policy based routing (PBR)

I was working on an issue with something not working related to PBR.

A good rule of thumb is do the PBR's on outbound traffic. Next the next hop IP to outside gateway or LAN switch

Let NAT's handle inbound traffic

Outbound

LAN1 > LAN2

LAN1 > Outside > NAT > Internet

Inbound

Internet traffic > Outside > NAT > LAN1

cisco duo authproxy using ldaps cert expired

The DC certs were renewed. The CA that signed them had also been renewed. The ssl_ca_certs_file in authproxy.cfg was now pointing to an old/incorrect CA certificate that no longer matched. This caused the SSL verification to fail and preventing users from logging in.

From the authproxy server. Run this power shell. You'lls need to update the name of DC1.domain.local to match your DC

$tcpClient = New-Object System.Net.Sockets.TcpClient("DC1.domain.local", 636)

$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream(), $false, {$true})

$sslStream.AuthenticateAsClient("DC1.domain.local")

$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain

$chain.Build($sslStream.RemoteCertificate)

$chain.ChainElements | ForEach-Object {

    $c = $_.Certificate

    Write-Host "Subject: $($c.Subject)"

    Write-Host "Thumbprint: $($c.Thumbprint)"

    Write-Host "---"

}

This should let us know the new thumbprint

Now we can use it to export the certs we need 

$tcpClient = New-Object System.Net.Sockets.TcpClient("DC1.domain.local", 636)

$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream(), $false, {$true})

$sslStream.AuthenticateAsClient("DC1.domain.local")

$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain

$chain.Build($sslStream.RemoteCertificate)

$caCert = $chain.ChainElements | Where-Object { $_.Certificate.Thumbprint -eq "NEW-CA-THUMBPRINT-HERE" } | Select-Object -First 1

$bytes = $caCert.Certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert)

$b64 = [System.Convert]::ToBase64String($bytes, [System.Base64FormattingOptions]::InsertLineBreaks)

$pem = "-----BEGIN CERTIFICATE-----`n$b64`n-----END CERTIFICATE-----"

[System.IO.File]::WriteAllText("C:\certs\DC-CA-new.cer", $pem)

Write-Host "Done - saved to C:\certs\DC-CA-new.cer"

Update authproxy.cfg file

under [ad_client] section

ssl_ca_certs_file=C:\certs\DC-CA-new.cer

Stop/start the authproxy service

net stop DuoAuthProxy && net start DuoAuthProxy

run connection tool again all should be fixed:
C:\Program Files\Duo Security Authentication Proxy\bin> .\authproxy_connectivity_tool.exe

google cyber sec cert notes

CIA triad 

• Confidentiality (least privilege / zero trust)
• Integrity ( data is correct and reliable, can't be edit, encryption )
• Availability ( data can be used when needed )

CISSP

Certified Information Systems Security Professional

CISSP 8 security domains

• Security and Risk Management: The foundational domain covering governance, compliance, the CIA triad (Confidentiality, Integrity, Availability), legal/regulatory issues, and organizational risk assessment
• Asset Security: Focuses on the protection of assets, data classification, handling requirements, data retention policies, and data lifecycle management
• Security Architecture and Engineering: Encompasses security models, cryptography, hardware/software design, and mitigating vulnerabilities within system architectures
• Communication and Network Security: Deals with secure network design, hardware, transmission methods, and securing communication channels (e.g., VPNs, firewalls)
• Identity and Access Management (IAM): Centers on controlling access to systems and data, covering authentication, authorization, and identity provisioning
• Security Assessment and Testing: Focuses on security testing methodologies, vulnerability assessments, penetration testing, and auditing to evaluate security controls.
• Security Operations: Covers daily operational tasks such as incident management, disaster recovery, patch management, and foundational forensic
• Software Development Security: Applies security controls and coding principles within the Software Development Life Cycle (SDLC) and databases.

Asset 

• A item that has value to an organisation

Threat

• Anything that can negatively impact assets  

Risk

• The likelihood of a threat occurring. We can also take into account low/high risk assets.
• 
  

Vulnerability 

A weakness that can be exploited by a threat. There must be a vuln and a threat for there to be a risk

vuln + threat = risk

Risk management framework

• Prepare 
• Categorize
• Select
• Implement
• Assess
• Authorize
• Monitor

What to do about risk:

