GIAC GDSA — Network Defense Controls

Detection Types:

• Signature-based: Matches known attack patterns (low FP for known threats, misses zero-days and polymorphic attacks)
• Anomaly-based: Establishes behavioral baseline, detects deviations (higher FP, catches new/unknown threats)
• Hybrid: Combines both approaches — most production IDS/IPS use hybrid detection

Placement (Critical for Exam):

• NIDS: Passive — deployed out-of-band via SPAN port (mirror port) or network tap. Does NOT block traffic. Generates alerts only.
• NIPS: Active — deployed inline between network segments. Can block malicious traffic. Adds latency. Failure can disrupt traffic (fail-open vs fail-closed policy).

Network Taps vs SPAN Ports:

• Hardware taps: Passive optical/copper devices providing 100% packet capture. No packet loss under load. Preferred for forensic-grade NSM.
• SPAN ports: Software-configured on switches. May drop packets when switch is under high load. Lower cost but less reliable.

Evasion Techniques:

• IP fragmentation — split payload across fragments to hide signature
• Protocol encoding — Base64, hex encode attack strings
• TTL manipulation — send packets with low TTL to reach IDS but expire before target
• Polymorphic payloads — change shellcode structure while preserving behavior
• Detection engines must reassemble TCP streams and IP fragments before matching

Key Products: Snort (open source, signature-based), Suricata (multi-threaded, open source), Cisco FTD (Firepower), Palo Alto NGFW with integrated IPS.

Alert Tuning: Reduce false positives by whitelisting known-good traffic patterns, adjusting anomaly thresholds, and suppressing alerts from specific IP/port combinations.

NSM Definition: Collection, analysis, and escalation of network data to detect and respond to intrusions. Provides forensic evidence for incidents that preventive controls miss.

Data Types (Know all three):

• Full Packet Capture (FPC): Complete forensic record of all network traffic. Tools: Stenographer (Google), Moloch/Arkime. High storage requirement. Essential for post-incident forensics.
• Flow Data (NetFlow/IPFIX/sFlow): Summarized connection metadata (src IP, dst IP, ports, bytes, duration). Much lower storage. Cannot reconstruct payload. Useful for anomaly detection and bandwidth analysis.
• Protocol Logs: Zeek/Bro generates structured logs per protocol: conn.log (all connections), dns.log, http.log, ssl.log, files.log. Queryable for threat hunting.

Core NSM Tools:

• Zeek (formerly Bro): Protocol analyzer producing structured log files. Passive, no blocking. Excellent for threat hunting and forensics.
• Suricata: High-performance IDS/IPS/NSM engine with rule sets (ET Open, ET Pro). Generates eve.json for SIEM integration.
• Security Onion: Linux distro bundling Zeek, Suricata, Elasticsearch, Kibana, Strelka, and Filebeat. Full NSM platform.

East-West Monitoring: NSM should capture lateral movement inside the network, not just perimeter traffic. Attackers who pass the perimeter move east-west between systems — this traffic is invisible if only perimeter is monitored.

Retention Requirements: Minimum 90 days of hot storage for active incident response. 1 year archive for compliance. Flow data is cheaper to retain than FPC.

SIEM Integration: Zeek logs and Suricata events forward to Splunk, Elastic SIEM, or Sentinel for correlation, alerting, and long-term retention.

Threat Hunting: Proactive searching for compromise indicators that haven't yet triggered alerts. NSM data is the primary corpus for hunting. Hypotheses driven by threat intelligence.

Purpose: Detonate suspicious files in an isolated virtual machine and observe behavior — file writes, registry changes, network connections, process spawning, API calls. Reveals malicious behavior invisible to static analysis.

Analysis Types:

• Static analysis: Examine file without executing — strings, hashes, PE header, imports, YARA rule matching. Fast, safe, but misses obfuscated/packed malware.
• Dynamic/behavioral analysis: Execute in isolated VM, monitor all actions. Catches packed/obfuscated malware. Requires safe execution environment.

Sandbox Products:

• Cuckoo Sandbox: Open source, self-hosted. Supports Windows/Linux/Android. Integrates with Suricata for network analysis.
• Joe Sandbox: Commercial, deep analysis including hypervisor-level monitoring.
• ANY.RUN: Interactive cloud sandbox — analyst can interact with sample in real time.
• VirusTotal: Multi-AV scan plus basic sandbox. Good for initial triage.

Sandbox Evasion Techniques (Critical for Exam):

• VM detection: Check CPUID for hypervisor bit, disk size check (sandboxes often have small disks), check for sandbox-specific processes/registry keys, MAC address OUI checks
• Timing attacks: Sleep for longer than sandbox analysis window (30-60 seconds) before executing malicious code
• User interaction requirements: Wait for mouse movement, require specific user action before executing payload — most sandboxes don't simulate realistic user behavior
• Environment checks: Check for domain membership, number of running processes, screen resolution

Integration Points: Email gateway (scan attachments before delivery), web proxy (scan downloaded files), EDR (forward suspicious processes to sandbox). Defense-in-depth requires sandbox at multiple inspection points.

YARA Rules: Pattern-matching language for static file classification. Used to identify malware families, threat actor TTPs, and suspicious strings across file types.

