Review: Operations and Monitoring Foundations
Key Module 8 Ideas
Why This Matters in Module 9
Security operations depend on reliable telemetry and disciplined operational processes.
After completing this module, you will be able to:
This section introduces core security principles, governance terms, and foundational controls used in enterprise environments.
9.1 Security Terminology: The CIA Triad
The Holy Trinity of Security
Confidentiality (Secrecy)
Integrity (Accuracy)
Availability (Uptime)
Security Audits
Why audit? To find broken locks before thieves do.
Regulatory Compliance (The Law)
This audit compliance diagram visualizes the security checklist approach: a clipboard with three checkboxes covers Firewall Rules, User Access, and Patch Levels. Agent Snoopy (the auditor) examines the document and draws a green arrow pointing to each checkbox. This represents the systematic verification process that audits conduct: walking through documented infrastructure, verifying each setting matches policy, and checking patches are current. The presence of a checklist and auditor (not just hoping security is good) emphasizes the "verify, don’t trust" principle central to external audits and compliance verification.
Symmetric (Private Key)
"The House Key"
Asymmetric (Public Key)
"The Mailbox"
Vulnerability and Exploit Types
Definitions
Zero-Day Attack
A vulnerability the vendor doesn’t know about yet.
This zero-day vulnerability diagram shows the critical danger: a Firewall (gray box) has an unpatched vulnerability (red box marked "No Patch") in its application layer. A cat-shaped attacker (symbolizing a sophisticated exploiter) arrows toward this vulnerability with an "ultra thick alertred" line labeled "Zero-Day Exploit." Because the vulnerability has no patch, the firewall cannot defend itself. This illustrates why unpatched vulnerabilities—especially day-zero flaws unknown to vendors—require immediate compensating controls or isolation, as technically sound defenses (the firewall) offer no protection against unknown exploits.
Defense Tool: Honeypots and Deception
What is a Honeypot?
A "Trap Server" designed to look juicy to hackers.
Common Tools
Canary: A device that chirps (alerts) when accessed. Cowrie: A fake SSH terminal that logs the hacker’s commands.
Threat analysis identifies disruptive and malicious behaviors so teams can prioritize controls and response readiness.
9.2 Threat Types and Assessment
The Attacker Hierarchy
The Insider Threat
Current or former employees.
This insider threat diagram illustrates the asymmetry of internal versus external threats: a dashed box marks the Internal Network boundary with an insider user and server inside. A firewall blocks the external attacker (cat) from reaching the server (red arrow labeled "Firewall Blocks"). However, the insider (trusted employee icon) can reach the server directly via an orange arrow labeled "Direct Access," bypassing the firewall entirely. This visualization explains why insider threats are particularly dangerous: traditional perimeter security cannot defend against trusted users with legitimate access who have gone rogue or clicked a phishing link.
Denial of Service (DoS) vs. Distributed DoS (DDoS)
The "Traffic Jam" Analogy
Goal
To attack Availability. The server isn’t hacked, it’s just overwhelmed.
This DDoS botnet attack diagram shows the command-and-control structure: a Master (hacker) sends dashed commands to multiple Bot agents (compromised devices), which simultaneously execute the attack. Three thick red arrows labeled "Attack" flow from the bots to the target server. Unlike a simple DoS (one attacker), a DDoS distributes traffic across hundreds of compromised devices, making it harder to block the attacker’s IP address. The dashed versus solid arrows show the distinction between the hidden command channel (dashed) and the visible attack traffic (solid red), representing how botnets hide attacker identity while multiplying attack volume.
Who are the Zombies?
Often insecure IoT (Internet of Things) devices:
Structure
Herder: The criminal.
C&C: Server giving orders.
Zombies: The infected devices.
This botnet zombie army diagram shows the scale of IoT compromise: a Command-and-Control server (cloud icon, top) issues dashed red commands to multiple zombie devices (hacked camera icons with semi-transparent appearance, showing they’re under attacker control). Three green status dots below each camera indicate they’re infected and listening to the C&C. The three camera icons are typical targets: smart cameras, smart bulbs, or connected devices with weak passwords. Unlike traditional servers, IoT devices rarely receive timely security updates, making them attractive for long-term botnet recruitment.
Virus (Needs a Driver)
Like a car that needs a driver, a Virus needs **YOU** to start it.
Worm (Self-Driving)
A Worm is a **self-driving car**.
Trojan Horse (The Trick)
Named after the Greek myth. It looks like a gift, but contains soldiers (malware).
Ransomware (The Kidnapper)
It doesn’t steal data; it locks it.
Case Study: The Zombie Accountants
Scenario: 2:00 AM Alert
Agent Snoopy’s pager buzzes. The KibbleCorp webstore has crashed.
He checks the network dashboard:
Detective Questions:
Why did the malware likely spread as a Worm instead of a Virus?
The computers are acting as a group. What is this "Army" called?
Is the attack trying to steal data or stop the business?
Case Study Solution: The Zombie Accountants
Snoopy’s Analysis
Propagation: It must be a Worm because it spread automatically while no one was using the computers.
The Army: They are a Botnet (Robot Network) of Zombies.
Goal: This is a DDoS (Distributed Denial of Service). The goal is to overwhelm the webstore (Availability), not steal data (Confidentiality).