• Acceptance: Accepting a risk to avoid disrupting business continuity

• Avoidance: Creating a plan to avoid the risk altogether

• Transference: Transferring risk to a third party to manage

• Mitigation: Lessening the impact of a known risk

NIST RMF terms

• Assess: The fifth step of the NIST RMF that means to determine if established controls are implemented correctly
• Authorize: The sixth step of the NIST RMF that refers to being accountable for the security and privacy risks that may exist in an organization
• Business continuity: An organization's ability to maintain their everyday productivity by establishing risk disaster recovery plans
• Categorize: The second step of the NIST RMF that is used to develop risk management processes and tasks
• External threat: Anything outside the organization that has the potential to harm organizational assets
• Implement: The fourth step of the NIST RMF that means to implement security and privacy plans for an organization
• Internal threat: A current or former employee, external vendor, or trusted partner who poses a security risk
• Monitor: The seventh step of the NIST RMF that means be aware of how systems are operating
• Prepare: The first step of the NIST RMF related to activities that are necessary to manage security and privacy risks before a breach occurs
• Ransomware: A malicious attack where threat actors encrypt an organization’s data and demand payment to restore access 
• Risk: Anything that can impact the confidentiality, integrity, or availability of an asset
• Risk mitigation: The process of having the right procedures and rules in place to quickly reduce the impact of a risk like a breach
• Security posture: An organization’s ability to manage its defense of critical assets and data and react to change
• Select: The third step of the NIST RMF that means to choose, customize, and capture documentation of the controls that protect an organization
• Shared responsibility: The idea that all individuals within an organization take an active role in lowering risk and maintaining both physical and virtual security
• Social engineering: A manipulation technique that exploits human error to gain private information, access, or valuables 
• Vulnerability: A weakness that can be exploited by a threat

Frameworks

Guidelines to build plans

NIST frameworks (CSF)

• Govern - strong management of cyber sec risk across the whole org
• Identify - Knowing what's in your network from assests to policies
• Protect - Secure systems like adding firewall rules or removing malware
• Detect - watching logs to detect issues or issues logged by ticket
• Respond - respond to an incident 
• Recover - restore files from backups

OWASP

• Open
• Web
• Application
• Security 
• Principles 

Minimize attack surface

Least privilege / zero trust

Defence in depth, multiple lines of defence. MFA / segregation

Separation of duties. Eg windows admins / network admins / backup admins. No one has full control of the org. We can also look at it like having 3 team members if one gets sick the team is still up

Keep security as simple as possible (

Fix security issues, do root cause analysis and fix for good.

Keeping up to date

Medium

Conferences local and the big ones

Security audit 

External and internal 

Most will be done internal 

We will review and improve se

identify risk

check controls 

assess compliance 

Security controls

• admin controls - policies
• technical controls - IPS systems
• physical controls - cctv / locks

If we opeerate in the EU and take CC payment then we need to comply with GDPR and PCIDSS.

Log analysis

• 
  
• Firewall logs - connections / actions / traffic passing through the firewall
• Network logs - Taken from the switches in side getting that east > west traffic
• Server / endpoint logs - User login's / process / etc

SIEM

• Security 
• Information 
• Event 
• Management 

The SIEM takes in all the logs from multiple sources. It will create dashboards / graphs / timelines etc. 

SOAR

• Security
• Orchestration
• Automation,
• And Response 

SIEM types

Self hosted - you have your own server and data storage

Cloud hosted - cloud hosted by your vendor

hybrid - 

Splunk / splunk enterprise - cisco purchased it

Chronical - googles cloud native tool 

• Chronicle: A cloud-native tool designed to retain, analyze, and search data

• Incident response: An organization’s quick attempt to identify an attack, contain the damage, and correct the effects of a security breach

• Log: A record of events that occur within an organization’s systems 

• Metrics: Key technical attributes such as response time, availability, and failure rate, which are used to assess the performance of a software application

• Operating system (OS): The interface between computer hardware and the user

• Playbook: A manual that provides details about any operational action

• Security information and event management (SIEM): An application that collects and analyzes log data to monitor critical activities in an organization

• Security orchestration, automation, and response (SOAR): A collection of applications, tools, and workflows that use automation to respond to security events

• SIEM tools: A software platform that collects, analyzes, and correlates security data from various sources across your IT infrastructure that helps identify and respond to security threats in real-time, investigate security incidents, and comply with security regulations

• Splunk Cloud: A cloud-hosted tool used to collect, search, and monitor log data

• Splunk Enterprise: A self-hosted tool used to retain, analyze, and search an organization's log data to provide security information and alerts in real-time

Playbooks

• SIEM detects events
• Playbooks provide a guide for all staff to follow for each kind of incident
• Playbooks are living documents so they are updated all the time
• We have an incident, we apply the playbook, we review and update with lessons learned .

