Ethical Hacking

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 69 today we're going to discuss about In security one of the most important things is to ensure that you understand,what openings you have created in your systems.When it comes to computers and networks,most of these openings are going to be created by ports.Now a port is simply a logical communication endpoint that exists on your computer or your server.For example, if you're running a web server,you're going to have port 80 open and listening for inbound requests from your potential visitors.Now ports are classified as either inbound or outbound ports.An inbound port is used when your computer or server is listening for a connection.Just as in my earlier example,the web server had port 80 open, that's an inbound port.It's just waiting for somebody to come along and connect to it.An outbound port on the other hand, is opened by a computer whenever it wants to connect to a server.If my computer is attempting to make a connection to your web server over port 80,well, then my computer is going to open up a random high number port such as port 52363 and it's going to make an outbound request to that web server.Now, what does all this look like in the real world?Well, let's look at an example of how an inbound and outbound port are used when my laptop attempts to connect to a remote server over SSH.First, we have a server at the top of the screen and it has a public IP address assigned to it,and it's listening on port 22,so port 22 is the inbound port awaiting new connections.And in this case, port 22 is open.At the bottom of the screen,I have my laptop that wants to make the connection.Now, my laptop has a private IP address assigned because my network is using NAT at the router and that gives me some additional protections.So, notice at this point my laptop doesn't have any ports opened yet.So now my laptop wants to go and establish the SSH connection.It's going to open up an outbound port on itself,which is going to be some random high number port like 51233 and it's going to send a request to the SSH server over port 22 which is the server's inbound ports and destined for it's IP address in this case, 46.124.63.13.Now once a server receives this request,it has to respond to it.So, it's going to send a packet of information back to my laptop's IP in the outbound port that was open.In this case that's port 51233 and in reality it would be the public facing IP address of my router but for our example, I'm going to use the private IP address of 192.168.1.45.Now, that my laptop has made the request to the server and the server answered that request,we now have a session established and both devices can communicate back and forth as needed.Once that session is over,the connection is going to be closed,my laptop is going to close it's outbound port because it's no longer needed and the server will keep that inbound port open so they can receive requests from the next user who wants to use it.So now that we showed how ports work in the real world,let's talk a little bit more about the ports themselves.In addition to being called inbound and outbound ports,the ports are going to be assigned a number.Now, the number can be anywhere between 0 and 65,535 but this big range is actually divided into three smaller groups.The first group is called the Well-Known ports.This is for any ports that are between 0 and 1023.These are called Well-Known ports because they are designated by IANA the Internet Assigned Numbers Authority and they are going to assign it to commonly used protocols and ports.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 68 today we're going to discuss about In this section of the course,we're going to discuss network attacks.There are many different types of threats out there and many of them carry out their attacks over your networks.These attacks include things like denial of service attacks,spoofing, hijacking, replays,transitive attacks, DNS attacks,and ARP poisoning.Now, before we get into all of those different types of attacks though,it's important for us to do a quick review of the basics of ports and protocols that you learned back in Network.After all, the exam is going to focus on particular ports and protocols and how it's best to secure them.So let's get started with our review of ports and protocols in the next lesson.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 67 today we're going to discuss about We have spent a lot of time discussing the cloud in this section.But the cloud is made up of a lot of different types of servers.In this lesson we're going to discuss a few specific types of servers that may be hosted in the cloud,and how you can best secure them.First, we have file servers.File servers are used to store,transfer, migrate, synchronize and archive your files.Any computer can act as a file server in the real world.The server might be running Windows, Linux or Mac OSX as its operating system. And it really doesn't matter which.Either way, you want to make sure the file server is using proper data encryption for its files when they're at rest,that the server has monitoring and logging being performed on it,and a good host based intrusion detection system.You might also want to use data loss prevention applications to ensure the data isn't stolen and all of the normal configuration hardening and patching that we've already discussed in the past during this course.Second, we have email servers.These servers are a frequent target of attacks because they contain a lot of valuable data from within your organization.In a Windows environment,the most common email server is Microsoft Exchange.Microsoft Exchange and its Unix and