All language subtitles for Free-CCNA-Security-Fundamentals-Day-48-CCNA-200-301-Complete-Course_en

This is a free, complete course for the CCNA.

If you like these videos, please subscribe\n

Also, please like and leave a comment, and\n

In this video we will cover security fundamentals.

The CCNA is not a cybersecurity certification,\n

of network and system security necessary to\n

Here are the exam topics we’ll cover in\nthis video.

We’ll define some key security concepts,\n

and user authentication, and define the AAA\n

That seems like a lot for one video, and it\nis.

This video will be a brief introduction to\n

If you haven’t studied this material before,\n

So I recommend taking notes to keep all of\n

Here’s what we’ll cover in specific.

First I’ll introduce some key security concepts\nand terms.

Then some common attacks which can target\n

Then I’ll talk about passwords and multi-factor\nauthentication.

Then the concepts of Authentication, Authorization,\n

Finally I’ll introduce security programs\n

to secure their systems and educate their\nstaff.

Watch until the end of the video for a bonus\n

So, the title of this slide is ‘why security?’

What is the purpose or goal of security in\nan enterprise?

I’m sure you can think of some reasons why\n

systems to be secure, but it’s good to have\na framework.

The principles of the CIA triad form the foundation\nof security.

We’re not talking about the American Central\n

Here’s what CIA stands for in this case.

It means that only authorized users should\n

Some information and data is public and can\n

put on the company website, but some is secret\n

And there are degrees in the middle, some\n

This means that data should not be tampered\n

Data should be correct and authentic, not\n

Finally, A stands for availability.

This means that the enterprise network and\n

For example, staff should be able to access\n

their duties, and the company’s website\n

Confidentiality, integrity, and availability.

Attackers can threaten the confidentiality,\n

We’ll see how attackers do that when we\n

In addition to the CIA triad, there are some\n

and these are explicitly stated in the exam\ntopics.

First, a vulnerability is any potential weakness\n

But keep in mind, a potential weakness on\n

The windows of a house for example are vulnerabilities,\n

Next, an exploit is something that can potentially\n

But again, something that can potentially\n

A rock can exploit the weakness of a window\n

Next, a threat is the potential of a vulnerability\n

To use the window and rock analogy, a threat\n

Here’s a more relevant example.

A hacker exploiting a vulnerability in your\nsystem is a threat.

Finally, a mitigation technique is something\n

There are various mitigation techniques and\n

against, and we’ll cover some techniques\n

Appropriate mitigation techniques should be\n

be exploited, for example client devices,\n

In addition, mitigation techniques include\n

from getting physical access to the devices\n

But always remember, no system is perfectly\nsecure.

Systems can be more secure or less secure,\n

You can, for example, implement malware detection\n

antivirus software on client PCs, but the\n

Now let’s review some common attacks.

These are threats which can potentially exploit\n

integrity, or availability, CIA, of an enterprise’s\n

These are the kinds of attacks we will look\nat.

There are many more potential attacks than\n

Let’s take a brief look at each one individually.

The first kind of attack is the denial-of-service,\nDoS, attack.

DoS attacks threaten the availability of a\n

There are many kinds, and I’ll show a few\n

TCP SYN flood, which exploits the TCP three-way\nhandshake.

As you know, the three-way handshake is SYN,\nSYN-ACK, and ACK.

In a TCP SYN flood, the attacker sends countless\n

The target sends a SYN-ACK message in response\n

But the attacker never replies with the final\n

The target waits for the final ACK of each\n

fill up the target’s TCP connection table.

The incomplete connections will timeout and\n

period of time, but the attacker continues\n

In the end, the target is no longer able to\n

has reached the maximum number of TCP connections\n

Let me demonstrate with a diagram.

For each SYN message the attacker sends, the\n

table and sends a SYN-ACK message, then waits\n

The attacker keeps sending SYN messages, and\n

Then the target’s TCP connection table fills\n

By the way, why do you think I drew the SYN-ACK\n

It’s because the attacker likely spoofs\n

IP address, so the SYN-ACK messages don’t\nreturn back to them.

I’ll talk about spoof attacks after DoS\nattacks.

However, a denial-of-service like that is\n

A much more powerful kind of attack is the\nDDoS.

In a DDoS, distributed denial-of-service,\n

with malware and uses them all to initiate\n

This group of infected computers is called\na botnet.

