Sws101_journal4
TryHackMe Traffic Analysis Essentials
Task 1 Introduction
As students learning cybersecurity, we should recognize the importance of protecting data, applications, devices, and systems connected to the network.
We need to study network data to identify problems and anomalies. Traffic analysis is a rich data source and the subdomain of the Network Security domain that can reveal odd or unexpected patterns, even if the data is encoded or encrypted.
Task 2
Network Security is a critical component of cybersecurity, focusing on the design, operation to ensure accessibility, integrity, continuity, and reliability.
At its core, Network Security revolves around two fundamental concepts: authentication and authorization.
Core Concepts of Network Security
Authentication: Verifying the identity of a user, device, or system attempting to access network resources. This process ensures that only authorized entities can gain access.
Authorization: Determining what actions an authenticated entity is permitted to perform within the network. This involves granting or denying access to specific resources based on predefined policies.
Base Control Levels
Network Security is structured around three foundational control levels:
Physical Security: Measures to prevent unauthorized physical access to network hardware, cables, and other components.(locks, surveillance systems)
Technical Security: Controls aimed at protecting network data from unauthorized access.(encryption, firewalls)
Administrative Security: Policies and procedures that govern network security operations.(access control policies, user training)
Main Approaches and Elements
Access Control: Ensures that only authorized individuals or systems can access network resources.
Firewall Protection: Filters network traffic based on predefined security rules to block malicious activity.
Network Access Control (NAC): Verifies that devices meet certain security standards before granting network access.
Identity and Access Management (IAM): Manages user identities and access rights to network resources.
Network Segmentation: Divides the network into segments to limit the spread of threats and enhance security.
Virtual Private Networks (VPNs): Securely connects remote users to the network.
Zero Trust Model: Assumes no entity inside or outside the network is trusted by default, requiring verification for every access request.
Threat Control: Focuses on detecting and preventing malicious activities.
Intrusion Detection and Prevention (IDS/IPS): Monitors network traffic for signs of intrusion and takes action to prevent or mitigate attacks.
Data Loss Prevention (DLP): Protects against unauthorized data extraction or leakage.
Endpoint Protection: Secures devices and applications that connect to the network.
Cloud Security: Safeguards cloud-based resources and data.
Security Information and Event Management (SIEM): Collects and analyzes security events to identify threats and vulnerabilities.
Security Orchestration Automation and Response (SOAR): Automates security operations to improve efficiency and response times.
Managed Security Services (MSS) For organizations lacking the resources or expertise to manage security operations internally, Managed Security Services (MSS) offer a viable alternative. MSS providers, known as Managed Security Service Providers (MSSPs), offer a range of services including:
Network Penetration Testing: Simulates attacks to assess network vulnerabilities.
Vulnerability Assessment: Identifies weaknesses in the network that could be exploited by attackers.
Incident Response: Provides a structured approach to handling security breaches.
Behavioral Analysis: Monitors system and user behaviors to detect anomalies and threats.
Task 3 Traffic Analysis
Traffic analysis identifies and addresses system health issues, network anomalies, and security threats.
That way, security and operational teams can uncover unusual patterns that may indicate potential problems or malicious activities.
Key disciplines
utilizing tools like Wireshark to capture and analyze network packets for insights into network behavior and potential security threats.
using tools such as Zeek to continuously observe network traffic, detect anomalies, and ensure network performance.
using Snort to identify and block malicious activities by analyzing network traffic for signs of intrusion attempts.
leveraging NetworkMiner to analyze captured network traffic for evidence of security incidents and breaches.
applying Brim to proactively search for threats and vulnerabilities within the network that might have evaded traditional security measures.
Techniques
flow analysis
simple but lacks the depth needed to pinpoint the root cause of specific issues.
packet analysis
time-consuming and requiring specialized skills, it offers a comprehensive view of network traffic, enabling the identification of the root cause of issues.
Importance of Traffic Analysis
Despite the evolution of security tools and the shift towards cloud computing, Traffic Analysis remains a vital skill for security analysts. Encoded or encrypted network data can still reveal patterns indicative of unusual or suspicious activities. Therefore, mastering Traffic Analysis is crucial for detecting and responding to advanced threats effectively.
Practical Application
Network Monitoring, Intrusion Detection, Network Forensics, and Threat Hunting.
Level-1 is simulating the identification and filtering of malicious IP addresses.
we got a malware? click the button.
this time we are getting logs of what is running over it. if we get enough, we can analyze data
fill the filter box with the ip address given above
I click the restart button. After restarting i find out i have blocked the malware.
Level-2 is simulating the identification and filtering of malicious IP and Port addresses.
Now we are blocking destination ports.
We can see the destination ports they correlate to in the Traffic Analyzer table on the right.
This time we need port numbers(choose 5,6,8)
(4444, 7777, 2222)
after playing restart, i blocked the malware successfully again.
Conclusion
The “Traffic Analysis Essesntials” room has completed.
We covered
Network Security is about protecting the network’s components through authentication and authorization.
Traffic Analysis is a method of intercepting, recording, and analyzing network data
traffic analysis operation using a static site. This exercise allowed for the practical application of Traffic Analysis skills, focusing on identifying anomalies and flags within network traffic.