CISSP Domain 4 – A Guide to Communication and Network Security

Domain 4 of the CISSP certification exam has had some changes you should be aware of. This domain focuses on communication, network security, and security information systems, which you must fully understand to be a cybersecurity professional. It comprises 13% of the exam material you need to learn.
In the following guide, we have compiled the essential aspects you need to know to pass Domain 4 of the CISSP exam and covered the 2021 update with new information.

4.1 Implement secure design principles in network architectures

Open System Interconnection (OSI) model

The CISSP exam contains technical elements, which especially apply to Domain 4, and is more technical than other domains. Networks allow organizations to identify and realize revenue opportunities and communicate and interact with clients. Therefore, networks are a valuable asset of any company and require protection.

What is a network?

A network is at least two devices that are connected to each other. Like people, in order to communicate, these devices must be able to speak a common language (which is what a protocol does), and common rules of communication must be followed.

What is a protocol?

The common rules of network communication are called protocols. A protocol is simply a standard set of rules that are understood, conformed to, and abided by so that two or more devices on a network can communicate.

OSI (Open System Interconnection) model

OSI stands for Open Systems Interconnection, which implies that the OSI model is about open systems that can interconnect and communicate with each other using protocols. The OSI model is a structured, layered architecture comprising seven layers:

Table 4.2: OSI versus TCP/IP
The most commonly used mnemonics for OSI are: All People Seem To Need Data Processing and Please Do Not Throw Sausage Pizza Away.

The higher the layer, the more functional the security features become, and more comprehensive controls can be implemented; the lower the layer, the opposite is true.

The actual implementation is through TCP/IP. The internet protocol suite (TCP/IP) consists of many protocols—a family of protocols. TCP and IP, and the other members of the protocol family run at different layers of the OSI model to support the underlying tasks of a given layer.

For example, the Network layer is primarily responsible for taking information and routing that, breaking it—fragmentation—into manageable chunks called datagrams and providing addressing so those chunks can be communicated across a network using a logical addressing scheme called IP addresses.

On the other hand, as information moves down from the Application layer to the Physical layer, encapsulation is taking place. On the other side, when the fully encapsulated information arrives, a process called decapsulation takes place.

Layer 1: Physical

Layer 1, the Physical layer, focuses on how devices interconnect as well as encoding the bits, the 0s and 1s, that Layer 1 understands.

Devices can connect using wired or wireless technologies:

Twisted pair cable refers to the fact that it is a pair of wires twisted together in a specific way that creates a magnetic field, which allows the signal traveling across the wire to remain within the magnetic field.

Coaxial cable is the cable often used by cable companies to bring television, telephone, and high-speed internet access to homes.

Unlike twisted pair and coaxial cable, which use voltage for communication, fiber optic utilizes light pulses to represent 0s and 1s. Both speed and security are great advantages of using fiber optic. Among other things, twisted pair and coaxial cable are both subject to what’s known as cross talk—interference—because copper, by design, conducts electricity.

Cabling is one part of the equation; another part relates to topologies, or how the cables are laid out. The most common network topology is known as a bus topology, which simply means that all devices are connected to a central wire, called a bus.

From a security point of view, a bus topology has several weaknesses. For one, the bus represents a single point of failure. For another, all devices are connected to a single wire, so by default, every device can intercept all the information being transmitted across the wire.

Another topology is known as a tree topology, which somewhat resembles a tree with different branches. By virtue of this structure, one of the immediate benefits is that transmissions can be isolated to certain branches of the tree, thereby limiting transmissions from being seen by the entire network.

A star topology, as the name suggests, resembles a star. All devices are connected to a central device, like a switch or a hub. One significant disadvantage of a star topology is that the central device represents a single point of failure.

A mesh topology interconnects every device with every other device. This is excellent for purposes of redundancy—if one device goes down, communication with other devices is not impacted.

A ring topology looks like a ring. Devices are connected to a closed loop, and in a sense, the loop is still essentially a bus, which can lead to issues like collisions.

Dealing with collisions

One of the major problems found in all the topologies except token ring is collisions. Three primary methods exist to handle them:

1. Token-based collision avoidance. A token is passed from device to device, and only the device holding the token can transmit information.

2. Polling. Interconnected devices poll each other to learn if any information needs to be transmitted. This method obviously implies a significant amount of network traffic, which explains why it is not popular or used often, if at all.

3. Carrier Sense Multiple Access (CSMA). Used by modern networks. Devices are connected to the same carrier, the same wire, and therefore each device can sense the wire to identify if another device is transmitting. Even with CSMA, collisions are still going to occur. This is why two flavors of CSMA exist—CSMA with Collision Avoidance (CSMA/CA) and CSMA with Collision Detection (CSMA/CD). CSMA/CA completely avoids collisions.

