious behavior.

Agent-based vs agentless

agent-based (host-based) AV runs on every machine; agentless scans from a central system, suits VMs (VMware vShield).

Host-based security suite

antivirus, anti-phishing, safe browsing, HIPS and firewall; telemetry is its logging, sent to a central location.

Network-based protection

AMP: endpoint malware; ESA: filters spam; WSA: website filtering and blocklisting; NAC: only compliant devices join.

9.3Host-Based Intrusion Prevention

Host firewalls and HIDS: how they log, detect by signature or anomaly, and enforce policy.

Windows Defender Firewall profiles

Public: restrictive, public networks; Private: behind a home router; Domain: trusted business network.

Linux firewalls

iptables: Netfilter kernel rules; nftables: its successor, kernel virtual machine; TCP Wrappers: rule-based access control and logging.

HIDS

agent-based; antimalware plus firewall; signatures miss zero-day and polymorphic malware. Products: Cisco AMP, AlienVault USM, Tripwire, OSSEC.

Anomaly-based vs policy-based

anomaly compares to a learned baseline of normal behavior (many false results); policy acts on predefined rule violations.

OSSEC

open source HIDS; central manager plus agents on Mac, Windows, Linux, Solaris; reads syslog, checks file integrity, detects rootkits.

9.4Application Security

Shrinking the attack surface with allowlists and blocklists, and testing files in a sandbox.

Attack surface

sum of vulnerabilities reachable by an attacker. SANS: network (protocols, IoT), software (web, cloud, apps), human (social engineering).

Blocklist vs allow list

blocklist names apps or sites that may not run; allow list names the only ones that may, based on a security baseline.

Sandboxing

run suspicious files safely to study behavior. Cisco Threat Grid Glovebox, Cuckoo (free, local), VirusTotal, Joe Sandbox, ANY.RUN.

10.1The Three Dimensions

The cybersecurity cube: principles (CIA), data states, and the safeguards that protect them.

Cube, 1st dimension

goals (CIA). Availability — accessible by authorized users when needed; a DoS on a website attacks it.

Confidentiality

prevents disclosure to unauthorized people, resources or processes. Integrity — accuracy, consistency, trustworthiness of data.

Cube, 2nd dimension

the three data states: in transit, at rest (in storage), in process. All three must be safeguarded.

Cube, 3rd dimension

safeguards: technology; policy and practices; education, training and awareness in people.

Tokenization

confidentiality without encryption: a random value with no mathematical relationship replaces the data; can keep its type and length.

DRM vs IRM

both use encryption. DRM protects copyrighted music, films, books; IRM lets an owner control access to shared email and files.

Sensitive information

personal (traceable to a person: medical, card numbers), business (acquisition plans, trade secrets), classified.

Privacy enhancement technologies

anonymization, data minimization, tokenization. Anonymization makes private data irreversibly anonymous.

Integrity methods

hashing, data validation checks, data consistency checks, access controls; a bank values integrity more than a social media channel.

Not causes of system failure

equipment maintenance and system backups; they maintain availability despite short planned outages.

Ensuring availability

maintenance, updates and patches, backup testing, disaster planning, new tech, activity monitoring, availability testing.

Equipment maintenance

component replacement, cleaning, alignment. Availability testing — port scans, vulnerability scans, penetration tests.

10.2States of Data

Data at rest, in transit and in process, where each lives, and how each gets attacked.

Data at rest

in storage, no user or process accessing, requesting or amending it; NAS and SAN hold stored data. Includes idle backups.

DAS

direct-attached storage (hard drive, USB flash drive) connected to one computer; not shared by default; vulnerable to attacks on the local host.

RAID

many disks seen as one. NAS — network device, central store. SAN — high-speed links many servers to one disk repository.

Sneaker net

carrying removable media; never fully eliminated. Wireless — radio waves; BYOD guests grow the attack surface.

Data in transit countermeasures

confidentiality: VPN, SSL, IPsec, encryption; integrity: hashing, data redundancy; availability: mutual authentication.

Mutual authentication

user authenticates to the server and server to the user; counters a rogue device posing as a wireless access point.

