CCNA Security Basics | Network Security Landscape

Organizations and large enterprises are vulnerable to cyber attacks as they hold valuable information assets and possess critical data.

Data can be of many types and categories:

1. Applications Data
2. Financial Data
3. IT Assets data
4. IAM Data
5. HR and Internal Organizational data
6. Sales Data

In the CCNA Domain, where IT infrastructure comes into picture like:

1. Enterprise Routers (Cisco ISR)
2. Enterprise Switches (Cisco Catalyst)
3. Enterprise Firewalls (Cisco ASA)
4. Enterprise Network Security Technologies ( Cisco VPN, IAM, SIEM, EDR, WAF)

These are critical Tech which is backbone for any large enterprise where multiple office locations exist both Physical and remote sites.

Securing them and protecting it’s infra becomes primary responsibility for Infosec and Network Security Professionals.

In this Article of CCNA Security Series, I will be illustrating more on the basics here and how these foundations are critical to network security domain and cyber security in general.

These core concepts and modules will be covered here:

1. Describing and explanation on – Vulnerability and Risk Management
2. Navigating – Threats and Cyber Attacks Impacting Network Security
3. Threat Actors and Cyber Attackers categorization
4. Some Basic and Healthy Cybersecurity hygiene
5. Further Expansion of CCNA Security in next modules

Understanding these terms will make your base strong and make you easier to grasp further knowledge.

Vulnerability and Risk Management in Network Security

Weaknesses exist in everyone be it humans and animals.

Similarly, machines and technologies also do have weaknesses in them, nothing is full proof secure as everything is made my humans.

In context of Cisco CCNA, weaknesses do exist in:

1. Routers
2. Switches
3. Firewalls
4. and surrounding security tech

These weaknesses are often referred as vulnerability. Managing these weaknesses under a structured approach is termed as Vulnerability management.

Similarly, Anything can happen at any time. These Infra Tech needs to be kept secure and protect from data breach, can be stolen, can be damaged or destroyed etc.

These unpredictable events and accidental incidents are called Risk in the IT landscape. Managing Risk under a tailored approach is termed as Risk Management.

Vulnerability management and risk management often go hand in hand and is tied together often when connecting the dots between information systems.

These are some foundation keywords surrounding Vulnerability management and Risk Management, let’s look them below:

1. Asset – Asset is something which holds value and is of importance to an enterprise. In the CCNA Domain, assets are Enterprise – Routers, Switches, Firewalls, Endpoints, Servers and LAN Ecosystem overall.
2. Asset Management – Categorization and labeling of IT Assets under risk score, sorting and classifying is often called asset management
3. Risk – Likelihood of a threat to exploit a vulnerability or weakness of an asset causing damage and impacting long term.
4. Threat – Danger to an asset like a malware and social engineering tactic to disrupt and asset.
5. Exploit – Threat which damages an asset by means of a channel via different mediums like email, infected drive or malicious script spread either directly or remote mediums. Exploit is an actual event when a cyber attack is performed.
6. Attack Surface – Total Sum of Weaknesses in an Asset that are open and accessible to a bad actor, can also be called entry points into a system ( Router or Switch)
7. Vulnerability – Weakness and flow in an asset or system. Unpactched software version, open ports etc.

Vulnerability Management – It deals with scanning for vulnerabilities across IT Systems and assets and generating Vulnerability reports. This is done via specific VM Technology deployed as sensors. Popular Companies include Nessus and Quallys.

Risk Management – Risk Management is an overall strategic approach to manage cyber security risks in an enterprise. It helps organizations classify risk and act as per risk strategy.

Although it’s quite broad domain in cyber security, for this blog post I am just showcasing the essentials here to get fundamentals clear.

Risk Management Includes Managing Risk and Acting as per these risk terms:

1. Risk Acceptance
2. Risk Avoidance
3. Risk Mitigation
4. Risk Transfer

IT Assets in CCNA Network Security

IT Assets here which I am often showcasing here are cisco tech which include:

Cisco ISR Enteprise Routers

Cisco Routers enable LAN to LAN Connectivity communication and collaboration possible.

Cisco Routers cater to different industries and organization sizes.

Common Cisco Routers include:

1. Cisco Catalyst 8300 Series Edge Platform
2. Cisco 900 Series Integrated Service Routers
3. Cisco 1000 ISR
4. Cisco 8000 Series Routers

Vulnerabilities in Routers do exist as well, I’ll write different articles moving forward, for now let’s make it broad and basic.

Cisco Routers provide layer 3 addressing and IP Forwarding which makes endpoints communicate via LAN to LAN. Branch A to Branch B.

Securing these branches and LAN Connections is a Network Security Strategy.

Various methods include to secure these Cisco ISR. I’ll make you explore in further articles exclusively.

One common method is to Encrypt the Traffic communication via VPN Technology. Cisco Any Connect is a dedicated VPN Solution by Cisco.

Cisco Catalyst Enterprise Switches

Cisco Switches form LAN Connection and enables internal communication happen effortlessly.

Switches have lot of functionalities and tech protocols into them making it a target for threat actors.

Securing Switches is also of greater deal for an enterprise.

Let’s look some common Cisco Switch models and variants as per business needs and size.

1. Cisco Catalyst 1300
2. Cisco Meraki
3. Cisco Catalyst 9400
4. Cisco Catalyst 9600

Switches are of different tiers as per enterprise network architecture. These are classified as:

1. Access Switches
2. Distribution Switches
3. Core Switches

Each serving different computing and scalability needs in an enterprise.

Cisco ASA Firewall

Threats and Cyber Attacks

Threats and cyber attacks are classied based on impact and vulnerabilities existing in Network Security Technologies.

Cyber Attacks can range from:

1. Social Engineering
2. Network Attacks
3. Access Attacks

Threats can be from various sources and channels which can disrupt, breach and modify network security infra.

Common Threat channels include:

1. Phishing Emails
2. Illegitimate Software Downloaded ( Malicious Patches and Updates)
3. Infected Drives

Social Engineering – These attacks manupulate people to trick into something fishy. Comman targets include IT Support Team, Non-IT Functional Teams ( SALES, HR and admin)

Network Attacks – Impacting Systems to disrupt availability

Access Attacks – Gaining unauthorized access into systems.

Threat Actor Types and it’s role in network Security

Types of Threat actors include

1. Script Kiddies – Amateur hackers experimenting online hacking stuff via forums and free tools
2. Vulnerability brokers – Finding flaws in systems an exploits and notifying companies
3. Hacktivists – Hacktivists publicly protest against organizations or governments by posting articles, videos, leaking sensitive information, and performing distributed denial of service (DDoS) attacks.
4. State Sponsored Actors – State-Sponsored hackers are threat actors who steal government secrets, gather intelligence, and sabotage networks of foreign governments, terrorist groups, and corporations. Most countries in the world participate to some degree in state-sponsored hacking. Depending on a person’s perspective, these are either white hat or black hat hackers.
5. Cyber Criminals – Cybercriminal is a term for black hat hackers who are either self-employed or working for large cybercrime organizations. Each year, cyber criminals are responsible for stealing billions of dollars from consumers and businesses.

Cyber Security Hygiene to protect Network Infra

Following essential cyber safe strategies can help companies prevent cyber attacks and can save millions of dollars which is essentially loss of revenue for organizations.

1. Adopoting Trust worthy Tech Vendors for Infra
2. Regular Updates and Patches
3. Routine Vulnerability assessments and penetration testing simulations
4. Frequent Data Backups
5. Strong Security Policy
6. Mandotory MFA
7. Strong Passwords Implementations