Network Security
Blog posts, papers, and articles on Network Security by Teri Radichel
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.
🔒 Related Stories: Network Security | AWS Security | Cloud Security Architecture
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Here are some of my posts on Network Security for those who are trying to improve the security of clouds, home networks, and offices.
Topics covered in this post (you can jump to the topic that interest you by searching for these names):
- How traffic got me into cybersecurity
- Basic network security improvements for home users
- Dealing with a network security incident
- Vendors make zero trust networks hard
- Inspecting network traffic
- Network Protocols — Dissecting Network Packets
- Route traffic through an AWS VPN for security and inspection
- AWS Networking
- General network security topics
- Posts that have been removed or moved on the WatchGuard blog
- SANS White Paper on packet capture in the cloud
How network traffic got me into cybersecurity
Basic network security improvements for home users
Dealing with a network security incident
There’s the correct way, which is a specific process for organizations with security incident response teams, security operations centers (SOCs) and then there’s me trying to get by as one person. There’s a big difference between the two. And yes, I have the GSE and a certification in incident response but this is not something I do day in and day out for a living, so refer to others for more detailed guidance on this topic if you are trying to get a job in incident response.
I had a security incident on my network that caused settings in my pfSense to change. I wrote about those and other issues where I’m rebuilding everything here. I also wrote about how you can inspect traffic in the next section to see if your network or systems are compromised (at a high level because large organizations are going to have teams and SIEMs and SOARs and other terms you’ll want to know if you wnat to do this for a living.
I reset the pfSense as explained in this post, and I’m actually using a new device that I haven’t used on the internet before.
You can find more posts about how I set up Ubiquiti here:
And pfSense here:
Vendors make zero trust networks hard
The network requirements vendors provide need to be more specific. That is why we have such a hard time creating secure networks. Vendor products need to be designed with zero trust networks in mind.
The network requirements vendors should provide but most of the time they do not — ask for it so they improve.
Inspecting network traffic
Figuring out what application code is causing certain traffic (in this case STUN which can bypass NATs and sometimes firewalls with TURN and ICE)
I have since determined that some location information provided by Little Snitch is completely wrong, so take this one with a grain of salt (meaning useful but verify.)
Also see this series of posts below:
Network Protocols — Dissecting Network Packets
Route traffic through AWS for security and inspection
Network Protocols — Dissecting Network Packets
Networking Basics — hexadecimal to binary to decimal, deciphering network packet headers, etc.
Attacks on and through network devices
Google Chrome DNS security bypass
Setting up a home network
I have a some posts on home networking in various places. To understand the big picture start here. Then check out my reltaed posts for the configuration of each device along the way.
Configuring the cable modem — reset the default password before you connect it to the internet! And you may want to reset it periodically anyway.
Configuring the pfSense starts here:
You can find more posts on pfSense configuration here:
I configured the UDM in these posts:
Some other topics related to home networks:
Route traffic through an AWS VPN for security and inspection
Here’s a mini-series on setting up your home or business traffic to flow through AWS for inspection. Still adding all the stories to show how to do it. Be careful with this one because the static network routes and systems always on might become a path for an attacker. Also this was too expensive for me to keep up and running.
Related to the above posts — some issues I had while trying to implement that solution:
AWS Networking
First…
And…
Also…
Convinced yet?
Find a number of posts on creating networks on AWS here
General network security topics
Be careful with VPNs as they can be a single point of failure. Monitor them closely and think through your architecture carefully. Update them whenever a new security patch comes out. Consider the difference between VPNs you manage and monitor and those monitored by someone else — who may have visibility into your logs even though they claim they don’t do that.
Posts that have been removed or moved on the WatchGuard blog
SANS White Paper on packet capture in the cloud
I also wrote this white paper: Packet Capture on AWS — before any cloud providers enabled or allowed packet capture. Azure was the first to introduce a solution followed by AWS and then GCP.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2022
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test
🔒 Schedule a consulting callFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