Linux counterparts all support the POP3 IMAP and SMTP protocols for receiving and sending email.This means that at a minimum,we have at least three open ports and services running,but usually, there are many, many more.Because email servers are frequently a target of attacks,it's important that you insure that they are securely configured using the hardening techniques discussed earlier in this course.That you have spam filtering applications installed,and antivirus, not just for the server itself,but also to scan and quarantine all of the attachments being sent or received by your users.Next, we have a web server.In the Windows environment,this is usually hosted by Internet Information Services or IIS server.For Linux or Mac,this is usually going to be an Apache web server.Either way, web servers are by default open to the internet to perform their job.So, it's important for us to properly secure them.They should always be placed in your organizations DMZ.They should be properly firewalled,monitored, logged, audited and patched to insure their security.Always insure that your web server is up to date with the latest patches.If you aren't sure what patches need to be applied you can always visit the common vulnerability and exposure website or CVE that's hosted by the Mitre corporation.This site maintains an up to date list of every known vulnerability for every type of software that's on the market.Our fourth type of server is an FTP server.An FTP server is a specialized type of file server that's used to host files for distribution across the web.These servers can be setup to allow anonymous login and receipt of files or they can be secured with a username, password or other credentials.You might want an anonymous FTP setup,if you're distributing your software for example,or you may want a secure FTP server setup so that your remote offices can upload and download large files over the internet to your network.If you're setting up an FTP server,remember to always force an encrypted connection using the transport layer security or TLS.Because if you're going to require a username or password,you want to make sure it's protected during transmission.By default, FTP runs over ports 20 and 21,and it passes its information across the web in an unencrypted format.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 66 today we're going to discuss about cloud security.Once we begin to rely on virtualization and cloud computing for our deployments,it becomes very important to recognize that our data might be hosted on the same physical server as another organization's data.By doing so, we introduce some vulnerabilities into the security of our systems.First, if the physical server crashes due to something one organization does,it can affect all of the organizations hosted on that same physical server.Similarly, if one organization has not maintained the security of their virtual environments being hosted on that server,there is a possibility that an attacker could utilize that to the detriment of all organizations based on that same server being hosted.Just as there are concerns when you conduct the interconnection of your networks with somebody else's,there are concerns with hosting multiple organizations' data on the same physical server that's being run by a given cloud provider.It's important for us to properly configure, manage,and audit user access to the virtual servers being hosted.Also, you should ensure that your cloud-based servers have the latest patches,anti-virus, anti-malware,and access control in place,if you're going to be using infrastructure as a service as your model.To minimize the risk of having a single physical server's resources being overwhelmed,it's a good idea to set up your virtual servers in the cloud with proper failover, redundancy,and elasticity.By monitoring the network's performance and the physical server's resources,you should be able to balance the load across several physical machines instead of relying on a single one.After all, elasticity is one of the main benefits of migrating to the cloud in the first place.Most of cloud security relies on the same security practices that you would perform for other servers,such as ensuring complex passwords are used,strong authentication mechanisms are in place,and strong encryption being used to protect your data at rest,in transit, or in process.Also, your cloud environment should have strong policies in place to ensure that it's clear what things a user may do and may not do with that cloud service.Finally, remember that the data that you're hosting in the cloud is on somebody else's physical server.If you're using a public cloud model,you need to be concerned about data remnants that could be left behind when a cloud server is deprovisioned after demand for the service is reduced.This could lead to a vulnerability where your data is available to other organizations using that same server.To prevent this, data should always be encrypted when placed in the cloud server,including the virtual hard disk files for those virtual servers that are being hosted.