Posts by ISeeTWizard

If you ever needed a Machine Name for an IP Address you can simply try this PowerShell command (always run as administrator).

$ComputerIPAddress = '10.10.10.10'
[System.Net.Dns]::GetHostEntry($ComputerIPAddress).HostName

There is an alternative to get more information while connection to the Active Directory (if available).

import-module activedirectory
$ComputerIPAddress = '10.10.10.10'
Get-ADComputer -property * -filter { ipv4address -eq $ComputerIPAddress }

Here are some useful commands regarding the DNS cache, resolve etc.

#Display the DNS Cache
ipconfig /displaydns

#Empty the DNS Cache
ipconfig /flushdns

#Display DNS Cache (Powershell only)
Get-DnsClientCache

#Empty the DNS Cache (PowerShell only)
Clear-DnsClientCache

#Test a connection to a computer (ping like PowerShell command)
Test-Connection ComputerName

<# Provides information about network latency and network loss at intermediate hops between a source and destination. 
This command sends multiple echo Request messages to each router between a source and destination, over a period of time, and then computes results based on the packets returned from each router. 
Because this command displays the degree of packet loss at any given router or link, you can determine which routers or subnets might be having network problems. #>
pathping ComputerName

#Performs a DNS name query resolution for the specified name
Resolve-DnsName ComputerName

#Find DNS records for a specific computer
nslookup -debug ComputerName

I had recent attacks on my Linux server and so I was searching on how to add an IP drop with my firewall.

On my Sites I have a security system that blocks already many things but unfortunately not all.

And so here I show you an example on how to do it (at least how I did it).

#add the ip 91.92.252.176 to the connection reject list
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="91.92.252.176" reject'

#reload the firewall with the new settings
firewall-cmd --reload

#see the state of the firewall engine
firewall-cmd --state

#see the current settings
firewall-cmd --list-all

Example - You want to add an IP that is already exisiting

Reload firewall - if all is ok you'll get a success

Checking the state will show you if it's running or it's stopped

With list-all you gonna see the current settings - so also what is allowed (here logicaly obfuscated)

PAN

Personal Area Network A personal area network (PAN) is a computer network for interconnecting electronic devices within an individual person's workspace. A PAN provides data transmission among devices such as computers, smartphones, tablets and personal digital assistants.

LAN

Local Area Network A local area network (LAN) is a collection of devices connected together in one physical location, such as a building, office, or home.

WLAN

Wireless Local Area Network A wireless local area network (WLAN) is a network that transmits information using electromagnetic waves or light, allowing devices to connect to the internet or other devices without the need for physical cables. WLANs are commonly used for wireless internet access in homes, offices, and public places.

CAN

Campus Area Network A campus area network (CAN) is a computer network that spans a limited geographic area. CANs interconnect multiple local area networks (LAN) within an educational or corporate campus. Most CANs connect to the public Internet.

MAN

Metropolitan Area Network A metropolitan area network (MAN) is a network that covers a smaller geographical area such as a city or a large college campus system. Good examples of MANs are the local telephone company and your local cable TV company. MANs are also widely used in large companies and in governments to interconnect their computers.

WAN

Wide Area Network A wide-area network (WAN) is the technology that connects your offices, data centers, cloud applications, and cloud storage together. It is called a wide-area network because it spans beyond a single building or large campus to include multiple locations spread across a specific geographic area, or even the world.

SAN

Storage Area Network A Storage Area Network (SAN) is a network of storage devices that can be accessed by multiple servers or computers, providing a shared pool of storage space.

SANS

System Area Network A system area network (SAN) is a group of devices that are linked by a high-speed, high-performance connection. A SAN connection uses Internet Protocol (IP) addresses, which are assigned by TCP/IP to each SAN network interface controller (NIC), to determine data routing.

POLAN

Passive Optical Local Area Network A Passive Optical Network (PON) utilizes fiber-optic technology to distribute data from one source to multiple endpoints. The term "passive" denotes the use of optical fiber cables linked to an unpowered splitter, which transmits data from the service provider's network to numerous customers.