Data in process

data during initial input, modification, computation or output; input threats: data entry, scanned forms, file uploads, sensors.

Data modification

encoding, compression, encryption are intentional; data corruption (unreadable) comes from failed equipment or malicious code.

10.3Cybersecurity Countermeasures

Technologies, awareness training and policies, standards, guidelines and procedures.

Software safeguards

software firewalls, network and port scanners, protocol analyzers, vulnerability scanners (assess weaknesses), host-based IDS.

Protocol analyzer

a.k.a. signature analyzer; examines traffic to find performance problems, misconfigurations, misbehaving apps, baselines.

Hardware safeguards

firewalls, proxy servers (one org-wide IP, act for the client), biometric hardware access control, network switches.

Security policy tasks

shows commitment, sets expected behavior, ensures consistency, defines legal consequences, gives staff management backing.

Policy types

identification and authentication, password, AUP (what users may and may not do), remote access, maintenance, incident handling.

Standards

mandatory, for consistency; e.g. passwords of 8+ mixed-case alphanumeric with a special character, changed every 30 days, history of 12.

Guidelines

flexible, usually not mandatory suggestions (best practices); sources: NIST Computer Security Resource Center, NSA guides, Common Criteria.

Procedures

longer, more detailed than standards and guidelines: step-by-step instructions with graphics, e.g. how to change your password.

11.1Defense-in-Depth

Know your assets, threats and vulnerabilities, then layer defenses: onion versus artichoke.

Identify first

assets (anything of value; data is the greatest), vulnerabilities (weakness in a system or design), threats (any potential danger).

Attack surface

all devices and info the organization owns or manages. Asset management — inventory them, then set policies to protect them.

Asset classification

groups resources by common traits so the most critical get the most protection; labels rate value and sensitivity.

Classification steps

1 identification category (information, software, physical, services); 2 accountability (owners); 3 criteria; 4 schema.

Classification criteria

confidentiality, value, time, access rights, destruction. Schema — consistent labeling for uniform protection.

Asset standards

the specific hardware and software products used, so a failed part is replaced fast; non-standard setups cost more to maintain.

Asset lifecycle

procurement (bought, inventoried), deployment (inspected, tested, barcoded, put in use), utilization, maintenance, disposal.

Utilization

longest stage: performance checks, patches, upgrades, licenses, audits. Maintenance — modify or upgrade. Disposal — wipe all data.

Threat identification

list of likely threats: what are the vulnerabilities, who may exploit them, what are the consequences if assets are lost.

E-banking threats

internal system compromise, stolen customer data, phony transactions, insider attack, data input errors, data center destruction.

Defense-in-depth

multiple layers at the edge, inside the network and on endpoints; the failure of one safeguard does not affect the others.

Edge router

first line of defense; rules allow or deny traffic, passes LAN-bound connections to the firewall.

Firewall

second line; tracks connection state, denies connections started from untrusted outside, can do authentication proxy for remote users.

Internal router

applies final filtering before the destination. Other layers: IPS, AMP (Advanced Malware Protection), web/email content security, NAC.

Security onion

attacker peels defenses layer by layer. Security artichoke — borderless networks; remove only certain leaves (e.g. mobile devices).

Layering

multiple defenses, each harder to beat. Limiting — each user gets only the access the job needs (file permissions, CCTV rooms).

Diversity

different layers, vendors, encryption and authentication (one vendor's swipe card, another's fingerprint reader).

Obscurity

reveal no OS or equipment details, e.g. generic error messages. Simplicity — complexity is not security: simple inside, complex outside.

11.2Cybersecurity Operations Management

Configuration management and the logs that show what happened.

Configuration management

identifying, controlling and auditing changes to a system's baseline, the template configuration for all similar systems.

Log management

generate, transmit, store, analyze, dispose. Audit log — authentication attempts; access log — requests for specific files.

OS log

OS events: logins, failed logins, usage. Application security log — security software flags malicious activity (Word going online).

Packet analyzer

packet sniffer on wired and wireless; traffic logging, problem analysis, misuse and intrusion detection, isolating exploited systems.