Networks and security

Before we can secure networks we need to understand how they work

MAC addresses (layer 2 local vlan)

IP's (layer 3 routing to other networks)

LAN small area (small business or home network)

WAN larger area (the internet is one big WAN)

• Hub - just retransmits signals broadcast all traffic everywhere not really used these days as they can cause loops. They are generally cheaper devices and often need to be rebooted regularly.
• layer 2 switch - more intelligent than a hub, has vlans and only sends traffic where it needs to go.
• router - connects multiple networks together
• layer 3 switch - switch and router combined. Many modern devices can do both for example a palo alto firewall can do switching on its ports, routing and firewalling.
• Home ISP device - Often a all in one small device that can do modem/routing/wifi/switching/basic firewalling. This lets home users connect to the ISP network and onto the internet.
• virtual network devices - virtual instances of network devices, we can bring up a virtual firewall in AWS for example 

Example traffic flow for small business

User device > switch > firewall  > internet > internet routers > destination

Example traffic flow for home connection

User device > WIFI > ISP modem/router > internet > internet routers > destination

Client/Server model

End user devices like computers / laptops / phones are known as clients

Servers are the servers hosting the service s that the clients want to use.

Cloud networks

Instead of having all the network devices and servers on site, companies can move their servers and network devices into the cloud and pay a cloud service provider (CSP).

Some benefits include on demand storage and processing power scaling. Cloud analytics (very useful for ops and security teams)

Software as a service (SaaS) - web applicaitons 

Infrastructure as a service (IaaS) - network and server infra

Platform as a service (PasS) - The development platform for the web apps

Just like normal infrastrucre, everything sits on top of the network and servers. None of the apps etc can work unless the infrastructure is working.

Iaas > Paas > SaaS

Data packet

Basic unit of information that travels from one device to another over the network

Basic form of a data packet

header body footer

On most networks data is transferred mostly via TCP/IP 

TCP/IP model

• 1 - Network access layer (ethernet / WIFI)
• 2 - Internet layer (IPv4 / IPv6)
• 3 - Transport layer (TCP / UDP)
• 4 - Application layer (HTTP TLS FTP SMTP etc)

ICMP 

Ping is the best and worst testing tool. ICMP used by ping is its own protocol. It's useful to testing basic network connectivity but it doesn't follow the same rules as TCP. For example you ping to a site can work but the website may not load because of an application layer issue.

TCP vs UDP

TCP - connections (SYN / SYN-ACK / ACK)

UDP - connectionless (used for voice/video streaming) QUIC MASQUE

OSI model 

• Application (HTTP, SMTP etc)
• Presentation (data translation / encryption / compression TLS)
• Session (Session manages open/active connections / reconnection them etc)
• Transport (transport, breaking up data into packets TCP/UDP)
• Network (get frames from data link and send them where to do, routing)
• Data link (macs and frames, NCP HDLC SDLC)
• Physical (cables etc)

TCP/IP model is real world. OSI is more theoretical. Need to be familiar with both.

IPv4 address

19.117.63.126

IPv6 address (32 characters)

684D:111:222:3333:444:555:6:77

All IPv4 addresses were being used up. We had to make IPv6 so there would be enough addresses for ever. So far it seems to have been adopted by service providers. I've not seen IPv6 on the LAN in most orgs. IPv6 addresses are much harder for humans to read and spot in logs.

Types of addresses:

• Public IP - on the internet
• Private IP - On the LAN
• MAC address - hardware address of the network card

Format of IPv4 packet

header 20-60

total 20 - 65535 bytes

• Version (VER): This 4 bit component tells receiving devices what protocol the packet is using. The packet used in the illustration above is an IPv4 packet.
• IP Header Length (HLEN or IHL): HLEN is the packet’s header length. This value indicates where the packet header ends and the data segment begins. 
• Type of Service (ToS): Routers prioritize packets for delivery to maintain quality of service on the network. The ToS field provides the router with this information.
• Total Length: This field communicates the total length of the entire IP packet, including the header and data. The maximum size of an IPv4 packet is 65,535 bytes.
• Identification: IPv4 packets can be up to 65, 535 bytes, but most networks have a smaller limit. In these cases, the packets are divided, or fragmented, into smaller IP packets. The identification field provides a unique identifier for all the fragments of the original IP packet so that they can be reassembled once they reach their destination.
• Flags: This field provides the routing device with more information about whether the original packet has been fragmented and if there are more fragments in transit.
• Fragmentation Offset: The fragment offset field tells routing devices where in the original packet the fragment belongs.
• Time to Live (TTL): TTL prevents data packets from being forwarded by routers indefinitely. It contains a counter that is set by the source. The counter is decremented by one as it passes through each router along its path. When the TTL counter reaches zero, the router currently holding the packet will discard the packet and return an ICMP Time Exceeded error message to the sender. 
• Protocol: The protocol field tells the receiving device which protocol will be used for the data portion of the packet.
• Header Checksum: The header checksum field contains a checksum that can be used to detect corruption of the IP header in transit. Corrupted packets are discarded.
• Source IP Address: The source IP address is the IPv4 address of the sending device.
• Destination IP Address: The destination IP address is the IPv4 address of the destination device.
• Options: The options field allows for security options to be applied to the packet if the HLEN value is greater than five. The field communicates these options to the routing devices.