This section examines identity and traffic manipulation attacks such as spoofing, poisoning, and interception techniques.
9.3 Spoofing: The Fake Return Address
What is Spoofing?
Falsifying data to gain an illegitimate advantage.
Why does this work?
The Internet (IP) is like the Mail System. It delivers to the Destination. It rarely checks if the Sender is telling the truth!
On-Path Attacks (The "Middle Man")
Concept: Passing Notes
Imagine Lucy passes a note to Linus in class.
This is an **On-Path** (formerly Man-in-the-Middle) attack.
Tools
Wireshark (to listen) and Ettercap (to intercept).
ARP Poisoning: The Roll Call Lie
The Vulnerability
ARP is the protocol that finds MAC addresses ("Who has IP 10.1.1.1?").
The Result
The Hacker Cat tells your computer "I am the Router." Your computer believes him and sends all your internet traffic to the Cat.
Changing Plates
Your MAC address is burned into the hardware, but software can override it.
Why do it?
To bypass MAC Filtering (Access Control Lists).
To hide the device manufacturer (OUI) so hackers don’t know what you are using.
The Hidden Suitcase
How do you sneak a forbidden item past a checkpoint?
Case Study: The Coffee Shop Interception
Scenario: Free Wi-Fi Danger
Agent Snoopy is at the "KibbleKafe." He connects to the open Wi-Fi to check his bank.
The Hacker Cat is sitting in the corner. Suddenly, Snoopy’s browser warns:
"Certificate Error: The identity of bank.com cannot be verified."
Snoopy realizes his traffic is being detoured through the Cat’s laptop.
Detective Questions:
What Layer 2 protocol is the Hacker Cat abusing to redirect the traffic?
What is the Hacker Cat’s position called (sitting between Snoopy and the Router)?
Why did Snoopy see a Certificate Error (HTTPS)?
Case Study Solution: The Coffee Shop Interception
Analysis
Protocol: ARP. The Cat used ARP Poisoning to tell Snoopy "I am the Router."
Position: On-Path (Man-in-the-Middle).
Error: The Cat tried to read encrypted (HTTPS) traffic. Since he doesn’t have the Bank’s private key, he used a fake certificate. Snoopy’s browser detected the fake.
Rogue infrastructure services can redirect or intercept traffic; this section covers common patterns and mitigations.
9.4 Rogue Devices and Evil Twins
Rogue Devices
Unauthorized hardware plugged into the network.
The Evil Twin (Wi-Fi)
The "Fake Starbucks" Attack.
The Danger
If an attacker plugs in a router, it might start handing out IP addresses.
The "Race" Condition
Clients accept the first DHCP OFFER they receive.
The Solution: DHCP Snooping
A security feature on switches that acts like a Club Bouncer.
Trust Boundaries
If an OFFER packet comes from an Untrusted port, the switch drops it.
DNS Attacks: Poisoning the Phonebook
Concept: The Phonebook
DNS turns Names (google.com) into Numbers (8.8.8.8).
DNS Poisoning
"Changing the entry in the book."
Human-targeted attacks remain a primary risk vector, requiring awareness, verification processes, and credential hardening.
9.5 Social Engineering: Hacking the Human
Phishing (The Bait)
Sending fraudulent messages to trick users.
Other Variants
Techniques
Why does it work?
Attackers exploit human psychology ("Hacking the Human").
Brute Force
Trying every possible combination (aaaa, aaab...).
Dictionary Attack
Using a list of common words (dictionary).
Tool Spotlight: John the Ripper & Salting
John the Ripper (JtR)
A tool used to test password strength by trying to crack them.
Defense: Salting
"Adding Spice to the Recipe."
Case Study: Intern Ike and the "CEO"
Scenario: 4:55 PM on a Friday
Intern Ike at KibbleCorp receives an email:
"From: ceo@kibble-corp.net (Notice the .net!) Subject: URGENT WIRE TRANSFER I am stuck in a meeting. Wire $5,000 to this vendor immediately. If this isn’t done by 5:00 PM, it will be your fault. Do it now!"
Questions:
What specific type of social engineering is this?
Which "Principles of Influence" are being used?
What should Ike do?
Case Study Solution: Intern Ike
Snoopy’s Advice
Type: Whaling (impersonating a big fish/exec) or Spear Phishing.
Principles:
Action: Verify Out-of-Band. Do not reply to the email. Call the CEO’s assistant or walk to their office. Report to Snoopy immediately.
The final section synthesizes offensive/defensive perspectives and maps them to layered mitigations and operational response.
Recap: Offensive vs. Defensive
The Attacker (Red Team)
The Defender (Blue Team)
Analyzing the Attack with Wireshark
Red Flags
Defense in Depth: Mitigation Strategies
No Single Solution
A firewall won’t stop a user from holding the door open for a hacker. You need all three layers (Defense in Depth).
Vulnerability Databases
Learning Tools
Key Concepts:
Security Operations:
This module covered network security concepts: the CIA Triad and AAA framework, common threats (DoS, malware, social engineering), spoofing attacks (MAC, IP, ARP, DNS), rogue devices and password cracking, and Defense in Depth strategies. You learned how to analyze attacks using Wireshark and implement layered security controls. This concludes the network fundamentals series—you are now equipped with foundational knowledge to secure, monitor, and operate enterprise networks.