11.3Security Policies, Regulations, and Standards

Business and security policies, the AUP, BYOD rules, and the laws an organization must follow.

Business policies

company (conduct, attendance, dress code), employee (HR: salary, benefits, vacations), security (objectives, rules, requirements).

Security policy parts

identification and authentication (who may access), password, AUP, remote access, network maintenance (updates), incident handling.

AUP

acceptable (appropriate) use policy: explicitly what users may and may not do, allowed traffic; all staff sign it, kept for the employment term.

BYOD policy goals

program goals, which employees and devices, access level, security staff rights on the device, regulations, safeguards if compromised.

BYOD best practices

unique passwords, Wi-Fi/Bluetooth off when unused, updates, backups, Find my Device with remote wipe, antivirus, MDM software.

Compliance regulations

define what organizations must provide and their liability if they fail; depend on organization type and data handled.

12.1Physical Security

Fences, biometrics, badges, guards and cameras: keeping people away from the hardware.

Type I vs. Type II error

Type I: false rejection of an authorized user; Type II: false acceptance of an imposter, the worst for access control.

Crossover error rate (CER)

point where false acceptance and false rejection rates meet; the common measure of overall biometric accuracy.

12.2Application Security

Secure development, input validation, and the threats an application faces.

Normalization

converts input to its simplest form so each string has a unique binary representation and malicious input is spotted.

Stored procedure

precompiled SQL statements in the database taking input parameters; less network traffic, faster results.

Obfuscation vs. camouflage

obfuscation hides data with random characters; camouflage swaps in realistic fictional data. Both deter reverse engineering.

Validation rule criteria

size (character count), format, consistency (codes in related items), range (min/max), check digit (extra calculation).

Integrity check

hashes a snapshot of data to prove it is unchanged (checksum); hash a download to verify it. MD5, SHA-1, SHA-256, SHA-512.

Code signing vs. secure cookies

code signing proves software is authentic and unchanged; secure cookies store browsing data safely for later requests.

12.3Network Hardening: Services and Protocols

Closing unneeded ports and replacing insecure protocols with secure ones.

DHCP snooping vs. DNSSEC

snooping blocks rogue DHCP servers by validating untrusted messages; DNSSEC digitally signs DNS, which maps names to IPs.

ICMP, RIP, NTP

ping uses ICMP to test reachability; RIP routes by hop count, max 15 hops; NTP syncs clocks for logs and certificates.

SSH vs. Telnet

SSH encrypts remote sessions on TCP 22; Telnet sends credentials in plaintext on TCP 23. SCP copies files over SSH.

Secure protocols

SNMPv3 adds cryptography; HTTP port 80, TLS replaces SSL (HTTPS); FTPS adds TLS/SSL; POP 110, IMAP 143; S/MIME signs and encrypts mail.

12.4Network Hardening: Segmentation

VLANs, the DMZ and security zones, and how traffic flows between them.

VLAN

logical (not physical) grouping of switch ports; limits broadcasts and isolates sensitive hosts. Trunks carry multiple VLANs between switches.

DMZ

small network between the trusted LAN and the Internet holding web and mail servers, so outsiders reach them without touching the internal network.

Zones of risk

LAN low, extranet medium-low, DMZ medium-high, Internet high. Zero Trust trusts no one automatically and monitors every user.

12.5Hardening Wireless and Mobile Devices

Wireless standards and their security, and keeping phones and tablets under control.

WEP → WPA

WPA replaced WEP: 256-bit keys (WEP 64/128), MIC to detect altered data, TKIP key handling; WPA-PSK is the most common setup.

WPA2 vs. WPA3

WPA2 (2006) made AES mandatory and replaced TKIP with CCMP; WPA3 keeps strong crypto and improves key exchange.

WPS

joins devices with a PIN that can be brute-forced; disable it.

Open system vs. shared key

open lets any device connect; shared key authenticates and encrypts client-to-AP. Best choice: WPA2 with EAP.

EAP methods

EAP-TLS: client and server certs, high security, hard; PEAP and EAP-TTLS: server cert only, medium; EAP-FAST: no certs, easiest.

Mutual authentication

both ends authenticate each other before connecting; detects rogue access points and stops man-in-the-middle attacks.