So, in this example the attacker could, through\n

Then, all together they start flooding the\n

server is no longer able to respond to legitimate\n

So, to summarize denial-of-service attacks,\n

Next let’s look at spoofing attacks.

To spoof an address is to use a fake source\n

There are numerous attacks that involve spoofing,\n

An example of a spoofing attack is a DHCP\nexhaustion attack.

Actually, it’s similar to the TCP SYN flood\nattack.

An attacker uses spoofed MAC addresses to\n

Then, the target server’s DHCP pool becomes\n

They won’t be able to get an IP address.

Note that spoofing attacks don’t have to\n

The attacker sends a DHCP discover message\n

Then it sends another with a different fake\nsource MAC address.

Then it does it again, with another fake source\nMAC address.

It keeps sending these at a very quick pace.

The server will reply to each Discover with\n

an IP address it will not assign that address\nto other devices.

So, if these PCs send DHCP discover messages\n

to give them their IP addresses because its\nDHCP pool is full.

Maybe it had 250 IP addresses to lease to\n

So, that’s just one example of a spoofing\nattack.

And in the previous TCP SYN flood example,\n

And this DHCP exhaustion attack resulted in\n

As you can see, some of these attack types\n

But once again, we are attacking the availability,\n

Note that not all spoofing attacks are DoS\nattacks.

Later I’ll show another type of spoofing\n

integrity of a system, not the availability.

Next let’s look at reflection and amplification\nattacks.

In a reflection attack, the attacker sends\n

spoofs the source address of its packets using\n

Then the reflector, for example a DNS server,\n

So, what’s the purpose of this attack?

Well, if the amount of traffic is large enough\n

But, there is a more powerful form of reflection\n

A reflection attack becomes an amplification\n

the attacker is small, but it triggers a large\n

This is how it can trigger a denial of service.

The attacker’s IP address is 1.2.3.4, but\n

a message to a server at 8.8.8.8, which becomes\nthe reflector.

5.6.7.8 is the IP address of the target of\nthe attack.

The attacker’s message causes the reflector\n

resulting in a denial of service.

For example, there are DNS and NTP vulnerabilities\n

You can check out these cloudflare articles\nto read about them.

Do a google search for ‘DNS amplification\n

and you’ll find these articles.

The next type of attack is the man-in-the-middle\nattack.

In this kind of attack, the attacker places\n

to eavesdrop on communications, or to modify\n

A common example is ARP spoofing, also known\nas ARP poisoning.

So, this is yet another kind of spoofing attack.

In an ARP spoofing attack, a host sends an\n

In this case, PC1 is asking for the MAC address\n

Because ARP request messages are broadcast,\n

Then the target of the ARP request, SRV1 in\n

requester, PC1, of SRV1’s MAC address.

The attacker waits briefly and then sends\n

If the attacker’s ARP reply arrives last,\n

Well, now in PC1’s ARP table, the entry\n

address, not the address of the real 10.0.0.1,\nwhich is SRV1.

So, when PC1 tries to send traffic to SRV1,\n

Then, the attacker can inspect the messages,\n

Or, another possibility is that the attacker\n

So, in this example the threat isn’t to\n

of attack compromises the confidentiality\n

of the communications between PC1 and SRV1.

It compromises the confidentiality because\n

to the communications between PC1 and SRV1.

And it compromises the integrity because that\n

before it reaches the destination.

Next let’s look at reconnaissance attacks.

These attacks aren’t attacks themselves,\n

a target which can be used for a future attack.

This is often publicly available information,\n

the information isn’t actually confidential.

For example, you can perform an NSLOOKUP to\n

From there, you can probe for open ports which\n

You could also perform a WHOIS query to learn\n

You can perform a WHOIS query at this website\n

Once contact information is known, some of\n

which we’ll look at soon can be carried\n

Next up is malware, something you’ve probably\nheard of.

Malware, which means malicious software, refers\n

Viruses are malware that infects other software,\n

The virus spreads as the software is shared\n

Once the virus has infected the device it\n

or modifying files on the target computer.

Then there are worms, which are different\n

They are standalone malware and are also able\n

The spread of worms from device to device\n

that if the worm has a ‘payload’, other\n

additional harm to target devices.

