Understanding basic network devices such as using a switch is an important topic for the Security+ exam. This post should help.
For example, can you answer this question?
Q. Your organization has several switches used within the network. You need to implement a security control to secure the switch from physical access. What should you do?
A. Disable unused ports.
B. Implement an implicit deny rule.
C. Disable STP.
D. Enable SSH.
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
How a Switch Works
A switch has the ability to learn which computers are attached to each of its physical ports. It then uses this knowledge to create internal switched connections when two computers communicate with each other.
Consider the following figure. When the switch turns on, it starts out without any knowledge other than knowing it has four physical ports. Imagine that the first traffic is the beginning of a TCP/IP conversation between Lisa’s computer and Homer’s computer.
Switch
When Lisa’s computer sends the first packet, it includes the MAC address of the destination computer. However, because the switch doesn’t know which port Homer’s computer is connected to, it forwards this first packet to all the ports on the switch.
Included in that first packet is the MAC address of Lisa’s computer. The switch logs this information into an internal table. It then directs any future traffic addressed to Lisa’s MAC address to port 1, and port 1 only.
When Homer’s computer receives the packet, it responds. Embedded in this return packet is the MAC address of Homer’s computer. The switch captures Homer’s MAC address and logs it with port 4 in the internal table. From here on, any unicast traffic between Lisa’s and Homer’s computers is internally switched. Switches will internally switch unicast traffic. However, they pass broadcast traffic to all ports.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Security Benefit of a Switch
What you really need to know is why basic networking relevant in security. If an attacker installed a sniffer on a computer attached to another port (such as port 3 in the figure above), the sniffer would not capture unicast traffic going through the switch to other ports. If Lisa and Homer are exchanging data on ports 1 and 4, none of the traffic reaches port 3. The sniffer can’t capture traffic that doesn’t reach the port.
In contrast, if the computers were connected via a hub, unicast traffic goes to all hub ports and the attacker could capture it. This is the main security reason why organizations replace hubs with switches. The switch reduces the risk of an attacker capturing data with a sniffer. Of course, switches also increase the efficiency of a network.
Physical Security of a Switch
Many switches have a console port that administrators can use to monitor all traffic. Unlike the normal ports that only see traffic specifically addressed to the port, the monitoring port will see all traffic in or out of the switch. This includes any unicast traffic the switch is internally switching between two regular ports. The monitoring port is useful for legitimate troubleshooting, but if the switch isn’t protected with physical security, it can also be useful to an attacker.
Physical security protects a switch by keeping it in a secure area such as in a locked wiring closet. Physical security ensures that attackers don’t have physical access to the switch and other network devices.
Loop Protection
In some situations, a network can develop a switching loop or bridge loop problem. The effect is similar to a broadcast storm and it can effectively disable a switch. For example, if a user connects two ports of a switch together with a cable, it creates a switching loop where the switch continuously sends and resends unicast transmissions through the switch. In addition to disabling the switch, it also degrades performance of the overall network.
This is trivial for many network administrators, because most current switches have Spanning Tree Protocol (STP) or the newer Rapid STP (RSTP) installed and enabled. STP and RSTP protect against switching loops. However, if these protocols are disabled, the switch is susceptible to loop problems. The simple solution is to ensure that switches include loop protection such as STP or RSTP.
Spanning Tree Protocol also protects the network against potential attackers. For example, imagine an attacker visits a conference room and has access to RJ-45 wall jacks. If loop protection isn’t enabled, he can connect two jacks together with a cable, slowing network performance down to a crawl.
Remember this
Loop protection such as STP or RSTP is necessary to protect against switching loop problems, such as those caused when two ports of a switch are connected together.
Q. Your organization has several switches used within the network. You need to implement a security control to secure the switch from physical access. What should you do?
A. Disable unused ports.
B. Implement an implicit deny rule.
C. Disable STP.
D. Enable SSH.
Answer is A. You can provide added security by disabling unused physical ports on the switch. If someone gains physical access to the switch by plugging in a computer to one of its unused ports, that person will not be able to connect to the network.
An implicit deny rule is placed at the end of an access control list on a router to deny traffic that hasn’t been explicitly allowed, but it doesn’t not affect physical ports differently.
Spanning Tree Protocol (STP) prevents switching loop problems and should be enabled.
Secure Shell (SSH) encrypts traffic but doesn’t protect a switch.