Jailbreaking vs. rooting vs. sideloading

jailbreak lifts Apple's app limits; rooting gives full Android admin access; sideloading installs unapproved apps.

12.6Cybersecurity Resilience

Staying up: five nines, redundancy, RAID, backups and disaster recovery.

Five nines

99.999% availability, under 5.26 min downtime a year. HA principles: no single points of failure, reliable crossover, detect failures.

N+1 redundancy

every N components have at least one spare (four tires plus a spare); not a fully redundant system.

RAID

fault tolerance for drive failure; data survives one lost disk except in RAID 0. Mirroring duplicates, striping spreads, parity adds checksums.

Spanning Tree Protocol (STP)

blocks redundant switch paths to prevent Layer 2 loops; unblocks them if a link or switch fails.

Power terms

spike: momentary high, surge: prolonged high; fault: momentary loss, blackout: complete loss; sag/dip: momentary low, brownout: prolonged low.

12.7Embedded and Specialized Systems

SCADA, IoT, VoIP and other devices that are hard to patch and easy to attack.

IoT first steps

make sure firmware can be patched and change default admin credentials, which are publicly known.

VoIP protection

encrypt voice packets against eavesdropping, SSH for gateways and switches, change default passwords, VoIP-aware firewalls.

Deception technologies

honeypot: exposed decoy server that logs attackers; honeynet: a set of honeypots; DNS sinkhole: blocks resolving malicious URLs.

13.1Access Controls

Physical, logical and administrative controls, and the steps of AAA: identify, authenticate, authorize, account.

Physical access controls

actual barriers: guards, fences, motion detectors, laptop locks, swipe cards, cameras, mantraps, alarms.

Logical access controls

hardware and software: encryption, smart cards, passwords, biometrics, ACLs, protocols, firewalls, routers, IDS, clipping levels.

Administrative access controls

policies and procedures focused on personnel and business practices, e.g. security training.

Authentication factors

something you know (password, PIN), something you have (token, card, fob), something you are (fingerprint).

Federated identity management

same credentials across several enterprises (single sign-on to the web); protect it by tying login to an authorized device.

Physiological vs. behavioral biometrics

physiological: fingerprint, DNA, face, hand, retina, ear; behavioral: gestures, voice, gait, typing rhythm.

Multi-factor authentication

at least two different factor types (ATM card plus PIN); 2FA is MFA with exactly two. Best: PIN, fob and fingerprint.

13.2Access Control Concepts

Zero trust, and the access control models: MAC, DAC, RBAC, ABAC and rule-based.

Zero trust

never trust, always verify; each access decision point is a perimeter. Pillars: workforce (people), workloads (apps), workplace (devices, IoT).

DAC

discretionary, least restrictive: owners control access to their own data, often with ACLs.

MAC

mandatory, strictest, military and mission critical: objects carry security labels, users need matching clearance.

RBAC (role-based)

access by role, job classification or responsibilities; also called non-discretionary access control.

ABAC

attribute-based: attributes of the object, the subject and the environment (e.g. time of day).

Rule-based vs. time-based

rule-based: admin-set rules in ACLs (IPs, protocols, no payroll after hours), users cannot change them; TAC: by time and day.

Least privilege vs. privilege escalation

give only the minimum access needed; escalation exploits flaws to gain more privilege than allowed.

NAC

network access control: checks device compliance by user type, device type and OS before granting access; makes BYOD and IoT control practical.

13.3Account Management

Account types, permissions, password and lockout policies, and authentication protocols.

Account types

user (day-to-day), service (interacts with the OS), guest (temporary); replace default accounts and require passwords on all.

Privileged account practices

reduce their number, least privilege, secure password storage, no shared accounts, rotate passwords every 30 or 60 days, MFA.

File permissions

Full control: all; Modify: change/delete, not create; Read and execute: view and run; Write: create and change; Read: view and open.

Deny and propagation

a deny overrides every other permission, even for admins. Only a move within the same volume keeps original permissions.

Local Security Policy

secpol.msc, for PCs not in a domain; sets password and account lockout policies (e.g. lock 30 min after 5 failed tries).

