Day 35

Security Fundamentals

security-fundamentals

At a glance

Security fundamentals: CIA triad, common attack types, and defense-in-depth habits before feature deep-dives. Maps to CCNA v2.0 objective(s) 4.0.

Deep chapter

Long-form companion reading (original prose).

CIA triad

Confidentiality, integrity, and availability form the CIA triad—the three goals every security control on the exam maps to. Confidentiality keeps data from unauthorized eyes (encryption, ACLs, private VLANs). Integrity keeps data unaltered in transit or at rest (hashes, signed configs, DAI against ARP lies). Availability keeps services reachable for authorized users (redundancy, DoS defenses, err-disable recovery that does not leave a port dead forever).

A single feature rarely owns all three. Port security mainly protects integrity of the MAC table and availability of a port under attack; SSH mainly protects confidentiality of management sessions. When a stem asks “which goal,” name the primary one the feature actually buys.

Trade-offs are exam bait. Locking a port with `shutdown` violation mode raises integrity of the access edge but can hurt availability if a legitimate phone reboot looks like a violation. Write the triad beside each feature as you study so the trade-off is visible.

Exam trap: availability is not “the network is fast.” It means authorized users can still reach the resource when you apply the control.

CIA triad triangle linking confidentiality, integrity, and availability to network controls — Map every control to C, I, or A. Exam stems often ask which goal a feature primarily serves.

Threat actors

Threat actors are who might attack you: external attackers on the Internet, insiders with credentials or physical access, script kiddies using commodity tools, organized crime, and nation-state groups. CCNA cares less about attribution theater and more about which actor model fits the scenario.

Insiders often bypass perimeter firewalls because they already sit inside the LAN. That is why access-layer controls—port security, DHCP snooping, DAI—matter even when the edge firewall is “solid.” Physical access to a console port is an insider-class threat regardless of job title.

External actors probe management planes (Telnet, SNMP, open HTTP) and abuse weak passwords. Harden first-hop services before you invent exotic crypto. `show users` and AAA logs tell you who got in; threat models tell you who you should assume will try.

Exam trap: “hacker” in a stem is not a technology. Pick the control that matches the access path—remote management, Layer 2 LAN, or physical console.

External attackers, insiders, and scripted tools targeting different network planes — Actor type points to the attack path: Internet edge, LAN access, or physical console.

Attack types

Know the attack vocabulary: reconnaissance, social engineering, DoS/DDoS, spoofing (IP, MAC, ARP), man-in-the-middle, malware, and password attacks. Each maps to a defensive family you will configure later in this week.

Spoofing at Layer 2 fills the CAM table or poisons ARP so traffic steers to the attacker. DHCP spoofing answers Discover messages with a rogue gateway. DoS floods exhaust CPU, bandwidth, or table space until legitimate users lose availability.

Management-plane attacks abuse clear-text protocols and default credentials. Prefer SSH over Telnet, SNMP v3 over v2c community strings, and disable unused VTY lines. Recon often starts with banner grabs and SNMP walks—shrink what you advertise.

Exam trap: MITM is not always “encryption missing.” On a LAN it often means ARP or DHCP spoofing succeeded first; DAI and snooping address that path.

Attack categories: spoofing, DoS, MITM, password attacks, and reconnaissance — Name the attack family first, then pick the Layer 2 or management control that stops it.

Defense in depth

Defense in depth stacks independent controls so one failure does not open the whole network. Edge firewall, ACLs, AAA, encrypted management, access-layer port security, and monitoring each cover a different failure mode.

Depth is not “more of the same.” Two identical ACLs do not replace logging and physical locks. Combine preventive controls (deny) with detective controls (syslog, SNMP traps) so you learn when something slipped through.

Campus practice: harden the switch (`shutdown` unused ports, SSH only, strong enable secret), then add port security on access ports, then DHCP snooping/DAI on user VLANs. Each layer assumes the previous one might be misconfigured or bypassed.

Exam trap: defense in depth is a design principle, not a single CLI keyword. If the stem asks for the concept, do not invent a phantom command.

Layered defenses from physical and access edge through management and monitoring — Independent layers: physical, access, distribution policy, management crypto, and detection.

