Learning Objectives
In this Blog, we will cover the following learning objectives:
Understand what a network is and identify its key components.
Explore the concept of the network perimeter and its importance.
Identify the key perimeter threats.
Examine the firewall logs to monitor normal and suspicious logs.
Network Components
Component | Purpose | Security Importance | Things to Monitor | Example Attack |
User Workstations (Endpoints) | PCs and laptops used by employees for daily work | Most common attack entry point; vulnerable to phishing emails and malicious downloads | • Malicious processes
• Unusual outbound connections (C2 traffic) | Phishing email installs malware on a user's PC |
File & Database Servers | Store company data• File servers → shared documents• Database servers → customer, HR, and financial records | High-value targets; often targeted by ransomware; common source of data theft (exfiltration) | • Unauthorized file access
• Large data transfers
• Suspicious server activity | Data theft or ransomware attack |
Application Servers | Provide business services to employees and customers• Web servers• Email servers• VPN gateways | Exposed to the Internet; frequently targeted by attackers | • SQL injection attempts
• Brute-force login attempts
• Suspicious external IP addresses | SQL injection or brute-force attack |
Active Directory (AD) / Authentication Servers | Manage users, groups, computers, permissions, and authentication | Controls access across the enterprise; primary target for privilege escalation and lateral movement | • Failed logins (password spraying)
• Unusual login times
• Logins from unexpected locations
• Accounts accessing unusual systems | Password spraying or privilege escalation |
Routers & Switches | Routers: Connect internal network to external networks (Internet)
Switches: Connect devices within the same network | Compromise can allow traffic interception, traffic manipulation, hidden Internet access channels, and MITM attacks | • Configuration changes
• Unusual traffic routes
• Unauthorized device access | Man-in-the-Middle (MITM) attack |
Firewalls / Perimeter Devices | Control traffic between internal network and the Internet; allow or block connections based on rules | First line of defense; prevent unauthorized access; generate valuable security logs | • Port scans
• Brute-force attacks
• Exploitation attempts
• Blocked and allowed connections | External exploitation attempt |
Network Visibility
1. What is Network Visibility?
2. Why is Network Visibility Important?
Benefit | Description |
Detect Anomalies | Identify unusual activities that may indicate attacks |
Incident Investigation | Reconstruct attack timelines and understand attacker actions |
Threat Hunting | Proactively search for hidden threats |
Compliance | Meet regulatory and auditing requirements |
Security Monitoring | Continuously monitor network activity |
Example
Without visibility:
Malware infections may go unnoticed.
Unauthorized access may remain undetected.
Data theft (exfiltration) may occur without alerts.
3. Main Sources of Network Visibility
There are two primary log categories:
Log Type | Focus |
Host-Centric Logs | Activities occurring on a specific device |
Network-Centric Logs | Communication between devices |
4. Host-Centric Logs
Logs generated by individual hosts such as:
Servers
Workstations
Laptops
They provide a ground-level view of what happens on a specific machine.
Key Host-Centric Log Sources
Source | Description |
Operating System Logs | Windows Event Logs, Linux Syslog, macOS logs |
Application Logs | Apache, Nginx, MySQL, MSSQL, etc. |
Security Tool Logs | Antivirus, EDR, HIDS logs |
What Host-Centric Logs Help Detect
Detailed Forensics
Files accessed
Files modified
Files deleted
Process Monitoring
Malicious processes
PowerShell execution
Unauthorized scripts
Service changes
User Activity Tracking
User logins
Login times
Privilege usage
Malware Investigation
Host-Centric Logs Summary
Answers Questions Like... |
What happened on the machine? |
Which files were touched? |
Which process executed? |
Which user logged in? |
Did malware run successfully? |
5. Network-Centric Logs
Category | Details |
Definition | Logs generated by network devices that monitor traffic between systems. |
Provides Visibility Into | • Source IPs • Destination IPs • Ports• Protocols • Allowed/Blocked actions |
Why They Matter | Reveal:• When something happened • Where traffic came from • How communication occurred |
Useful for Identifying | • Reconnaissance • Lateral Movement • Data Exfiltration • Command & Control (C2) |
Key Network Centric Logs
Log Source | What They Log / Generate | Use Cases |
Firewalls | • Allowed connections • Blocked connections | • Unauthorized access attempts • Internet-based attacks |
IDS (Intrusion Detection System) | Detects suspicious activity | • Signature-based attack detection • Anomaly detection |
IPS (Intrusion Prevention System) | Detects and blocks attacks | • Signature-based attack detection • Anomaly detection |
Routers & Switches | • NetFlow • IPFIX • Traffic flow dataShow: • Source/Destination • Duration • Amount of data transferred | • High-level network visibility |
Web Proxies | • Websites visited • User web activity | • Detecting malicious websites • Policy violations • Data exfiltration |
VPN Logs | • User connections • Login times • Source locations | • Monitoring remote access security |
6. Importance of Network-Centric Logs
Function | Description |
Early Threat Detection | Detect attacks before endpoints are compromised |
C2 Detection | Identify communication with attacker infrastructure |
Lateral Movement Detection | Observe attacker movement between internal systems |
Data Exfiltration Detection | Detect suspicious outbound data transfers |
Attack Scope Analysis | Determine affected devices and communications |
7. Host-Centric vs Network-Centric Logs
Feature | Host-Centric Logs | Network-Centric Logs |
Focus | Single device activity | Traffic between devices |
Generated By | Hosts/endpoints | Network appliances |
Visibility Level | Detailed view | Broad overview |
Examples | Event Logs, EDR Logs | Firewall, IDS/IPS, VPN Logs |
Answers | What happened on the host? | Who communicated with whom? |
Best For | Forensics & malware analysis | Threat detection & network monitoring |
8. Correlation of Both Log Types
Best Practice
Use both host-centric and network-centric logs together.
Analogy
Combined Benefits
Network Perimeter
Definition
Boundary separating:
Internal Network (Trusted Zone) – employees, servers, business applications.
External Internet (Untrusted Zone) – potential threats.
Point where data enters and leaves the network.
Acts as the first and most critical line of defense.
All traffic entering or leaving the network passes through the perimeter.
Key Points
Internal network contains business-critical systems.
External Internet contains potential threats.
Perimeter is the controlled entry and exit point for traffic.
Understanding and defending the perimeter is important for security analysts.
Components of a Network Perimeter
Component | Purpose |
Firewalls | Filter traffic between internal and external networks. |
Routers/Gateways | Route traffic and enforce access rules. |
DMZ (Demilitarized Zone) | Buffer network segment for public-facing servers (web, mail, VPN). |
Remote Access Gateways / VPNs | Secure entry points for employees working remotely. |
Modern Perimeter May Also Include
Virtual gateways
Cloud connections
Remote access points
Importance of the Network Perimeter
Acts as a gatekeeper controlling network traffic.
Consists of multiple security controls and network components.
Protects internal assets from external threats.
Components work together to manage, filter, and secure data flow.
Why It Matters
Risks of a Weak or Misconfigured Perimeter
Exploitation of exposed services (RDP, MySQL, SMB).
Scanning and reconnaissance activities.
Brute-force attacks against login services.
Data exfiltration of stolen information.
Comments
Post a Comment