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 65 today we're going to discuss about As a Service. Cloud computing also comes as four different types of services.I like to refer to these by the generalized term of as a service because as you're going to see,everything in the cloud is something as a service.The four types you need to be aware of are Software as a Service,Infrastructure as a Service,Platform as a Service,and Security as a Service.With Software as a Service,you're going to be provided with a complete solution.This includes the hardware,the operating system,the software, the applications,everything that's needed for that service to be delivered.For example, if you use Office 365 for Microsoft,this is considered Software as a Service,and it allows your end users to access their email,their Word documents, their PowerPoint presentations,and all of that directly from within their web browser.Sometimes though, you're going to have to build a customized piece of software to meet your particular service needs.In this case you might only need the service provider to give you the hardware, the operating system,and the backend server software.With Infrastructure as a Service,you get the benefit of this dynamic allocation of additional resources known as elasticity,but you don't have to deal with the headache of long-term commitments and contracts, buying the hardware,and installing the underlying operating systems.For example, you might want to contract for a new cloud-based web host to host your company's website upon.The server might be built and hosted by the cloud service provider,and come with a pre-installed Linux operating system and an Apache web server.Now, your programmers can simply create a custom application for your customers that's run on top of this web server without having to worry about the underlying operating system and hardware.The third type of service is called Platform as a Service.Under this model, the third party vendor will provide your organization with all the hardware and software needed for a specific service to operate.For example, if you're company is developing a new piece of software, they might have a development platform that's provided by a third party cloud provider.This might be an example of Platform as a Service.Now, if we want to summarize these three types,remember that Infrastructure as a Service,you're provided with everything you need to run a server,including the power, the space, the cooling,the network, the firewalls, the physical servers,and the virtualization layer.With Platform as a Service,the operating system and the infrastructure software is added to that list I just gave you.Now infrastructure software includes things like an Apache web server, a MySQL database,programming languages and lots more.With Software as a Service,the hosted application software is added to top of this infrastructure and platform portions.As you can see, Software as a Service is much closer to your end user than either Platform as a Service, or Infrastructure as a Service.Now, at the beginning of this lesson,I said that there was four types of as a service that you had to know for the exam.The fourth one is Security as a Service.

Hello everyone my name is vijay kumar Devireddy and I am glad to have you back on my episode 64 today we're going to discuss about Cloud computing isn't a single thing though,because there are many different ways to implement the cloud you should know that there are four different cloud types.Public, private, hybrid and community.The most common type of cloud architecture is the public cloud.Under this model, a service provider makes resources  available to the end user over the internet.There are numerous public cloud solutions available today,including those from google,Microsoft and Amazon.For example, google drive is a public cloud service that's offered both as a free and pay for use model.Public clouds can often be an inexpensive way for an organization to gain the required capability and service they need quickly and efficiently.The second option is what's known as a private cloud.This service requires that a company create its own cloud environment that only it can utilize as an internal enterprise resource to manage its cloud.With a private cloud, your organizations responsible for the design, implementation and operation of the cloud resources, and the servers that host them.For example, the United States Government runs a private cloud for use by different organizations within the government.But my company and yours, can't get access to it like we could with google drive.Generally, a private cloud is chosen when security is more important to the organization than cost.A hybrid cloud solution combines the benefits of both the public cloud and the private cloud options. Under this architecture,some resources are developed and operated by the organization itself like a private cloud would be but the organization can also utilize the publicly available resources or outsource services  to another service provider like a public cloud does! Because of this mixture of private and public cloud resources, strict rules should be applied for what type of data is hosted in each portion of this hybrid cloud.For example, any confidential information should always be hosted on the organization's private cloud portion.Our fourth option is known as a community cloud.Under this model, the resources and cost are shared among several different organizations who have a common service need, this is similar to taking several private clouds and connecting them together.Now, the security challenge here is that each organization may have their own security controls,remember if you connect your network to another network,you inherit their security risks as well.This doesn't change just because we've moved to the cloud environment.So, which of these four models or combination of models is right for your organization?Well, there's no clear cut answer,because it really depends on your security needs,your cost restrictions and your risk tolerance.Generally, it's cheapest to use a public cloud model,but this also increases the risk to your information's confidentiality and availability.Well, there's many other things you need to consider as a security practitioner, there is going to be no single right answer here, instead it's our job to weigh the benefits and the drawbacks of each other these models to decide which one is right for our organization's security needs and their concerns.