Secure management plane

The management plane is how you configure and monitor the box: console, VTY (SSH/Telnet), SNMP, HTTP/HTTPS, NETCONF. Compromise here equals full device ownership. Treat every management path as a high-value target.

Prefer SSH with `transport input ssh` on VTY lines; disable Telnet. Set `ip domain-name`, generate RSA keys (`crypto key generate rsa`), and create a local user with `privilege 15` or use AAA. Bind management to a loopback and ACL the VTY if the platform supports it.

SNMP: avoid clear-text community strings facing untrusted networks; use SNMPv3 where the stem allows. HTTP server (`ip http server`) is a classic leave-on risk—disable it unless you need the GUI and then prefer HTTPS with auth.

Exam trap: encrypting user data plane traffic does not secure the management plane. You still need SSH, secrets, and VTY ACLs on the device itself.

Control plane ACL glance

The control plane handles packets destined to the device CPU: routing protocol Hellos, ARP that needs the CPU, management sessions, and some ICMP. A flood against the control plane can starve legitimate protocols even when the data plane still switches frames.

Control-plane policing (CoPP) and infrastructure ACLs limit what reaches the CPU. On CCNA you need the idea: protect routing and management protocols, rate-limit noisy traffic, and do not blindly ACL-drop OSPF or SSH you still need.

A practical glance: an ACL on the VTY is management-plane filtering; CoPP is broader CPU protection. Both can “break” the network if you deny the wrong traffic. Lab with a known-good management host before you tighten.

Exam trap: confusing data-plane ACLs on interfaces with control-plane protection. Interface ACLs filter transit; CoPP/VTY ACLs protect the device itself.

Packets to the CPU filtered by control-plane protection versus transit data-plane ACLs — Control-plane filters guard the CPU. Interface ACLs guard transit traffic.

Password hygiene

Store secrets properly: `enable secret` (hashed) over `enable password` (weak/reversible themes on old IOS). Use `service password-encryption` as a light obfuscation for other password types—it is not strong cryptography, but it stops shoulder-surfing in `show run`.

Local users: `username admin secret <password>` beats `username admin password`. Prefer AAA to a central server when the question offers it so credentials are not cloned across fifty switches.

Rotate credentials after lab sharing and never leave factory defaults. Console lines need a password or login local too—physical access without auth is still a management-plane hole.

Exam trap: `service password-encryption` does not make Telnet safe. Encrypt the transport with SSH; encrypting the stored password is a separate hygiene step.

enable secret versus enable password and password-encryption in the config — Hash enable with secret; obfuscate other passwords; still use SSH for the wire.

Disable unused services

Unused services widen the attack surface. Common harden list: `no ip http server`, `no ip http secure-server` if unused, disable Telnet on VTY, shut unused ports, and remove unnecessary CDP on links toward untrusted devices when policy requires.

Pad, finger, and legacy TCP/UDP small services belong off on modern images. If an older platform still offers `service tcp-small-servers`, turn them off. SNMP with a public community is effectively an open read API—disable or lock it down.

Access ports that nothing plugs into should be `shutdown` and often placed in an unused VLAN. That simple step blocks opportunistic wall-jack attacks without any fancy feature license.

Exam trap: disabling CDP everywhere can break VoIP phone discovery and some management tools. Disable selectively toward untrusted edges, not blindly on every uplink.

Unused HTTP, Telnet, open ports, and SNMP marked for disable on a switch — Shut idle ports and turn off unused management services before adding complex features.

Banner motd

A MOTD or login banner displays a legal notice before or at login. Configure with `banner motd #Unauthorized access prohibited#` (pick a delimiter that does not appear in the text). Banners support prosecution and policy; they do not authenticate anyone.

Keep wording a warning, not an invitation. “Welcome to the corporate network” can undermine legal posture. Prefer “Authorized users only” language your counsel approved.

`show running-config | include banner` confirms the text. Test from console and VTY so you know which banner fires when. Login banners differ from exec banners on some platforms—know which one the stem describes.

Exam trap: a banner is not a security control that stops attacks. It is evidence and policy signaling; combine it with real auth and encryption.

Banners warn and document policy. Authentication and SSH still do the real work.

Logging and AAA

AAA = Authentication, Authorization, Accounting. Authentication proves identity; authorization limits what that identity may do; accounting records the session. On IOS: `aaa new-model`, then method lists for login and exec that point at local, RADIUS, or TACACS+.

