Securing Networks
AP Cybersecurity Topic 3 9:26 English narration · English + 中文 subtitles burned in
Chapters
Transcript
You send a message to your bank. It arrives. The reply comes back.
你给银行发一条消息，消息送到了，回复也回来了，一切看起来都很正常。
Everything looks normal. But someone is sitting quietly between you, reading every message and changing some before passing them on.
但有人正悄悄坐在你们中间，读取每一条消息，还会在转发前改动其中一些。
Neither side notices.
双方都毫无察觉。
This is an on-path attack.
这就是中间人攻击。
This is Unit Three, in five steps. The attacks a network invites. The policies and settings that close the easy doors. Segmentation. Firewalls and the rule list that decides what gets through. And detection, for when prevention has already failed.
这就是第三单元，分五步：网络会招来的攻击；关上简单入口的政策与设置； 网络分段；防火墙，以及决定什么能通过的规则表； 最后是检测——当防护已经失效时该怎么办。
Four classic attacks — know all four by name.
四种经典攻击，考试要求四种都能说出名字。
A R P poisoning — that is the address resolution protocol — sends fake address messages, so your traffic reaches the adversary instead.
ARP（地址解析协议）投毒发送伪造的地址消息， 让本该发给你的流量流向对手。
MAC flooding drowns a switch in fake hardware addresses until it broadcasts everything, and the adversary listens in: that eavesdropping is the point of both.
物理地址泛洪用大量伪造的硬件地址淹没交换机， 直到它广播一切，对手就能窃听——两者的目的都是窃听。
D N S poisoning — the domain name system — plants a fake record on a name server, sending your browser to a fake login page, which is credential harvesting.
DNS（域名系统）投毒在域名服务器上种下一条假记录， 让浏览器落到一个仿冒的登录页，这就是凭据窃取。
The fourth one is the smurf attack.
第四种是 Smurf 攻击。
It aims a storm of small requests at a whole network — I C M P echo requests, using the victim's address — so every device replies to the victim at once.
它用受害者的地址，向整个网络发出大量小请求—— 也就是 ICMP 回显请求——于是每台设备都同时回复受害者。
That is denial of service, DoS: no real user can reach the system.
这就是拒绝服务（DoS）：真正的用户已经访问不到系统。
Many machines attacking together make it a distributed denial of service, DDoS, and the impact is severe enough that mitigation has to be planned before it happens.
许多机器一起攻击，就成了分布式拒绝服务（DDoS）； 它的影响足够严重，所以缓解措施必须在事发之前就规划好。
Now the part that earns marks.
接下来是能拿分的部分。
Each attack leaves a different trace.
每种攻击留下的痕迹都不一样。
ARP poisoning shows one IP address paired with two hardware addresses.
地址解析投毒表现为一个 IP 地址对应两个硬件地址。
MAC flooding shows a sudden surge of new hardware addresses.
物理地址泛洪表现为突然涌入大量新的硬件地址。
DNS poisoning is the hardest to see; the only clue is a drop in traffic to your site.
域名投毒最难发现，唯一的线索往往是网站流量下降。
And a smurf attack shows a spike of requests at the broadcast address.
而 Smurf 攻击表现为大量请求涌向广播地址。
So why do networks fall?
那么网络为什么会失守？
Adversaries flood a network, map what is inside it, or pretend to be a device that belongs there.
对手向网络灌入流量、探测内部结构， 或者伪装成一台本就属于这里的设备。
Two openings do most of the damage.
两个入口造成了大部分损失。
A wall socket with no port security lets anyone who walks in plug into the local network.
一个没有端口安全的墙上网口，让走进来的任何人直接接入本地网络。
An open port lets them fit a rogue access point, reaching your network from outside, past the firewall.
一个开放的端口，让他们装上非法接入点，从楼外就能进入你的网络，绕过防火墙。
You can find these holes first.
你可以先一步找到这些漏洞。
An automated vulnerability scanner checks your networks, devices and applications against a database of known weaknesses.
自动漏洞扫描器拿你的网络、设备和应用 去比对一个已知弱点的数据库，然后打印出报告。
Each finding in its report carries a severity.
每条发现都带有严重等级。
High risk: one flat network with weak wireless encryption.
高风险：一整片没有分段的网络加上脆弱的无线加密。
Medium risk: the firewall never blocks outside pings.
中等风险：防火墙从不拦截来自外部的探测。
Low risk: an access point still announces its name.
低风险：某个接入点仍在广播自己的名字。
Fix the highest severity first.
先修最严重的。
Security starts with writing, before any device is on.
安全从写下来开始，在任何设备开机之前。
Router and switch policies ban local accounts and demand port security.