Another famous kind of malware is the trojan\n

Trojan horses spread through user interaction\n

Note that these types of malware are defined\n

and how it spreads, not the attacks they carry\n

The above malware types can exploit various\n

And as I said before, there are many types\n

Next up is a very dangerous category of attack,\n

Social engineering attacks target the most\n

This is something you have to be aware of\n

No matter how many security features you configure\n

PCs, etc, people are always a vulnerability\n

Social engineering attacks involve psychological\n

information or perform some action the attacker\n

As with the previous attack types, there are\n

Phishing involves fraudulent emails that appear\n

Amazon, your bank, or your credit card company,\nfor example.

These emails contain links to a fraudulent\n

For example, the website may look identical\n

Users are told to login to the fraudulent\n

Spear phishing is a type of phishing that\nis more targeted.

Not mass emails sent out to anybody, but perhaps\n

Whaling is another kind of phishing targeted\n

There is also vishing, voice phishing, which\n

The attacker could pretend to be from the\n

They might say something like, Hi this is\n

Due to company policy we need to reset your\n

currently using and I’ll reset it for you?’

Now, I’m sure a real attacker would be more\n

Another kind is smishing, SMS phishing, which\n

Okay, let’s move on from phishing, because\n

Watering hole attacks compromise sites that\n

If a malicious link is placed on a website\n

So, this kind of attack is taking advantage\n

frequently visit, they don’t think twice\n

Okay, I want to mention one more kind of social\nengineering.

Tailgating attacks involve entering restricted,\n

authorized person as they enter.

Any company that has restricted areas will\n

will hold the door open for the attacker to\n

To summarize social engineering attacks, they\n

a company’s IT systems, instead they exploit\nthe employees.

Here’s an example of a phishing email.

It says that the target’s Amazon account\n

and there is a link at the bottom requesting\n

If the target clicks on that link and enters\n

has access to their Amazon account.

Anyone who has an email address has seen emails\n

It’s something we all have to watch out\nfor.

Okay, the final kind of attack we’ll look\n

Most systems use a username and password combination\n

The username itself is often simple and easy\n

So, the strength and secrecy of the password\n

However, attackers can learn a user’s password\n

First of all, they could simply guess the\npassword.

Now, successfully guessing a password should\n

A dictionary attack can also be used, in which\n

is a list of common words and passwords to\n

It tries each one, hoping to find the correct\npassword.

A brute force attack involves trying every\n

and special characters to find the target’s\npassword.

This requires a very powerful computer, and\n

chances of it working are very low, because\n

So, what makes a password strong, so that\n

Well, strong passwords should contain at least\n8 characters.

Definitely not less, but preferably more than\n8.

The more characters, the harder it is to brute\n

A strong password should have a mix of uppercase\n

Also it should have one or more special characters\n

Finally it should be changed regularly.

Most enterprises will enforce rules like these\n

that you follow rules like these when making\n

Okay, that was a lot of potential attacks.

To help you review, here’s a basic summary\nof each attack.

If you want to know more about each kind of\n

For our purposes, just a basic understanding\n

So, make sure you know these basic attack\ntypes.

Next let’s continue with the topic of multi-factor\n

No matter how secure the password, there is\n

That’s why multi-factor authentication is\n

Multi-factor authentication involves providing\n

It usually involves providing two of the following,\n

First is something you know, for example a\n

Next is something you have, for example pressing\n

using an authenticator app, or perhaps a badge\nthat is scanned.

The third is something you are, these are\n

For example, biometrics such as a face scan,\n

Requiring multiple factors of authentication\n

Even if an attacker learns the target’s\n

Another form of authentication involves the\n

to prove the identity of the holder of the\ncertificate.

They are mainly, but not exclusively, used\n

Entities that want a certificate, for example\n

signing request, to a CA, certificate authority,\n

When you access a website, modern browsers\n

website is secure and has a valid certificate.

As you can see, my website has a valid certificate,\n

This is how you can know that the website\n

not a fake website pretending to be jeremysitlab.com.

I’ve been mentioning authentication a lot,\n

you need to know for the CCNA.

AAA stands for Authentication, Authorization,\nand Accounting.

It’s a framework for controlling and monitoring\n

So, what do each of those A’s mean?

Authentication is the process of verifying\na user’s identity.

When a user logs in, ideally using multi-factor\n

Then, Authorization is the process of granting\n

So, granting the user access to some files\n

files and services, is authorization.

Finally, accounting is the process of recording\n

For example, logging when a user makes a change\n

in or logs out, is accounting.

Enterprises typically use a AAA server to\nprovide AAA services.