Network protocols

A sample flow of a basic connection to a website.

• DNS - lookup IP to domain name www.website.com
• ARP - Find where next hope gateway is towards internet
• TCP - Make a connection to the website IP
• TLS - Setup secure connection between client and server
• HTTPS - Display the webpage in the browser over the TLS connection 

WIFI security

IEEE 802.11 is WIFI

WEP (broken) > WPA (transitional) > WPA2 (KRACK attacks still work) > WPA3 (more secure, more complex)

Firewalls

Allow/block traffic based on their rules. The rules are configured by admin.

• Hardware - physical device has its own memory/CPU
• Software - Software imagine which can run in your virtualization infra
• Cloud - Cloud hosted software firewall

stateless - Just applies its rules to traffic but doesn't keep track of connections (less secure

stateful - keeps track of connections and filters threats

ngfw - Does everything stateful does and more (DPI, IPS, Threat intel, content filtering etc)

Firewalls are often the headend for dial in VPNs (remote access for users)

VPNs (virtual private networks)

• Site links are expensive, we can make VPN across the public internet but keep them secure 
• S2S VPNs - connect two sites via an encrypted tunnel
• dial in or RA VPNS - remote access VPNs for end users to work from home etc

Security Zones

Before we had interfaces

Now we can have zones where we have multiple interfaces in one zone

Zones are used as part of network segmentation

Outside/internet - uncontroller

Ideally

Internet > firewall > DMZ > firewall > LAN > firewall > Restricted zone

We can have multiple DMZ's / LANs / WIFIs / Restricted zones

Often to cut costs we will just have one firewall with each zone as an interface off the firewall

Internet > firewall > DMZ/LAN/WIFI/Restricted

The firewall controls access between the zones.

To do some network segmentaiton

• Firewall interface (with firewall rules applied)
• Assign it to the inside security zone 
• Attach interface to the LAN vlan on the switch
• Create an IP subnet for the LAN network

Proxy servers

The proxy server forwards requests on.

The most common was a web proxy or forward proxy.

user > web proxy > internet

Users never get direct internet access.

Reverse proxy (often socks5) take data from internet/dmz and forwards it to inside servers.

forward: user > proxy > internet

reverse: internet/dmz > proxy > server

Many left behind forward proxies for cisco umbrella / dns protection.

VPN protocols

Wireguard

• code base: 4K lines
• cryptography: fixed modern suite
• High speed vpn
• newer (2016)
• open source
• key-pairs but not built in identity system

IPsec (IKEV2)

• code base: 10K plus
• Earlier protocol (late 1990s)
• More complex
• cryptography: Negotiable, many cipher/algorithm
• Tried and tested, well supported

 

TLS/DTLS-based VPNs (OpenVPN, Cisco AnyConnect/DTLS, GlobalProtect)

• code base: 10K plus
• In the middle protocol (openvpn 2001, dtls 2006)
• More complex
• cryptography: Negotiable, many cipher/algorithm
• Tried and tested, well supported

Rule-of-thumb selection guidance

• Need it to work everywhere, even hostile networks > TLS/DTLS (OpenVPN-style)
• Need broad native client support with enterprise auth (RADIUS/certs/MFA) > IPsec/IKEv2
• Need maximum speed/efficiency and control both ends > WireGuard (often paired with an identity/ACL layer like Tailscale for enterprise use)

Security hardening

Just like our house we don't leave doors and windows opens, we might use CCTV cameras and have a house alarm.

In IT we patch/update our systems. We require passwords/MFA to get access, we encrypt data in transit. We monitor logs for suspicious activity

OS hardening

• OS updates/patches
• Application updates/patches
• Library, some applications make use of common public librarys/packages, usually covered by updating the application but not always
• Password policies and MFA
• Baseline config

Brute force attacks - trying every combination of password

Dictionary attacks - trying password lists of credentials from previous breachs

Rainbow table attack - If we have a hash of the users password we can see if the hash has been cracked already to the plain text password.