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 63 today we're going to discuss about Cloud Computing.These days,could computing seems to be the big trend within our industry.But what exactly is cloud computing? Well, cloud computing is defined as a way of offering on-demand services that extend the traditional capabilities of a computer or a network,out into the Internet.With the promise of increased availability,higher resiliency,and unlimited elasticity, the cloud definitely can provide our organizations a lot of advantages over our traditional network architectures. But, cloud computing can also bring a number of unique security challenges into our environments, too.For cloud computing to gain its intended cost savings and efficiencies, though,it relies heavily on the concept of virtualization.By using virtualization,numerous logical servers can be placed on a single physical server.This, in turn,can help us reduce the amount of physical space,power, and cooling,that's needed inside your data center.Additionally, by using virtualization,we can achieve higher levels of availability by spinning up additional virtual servers when necessary.This ability to dynamically provision memory and CPU resources, is one of the key benefits to cloud computing.While there are a lot of benefits to cloud computing,such as decreased cost,increased scalability,and unlimited elasticity,there are also numerous security issues that we have to consider.Most of the same security issues that we have with physical servers also get carried over into the cloud computing environment, too.Often times,I hear executives think that all of their problems will be solved by moving to the cloud.This is simply not the case.To gain these efficiencies,cloud providers rely on virtualization to allow multiple logical serversto be placed on that single physical server,as we said before.Many cloud service providers, though,have taken virtualization a step further with the concept of hyper-converged infrastructure.This allows providers to fully integrate the storage,network, and servers,without having to perform hardware changes.Instead,they rely on a software and virtualization technology to perform all of the needed integrations. All of this can be managed from a single interface or a device,without any worry about the underlying vendor solutions.Many cloud providers are also offering Virtual Desktop Infrastructure as one of their services.VDI allows a cloud provider to offer a full desktop operating system to an end user from a centralized server.There are a lot of security benefits to this approach.For example,one organization that I worked with creates a new virtual desktop image for each user,every time they log on in the morning.This desktop is non-persistent. So even if it's exploited by an attacker,it is destroyed as soon as the user logs off at the end of the day,or at midnight each night.This effectively destroys the attacker's ability to remain persistent on the end user's desktop,and adds a lot of security for us.Now, when we look at these numerous logical servers being stored on a single physical server,we also have to consider that there has to be a way to keep the data confidential and separated from the other logical servers, too.To do this,we use Secure Enclaves and Secure Volumes.Secure Enclaves utilize two distinct areas that the data may be stored and accessed from Each enclave can be accessed by the proper processor.This is a technique that's used by Microsoft Azure and many other cloud service providers.Secure volumes, on the other hand,are a method of keeping data at rest,secure from prying eyes.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 62 today we're going to discuss about Unified threat management,the unified threat management or UTM system is a newer concept that was introduced in the last five to 10 years.Basically, security professionals realized as I'm sure you're realizing now too,that relying on a single firewall is not enough to protect our networks,and so a UTM was created, now a unified threat management system is a combination of network security devices and technologies that are added to a network to better protect it.Simply put a UTM is a single device that combines many other devices and technologies into it.For example your UTM might include a firewall,a network intrusion detection system,or a network intrusion prevention system,a content filter or a proxy, an antivirus or anti-malware gateway, a data loss prevention system,and maybe even a site to site VPN if you have the need.Now these devices are designed to make it easier for a security administrator to use them.And instead of relying on a command line interface,with all the tech space commands,they get a graphical user interface instead.It allows them to make policies, rules, and signatures,that makes it much easier and much quicker to use.Now UTM's provide a singular package with multiple protections.And they are essentially a defense in depth strategy within a single device or system.Because of this often these devices will replace your firewall, and it's usually placed as the outer most device in your local area network.To provide its' perimeter defense and its' protections.You may have also heard the term, Next Gen Firewall,or Next Generation Firewall, also known as NGFW.If you've heard this term, it's because it's being used in the industry instead of using the term UTM or unified threat management.These are those all in one security devices and that's all a Next Generation Firewall is.This is a marketing ploy because people weren't understanding the UTM concept,but they understood firewalls,and so calling it a Next Generation Firewall helped them increase sales.