路由器和交换机政策禁止本地账户， 并要求启用端口安全。
A VPN policy says who may connect, and forbids split tunneling.
VPN 政策规定谁可以连接，并禁止分离隧道。
Then the wireless network itself: disable beacon frames so it stops announcing itself, control signal strength so it cannot leak outside the building, enable strong encryption — WPA3 — and use MAC filtering to limit which devices may join.
然后是无线网络本身：关掉宣告网络存在的信标帧，把信号调低，让它不会泄漏到街上， 并使用 WPA3 加密。
WEP and the original WPA are broken.
WEP 和最初的 WPA 都已被攻破。
Now, containment.
接下来是控制范围。
Network segmentation cuts one big network into smaller isolated pieces called subnets.
网络分段把一个大网络切成更小的、彼此隔离的部分，叫做子网。
If an adversary breaks into one piece, the damage is contained — the damage stops there.
如果对手攻进其中一块，损害就被遏制——损害就停在那里。
You can build the pieces by IP address, which is subnetting, or logically on one switch, using VLANs.
你可以按 IP 地址划分，这叫子网划分； 也可以在同一台交换机上逻辑地划分，这叫虚拟局域网。
This is the pattern the exam loves.
这就是考试最爱的结构。
On the left, the public internet: untrusted.
左边是公共互联网，不可信。
On the right, the private network with the sensitive data.
右边是私有网络，存放敏感数据。
Between them sits a screened subnet, also called a DMZ, with a firewall on each side.
中间是一个屏蔽子网，也叫隔离区，两侧各有一道防火墙。
Public web and mail servers live in that middle zone.
对外的网页和邮件服务器就放在中间这一区。
If one is taken, the adversary is still outside the second firewall.
如果其中一台被攻破， 对手仍然被挡在第二道防火墙之外。
This is what those words look like in a real building.
这就是这些词在真实机房里的样子。
Racks of servers, split into segments that cannot reach each other.
一排排服务器机架，被切分成彼此无法互访的分段。
And the switches where a firewall belongs.
还有交换机——防火墙正该放在这里。
A firewall allows or denies traffic entering or leaving a network.
防火墙允许或拒绝进出网络的流量。
There are three kinds.
它有三种。
A stateless firewall reads only the packet header, and judges each packet alone.
无状态防火墙只读取数据包的包头，单独判断每个数据包。
A stateful firewall also remembers each connection, so it can tell your own reply from a stranger at the door.
有状态防火墙还会记住每一条连接，因此能分辨哪是给你自己的回复，哪是陌生人在敲门。
A next-generation firewall, NGFW, adds intrusion prevention and deep inspection.
下一代防火墙（NGFW）则加上入侵防御和深度检查。
Every one of them decides using an access control list, an ACL, read in order from the top until a rule matches.
它们每一种做判断时用的都是访问控制列表（ACL）：从上往下依次读， 直到某一条规则匹配为止。
Watch how the decision is made.
看看这个判断是怎么做出的。
Each packet is tested against a list of rules.
每个数据包都会拿去和一张规则表逐条比对。
If a rule matches, its action happens at once: permit, and the packet passes; deny, and it is dropped.
一旦某条规则匹配，它的动作立刻执行：允许，数据包通过；拒绝，数据包被丢弃。
Nothing below is even read.
更靠下的规则根本不会被读到。
That list is the access control list.
这张表就是访问控制列表。
Every rule names a direction, a filter, and an action.
每条规则都指明方向、过滤依据以及动作。
Rules are read from the top down, and the first match wins.
规则自上而下读取，第一条匹配的说了算。
Follow this packet: port four four three, from an address in the company's range.
跟着这个数据包看： 它要去 443 端口，来自公司自己网段内的地址。
Rule one, no match.
第一条，不匹配。
Rule two, no match.
第二条，不匹配。
Rule three denies exactly that.
第三条，正好拒绝这种流量。
The traffic is dropped, and rule four, which would allow it, is never reached.
流量被丢弃，而本来会放行它的第四条，根本没被读到。
Your turn.
轮到你了。
Here are just two firewall rules.
这里只有两条防火墙规则。
Rule one allows TCP port twenty-two, which is SSH, from everyone.
第一条允许所有人访问 TCP 22 端口，也就是 SSH。
Rule two denies all TCP from everyone.
第二条拒绝所有人的全部 TCP 流量。
An SSH packet arrives.
一个 SSH 数据包到达。
Pause the video: does it get through, and what if the rules trade places?
暂停视频：它能通过吗？ 如果两条规则调换位置又会怎样？
Rule one matches first, so the packet is allowed and SSH works.