Hashing

We take a plain text "password" and hash it with give a string. It's a one way password > hash. Then we can store the hash in our database instead of the users password.

Salting

Involves adding salt to the dish. hash = H(password + salt).

The salt is the stored alongside the hash (it doesn't need to be secret).

Rainbow table attacks: Attackers precompute huge tables of hash values for common passwords. If your hash matches an entry, they instantly know the password. Salting defeats this because each password now hashes differently even if the underlying password is the same — a precomputed table would need to account for every possible salt, making the attack impractical.

Duplicate detection: Without salts, two users with the same password get the same hash — visibly revealing that they share a password. Salts make each hash unique even for identical passwords.

Network hardening

• Updating software on network devices
• Using a firewall/ACLs to control access
• Port filtering
• network segmentation
• use latest encryption 
• network log analysis
• IPS/IDS

Network security in the cloud

Cloud security we should use baseline OS images

You can think about cloud security like living in a house alone. You might leave everything unlocked because its just you there. However if you have roommates you might start locking your room. When you are in a public cloud you are in there with roommates. Then cloud vendor and other customers.

Keep in mind with cloud some aspects will be hidden to you. With on prem you would have access to everything.

CSP secures the cloud infra and OS patches etc.

hypervisor type1: run on hardware

hypervisor type2: software

security holes in hypervisor can lead to VM escapes.

Baselining all security settings

encryption on data in flow and at rest

TPM: chip in computer to store private keys

CLoudHSM: cloud hardware security module

Security groups are groups in cloud that limit exposre of N/S and E/W traffic.

BIOS chips boot the computer

UEFI chips replaced BIOS chips on modern computers

BIOS/UEFI chips have a list of checks to boot the computer hardware

The last instruction activates the bootloader.

Bootloader is a software program that boots the OS

Once the OS boots the user can interface with the computer/applications

There are many attacks on operating systems but keep in mind there are attacks on chips and bootloaders too.

The OS is like a conductor allocating resources when and where needed.

The computer has limited resources but lots of applications asking for memory/CPU/disk access

GUI vs CLI

Often you will need to work on CLI in linux in IT security 

GUI: Icons and text

CLI: text based and commands

Using CLI is usually faster when you know what to do

history file is recorded so you can see what you have used

you may look at history file in a security incident

Linux in security 

linux is open source

gnu public license so they can be used and improved

global group of people working on code

FSH - file system hierarchy 

almalinux replaced centos

Package managers

apt and yum for installing applicaton

Types of shells 

bourne again shell (bash)

c shell (csh)

korn shell (ksh)

enchanced c shell (tcsh)

z shell (zsh)

bash is default for most distros

standard input (info you input into the shell)

String data

echo hello

standard output

the computers response on the cli

standard error

any errors the computer needs to output

Linux shell

You will need to work with log files and set permissions via the cli

Bash shell is the default for most distros and often all that is available on older systems

cat - output the full file

more - output the file but paged

head -n 5 - see the top of the file

tail -n 5 - see the end of the file

The root directory is always at the top and its /

/home - user directories 

/bin - binary executables (programs)

/etc - config files

/tmp - temp files

/mnt - mounted media stores like USB drives or network shares

man heir to learn more 

Grep

grep OS updates.txt

We are looking for "OS" in the updates.txt file

Pipe |

Sends the output of one command to another command

ls /home | grep users

Filtering for certain information is important for cyber sec professionals

Fin search for directories and files and meet a criteria

find /home/analyst/projects

-name is case sensitive

-iname is not case sensitive

find /projects/ -iname log

-mtime 3 all files that have been modified in the last 3 days

-mtrime +1 all files modified more than 1 day ago

Deleting directory

rmdir oldreports

Deleting file 

rm file.txt

delete a directory and everything under it

rm -rf oldproject

File editors

Nano is good for beginners

vi or vim is often on older systems, neovim is a newer version

emacs is also popular older editor

 

update palo alto firewall via CLI

When updating from the web gui in a rush its a bit painful

• Do dynamic updates check
• Go to Software
• Unclick Base releases
• wait
• Unclick preferred releases 
• wait
• check for updates
• download the version you need
• install

CLI commands

request system software check (optional, lists all updates without filters)

request system software download version 11.2.7-h16  (download the version we need)

request system software install version 11.2.7-h16 (install the version we need)