SSO, OAuth, password vault, KBA

one login for many apps; third-party use of account info; one password guards stored credentials; question-based reset.

HMAC

hash plus secret key to prove integrity and authenticity; IPsec VPNs use it on every packet (e.g. with SHA-1).

PAP vs. CHAP

PAP sends username and password in plaintext; CHAP compares one-way hashes and re-verifies the client during the session.

Kerberos

mutual authentication by tickets: a ticket-granting ticket, then a service ticket; tickets are timestamped and expire.

Hash choice

use SHA-256 or higher; avoid SHA-1 and MD5. Hashing alone catches accidental, not deliberate, changes.

13.4AAA usage and operation

Local versus server-based AAA, RADIUS versus TACACS+, and what accounting records.

AAA

authentication: who are you (passwords, challenge-response, token cards); authorization: what you may do (FTP only); accounting: what you did.

Local vs. server-based AAA

local (self-contained) suits small networks; centralized server suits medium-to-large and is preferred, more scalable.

TACACS+

Cisco, TCP 49; separates all three A's; encrypts the whole packet body; per-user router command authorization; limited accounting.

RADIUS

open standard, UDP 1812/1813 (or 1645/1646); combines authentication and authorization; encrypts only the password; extensive accounting.

Accounting types

network (PPP sessions), connection (outbound, e.g. SSH), EXEC (user shells), system (reboots), command (shell commands per privilege level).

14.1Introduction to Access Control Lists

What an ACL is, standard versus extended, numbered versus named, inbound versus outbound.

ACL vs ACE

an ACL is a sequential list of permit or deny statements; each statement is an ACE. A router has no ACLs by default.

Standard vs extended ACL

standard filters at Layer 3 on source IPv4 only; extended adds destination, protocol and TCP/UDP ports (L3 and L4).

ACL number ranges

standard 1–99 and 1300–1999; extended 100–199 and 2000–2699.

Named ACLs

preferred method; can be standard or extended; alphanumeric, case sensitive, unique, no spaces or punctuation; entries can be added or deleted.

Inbound ACL

filters before routing, saving a routing lookup for discarded packets; best when one inbound network is the only source to examine.

Outbound ACL

filters after routing, toward the destination; best when one filter covers packets from several inbound interfaces leaving one interface.

Implicit deny

hidden last ACE of every ACL blocks anything unmatched; an ACL with no permit statement denies all traffic. First match wins, rest skipped.

14.2Wildcard Masking

0 means match and 1 means ignore. Work out masks from subnets, and use host and any.

Wildcard mask

32-bit; bit 0 = match the address bit, bit 1 = ignore it (reverse of a subnet mask). Also used by OSPF.

Common wildcards

0.0.0.0 one host; 0.0.0.255 a /24; 0.0.255.255 a /16; 255.255.255.255 all hosts.

Wildcard calculation

255.255.255.255 minus the subnet mask: /28 = 0.0.0.15, /23 = 0.0.1.255, /20 = 0.0.15.255; 172.16–19.0.0 = 0.3.255.255.

host and any

host replaces the 0.0.0.0 mask (one address); any replaces 255.255.255.255 (every address).

14.3Configure ACLs

The commands for standard and extended ACLs, ports, and the established keyword.

Standard ACE defaults

if the source wildcard is omitted, 0.0.0.0 is assumed; remove a numbered ACL with no access-list number.

remark and log

remark documents an ACL (max 100 characters); log messages on the first matched packet, is CPU intensive, troubleshooting or attacks only.

Extended ACE fields

protocol (ip = all IP protocols, tcp, udp, icmp), source and destination, port operators lt, gt, eq, neq; eq matches one application.

Protocol and port numbers

ICMP 1, TCP 6, UDP 17; SSH (22) and HTTPS (443) have no port name, so enter the number; www = 80.

established

TCP only; matches returning segments with ACK or RST set, letting replies to inside traffic back in; a basic 1st generation stateful firewall.

Named ACL commands

ip access-list standard NAME or ip access-list extended NAME enters ACL sub-configuration mode; no need to repeat the command per ACE.