第一条先匹配，所以数据包被放行，SSH 正常。
Now swap the two rules.
现在把两条规则调换。
The deny rule is read first and matches everything, so the packet is denied, and SSH with it.
拒绝规则先被读到，而它匹配一切，于是数据包被拒绝，SSH 也一起被挡住。
The fix is to move the allow rule above the deny.
修复办法是把允许规则挪到拒绝规则之上。
Same two rules, opposite result.
同样两条规则，结果完全相反。
Prevention fails eventually.
防护终究会失效。
Detection takes over, reading the log files the network writes.
这时就轮到检测：读取网络写下的日志文件。
A network intrusion detection system, NIDS, analyses traffic and raises an alert, but it stops nothing.
网络入侵检测系统分析流量并发出警报，但什么也拦不住。
A network intrusion prevention system, NIPS, can also act: close a port, block an address, reject a protocol.
网络入侵防御系统还能动手：关闭端口、封锁地址、拒绝某种协议。
Security information and event management — SIEM — gathers many sources, including packet-capture files, to spot a pattern no single tool sees.
安全信息与事件管理系统则汇集多个来源，找出单一工具看不到的模式。
Two ways to decide that traffic is bad.
判断流量是否有害有两种方法。
Signature-based detection compares traffic to a database of known attack signatures.
基于特征的检测把看到的内容与已知攻击的数据库比对。
It is fast and its low false-positive rate matters, but it is blind to any attack nobody has recorded.
它很快，几乎不误报，但对还没有人记录过的攻击完全看不见。
Anomaly-based detection learns a baseline of normal traffic and flags anything unusual.
基于异常的检测先学习正常流量的基线，再标记任何异常。
It catches brand-new attacks, but costs more and raises more false alarms.
它能抓到全新的攻击，但成本更高，误报也多得多。
A hybrid uses both.
混合方式两者都用。
The network-based indicators of compromise you are watching for are unauthorized network scans, spikes or slowdowns in traffic, and mismatched port-application traffic — a tell-tale sign that something is not the service it claims to be.
你要留意的基于网络的入侵指标有：未经授权的网络扫描、 流量的突增或变慢，以及端口与应用不匹配的流量—— 那是某个东西并不是它自称的那个服务的明显迹象。
One last problem.
最后一个问题。
A medium network logs millions of events a day, so AI sorts them.
一个中等规模的网络每天记录数百万条事件，所以要用人工智能模型来分类。
The models are probabilistic: they do not answer yes or no, they return a percentage of how likely the event is to be malicious.
这些模型不给出是或否，而是给出一个百分比：这件事有多大可能是恶意的。
The organisation picks a threshold, the percentage that fires an alert.
机构再选定一个阈值：达到多少就发出警报。
Set the threshold too high, and real attacks slip through undetected. Set it too low, and the team is overwhelmed, drowning in false alerts.
阈值定得太高，真正的攻击会悄悄溜过去； 定得太低，团队就被误报淹没。
That has a name: alert fatigue, where responders stop believing any alarm at all.
这有个名字：警报疲劳——响应人员从此不再相信任何警报。
Five marks you can bank.
五个可以稳拿的分。
One: in an access control list, read top to bottom and stop at the first match.
第一：访问控制列表要自上而下地读，读到第一条匹配就停。
Two: pair each attack with its tell.
第二：把每种攻击和它的迹象配对。
Three: signature detection is fast but blind; anomaly catches new attacks but cries wolf.
第三：基于特征的检测快但看不见新攻击； 基于异常的检测能抓新攻击，但常常虚报。
Four: name the screened subnet when public services split from internal data.
第四：只要题目把对外服务和内部数据分开，就点出屏蔽子网。
Five: WPA three is strong; WEP and the original WPA are broken.
第五：WPA3 是强的，WEP 和最初的 WPA 已被攻破。
Five things to take with you.
带走五件事。
First, an ACL is first match: a DENY above an ALLOW blocks the traffic.
第一，访问控制列表是先匹配者胜：DENY 在 ALLOW 上面就会拦住流量。
Second, pair each attack with its tell.
第二，把每种攻击和它的迹象配对。
Third, signature detection is fast but blind; anomaly catches new attacks.
第三，特征检测快但看不见新攻击；异常检测能抓新攻击。
Fourth, run a vulnerability scanner and fix the highest-severity findings first.
第四，跑漏洞扫描器，先修最高严重度。
Fifth, read packet captures for network indicators of compromise, and name the screened subnet when public services sit apart from internal data.
第五，读数据包捕获找网络失陷指标， 题目把对外服务和内部数据分开时，要点出屏蔽子网。