Research Topic: Tcpdump. (Monday 2-4; Tutor: Eric Ohana)

Tcpdump is a command-line packet analyzer. It displays TCP/IP packets and other packets being transmitted or received over a network and operates on UNIX and Linux operating systems, and versions of it are available for Windows computers. Tcpdump’s power and functionality can be seen by the large number of switches that are available for tcpdump. A complete list of tcpdump switches is available at www.tcpdump.org/manpages/tcpdump.1.html.

Research tcpdump describing it and noting its capabilities. What are its advantages and disadvantages?  What is the Windows equivalent of tcpdump – briefly outline it. How does Tcpdump compare with Wireshark? Which would you choose (Tcpdump or Wireshark), and why? You may include illustrative diagrams to enhance your report.

Research Topic: DDoS mitigation. (Tuesday 6-8, Tutor: Bhargavi Goswami, and Thursday 9-11 Tutor: Tony Rhodes)

For websites, the only real protection against DDoS attacks is DDoS mitigation services. These services will detect abnormal network traffic that may signal an imminent DDoS attack and then reroute the traffic away from the target, either to be filtered or just discarded. This rerouting is most often done in one of two ways. The first method uses DNS redirection. This is accomplished by changing DNS records (specifically the CNAME and A record) to point to the IP address of the mitigation provider, where malicious requests are dropped while legitimate requests are forwarded back to the actual website. In some ways DNS redirection is similar to DNS poisoning. The second method is Border Gateway Protocol (BGP) routing that can divert all Network Layer packets, meaning that it is effective across all protocols to stop various types of Network and Application Layer attacks. However, DDoS mitigation services can be expensive.

Investigate Distributed Denial of Service (DDOS) attacks on websites. Firstly, outline/define a DDOS attack. Then research how most organizations attempt to mitigate a sudden DDoS attack that is directed at their web servers? Use the Internet to research DDoS mitigation techniques, technologies, and third-party entities that provide mitigation services. Which would recommend and why? You may include illustrative diagrams..

Research Topic: Microsoft Macro Protection (Wednesday 4-6, Tutor Tamara Orth)

Due to the impact of macro malware, Microsoft has implemented several protections.

· Protected View. Protected view is a read-only mode for an Office file in which most editing functions are disabled and macros will not launch. Files that are opened from an Internet location, received as an email attachment, opened from a potentially unsafe location, opened from another user’s OneDrive storage, or have “active content” (macros or data connections) will display a Protected View warning message.

· Trusted Documents. A trusted document is a file that contains active content but will open without a warning. Users can designate files in the Office Trust Center as trusted. However, files opened from an unsafe location cannot be designated as a trusted document. Also, the ability to designate a trusted document can be turned off by the system administrator.

· Trusted Location. Files that are retrieved from a trusted location can be designated as safe and will not open in Protective View. It is recommended that if a user trusts a file that contains active content, it should be moved to a trusted location instead of changing the default Trust Center settings to allow macros.

Using the internet, research these protections against Microsoft macros. Your research should list each protection type, their strengths and weaknesses, and how they would be implemented in an enterprise. In an appendix, Include a brief description of 3 real-world examples of Macro-Based Attacks.

Research Topic: Network Access Control. (Thursday 4-6, Tutor: Eric Ohana)

Use the Internet to research the network access control (NAC) products from Microsoft and Cisco. Outline the purpose of a NAC product. How are they different? How are they similar? What are some of the options for each product? Which product would you choose, and why? You may include an illustrative diagram to enhance the report.

Research Topic: Compare different types of firewalls. (Friday 8-10, Tutor: Tamara Orth)

Use the Internet to describe network firewalls. Then identify three network firewalls and create a chart that compares their features. Note if they are rule-based or policy-based, perform. stateless or stateful packet filtering, what additional features they include (IDS, content filtering, etc.), their costs, etc. Which would you recommend? Why? You may include an illustrative diagram to enhance the report.

Research Topic: UTM Devices (Monday 6-8, Tutor: Bhargavi Goswami)

UTM devices, or Unified Threat Management devices, are hardware or software solutions that consolidate multiple network security functions into a single, easy-to-manage appliance.

Firstly describe UTM’s, then create a table of four UTM devices available today. Include the vendor name, pricing (if available), a list of features, the type of protections it provides, and any other functions you consider relevant. Based on your research, assign a value of 1–5 (lowest to highest) that you would give each UTM. Include a short explanation of why you gave it that ranking. You may include any illustrative diagram/s to enhance the report.