Cisco 200-201 - Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

 Tap and SPAN are two methods of capturing network traffic for analysis. Tap (Test Access Point) is a hardware device that is inserted between two network devices and sends a copy of all traffic to a monitoring device. SPAN (Switched Port Analyzer) is a software feature that allows a network switch to replicate traffic from one or more source ports to a destination port, where a monitoring device is connected. Both methods provide visibility into network traffic, but Tap is more reliable and less intrusive than SPAN, as it does not affect the network performance or introduce errors. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 68.

 The event described falls under the ‘action on objectives’ category of the Cyber Kill Chain. This stage occurs after the attacker has established a foothold within the network and begins to execute their intended actions, such as data exfiltration. References: The Cyber Kill Chain framework outlines the stages of a cyberattack, with ‘action onobjectives’ being the final step where attackers achieve their primary goal, such as data theft

Delivery is the fourth phase of the cyber kill chain, which is a model to describe the stages of a cyberattack. Delivery refers to the transmission of the weaponized payload to the target system, such as via email attachments, web links, USB drives, or network connections. Delivery does not necessarily imply successful installation or execution of the payload, which are subsequent phases of the kill chain. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 31.

Role-Based Access Control (RBAC) is an approach to restricting system access to authorized users based on their roles within an organization. It depends on the job functions that individual users have as part of their responsibilities and is designed to reduce administrative work by assigning roles based on job competency, authority, and responsibility. References: Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.2: Data Protection, Topic 1.2.2: Access Control Models

The situation where endpoint logs show a machine receiving an unusual gateway address and DNS servers via DHCP is indicative of a Man-in-the-Middle (MitM) attack, specificallya DHCP spoofing attack. In this type of attack, an adversary can set up a rogue DHCP server or manipulate the DHCP communication to provide false gateway and DNS information to clients. This allows the attacker to intercept, monitor, or manipulate traffic between the client and the intended gateway or DNS servers2.

Cisco’s best practices for network protections and attack identification3, and additional insights on securing networks from DHCP attacks

Defense-in-depth is a layered security strategy that aims to protect information and resources through multiple security measures.

One of its key principles is the concept of least privilege, which means providing users and systems with the minimum level of access necessary to perform their job functions.

By assigning only the necessary permissions, the attack surface is reduced, and the potential damage from a compromised account or system is minimized.

This principle helps in mitigating the risk of unauthorized access and limits the capabilities of an attacker if they gain access to an account.

References

Defense-in-Depth Strategy by NIST

Principle of Least Privilege in Cybersecurity

Layered Security Approach Explained

 In RBAC, access is based on the roles that users have within an organization, and permissions to perform certain operations are assigned to specific roles. DAC, on the other hand, is a type of access control where the access rights are determined by the owner of the resource or the resource itself.