Cisco 200-201 - Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

A Distributed Denial of Service (DDoS) attack involves multiple compromised devices (botnet) sending a large number of requests to a target server to overwhelm it.

In a specific type of DDoS attack known as an NTP amplification attack, the attacker exploits the Network Time Protocol (NTP) servers by sending small queries with a spoofed source IP address (the target’s IP).

The NTP server responds with a much larger reply to the target’s IP address, thereby amplifying the traffic directed at the target.

This reflection and amplification technique significantly increases the volume of traffic sent to the target, causing denial of service.

References

OWASP DDoS Attack Overview

NTP Amplification Attack Explained

Understanding Botnets and Distributed Attacks

Untampered images are crucial for security investigations as they provide original evidence that has not been altered or corrupted; their integrity and authenticity can be verified by comparing the stored hash and the computed hash of the image. If they match, the image is untampered and can be used for analysis. Tampered images, on the other hand, are useless for security investigations as they may contain false or misleading information; their integrity and authenticity are compromised by the modification of the image data. Tampered images may be used for incident recovery purposes, such as restoring a system to a previous state, but not for forensic purposes. References := Cisco Cybersecurity Operations Fundamentals - Module 6: Security Incident Investigations

A file hash is a unique identifier that is used to detect a specific file. It is generated by running a file through a cryptographic hash function, which produces a string of characters that represents the contents of the file. If even a single bit in the file changes, the resulting hash will be different, making it an effective way to identify files uniquely.

Digital certificates are electronic documents that use public key cryptography to verify the identity and authenticity of the sender and the receiver of encrypted communications. Digital certificates are issued and signed by trusted entities called certificate authorities (CAs), and they contain information such as the public key, the name, and the expiration date of the certificate. Digital certificates enable network security devices to decrypt perimeter traffic and inspect it for command and control communications or other malicious activity. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 51.

 SYN flood and teardrop are two types of denial-of-service (DoS) attacks, which aim to disrupt the availability of a service or a system by overwhelming it with malicious traffic or requests. A SYN flood attack exploits the TCP three-way handshake process by sending a large number of SYN packets to the target’s port, without completing the connection. This causes the target to allocate resources for half-open connections, eventually exhausting its memory or bandwidth. A teardrop attack exploits the IP fragmentation process by sending malformed or overlapping IP fragments to the target, causing it to crash or reboot when trying to reassemble them. References := Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.3: Common Network Application Operations and Attacks, Topic 1.3.4: Denial-of-Service Attacks

Full packet capture (FPC) is a valuable tool for investigating security breaches because it provides comprehensive data that can be used to reconstruct the event and identify the root cause. By capturing every packet, FPC allows engineers to see exactly what took place during the breach, including the TCP flags set within each packet, which can help focus on suspicious packets to identify malicious activity. It also collects metadata,including IP traffic packet data that is sorted, parsed, and indexed, and provides the full TCP streams to follow the metadata to identify the incoming threat