Preface

This book talks about the in-depth analysis of network designs and protocols, the corresponding attacks made on them, and the appropriate security measures with a completely practical approach. The first few chapters will talk in depth about the network architectures and how are they designed or monitored. In later chapters, the corresponding attacks on network protocols (such as routing protocols and ARP), device-based attacks (such as on routers or switches), attacks on various technologies such as VOIP and email gateways, web-based attacks, CnC, and data ex-filtrations over network protocols (such as DNS) are demonstrated practically. At the end of each chapter, the steps to protect against such attacks are given.

Who this book is for

This book is written for network security professionals or network administrators, security analysts, system administrators, and quality assurance personnel who are planning to change their profession from network to security. We have kept the language of this book as simple as we can so that any reader can understand it in a much simpler way and can implement security in their environment. This book is also for those who have cleared the CCNA and CCNP certifications and now are planning to advance their career in network security.

What this book covers

Chapter 1, Data Centers and the Enterprise Network Architecture and its Components, provides a preview of the data network structure and its weaknesses, describing the hardware, software, and protocols involved in the network and their potential vulnerabilities. In the chapter, we will start with traditional enterprise data centers and enterprise networks, talk about connectivity to the cloud, and end with Software Defined Networks (SDNs), Network Function Virtualization (NFV), and potential breaches.

Chapter 2, Network Protocol Structures and Operations, introduces networking protocols, from Layer 2 up to application protocols, including the way each layer is structured, encapsulated, and, in some cases, tunneled. We will describe the networking protocols that work in and between the network components, understand their objectives and operation, and what the risks are when they are compromised.

Chapter 3, Security Protocols and Their Implementation, will teach us about encryption, authorization and authentication principles, protocols, and security components. We talk about the practical aspects of the protocols and which parts of the network can be used in order to establish a secure network.

Chapter 4, Using Network Security Tools, Scripts, and Codes, provides the practice for network security tools, Linux scripts, and programming skills for testing and securing communication networks. The chapter describes tool families, functionality, and recommendations of what to work with.

Chapter 5, Finding Protocol Vulnerabilities, details the tools and scripts for discovering protocol vulnerabilities, using data injection on network protocols, and trying to find bugs that will allow us to modify or hijack information. The tools and scripts provided here will be used in each one of the protocols in the following chapters.

Chapter 6, Finding Network-Based Attacks, talks about how networks can be tampered with and various types of network-based attacks and explains and provides examples for each type.

Chapter 7, Detecting Device-Based Attacks, explains attacks that can be performed on the hardware and software of network devices. The chapter talks about the structure of these devices and how they can be compromised.

Chapter 8, Network Traffic Analysis and Eavesdropping, covers how we can listen to the network, gather information through passive and active actions, perform man-in-the-middle operations to attract traffic in our direction, and decode the data at our disposal.

Chapter 9, Using Behavior Analysis and Anomaly Detection, explores how, due to the evolution of the IoT and industrial networks, behavior analysis is becoming common for threat analysis. This chapter talks about behavior analysis as a method of collecting data from network traffic and how to identify any threat patterns in this traffic. We also talk about methods, tools, and scripts that can be used to analyze this data.

Chapter 10, Discovering LAN, IP, and TCP/UDP-Based Attacks, talks about Layer-2- and 3-based attacks - that is, Ethernet LANs and ARP- and IP-based attacks and how to generate, identify, and protect against them. This chapter also talks about TCP and UDP client and server programs and their vulnerabilities, what the common attacks on them are, and how to generate, discover, and protect against them in the places they accrue.

Chapter 11, Implementing Wireless Network Security, describes wireless (as in, Wi-Fi) networks and protocols with an emphasis on security, providing the tools and methods for hacking and protecting them.

Chapter 12, Attacking Routing Protocols, talks about Interior Gateway routing protocols, including RIP, OSPF, and ISIS, how they work, what the threats and common attacks against them are, how to identify them, and how to configure our routers to protect against them.

Chapter 13, DNS Security, details the Domain Name Service (DNS) protocol, attacks against it, how it is used to break into users' networks, and how to discover these attacks and protect against them.

Chapter 14, Securing Web and Email Services, talks about HTTP and HTTPS, attacks against HTTP and HTTPS servers and services, and how to generate, discover, or protect against them. Another part of the chapter talks about web-based attacks such as SQLI, XSS, buffer overflows and email gateways, and exchange-related vulnerabilities.

Chapter 15, Enterprise Applications Security - Databases and Filesystems, explains how there are various applications in every enterprise network: databases, Active Directory servers and services, filesystems, file servers, and more. In this chapter, we will introduce these application behaviors, potential hacks, how to discover them, and how to protect against them

Chapter 16, IP Telephony and Collaboration Services Security, covers the fact that voice and video over IP, along with collaboration applications, have become a critical part of every organization. In this chapter, we explain the protocols involved, their vulnerabilities, how attacks are done, and how to defend against attacks and penetration attempts to these applications.

Download the color images

We also provide a PDF file that has color images of the screenshots and diagrams used in this book. You can download it here: https://packt.link/NzMIA.

Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "Mount the downloaded WebStorm-10*.dmg disk image file as another disk in your system."

A block of code is set as follows:

html, body, #map { height: 100%; margin: 0; padding: 0 }

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

[default] exten => s,1,Dial(Zap/1|30) exten => s,2,Voicemail(u100) exten => s,102,Voicemail(b100) exten => i,1,Voicemail(s0)

Any command-line input or output is written as follows:

$ mkdir css

$ cd css

Bold: Indicates a new term, an important word, or words that you see onscreen. For instance, words in menus or dialog boxes appear in bold. Here is an example: "Select System info from the Administration panel."

Tips or important notes

Appear like this.

Get in touch

Feedback from our readers is always welcome.

General feedback: If you have questions about any aspect of this book, email us at customercare@packtpub.com and mention the book title in the subject of your message.

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at copyright@packt.com with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.

Share your thoughts

Once you've read Network Protocols for Security Professionals, we'd love to hear your thoughts! Please click here to go straight to the...