DDoS Attack Classification:

• Volumetric: Flood and consume bandwidth. UDP flood, ICMP flood, DNS amplification (attacker sends small query → DNS returns large response to victim). Goal: saturate network pipe.
• Protocol: Exhaust stateful device tables (firewalls, load balancers). SYN flood (fill TCP half-open connection table), Ping of Death, Smurf attack. Goal: crash network devices.
• Application Layer (Layer 7): Exhaust application server resources. HTTP flood, Slowloris (open many slow HTTP connections), DNS query flood. Goal: crash web/app servers. Hardest to filter — traffic looks legitimate.

SYN Cookies (Exam Favorite):

• Problem: SYN flood fills the server's half-open connection table (backlog queue) — server can't accept new connections
• SYN cookies: server encodes connection state into the TCP ISN (Initial Sequence Number) of the SYN-ACK. Server does NOT store connection state until client completes the handshake (sends ACK)
• Result: backlog queue stays empty. Server can handle unlimited SYN packets without state table exhaustion
• Downside: loses TCP options (window scaling, timestamps) — minor performance trade-off

Other Mitigations:

• Rate limiting: Per-source-IP connection limits. Effective for smaller attacks but doesn't help against distributed botnets.
• Black hole routing (RTBH): Null-route the victim IP — stops attack traffic but also legitimate traffic. Last resort.
• Upstream scrubbing services: Cloudflare, Akamai, AWS Shield Advanced absorb attack traffic in their scrubbing centers before it reaches your network. Best for large volumetric attacks.
• Anycast diffusion: Distribute attack traffic across multiple PoPs globally — no single location is overwhelmed.

Web Proxy Architecture:

• Forward proxy: All outbound HTTP/HTTPS traffic is routed through the proxy server. Provides URL filtering, logging, content inspection.
• Transparent proxy: Network appliance intercepts traffic without client configuration (policy-based routing or WCCP). Client doesn't know proxy exists.
• Explicit proxy: Client browser/OS configured with proxy address. Can use PAC (Proxy Auto-Configuration) files to automate browser configuration.

SSL/TLS Inspection: Proxy performs man-in-the-middle — establishes separate TLS sessions with client (using corporate CA certificate) and server. Decrypts, inspects, re-encrypts traffic. Corporate CA must be trusted by all endpoints (deployed via Group Policy/MDM). Reveals malware C2 callbacks, data exfiltration, threats in encrypted traffic.

Email Authentication Standards:

• SPF (Sender Policy Framework): DNS TXT record listing IP addresses authorized to send email for the domain. Receiving server checks if sending IP is in the SPF record. Values: +all (pass), -all (hard fail/reject), ~all (soft fail/spam). Does NOT protect against header spoofing — only validates envelope From.
• DKIM (DomainKeys Identified Mail): Cryptographic signature applied to email headers and body. Receiving server retrieves public key from DNS (TXT record) and validates signature. Proves message was not altered in transit and originated from authorized sender. Does NOT prevent lookalike domains.
• DMARC (Domain-based Message Authentication, Reporting, and Conformance): Policy telling receiving servers what to do when SPF/DKIM checks fail. Values: p=none (monitor, take no action), p=quarantine (send to spam), p=reject (block delivery). Also provides rua/ruf reporting for visibility into spoofing. Alignment: requires SPF/DKIM to align with the From: header domain.

Email Gateway Security: Attachment sandboxing, URL rewriting (URLs re-written to proxy for post-delivery scanning), RBL (Reputation Block Lists) to block known bad sending IPs, outbound DLP scanning, DNSSEC for domain validation.

NGFW vs Traditional Stateful Firewall:

• Traditional: inspects IP/port/protocol (Layers 3-4), stateful connection tracking, simple ACLs
• NGFW adds: Application identification (Layer 7 DPI — identifies Dropbox regardless of port), user-identity integration (from Active Directory/LDAP), URL filtering, integrated IPS, TLS/SSL inspection, threat intelligence feeds, sandboxing integration
• Zone-based policy: Zones (DMZ, internal, external, management) with explicit policies between zones. Implicit deny all. Policy applies between zone pairs.

VPN Technologies:

• IPsec IKEv2: Preferred over IKEv1. Shorter handshake, stronger crypto (AES-256/SHA-256), MOBIKE for mobility (handles IP address changes), EAP authentication methods, built-in NAT traversal. IKEv1 had known weaknesses (aggressive mode, weak DH groups).
• IPsec components: AH (authentication only, no encryption), ESP (encryption + authentication — use ESP). Tunnel mode (entire IP packet encrypted, new IP header — use for site-to-site and remote access). Transport mode (only payload encrypted — used between hosts).
• SSL/TLS VPN: Clientless (browser-based, portal access to internal apps) or full client. Easier to deploy, works through most firewalls. Lower performance than IPsec.
• Split tunneling: Risk — non-corporate traffic goes directly to internet, bypassing corporate security controls (proxy, firewall, DLP). Always-on VPN forces all traffic through corporate network.

Jump Box / Bastion Host Requirements:

• All privileged/admin access to production systems routes through the jump box
• MFA enforced — all authentication requires second factor
• Session recording — all admin sessions recorded (video + keystrokes). PAM tools: CyberArk, BeyondTrust, Teleport.
• Dedicated management VLAN — isolated from other traffic
• Minimal installed software — attack surface reduction
• Admin workstation never holds production credentials — credentials only accessible from jump box
• Quarterly access reviews — ensure only authorized admins have access