Syslog sends operational events to a server: `logging host <ip>`, set `logging trap` level, and ensure the device has a reachable path and correct clock (`clock set` / NTP) so timestamps are useful. Local `show logging` is fine for labs; production needs a collector.

Accounting ties users to changes. Without AAA accounting, “who typed `no spanning-tree`” becomes a guess. Pair AAA with privileged EXEC logging themes so config changes leave a trail.

Exam trap: AAA method lists fall through. If RADIUS is down and you omitted `local` as backup, you can lock yourself out of VTY—always keep a break-glass local path in labs.

Physical security

Physical access bypasses almost every CLI control. Console ports, USB, and reset buttons let someone with a laptop recover or wipe passwords. Lock racks, control wiring closets, and treat spare wall jacks as open doors.

Cameras, badge access, and locked cabinets are part of the CCNA security story even though they are not IOS commands. A stolen switch with the config intact leaks secrets and topology.

Cable plants matter: an attacker who unplugs an uplink and inserts a tap owns that path. Label and secure critical trunks; disable unused patch-panel ports at the switch.

Exam trap: do not answer a physical-access stem with only SSH. Crypto on the wire does not stop someone at the console.

Locked closet, secured console, and unused wall jack treated as a threat — Physical control protects console and cabling paths no ACL can see.

Exam mindset

Security questions on 200-301 reward precise matching: attack → layer → feature. Rogue DHCP → DHCP snooping. ARP spoof → DAI. Unknown MAC on access port → port security. Clear-text management → SSH.

Read whether the stem wants a concept (CIA, defense in depth) or a command. Concept answers rarely include `interface GigabitEthernet0/1` detail; command answers need the exact mode and keyword.

Eliminate answers that secure the wrong plane. Encrypting a WAN VPN does not stop a CAM overflow on an access switch. Pick the control that sits on the path the attacker used.

Exam trap: “most secure” without constraints is usually wrong. The best answer is the least privilege control that stops the stated attack without breaking the stated topology.

Decision flow from attack description to layer and matching Cisco feature — Attack path first, then plane, then feature. Wrong plane means wrong answer.

Lab harden switch

Lab sequence on a spare switch: set hostname, `enable secret`, local user with secret, `service password-encryption`, domain name + RSA keys, VTY `login local` and `transport input ssh`, MOTD banner, `no ip http server`, NTP or clock, and logging buffered.

Shut unused ports; put them in a parking VLAN. Leave one known port for your lab PC. Verify with `show ip ssh`, `show users`, and a failed Telnet attempt that should refuse.

Save with `copy running-config startup-config`. Reboot once to prove SSH and local auth survive reload. Document the management IP and credentials outside the device.

Exam trap: generating keys without `ip domain-name` fails on many images. Order matters: domain, then `crypto key generate rsa`, then VTY SSH-only.

Harden management and idle ports first; then layer on port security and snooping.

Checklist

CIA labeled for each feature you studied. Threat actor and attack type named for one LAN scenario and one remote-management scenario. Defense in depth listed as at least three independent controls.

Management plane: SSH only, enable secret, local or AAA users, HTTP off if unused, banner present. Control-plane idea stated in one sentence without confusing it with interface ACLs.

Physical: unused ports shut, closet access assumed hostile. Logging host or local logging verified; AAA method list includes a local backup in the lab.

Exam trap: a checklist without verification commands is theater. Tie each item to `show run`, `show ip ssh`, or `show logging` proof.

Security fundamentals checklist covering CIA, hardening, AAA, and physical controls — Close Day 48 by proving each harden item with a show command, not just a config paste.

Key ideas

Confidentiality, Integrity, Availability.
Threat actors range from script kiddies to insiders and nation-states.
Recon, spoofing, MitM, DoS — know the pattern language.
Least privilege and segmentation reduce blast radius.
Physical security still matters for switches/closets.
Patch and harden management planes (SSH, ACLs, disable unused services).
CCNA next: port-security, DHCP snooping, DAI as concrete controls.

Self-check

Expand CIA.
Give one integrity attack example.
Why segment management VLANs?
Telnet on a production switch — which CIA leg fails most obviously?
Name two Layer-2 security features coming next.