EPAN

Enterprise Private Network An Enterprise Private Network (EPN) is a computer network built by a business to interconnect its various company sites such as production sites, offices, and shops. This private network allows companies to share resources and communicate effectively.

VPN

Virtual Private Network A VPN protects its users by encrypting their data and masking their IP addresses. This hides their browsing activity, identity, and location, allowing for greater privacy and autonomy. Anyone seeking a safer, freer, and more secure online experience could benefit from a VPN.

Virtual Private Network - VPN

• NordVPN
• ExpressVPN
• Cisco AnyConnect
• Juniper Networks VPN

Cloud Based Security Brokers - CASB

• Microsoft Cloud App Security
• Bitglass Total Cloud Security
• Netskope Security Cloud
• McAfee MVISION Cloud

Antivirus / Antimalware

• Symantec Endpoint Protection
• McAfee Endpoint Prtoection (now Trellix)
• Kaspersky Endpoint Protection
• ESET Endpoint Protection

I personally recommend to just use the Microsoft Defender

Endpoint Detection and Reponse (EDR)

• CrowdStrike Falcon
• SentinelOne
• Carbon Black (part of VMWare)
• Sophos Intercept X

Firewalls

• Cisco ASA with FirePOWER
• Palo Alto Networks Next-Generation Firewalls
• Fortinet FortiGate
• Check Point Next Generation Firewall

Identity and Access Management (IAM)

• Okta
• Microsoft Azure Active Directory
• Duo Security (Cisco)
• SailPoint IdentiIQ

Intrusion Detection and Prevention Systems (IDPS)

• Snort
• Cisco Firepower
• Palo Alto Networks Threat Prevention
• Check Point SandBlast

Security Information and Event Management (SIEM)

• Splunk Enterprise Security
• IBM QRadar
• LogRhythm NextGen SIEM Platform
• AlienVault USM (AT&T Cybersecurity)

Secure Web Gateways (SWG)

• Zscaler Internet Access
• Symantec Web Security Service
• McAfee Web Gateway
• Forcepoint Web Security

Network Access Control (NAC)

• Cisco Identity Services Engine (ISE)
• Aruba ClearPass
• Forescout Counter ACT
• Portnox CORE

Email Security

• Trustifi AI-Security
• Barracuda Email Security Gateway
• Proofpoint Email Protection
• Mimecast Secure Email Gateway
• Cisco Email Security

Data Loss Prevention (DLP)

• Symantec Data Loss Prevention
• Digital Guardian
• McAfee Total Protection for Data Loss Prevention
• Forcepoint DLP

There are some default Ports used when working on a network/server but most of these ports exists in a default way and a secure way. Here are some essential ports listed with it's default number and it's secured number.

Within the network there are many different protocols.

9 of them are more than essential.

The OSI Layer should be commonly known in the world of ICT but did you know what attack targets what layer?

Here a table to clarify this...

Information and communications technology (ICT) is an extensional term for information technology (IT) that stresses the role of unified communications and the integration of telecommunications (telephone lines and wireless signals) and computers, as well as necessary enterprise software, middleware, storage and audiovisual, that enable users to access, store, transmit, understand and manipulate information.

ICT is also used to refer to the convergence of audiovisuals and telephone networks with computer networks through a single cabling or link system. There are large economic incentives to merge the telephone networks with the computer network system using a single unified system of cabling, signal distribution, and management. ICT is an umbrella term that includes any communication device, encompassing radio, television, cell phones, computer and network hardware, satellite systems and so on, as well as the various services and appliances with them such as video conferencing and distance learning. ICT also includes analog technology, such as paper communication, and any mode that transmits communication.

ICT is a broad subject and the concepts are evolving. It covers any product that will store, retrieve, manipulate, process, transmit, or receive information electronically in a digital form (e.g., personal computers including smartphones, digital television, email, or robots). Skills Framework for the Information Age is one of many models for describing and managing competencies for ICT professionals in the 21st century.