Transmission methods

How these devices communicate is through transmission methods. From a security perspective, unicast is the most secure method because communication is limited to a specific destination device.

Layer 1 devices

Several important devices operate at Layer 1, among them:

• Hubs

• Repeaters

• Concentrators

Layer 2: Data Link

Layer 2—the Data Link layer—acts as a conduit between Layer 1—the Physical layer—and Layer 3—the Network layer. The Physical layer only works with bits, and the Network layer works with datagrams. Between them, the Data Link layer takes datagrams from the Network layer and formats them in a manner that allows the Physical layer to work with them as bits.

Physical addressing

Layer 2 is also the layer where devices that operate across a network are physically and uniquely identified and separated from each other. For a network to work, the devices on it need to have unique physical addresses. This unique physical address exists and is known as a Media Access Control (MAC) address.

A MAC address is simply bits—0s and 1s—that uniquely identify and distinguish every device on a network, and this unique identifier is specified via a device’s network card.

Networks work by virtue of logical address schemes that facilitate communication between devices. This is done at Layer 3 and is known as IP addressing, which can take IP addresses and convert them to MAC addresses and vice versa.

Specifically, two protocols handle these needs: Address Resolution Protocol (ARP) and Reverse Address Resolution Protocol (RARP). ARP allows IP addresses to be mapped to physical addresses, while RARP allows physical addresses to be mapped to IP addresses.

Circuit-switched network

A great example of a circuit-switched network is the Public Switched Telephone Network (PSTN), which has been in existence for many, many years. Connecting across the PSTN requires another person’s telephone number, which can then be dialed, and a series of devices that comprise the PSTN will establish the circuit—the connection.

Transmission of digital data over analog connections

Data networks were built for speed and bandwidth, and it wasn’t long before voice communications using data transmission were perfected. We know this as Voice over IP, or VoIP or IP telephony, which encapsulates the internet protocol to enable transmission of digital data over analog connections.

Packet-switched network

Packet-switched networks function by taking data that needs to be communicated from one device to another and breaking it into datagrams or packets. Each data packet contains information, such as addresses and sequence numbers.

Layer 2 protocols

Layer 2 protocols are:

• L2F

• PPTP

• L2TP

• SLIP

• ARP - IP to MAC

• RARP - MAC to IP

The first three are tunneling protocols, which are required to create virtual private networks (VPN).

Layer 2 devices

Significant devices that operate at Layer 2 are bridges and switches.

Authentication protocols

As remote authentication needs have matured, authentication protocols have also matured to meet those needs. Extensible Authentication Protocol (EAP) is the best authentication protocol available, and its capabilities have been extended to Protected Extensible Authentication Protocol (PEAP).

Password Authentication Protocol (PAP) simply prompts for a user ID and password when establishing a connection, and Challenge Handshake Authentication Protocol (CHAP) is an improved version of PAP.

Layer 3: Network

Data at the Network layer exists as packets/datagrams, and logical addressing is used to map IP addresses to MAC addresses—ARP; Reverse ARP (RARP) maps MAC addresses to IP addresses.

Layer 3 protocols

Layer 3 is home to several significant TCP/IP protocols. In addition to the already discussed IP protocol, IGMP, IPsec, and routing protocols BGP, OSPF, and RIP operate at Layer 3.

Layer 3 devices

The most obvious are routers, but Layer 3 switches can also be found at the Network layer, along with packet-filtering firewalls.

Logical addressing

Internet protocol datagrams consist of data, also known as the payload.

IPv4 addresses are comprised of four numbers separated by dots, e.g., 192.168.1.254. The IP address is a 32-bit value, and each number represents an 8-bit octet, while IPv6 addresses are comprised of 128 bits divided into eight groups of 16 bits.

LAN technologies

These are the three common IEEE standards from the 802 family:

Private IPv4 addresses

Private IP addresses are non-routable, which means their use within corporate or home networks provides a layer of security between public-facing internet devices and internal devices.

These are the private IPv4 IP address ranges that are not to be used on public networks (like the internet).

Network classes

if networks were limited to only Class A, B, or C ranges, every network would have only 254, 65,534, or 16+ million IP addresses for host devices, and these limitations could create huge inefficiencies, potential security issues, significant administrative overhead, and potential network-related performance and congestion issues.

Through the use of subnetting, which reflects awareness of the current environment and planning for the future, the proper-size logical host environment can be architected and deployed and can mitigate many, if not all, of the issues noted.