14.4Named Standard IPv4 ACL Syntax

Editing an ACL by its sequence numbers instead of retyping it.

Text editor method

copy ACL, fix it, remove the old ACL from the router, then paste; pasting without removing only appends ACEs.

Sequence number method

remove one ACE quickly with no plus its sequence number; numbers show in show access-lists, not show running-config.

14.5Implement ACLs

Applying ACLs to interfaces and VTY lines, and where to place standard versus extended ACLs.

ACL guidelines

most specific ACE first; one ACL per interface, protocol and direction; new ACEs go last; outbound ACLs skip router-generated packets.

Applying ACLs

ip access-group in|out on an interface; ip access-class in|out on vty lines. no ip access-group detaches; no access-list deletes it.

ACL placement

standard close to the destination; extended close to the source. Factors: organizational control, network bandwidth, ease of configuration.

14.6Mitigate Attacks with ACLs

Stopping spoofing, allowing only needed services, and filtering ICMP.

Anti-spoofing sources to deny inbound

all zeros, broadcast, 127.0.0.0/8, APIPA 169.254.0.0/16, RFC 1918 private, multicast 224.0.0.0/4.

ICMP to block inbound

echo (ping sweeps, DoS floods) and redirect (alters host routing tables).

ICMP to allow in

echo reply, source quench, unreachable. Allow out — echo, parameter problem, packet too big (MTU discovery), source quench.

SNMP attacks

filter SNMP with interface ACLs, but the most effective prevention is disabling it with no snmp-server.

14.7IPv6 ACLs

IPv6 ACLs are all named and extended, and have their own implicit rules.

Dual stack and Teredo risks

attackers use IPv4 to exploit IPv6 on dual-stack hosts; Teredo tunnels IPv6 in IPv4 UDP through NAT unseen by IPv4 firewalls.

IPv6 ACLs

no standard type (extended-like only), must be named; created with ipv6 access-list NAME, applied with ipv6 traffic-filter; any = ::/0.

IPv6 implicit rules

implicit deny ipv6 any any plus implicit permits for NDP nd-na and nd-ns; with an explicit deny, permit nd-na/nd-ns first.

+Across the module

Points from the labs and summary that span several sections.

18.1Confidentiality

Classic ciphers, then modern symmetric and asymmetric encryption, and how keys are managed.

Symmetric vs asymmetric

symmetric: one pre-shared key, 40–256 bits, fast, bulk data (VPN). Asymmetric: public + private key pair, 512–4096 bits, slow.

Symmetric algorithms

DES (legacy, do not use), 3DES (avoid), AES (recommended; 128/192/256-bit keys), SEAL (stream), RC4 (insecure). Use 128+ bit keys.

Asymmetric (public-key) algorithms

the encrypting and decrypting keys differ and neither can be worked out from the other; slow, so used for signatures and key exchange.

Asymmetric key lengths

DH 512–4096; RSA 512–2048; DSA 512–1024; ElGamal 512–1024; elliptic curve 224+. 2048+ bits can be trusted; 1024 or less is insufficient.

RSA

Rivest, Shamir, Adleman; security rests on how hard it is to factor very large numbers; the first algorithm fit for both signing and encryption; used in e-commerce.

RSA step 1: n

pick two primes p and q, then n = p × q; n is part of both keys. Example: p = 3, q = 11, so n = 33.

RSA step 2: φ(n)

φ(n) = (p − 1)(q − 1), kept secret and used only to find d. Example: (3 − 1)(11 − 1) = 2 × 10 = 20.

RSA step 3: e

public exponent with 1 < e < φ(n) and gcd(e, φ(n)) = 1 (no shared factor). Example: e = 3, since gcd(3, 20) = 1.

RSA step 4: d

private exponent with e × d mod φ(n) = 1. Example: 3 × 7 = 21 and 21 mod 20 = 1, so d = 7. Public key (3, 33), private key (7, 33).

RSA step 5: encrypt

C = Mᵉ mod n, with M smaller than n. Example: M = 4, so 4³ = 64 and 64 mod 33 = 31. C = 31.

