Part I : Fundamentals of Network Security

Foundation Topics

Understanding Network and Information Security Basics

Network Security Objectives

Confidentiality, Integrity, and Availability

Cost-Benefit Analysis of Security

Classifying Assets

Classifying Vulnerabilities

Classifying Countermeasures

?What Do We Do with the Risk

Recognizing Current Network Threats

Potential Attackers

Attack Methods

Attack Vectors

Man-in-the-Middle Attacks

Other Miscellaneous Attack Methods

Applying Fundamental Security Principles to Network Design

Guidelines

Network Topologies

Network Security for a Virtual Environment

How It All Fits Together

Network Security Threat Landscape

Distributed Denial-of-Service Attacks

Social Engineering Methods

Social Engineering Tactics

Defenses Against Social Engineering

Malware Identification Tools

Methods Available for Malware Identification

Data Loss and Exfiltration Methods

 

Cisco Secure ACS, RADIUS, and TACACS

?Why Use Cisco ACS

?On What Platform Does ACS Run

?What Is ISE

Protocols Used Between the ACS and the Router

(Protocol Choices Between the ACS Server and the Client (the Router

Configuring Routers to Interoperate with an ACS Server

Configuring the ACS Server to Interoperate with a Router

Verifying and Troubleshooting Router-to-ACS Server Interactions

Bring Your Own Device Fundamentals

BYOD Architecture Framework

BYOD Solution Components

Mobile Device Management

MDM Deployment Options

On-Premise MDM Deployment

Cloud-Based MDM Deployment

 

Understanding VPNs and Why We Use Them

Cryptography Basic Components

Ciphers and Keys

Block and Stream Ciphers

Symmetric and Asymmetric Algorithms

Hashed Message Authentication Code

Digital Signatures

Key Management

Next-Generation Encryption Protocols

IPsec and SSL

Public Key Infrastructure

Public and Private Key Pairs

RSA Algorithm, the Keys, and Digital Certificates

Certificate Authorities

Using the Digital Certificates to Get the Peer’s Public Key

X.500 and X.509v3 Certificates

Authenticating and Enrolling with the CA

PKI Topologies

Putting the Pieces of PKI to Work

Viewing the Certificates in ASDM

ASA’s Default Certificate

Adding a New Root Certificate

IPsec Concepts, Components, and Operations

The Goal of IPsec

Now IPsec Can Protect the User’s Packets

The Internet Key Exchange (IKE) Protocol

Configuring and Verifying IPsec

Tools to Configure the Tunnels

Viewing the CLI Equivalent at the Router

Completing and Verifying IPsec

Planning and Preparing an IPsec Site-to-Site VPN

Customer Needs

Planning IKEv1 Phase 1

Planning IKEv1 Phase 2

Implementing and Verifying an IPsec Site-to-Site VPN in Cisco IOS

Devices

Troubleshooting IPsec Site-to-Site VPNs in Cisco IOS

Implementing and Verifying an IPsec Site-to-Site VPN in Cisco ASA

Troubleshooting IPsec Site-to-Site VPNs in Cisco ASA

Functions and Use of SSL for VPNs

SSL and TLS Protocol Framework

The Play by Play of SSL for VPNs

SSL VPN Flavors

Configuring Clientless SSL VPNs on ASA

Using the SSL VPN Wizard

Seeing the VPN Activity from the Server

Using the Cisco AnyConnect Secure Mobility Client

Types of SSL VPNs

Configuring the Cisco ASA to Terminate the Cisco AnyConnect Secure

Groups, Connection Profiles, and Defaults

Split Tunneling

Troubleshooting SSL VPN

Troubleshooting SSL Negotiations

Traffic-Specific Issues

 