Layer 4: Transport

TCP and UDP are two transport protocols that reside at Layer 4.

both protocols are still heavily relied upon, and each serves a purpose. For reliable, perhaps a bit slower, transmissions, TCP is a clear choice. However, UDP is fast, and for things like video streaming, which requires speed, as well as handling DNS requests, UDP is very efficient.

TCP three-way handshake

What’s known as the TCP three-way handshake is the building of the technological road to reliably connect hosts across a network. Let’s examine this more closely through an example in the following figure:

Each transmission must be acknowledged by the receiving device, and in the three earlier steps, a full-duplex connection is established; thus, the term three-way handshake.

Ports

Ports equate to services, and services are small applications that provide specific functionality. For example, for the common web service, HTTP, port 80 is used by default.

If a service is not needed, especially ones that are dangerous, the associated port should be closed, and techniques like packet filtering can be used to block datagrams that reference the associated ports in the header.

There are three classes of available TCP and UDP ports:

• Well known: 0-1,023
• Registered: 1,024-49,151
• Dynamic/Private/Ephemeral: 49,152-65,535

These are common TCP ports:

In addition, the two main VoIP protocols are:

• Secure Real-time Transport Protocol (SRTP). This is the secure version of RTP, which supports encryption, authentication, integrity, and replay attack protection.
• Session Initiation Protocol (SIP). It is responsible for initiating, maintaining, and terminating voice and video sessions.

Vishing

Vishing is a form of phishing (voice phishing) that specifically takes place in the context of VoIP environments. Smishing, on the other hand, relates to the attacker sending SMS messages to the victim (SMS phishing).

Network security attacks

Network attacks resemble network assessments in terms of the steps/phases that each follows, with the exception of assessments including an exploitation phase. Passive attacks do not change the environment or information, while active attacks can change information.

Network attack phases

The main difference between network attacks and network assessments is that an attacker will not care if they inflict damage on the target network when they are launching an exploit, while the penetration tester will do that in a more controlled manner and while respecting the scope and rules of engagement.

In virtually all cases, any successful attack will sequentially go through the phases outlined here:

1. Reconnaissance
2. Enumeration
3. Vulnerability analysis
4. Exploitation

SYN scanning

Tools like Nmap can easily perform SYN scanning, which consists of:

1. A client sends an SYN packet to a target machine’s specific port (e.g., TCP port 80) to try and identify if it’s open or closed.
2. Possible responses are:
   1. If the port is open, the target replies with an SYN-ACK packet, and then the client responds with a final ACK packet, and the session is established.
   2. If the port is closed, the target responds with an RST packet, and the session is terminated.

SYN flooding

SYN flooding takes advantage of this fact when multiple SYN requests are sent in rapid succession to a target machine, which responds with an SYN-ACK packet, considering these valid connection requests. SYN floods are active attacks because they impact the host by degrading its performance or bringing it down altogether.

IP-based attacks

A number of IP-based attacks exist, like SYN flooding, eavesdropping, overlapping fragment, and teardrop attacks.

DoS and DDoS

A Denial-of-Service (DoS) attack is any attack that attempts to impede or completely deny functionality. A Distributed-Denial-of-Service (DDoS) attack involves multiple machines acting in unison.

Man-in-the-Middle

A man-in-the-middle attack manifests when the attacker inserts themselves in the communication path of two entities and thus has an opportunity to intercept and manipulate traffic between them.

Spoofing

Spoofing is pretending to be someone or something else, because that someone or something usually possesses more privileges or has access to a resource. It is not limited to one area of focus. Email, DNS entries, user IDs, IP and MAC addresses, and even biometrics can be spoofed.

Common tools and protocols

The next table summarizes some common tools and protocols that attackers use to take advantage of networks.

• Ping
• Traceroute
• ICMP
• DHCP
• Ipconfig
• WHOIS
• Dig
• Putty
• Nmap
• John the Ripper
• Netstat
• Nslookup

ARP poisoning

ARP poisoning involves a malicious user modifying their ARP table to direct network traffic meant for another device to their device.

ARP uses tables to map IP addresses to physical addresses—the MAC addresses—of a device. Every device on a network has a physical address and an ARP table.

Wireless

Radio frequency management

Radio frequency management refers to the placement of devices that broadcast wireless traffic. Managing Wi-Fi signals is called radio frequency management, which can prove quite challenging at times as there is an abundance of different devices operating at different areas of the radio spectrum.

802.11 Wireless protocol family

These are the different IEEE 802.11 specifications, starting with 802.11:

802.11 Security Solutions

To secure wireless communication, four (4) security services are required:

• Access control
• Authentication
• Encryption
• Integrity protection

The following table illustrates how they are implemented: