# Traffic Analysis Essentials

Network Security is a significant subdomain of cybersecurity operations for protecting data, applications, devices and systems connected to the network. It focuses on system design, operation and management of the architecture/infrastructure to provide network accessibility, integrity, continuity and reliability. Traffic analysis (Network Traffic Analysis) is a subdomain of the Network Security domain with a primary focus on investigating the network data to identify problems and anomalies.

### <mark style="color:red;">Network Security</mark>

Two core concepts of Network Security are **authentication** and **authorization**. A variety of tools, technologies, and approaches exist to ensure and measure implementations and go beyond to provide continuity and reliability. Network security operations contain three base control levels to ensure the maximum available security management.

<mark style="color:orange;">Base Network Security Control Levels:</mark>

| **Physical**       | Physical security controls prevent unauthorized access to networking devices, cable boards, locks, and all linked components.                                  |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Technical**      | Data security controls prevent unauthorized access to network data, like installing tunnels and implementing security layers.                                  |
| **Administrative** | <p>Administrative security controls provide consistency in security operations like creating policies, access levels and authentication processes.<br><br></p> |

\ <mark style="color:orange;">The most common elements/approaches used in network security operations:</mark>

| **Access Control**                                                                                          | **Threat Control**                                                                                                                                       |
| ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The starting point of Network Security. It is a set of controls to ensure authentication and authorization. | <p>Detecting and preventing anomalous/malicious activities on the network. It contains both internal (trusted) and external traffic data probes.<br></p> |

<mark style="color:orange;">The key elements of Access Control:</mark>

| <p><strong>Firewall Protection</strong><br></p>            | Controls incoming and outgoing network traffic with predetermined security rules. Designed to block suspicious/malicious traffic and application-layer threats while allowing legitimate and expected traffic.        |
| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>Network Access Control (NAC)</strong><br></p>   | Controls the devices' suitability before access to the network. Designed to verify device specifications and conditions are compliant with the predetermined profile before connecting to the network.                |
| **Identity and Access Management (IAM)**                   | Controls and manages the asset identities and user access to data systems and resources over the network.                                                                                                             |
| **Load Balancing**                                         | Controls the resource usage to distribute (based on metrics) tasks over a set of resources and improve overall data processing flow.                                                                                  |
| <p><strong>Network Segmentation</strong><br></p>           | Creates and controls network ranges and segmentation to isolate the users' access levels, group assets with common functionalities, and improve the protection of sensitive/internal devices/data in a safer network. |
| <p><strong>Virtual Private Networks (VPN)</strong><br></p> | Creates and controls encrypted communication between devices (typically for secure remote access) over the network (including communications over the internet).                                                      |
| **Zero Trust Model**                                       | <p>Suggests configuring and implementing the access and permissions at a minimum level (providing access required to fulfil the assigned role). The mindset is focused on: "Never trust, always verify".<br></p>      |

<mark style="color:orange;">The key elements of Threat Control:</mark>

| <p><strong>Intrusion Detection and Prevention (IDS/IPS)</strong><br></p>          | Inspects the traffic and creates alerts (IDS) or resets the connection (IPS) when detecting an anomaly/threat.                                                                                                                                                    |
| --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p><strong>Data Loss Prevention (DLP)</strong><br></p>                            | <p>Inspects the traffic (performs content inspection and contextual analysis of the data on the wire) and blocks the extraction of sensitive data.<br></p>                                                                                                        |
| <p><strong>Endpoint Protection</strong><br></p>                                   | Protecting all kinds of endpoints and appliances that connect to the network by using a multi-layered approach like encryption, antivirus, antimalware, DLP, and IDS/IPS.                                                                                         |
| **Cloud Security**                                                                | Protecting cloud/online-based systems resources from threats and data leakage by applying suitable countermeasures like VPN and data encryption.                                                                                                                  |
| <p><strong>Security Information and Event Management (SIEM)</strong><br></p>      | Technology that helps threat detection, compliance, and security incident management, through available data (logs and traffic statistics) by using event and context analysis to identify anomalies, threats, and vulnerabilities.                               |
| <p><strong>Security Orchestration Automation and Response (SOAR)</strong><br></p> | Technology that helps coordinate and automates tasks between various people, tools, and data within a single platform to identify anomalies, threats, and vulnerabilities. It also supports vulnerability management, incident response, and security operations. |
| Network Traffic Analysis & Network Detection and Response                         | Inspecting network traffic or traffic capture to identify anomalies and threats.                                                                                                                                                                                  |

<mark style="color:orange;">Typical Network Security Management Operation is explained in the given table:</mark><br>

| **Deployment**                                                                                      | **Configuration**                                                                    | **Management**                                                                                                | Monitoring                                                                                                                                  | Maintenance                                                                                                                               |
| --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| <ul><li>Device and software installation</li><li>Initial configuration</li><li>Automation</li></ul> | <ul><li>Feature configuration</li><li>Initial network access configuration</li></ul> | <ul><li>Security policy implementation</li><li>NAT and VPN implementation</li><li>Threat mitigation</li></ul> | <ul><li>System monitoring</li><li>User activity monitoring</li><li>Threat monitoring<br></li><li>Log and traffic sample capturing</li></ul> | <ul><li>Upgrades</li><li>Security updates</li><li>Rule adjustments</li><li>Licence management</li><li>Configuration updates<br></li></ul> |

### Managed Security Services

Budget, employee skillset, and organization size can determine how security operations are handled. **Managed Security Services** (MSS) fulfill the required effort to ensure/enhance security needs. MSS are services outsourced to service providers called Managed Security Service Providers (MSSPs). Most MSS are time and cost effective, can be conducted in-house or outsourced, easy to engage, and ease management process.&#x20;

<mark style="color:orange;">Common elements of MSS:</mark>

| **Network Penetration Testing**               | Assessing network security by simulating external/internal attacker techniques to breach the network.                                                                                    |
| --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Vulnerability Assessment**                  | Assessing network security by discovering and analyzing vulnerabilities in the environment.                                                                                              |
| <p><strong>Incident Response</strong><br></p> | An organized approach to addressing and managing a security breach. It contains a set of actions to identify, contain, and eliminate incidents.                                          |
| **Behavioral Analysis**                       | An organized approach to addressing system and user behaviors, creating baselines and traffic profiles for specific patterns to detect anomalies, threats, vulnerabilities, and attacks. |

***Which Security Control Level covers contain creating security policies?***

Administrative

***Which Access Control element works with data metrics to manage data flow?***

Load Balancing

***Which technology helps correlate different tool outputs and data sources?***

SOAR

### <mark style="color:red;">Traffic Analysis</mark>

### Traffic Analysis / Network Traffic Analysis

Traffic Analysis is a method of intercepting, recording/monitoring, and analyzing network data and communication patterns to detect and respond to system health issues, network anomalies, and threats.&#x20;

**Operational issues** cover system availability checks and measuring performance while **security issues** cover anomaly and suspicious activity detection on the network.&#x20;

Traffic analysis is one of the essential approaches used in network security, and it is part of multiple disciplines of network security operations listed below:

* Network Sniffing and Packet Analysis (Covered in [Wireshark room](https://tryhackme.com/room/wiresharkthebasics))
* Network Monitoring (Covered in [Zeek room](https://tryhackme.com/room/zeekbro))
* Intrusion Detection and Prevention (Covered in [Snort room](https://tryhackme.com/room/snort))
* Network Forensics (Covered in [NetworkMiner room](https://tryhackme.com/room/networkminer))
* Threat Hunting (Covered in [Brim room](https://tryhackme.com/room/brim))

There are two main techniques used in Traffic Analysis:

| Flow Analysis                                                                                                                                                                                                                                                                                                                                                                            | Packet Analysis                                                                                                                                                                                                                                                                                                                                                                    |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <p>Collecting data/evidence from the networking devices. This type of analysis aims to provide statistical results through the data summary without applying in-depth packet-level investigation.</p><ul><li><strong>Advantage</strong>: Easy to collect and analyze.</li><li><strong>Challenge</strong>: Doesn't provide full packet details to get the root cause of a case.</li></ul> | <p>Collecting all available network data. Applying in-depth packet-level investigation (often called Deep Packet Inspection (DPI) ) to detect and block anomalous and malicious packets.</p><ul><li><strong>Advantage</strong>: Provides full packet details to get the root cause of a case.</li><li><strong>Challenge</strong>: Requires time and skillset to analyze.</li></ul> |

Benefits of the Traffic Analysis:

* Provides full network visibility.
* Helps comprehensive baselining for asset tracking.
* Helps to detect/respond to anomalies and threats.

### Does the Traffic Analysis Still Matter?

The widespread use of security tools/services and an increasing shift to cloud computing force attackers to modify tactics and techniques to avoid detection. If network data is encoded/encrypted, it still provides a value by pointing to an odd, weird or unexpected pattern/situation. Traffic analysis is still a must-to-have skill to detect and respond to advanced threats.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://jacob-taylor.gitbook.io/security-analyst/path-3/network-security-and-traffic-analysis/traffic-analysis-essentials.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.