RSA step 6: decrypt

M = Cᵈ mod n. Example: 31⁷ mod 33; 31 ≡ −2, (−2)⁷ = −128, and −128 mod 33 = 4. The message 4 is back.

RSA signing

swap the keys: sign with the private key (S = Mᵈ mod n), verify with the public key (Sᵉ mod n = M). Only the key owner could have signed.

Confidentiality

public key (encrypt) + private key (decrypt). Alice encrypts with Bob's public key; only Bob's private key opens it. Leaked private key = new key pair.

Authentication

private key (encrypt) + public key (decrypt). Alice encrypts with her private key; anyone can decrypt with her public key, which proves she sent it.

Diffie-Hellman (DH)

asymmetric algorithm that lets two computers that never talked before generate an identical shared secret; the key itself is never sent.

DH is key exchange only

DH encrypts no data and authenticates nobody; the agreed key feeds a symmetric cipher (AES, 3DES) that encrypts the bulk traffic.

Where DH is used

data exchanged over an IPsec VPN (through IKE) and SSH sessions. Asymmetric protocols overall: IKE, SSL/TLS, SSH and PGP.

DH colour analogy

common yellow (public, not secret) + secret red or blue (private keys) = public orange and green, swapped; each mix gives the same brown (shared key).

DH steps

agree public prime p and base g; pick private a and b; Alice sends A = gᵃ mod p, Bob sends B = gᵇ mod p; key K = Bᵃ mod p = Aᵇ mod p.

DH example: public values

p = 23, g = 5, a = 6, b = 15. Alice sends A = 5⁶ mod 23 = 8; Bob sends B = 5¹⁵ mod 23 = 19. Both travel in the open.

DH example: shared key

Alice: 19⁶ mod 23 = 2. Bob: 8¹⁵ mod 23 = 2. Same K = 2, never transmitted; an eavesdropper sees only p, g, A and B.

DH security

raising a number to a power is easy, finding which power was used is hard (discrete logarithm); a 1024-bit DH number is about 309 decimal digits.

DH groups

1 = 768, 2 = 1024, 5 = 1536, 14 = 2048, 15 = 3072, 16 = 4096 bits; 19, 20, 24 are elliptic curve. Higher group = more secure, slower.

RSA vs DH

RSA encrypts, signs and exchanges keys (factoring); DH only agrees a key (discrete log) and needs signatures or certificates against man-in-the-middle.

18.2Obscuring Data

Masking, steganography and obfuscation: hiding data instead of encrypting it.

Masking vs steganography

masking swaps real data for a realistic fake (substitution, shuffling, nulling out); steganography hides data in an image, audio or text file.

18.3Integrity and Authenticity

Hashes prove data did not change, and HMAC proves who sent it.

Secure communications

integrity (SHA-2/SHA-3 hashes), origin authentication (HMAC), confidentiality (encryption), non-repudiation (sender cannot deny).

Hashes

one-way, fixed-length digest, not reversible. MD5 128-bit and SHA-1 160-bit are legacy; SHA-2 224–512; SHA-3 is newest and most secure.

HMAC

a hash with a secret key as input: integrity plus origin authentication, so a man-in-the-middle cannot redo it. Used in IPsec, SSH, SSL and OSPF.

18.4Using Hashes

Hashing passwords with salt, and the attacks on them.

18.5Public Key Cryptography

Public and private key pairs, digital signatures, and Diffie-Hellman key exchange.

Digital signature

the signer's private key encrypts the hash: authenticity, integrity, non-repudiation. DSS: DSA (original), RSA (common), ECDSA (newest, small).

Code signing

proves downloaded code is authentic from the publisher, unmodified since it left them, and undeniably published by them (non-repudiation).

18.6Authorities and the PKI Trust System

Certificate authorities, X.509 certificates, and how PKI builds trust.

Certificate classes

0 testing; 1 email; 2 organizations; 3 servers, software signing; 4 business-to-business; 5 private orgs, government (most trusted).

Linking and revoking

large PKIs link CAs as cross-certified or hierarchical; revoke a certificate with a CRL (polled list) or OCSP (online status query).

18.7Applications and Impacts of Cryptography

Where cryptography is used, and how it hides traffic from security monitoring.