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 61 today we're going to discuss about NIDS versus NIPS.Now, we've already spoken a little bit about intrusion detection and intrusion prevention systems earlier on in this course.In this lesson though, we're going to focus on the differences between a network based IDS and a network based IPS.A Network Intrusion Detection System,or a NIDS, is a type of IDS that attempts to detect malicious network activities.For example, port scans and denial of service attacks.Now, this is a device that's usually placed either before the firewall, so that it can be directly exposed to all of the traffic that's coming in,or right behind the firewall.Personally though, I like to have my NIDS placed behind the firewall, as this helps filter the amount of traffic that we'd have to see and review, since the firewall is already going to block a lot of it for us.Generally, your Network Intrusion Detection System will be placed into what's known as promiscuous mode.This allows it to see all of the traffic that crosses the network instead of just the traffic that's destined for it's own Mac address This is easily done through the configuration of the NIDS, and by placing your NIDS on a span port of your network switch so that it can receive all of the traffic moving through that switch, and not just the traffic on it's own switch port.A NIDS can only detect, monitor, and alert on traffic based on signature base rules or heuristics,and, it won't do anything to actually stop an attack from occurring.When you're dealing with a NIDS,all it's going to do is log it,and let you know about it.A Network Intrusion Prevention System, or NIPS on the other hand, is a type that's designed to inspect traffic and based on it's configuration or security policy,it can also remove, detain, or redirect that malicious traffic.That means a NIPS can not only detect it and log it like an IDS does,but it can also stop that ongoing attack by blocking the IP address that's causing issues or shutting down the connection.But, to be able to effectively take these actions,the NIPS has to be installed in line,in your network.Again, I like to place my NIPS in line,just behind the firewall.This way it's just inside the network perimeter and it allows me to have a good vantage point for it.Remember, when you're using a NIPS to block an ongoing attack,you want to ensure that the NIPS is properly tuned.If you didn't tune it properly with the right signatures, you could have a lot of false positives, and since these would be terminated, it could cause an inadvertent denial of service for your network if it tries to prevent what it thinks is malicious traffic from flowing into the network.Now, because a NIPS is an in line device,you also have to think about what's going to happen if that device fails.Should that device fail open, or should it fail shut?If you set the device to be configured to fail open, this means that the NIPS is going to simply let all of the traffic through it whenever it fails.This is less secure obviously,and so you have to think about if this is really what you want.Now, if you choose to fail shut on the other hand,the device is going to block all the traffic if it fails for some reason.This means that it's going to create a denial of service condition for your entire network,which is also pretty bad.For this reason, most organizations choose to fail open with their Network Intrusion Prevention Systems, and rely on other defensive layers to provide some layer of protection, until the NIPS can be brought online again and fixed.Now, in addition to providing their NIDS and NIPS functions, these devicesalso can be used as a protocol analyzer.

Hello everyone my name is vijay kumar Devireddy and i am glad to have you back on my episode 60 today we're going to discuss about Data loss prevention.Data loss prevention, or DLP systems,are designed to protect data by conducting content inspection of your data as it's being sent out of your organization's network.While data loss prevention is the most commonly used term,it's also referred to as ILP for Information Leak Prevention or EPS, Extrusion Prevention Systems.Usually these systems are installed as a network based DLP or a Cloud based DLP.For example, my company happens to use a Cloud based DLP through Google's G Suite.Anytime one of our employees tries to send information outside of our own domain through email,that email is flagged and they have to verify that they understand the data is being sent outside of security.com We have our DLP set to low because we communicate with so many people outside of our organization on a daily basis.But if we wanted to, we could force a higher security level and make each email being sent be checked and verified by a third employee before it was sent out to ensure that no confidential data was being left outside of our network.Now, there's also automated ways to do this,so you can flag particular emails based on key words or a no-no list and prevent any files or emails from being transferred with those keywords inside of them.It all depends on how you want to configure your DLP.DLPs are used to ensure your data stays within your network,that it isn't leaked out to outsiders,and that the privacy of your confidential data remains private.That's the whole goal here.We want to make sure that data isn't being sent outside of your network over and over again and have this massive data exfiltration going on.DLP systems can help you with that.