VLAN and Trunking Fundamentals

Trunking with 802.1Q

Inter-VLAN Routing

The Challenge of Using Physical Interfaces Only

Spanning-Tree Fundamentals

Loops in Networks Are Usually Bad

Common Layer 2 Threats and How to Mitigate Them

Disrupt the Bottom of the Wall, and the Top Is Disrupted, Too

Specific Layer 2 Mitigation for CCNA Security

BPDU Guard

Root Guard

Port Security

CDP and LLDP

DHCP Snooping

Dynamic ARP Inspection

Using Network Foundation Protection to Secure Networks

The Importance of the Network Infrastructure

The Network Foundation Protection Framework

Understanding the Management Plane

Understanding the Control Plane

Understanding the Data Plane

Best Practices for Protecting the Data Plane

Additional Data Plane Protection Mechanisms

Securing Management Traffic

Using AAA to Verify Users

AAA Components

Options for Storing Usernames, Passwords, and Access Rules

Authorizing VPN Users

The AAA Method List

Role-Based Access Control

Encrypted Management Protocols

Understanding NTP

Implementing Security Measures to Protect the Management Plane

Implementing Strong Passwords

User Authentication with AAA

SSH and HTTPS

SNMP Features

Configuring NTP

Securing the Cisco IOS Image and Configuration Files

Understanding and Configuring IPv6

The Format of an IPv6 Address

Configuring IPv6 Routing

Developing a Security Plan for IPv6

Best Practices Common to Both IPv4 and IPv6

New Potential Risks with IPv6

Securing the Control Plane

Minimizing the Impact of Control Plane Traffic on the CPU

Control Plane Policing

Securing Routing Protocols

Implement Routing Update Authentication on OSPF

Implement Routing Update Authentication on EIGRP

Implement Routing Update Authentication on RIP

Implement Routing Update Authentication on BGP

 

Firewall Concepts and Technologies

Firewall Technologies

The Defense-in-Depth Approach

Static Packet Filtering

Application Layer Gateway

Stateful Packet Filtering

Application Inspection

Next-Generation Firewalls

Using Network Address Translation

NAT Is About Hiding or Changing the Truth About Source Addresses

Creating and Deploying Firewalls

Firewall Technologies

Firewall Design Considerations

Packet-Filtering Access Rule Structure

Rule Implementation Consistency
Chapter 15 : Implementing Cisco IOS Zone-Based Firewalls

Cisco IOS Zone-Based Firewalls

How Zone-Based Firewall Operates

Zones and Why We Need Pairs of Them

Configuring and Verifying Cisco IOS Zone-Based Firewalls

Using CCP to Configure the Firewall

Verifying the Firewall

Implementing NAT in Addition to ZBF

Verifying Whether NAT Is Working

The ASA Appliance Family and Features

ASA Firewall Fundamentals

ASA Security Levels

Tools to Manage the ASA

Packet Filtering on the ASA

Implementing a Packet-Filtering ACL

Configuring the ASA

Getting to the ASDM GUI

IP Addresses for Clients

NAT and PAT

Permitting Additional Access Through the Firewall

Using Packet Tracer to Verify Which Packets Are Allowed

IPS Versus IDS

Identifying Malicious Traffic on the Network

Signature-Based IPS/IDS

Policy-Based IPS/IDS

Anomaly-Based IPS/IDS

Reputation-Based IPS/IDS

Managing Signatures

Monitoring and Managing Alarms and Alerts

Security Intelligence

Define Key Terms

Chapter 18 : Mitigation Technologies for E-mail-Based and Web-Based Threats
Mitigation Technology for E-mail-Based Threats

E-mail-Based Threats

Cisco Cloud E-mail Security

Cisco Hybrid E-mail Security

Cisco E-mail Security Appliance

Cisco ESA Initial Configuration

Mitigation Technology for Web-Based Threats

Cisco CWS

Cisco WSA

Cisco Content Security Management Appliance

Antivirus and Antimalware Solutions

Personal Firewalls and Host Intrusion Prevention Systems

Advanced Malware Protection for Endpoints

Hardware and Software Encryption of Endpoint Data

E-mail Encryption

 

Tools for Final Preparation