NET-TRAFFIC-01, NET-FIREWALL-01 & Final Assessment

<!-- Wireshark Filters -->
# HTTP traffic
http
# HTTPS traffic
ssl
# DNS queries
dns
# Suspicious patterns
tcp.flags.syn == 1 and tcp.flags.ack == 0
# Source IP analysis
ip.src == 192.168.1.100
# Port scanning detection
tcp.port == 22 and tcp.flags.syn == 1

<!-- NetFlow Analysis -->
# High bandwidth flows
flow-export destination 192.168.1.100 2055
flow-export version 9
flow-export template timeout-rate 1
<!-- sFlow Configuration -->
sflow agent-ip 192.168.1.1
sflow collector-ip 192.168.1.100
sflow sampling-rate 1000
sflow polling-interval 20

<!-- Baseline Traffic Patterns -->
# Normal business hours
08:00-18:00: 1000-5000 packets/min
18:00-08:00: 100-500 packets/min
# Anomaly thresholds
Bandwidth: >200% of baseline
Connections: >500% of baseline
Failed logins: >10 per minute
# Alert conditions
if (traffic > baseline * 2) {
  trigger_alert("High traffic volume");
}

<!-- User Behavior Analysis -->
# Normal user patterns
- Login during business hours
- Access to authorized resources
- Normal data transfer volumes
# Suspicious patterns
- Login outside business hours
- Access to unauthorized resources
- Unusual data transfer patterns
- Multiple failed login attempts

<!-- Basic Firewall Rules -->
# Default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow SSH from specific network
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

<!-- Rate Limiting -->
iptables -A INPUT -p tcp --dport 22 -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP
<!-- Port Knocking -->
iptables -A INPUT -p tcp --dport 1000 -m recent --set --name KNOCK1
iptables -A INPUT -p tcp --dport 2000 -m recent --rcheck --seconds 10 --name KNOCK1 -m recent --set --name KNOCK2
iptables -A INPUT -p tcp --dport 3000 -m recent --rcheck --seconds 10 --name KNOCK2 -j ACCEPT

<!-- Cisco Zone-Based Firewall -->
# Define zones
zone security INSIDE
zone security OUTSIDE
zone security DMZ
# Define zone pairs
zone-pair security INSIDE-OUTSIDE source INSIDE destination OUTSIDE
zone-pair security OUTSIDE-DMZ source OUTSIDE destination DMZ
# Apply policies
class-map type inspect INSIDE-OUTSIDE
match access-group 100
policy-map type inspect INSIDE-OUTSIDE-POLICY
class INSIDE-OUTSIDE
inspect

<!-- Application Control -->
# Block specific applications
application-control
  block facebook
  block youtube
  allow business-apps
# Deep Packet Inspection
dpi
  inspect http
  inspect https
  inspect ftp
  inspect smtp

<!-- Security Assessment Process -->
1. Planning and Preparation
  - Define scope and objectives
  - Obtain authorization
  - Gather information
2. Reconnaissance
  - Network discovery
  - Service enumeration
  - Vulnerability scanning
3. Vulnerability Assessment
  - Manual testing
  - Automated scanning
  - Risk analysis
4. Reporting
  - Document findings
  - Risk prioritization
  - Remediation recommendations

<!-- Testing Techniques -->
# Network Testing
- Port scanning
- Service enumeration
- Protocol analysis
- Traffic analysis
# Application Testing
- Web application scanning
- Authentication testing
- Input validation testing
- Session management testing
# Social Engineering
- Phishing simulations
- Physical security testing
- Awareness assessment

<!-- Incident Response Phases -->
1. Preparation
  - Incident response plan
  - Team roles and responsibilities
  - Communication procedures
2. Identification
  - Detect security incidents
  - Analyze indicators of compromise
  - Assess impact and scope
3. Containment
  - Isolate affected systems
  - Prevent further damage
  - Preserve evidence
4. Eradication
  - Remove threats
  - Patch vulnerabilities
  - Strengthen defenses
5. Recovery
  - Restore systems
  - Monitor for reoccurrence
  - Validate security
6. Lessons Learned
  - Document incident
  - Update procedures
  - Improve security

<!-- Forensic Analysis -->
# Memory analysis
volatility -f memory.dump --profile=Win7SP1x64 pslist
volatility -f memory.dump --profile=Win7SP1x64 netscan
# Disk analysis
autopsy
sleuthkit
# Network forensics
wireshark
tshark -r capture.pcap -T fields -e ip.src -e ip.dst
# Timeline analysis
log2timeline.py timeline.csv /path/to/evidence

<!-- ELK Stack Configuration -->
# Elasticsearch configuration
cluster.name: security-cluster
node.name: security-node-1
network.host: 0.0.0.0
http.port: 9200
# Logstash configuration
input {
  beats {
    port => 5044
  }
}
filter {
  if [fields][log_type] == "security" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{IP:source_ip} %{GREEDYDATA:message}" }
    }
  }
}

<!-- Threat Intelligence Feeds -->
# IOC (Indicators of Compromise)
- IP addresses
- Domain names
- File hashes
- Email addresses
# Threat Intelligence Sources
- Commercial feeds
- Open source feeds
- Government sources
- Industry sharing
# Integration with SIEM
- Automated correlation
- Real-time alerts
- Historical analysis
- Trend analysis

<!-- Security Frameworks -->
# NIST Cybersecurity Framework
- Identify: Asset management, Risk assessment
- Protect: Access control, Data security
- Detect: Monitoring, Detection processes
- Respond: Response planning, Communications
- Recover: Recovery planning, Improvements
# ISO 27001
- Information security management system
- Risk management
- Security controls
- Continuous improvement
# COBIT
- IT governance framework
- Process management
- Control objectives
- Maturity models

<!-- Risk Assessment Process -->
1. Asset Identification
  - Hardware assets
  - Software assets
  - Data assets
  - Human assets
2. Threat Analysis
  - External threats
  - Internal threats
  - Threat likelihood
  - Threat impact
3. Vulnerability Assessment
  - Technical vulnerabilities
  - Process vulnerabilities
  - Human vulnerabilities
4. Risk Calculation
  Risk = Threat × Vulnerability × Impact
5. Risk Treatment
  - Accept
  - Avoid
  - Mitigate
  - Transfer