ISE, Identity Services Engine, is Cisco’s\n

These AAA servers typically support the following\n

RADIUS, which is an open standard protocol\n

And TACACS+, which is a Cisco proprietary\n

Just in case, I recommend remembering the\n

but for the CCNA that’s all you need to\nknow about them.

However, make sure you know the differences\n

They are stated directly in the exam topics\nlist.

Okay, the final topic for today is security\nprogram elements.

A security program is an enterprise’s set\n

For the CCNA, there are a few elements you\nhave to be aware of.

First up, user awareness programs.

These are designed to make employees aware\n

Not all employees are cyber-security experts.

Someone working in the HR department is probably\n

So, user awareness programs will help make\n

For example, a company might send out false\n

link and sign in with their login credentials.

Although the emails are harmless, employees\n

informed that it is part of a user awareness\n

So, that’s an example of a user awareness\nprogram.

User training programs are more formal than\n

For example, dedicated training sessions which\n

how to create strong passwords, and how to\n

These should happen when employees enter the\n

Another essential element of a security program\n

equipment and data from potential attackers\n

areas such as network closets or data center\nfloors.

This is not just to prevent people outside\n

Even within the company, access to these areas\n

Multifactor locks can protect access to these\nrestricted areas.

For example, a door that requires users to\n

That’s something you have, a badge, and\n

Badge systems are very flexible, and permissions\n

For example, permissions can be easily removed\n

This allows for strict, centralized control\n

Okay, before moving on to the quiz let’s\nreview what we covered.

First we covered some key security concepts\n

exploits, threats, and mitigation techniques.

Then we looked at some common attacks, from\n

attacks which target people, not devices.

Then passwords and multi-factor authentication,\n

you know, something you have, and something\nyou are.

Authentication is the process of verifying\na user’s identity.

Authorization is the process of controlling\n

And accounting is keeping track of what the\nuser does.

Finally I introduced some elements of an enterprise’s\n

user training, and physical access control.

So, that was a lot to cover.

But if you learn the information in this video,\n

In the next few videos we’ll take a closer\n

Make sure to watch until the end of the quiz\n

Okay, let’s go to question 1 of the quiz.

Which part of the CIA triad ensures that systems\n

Pause the video now to look at the options\n

Okay, the best answer is D, availability,\n

A, confidentiality, means that data should\n

B, integrity, means that data should only\n

C, E, and F are aspects of AAA, not the CIA\ntriad.

Okay, let’s go to question 2.

Which of the following terms refers to the\n

is taken advantage of to attack a system?\n

Okay, the best answer is A, threat.

A threat is the possibility that a vulnerability\n

Mitigation techniques can be used to reduce\nthat possibility.

Your company implements door locks that require\n

(select the two best answers) Pause the video\n

Okay, the best answers are C, physical access\n

Physical access control allows only authorized\n

Multi-factor authentication uses a combination\n

this case something in the ‘something you\n

in the ‘something you know’ category,\nthe pass code.

Which of the following is NOT an example of\n

Pause the video now to look at the options\n

Okay, the best answer is C, doing a retina\n

Why is this not multifactor authentication,\n

It’s because the key of multifactor authentication\n

from something you know, have, and are.

A retina scan and a fingerprint scan both\n

so this is not multifactor authentication.

Which of the following is considered Accounting\n

Pause the video now to look at the options\n

Okay, the best answer is D, logging the date\n

Accounting is all about keeping track of a\nuser’s actions.

A and C are examples of authorization, and\n

Now let’s take a look at a bonus question in Boson Software’s

There are supplementary materials for this\nvideo.

There is a flashcard deck to use with the\nsoftware ‘Anki’.

This time there won’t be a packet tracer\npractice lab.

Instead, I’ll do a bonus demo of one of\n

DHCP starvation attack, using a Linux distribution\n

That will be in the next video.

Before finishing today’s video I want to\n

To join, please click the ‘Join’ button\nunder the video.

Thank you to Khoa, Justin, Christopher, Sam,\n

Serge, Njoku, Viktor, Roger, Raj, Kenneth,\n

Gustavo, Prakaash, Nasir, Erlison, Marko,\n

Mark, Yousif, Boson Software, Devin, Yonatan,\nand Vance.

Sorry if I pronounced your name incorrectly,\n

This is the list of JCNP-level members at\n

If you signed up recently and your name isn’t\n

Please subscribe to the channel, like the\n

with anyone else studying for the CCNA.

If you want to leave a tip, check the links\nin the description.

I'm also a Brave verified publisher and accept\n