Video summary

Network Security v1.0 - Module 1 - Securing Networks

Main summary

Key takeaways

Technology

Network security landscape & why it matters

  • Networks are frequent targets: the video emphasizes that network attacks are routine and notes the existence of threat maps such as Kaspersky’s interactive cyber threat realtime map, which is fed by worldwide network security product data.
  • Consequences of breaches can include:
    • Disruption of e-commerce
    • Loss of business data
    • Privacy threats
    • Compromise of information integrity
  • Threat intelligence and incident handling sources mentioned:
    • Cisco Talos Intelligence Group for security and threat intelligence
    • Cisco PSIRT (Product Security Incident Response Team) for investigating and mitigating Cisco vulnerabilities

Core concept: attack vectors

  • An attack vector is defined as the path a threat actor uses to reach a server host or network.
  • Vectors can originate inside or outside the corporate network.
  • The video also highlights common attacker goals, such as denial of service (DoS) by attacking availability.

Data loss and common vectors for compromise

Likely vectors for data loss include:

  • Email and instant messaging
  • Social networking

Example risks:

  • Intercepted email/IM can expose confidential information (even when devices are encrypted, interception risk depends on implementation).
  • A stolen corporate laptop can expose data if it is not properly encrypted.
  • Cloud storage can help, but exposure can occur if security settings are weak or if cloud access is compromised.
  • Removable media (USB drives): unauthorized transfers or lost/stolen USBs.
  • Hard-copy disposal mistakes: discarded reports could be retrieved unless securely destroyed.

Access control as a baseline control

  • The video highlights improper access control as a key weakness.
  • Passwords are described as the first line of defense—stolen or weak/compromised passwords can enable easy attacker access.

Defense-in-depth network architecture (campus / enterprise)

The video describes campus/enterprise networks using multiple layers and Cisco security products.

Campus / enterprise protective controls

  • Cisco Integrated Services Router (ISR)
    • Establishes VPNs to protect data in transit
    • Provides confidentiality and integrity from authenticated resources
  • Cisco ASA firewall
    • Performs stateful filtering of return traffic from outside into the campus network
  • Cisco IPS (Intrusion Prevention System)
    • Monitors incoming/outgoing traffic for malicious activity
    • Logs activity, attempts to block and report
  • Layer 3 switches (distribution layer)
    • Uses secure “rather than trunk” connections to Layer 2
  • Layer 2 switches (access layer)
    • Security features mentioned:
      • Port security
      • DHCP snooping
      • Dynamic ARP inspection (DAI)
      • IP source guard
  • Email/Web security
    • ESA (Email Security Appliance) and WSA (Web Security Appliance)
      • Provide threat visibility/control and reporting for email and web traffic
  • Authentication/authorization/auditing (AAA)
    • A triple AAA server (“triple server”)
      • Authenticates, authorizes, and tracks user activity (accounting)
  • Endpoints / hosts
    • Protected via antivirus/antimalware and host intrusion protection (HIPS)-type capabilities
    • 802.1X-style network access authentication is mentioned

Small Office / Home Office (SOHO) security model

SOHO networks can be secured using:

  • A consumer-grade wireless router with integrated firewall and secure wireless connections
  • A hardened Layer 2 access switch using port security
  • Wireless clients using WPA2 encryption
  • Endpoint protections such as antivirus/anti-malware

Wide Area Networks (WANs)

  • WANs span long distances and use the public internet, so secure transport for data in motion is required.
  • Edge security devices are emphasized. Example given:
    • ASA at the main site provides:
      • Stateful firewall functionality
      • VPN tunnels to connect to branch sites, regional sites, SOHO sites, and mobile workers
  • Key message: the Internet is insecure, so use VPN tunnels.

Data center networks & physical security

Data center basics

  • Data centers are described as offsite facilities storing sensitive/proprietary data.
  • They connect to corporate sites via VPN technology, using ASA devices and integrated data center switches.

Physical security

The video stresses that physical security protects:

  • Access to facilities
  • People and equipment
  • Data

Examples mentioned:

  • Fire alarms/sprinklers, seismically braced racks
  • HVAC (heating/ventilation/air conditioning)
  • UPS systems
  • Both outside perimeter and inside perimeter security, including:
    • Fences/gates/security officers/video/breach alarms
    • Motion detectors, biometric access sensors, controlled entry/exit

Cloud vs virtualization clarification

  • Virtualization is identified as the foundation of cloud computing.
  • Cloud computing concept: separates the application from hardware
  • Virtualization: separates the operating system from hardware

Virtualization security risks in data centers

The video lists VM-targeted threats:

  • Hyperjacking
    • The attacker hijacks the hypervisor/VM-control software as a launch point to attack other devices
  • “Instant/activation” (likely VM provisioning/initialization)
    • Newly activated VMs may have outdated security policies that deviate from baseline, creating vulnerabilities
  • Antivirus storms
    • Many VMs may simultaneously attempt to fetch antivirus definition files, stressing infrastructure

Borderless networks & BYOD / endpoint expansion

  • Mobile devices (smartphones/tablets) are becoming substitutes for PCs behind firewalls.
  • Cisco’s “borderless network” concept:
    • Users can initiate access from many locations
    • Access supports many device types and connectivity methods
  • Mobile Device Management (MDM) features described:
    • Data encryption enforcement (only devices with encryption enabled can access)
    • Wipe remotely (full or partial) if lost/stolen
    • Enforcement/logging (intended meaning: device compliance/enforcement via logging/telemetry)
    • Data Loss Prevention (DLP) to prevent careless/malicious actions with critical data
    • Jailbreak / Root detection
      • Detects bypass attempts (iOS jailbreak, Android rooting)
      • Restricts device access immediately if detected

“Security networks” module takeaways / summary

  • Network breaches can impact business operations, privacy, and data integrity.
  • Organizations should apply defense-in-depth using controls such as:
    • VPN
    • ASA firewalls
    • IPS
    • Layer 3 and Layer 2 security (including switch security features)
    • ESA/WSA
    • Triple AAA server
    • Host/endpoint security
  • Data center security is split into outside perimeter and inside perimeter controls.
  • Virtual environments need protection against:
    • Hyperjacking
    • Activation/baseline policy drift
    • Antivirus storms
  • Borderless network access requires endpoint governance via MDM, including:
    • Encryption enforcement
    • Wipe
    • DLP
    • Jailbreak/root detection

Main speakers / sources (as mentioned)

  • Cisco Talos Intelligence Group
  • Cisco PSIRT (Product Security Incident Response Team)
  • Kaspersky (Kperski) Interactive Cyber Threat Realtime Map (as spelled imperfectly in subtitles)
  • Cisco products referenced throughout: ISR, ASA, IPS, ESA, WSA, AAA server, and MDM-enabled borderless networking concepts

Original video