7.3 AAA, Network Defense & Incident Response

AAA Framework, Network Defense Architecture & Incident Response

Securing enterprise infrastructure requires a comprehensive defense strategy combining robust identity governance, resilient perimeter filtering, continuous host telemetry, and structured incident response procedures. When security boundaries are challenged, IT professionals must be equipped to authenticate users securely, inspect and filter network traffic, isolate compromised endpoints, and remediate cyber incidents systematically.

This section covers the AAA security framework, modern multi-factor authentication and identity federation (Kerberos, SAML, OAuth 2.0, OIDC), firewall architectures, Intrusion Detection and Prevention Systems (IDS/IPS), Demilitarized Zones (DMZs), system hardening, and the official NIST SP 800-61 Rev. 2 Incident Response Lifecycle.

---

1. The AAA Security Framework: Authentication, Authorization & Accounting

The AAA Framework is the foundational architecture governing access control, identity validation, and compliance tracking across enterprise networks, VPN gateways, and directory services.

+-----------------------------------------------------------------------------+
|                             THE AAA FRAMEWORK                               |
|                                                                             |
|   [ AUTHENTICATION ]          [ AUTHORIZATION ]           [ ACCOUNTING ]    |
|   - "Who are you?"            - "What can you do?"        - "What did you   |
|   - Verifies identity         - Grants permissions          do & when?"     |
|   - Passwords, MFA,           - RBAC, ABAC, ACLs          - Syslog, SIEM    |
|     Biometrics, Smart Cards   - Group memberships           audit trails    |
|                                                                             |
|   Centralized AAA Protocols: RADIUS (UDP 1812/1813) & TACACS+ (TCP 49)      |
+-----------------------------------------------------------------------------+

1. Authentication (Identity Verification)

Authentication is the process of verifying the claimed identity of a user, service account, or computing device before granting entry to a system. It answers the fundamental question: "Who are you, and can you prove it?"

• Techniques: Passwords, digital certificates, hardware security tokens, biometrics.

2. Authorization (Permission & Privilege Assignment)

Once an identity is authenticated, authorization determines the specific resources, services, files, or network segments that the identity is permitted to access, as well as the operational rights allowed (Read, Write, Execute, Delete). It answers: "What are you allowed to do?"

• Techniques: Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), NTFS/POSIX filesystem permissions, Active Directory group policies.

3. Accounting (Auditing & Forensic Tracking)

Accounting is the continuous measurement, logging, and auditing of user activity, resource consumption, active session times, data transfers, and administrative actions while logged in. It answers: "What did you do, when did you do it, and what systems did you access?"

• Techniques: Centralized syslog servers, Security Information and Event Management (SIEM) ingestion, database transaction audit logs, session recording.

Enterprise AAA Protocols:

• RADIUS (Remote Authentication Dial-In User Service): An open standard client/server protocol running over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting). It combines authentication and authorization into a single profile and encrypts only the password packet payload. Widely used for 802.1X Wi-Fi network authentication and enterprise VPN access.
• TACACS+ (Terminal Access Controller Access-Control System Plus): A Cisco-developed protocol running over TCP port 49. It strictly separates Authentication, Authorization, and Accounting into independent modular processes and encrypts the entire packet payload. Ideal for centralized administrative management of network routers, switches, and firewalls.

---

2. Modern Authentication & Identity Governance

Traditional single-factor authentication (a static username and password) is fundamentally broken against modern credential-stuffing botnets, phishing schemes, and password-spraying attacks. Organizations require Multi-Factor Authentication and centralized Single Sign-On federation.

+-----------------------------------------------------------------------------+
|                        AUTHENTICATION FACTOR CATEGORIES                     |
|                                                                             |
|   [ SOMETHING YOU KNOW ]   [ SOMETHING YOU HAVE ]   [ SOMETHING YOU ARE ]   |
|   - Knowledge Factor       - Possession Factor      - Inherence Factor      |
|   - Passwords, PINs,       - Hardware FIDO2 Key,    - Fingerprint, Retina,  |
|     Security Questions       Authenticator App,       Facial Recognition,   |
|                              Smart Card (CAC/PIV)     Voice Biometrics      |
|                                                                             |
|   [ SOMEWHERE YOU ARE ]                             [ SOMETHING YOU DO ]    |
|   - Location Factor                                 - Behavioral Factor     |
|   - IP Geolocation, GPS, BSSID Beacon               - Keystroke dynamics    |
+-----------------------------------------------------------------------------+

Multi-Factor Authentication (MFA)

Multi-Factor Authentication requires a user to present two or more independent authentication factor categories before access is granted. Presenting two items from the same factor (e.g., a password and a PIN) is merely two-step verification within a single category, not true MFA.

MFA Factor Categories:

1. Something You Know (Knowledge Factor): Passwords, passphrases, PIN codes, secret security challenge answers.
2. Something You Have (Possession Factor): Physical hardware security keys (YubiKey, Google Titan), smartphone authenticator apps (TOTP), smart cards (PIV/CAC cards), software certificate tokens.
3. Something You Are (Inherence Factor): Biological and physical biometrics—fingerprint scans, facial recognition (Apple Face ID), retina/iris scans, voiceprint geometry.
4. Somewhere You Are (Location Factor): Physical GPS coordinates, corporate subnet IP whitelisting, Bluetooth/Wi-Fi beacon proximity.
5. Something You Do (Behavioral Factor): Keystroke typing cadence, mouse movement dynamics, touch-screen gesture recognition.

MFA Mechanisms & Security Postures:

• SMS / Voice OTP (Insecure): One-Time Passwords delivered via SMS or automated phone calls are vulnerable to SIM swapping attacks, cellular SS7 protocol interception, and mobile malware. NIST SP 800-63B deprecates SMS OTP for high-security environments.
• Time-Based One-Time Password (TOTP - RFC 6238): Authenticator apps (Google Authenticator, Microsoft Authenticator) calculate a 6-digit cryptographic code based on a pre-shared secret seed and the current Unix epoch time (30-second rotating window). Secure against offline interception, but susceptible to real-time reverse-proxy phishing (Evilginx).
• Push Notifications (Moderate Risk): Mobile approval prompts sent to smartphones. Attackers exploit user distraction via MFA Fatigue Attacks (bombarding a user with hundreds of push notifications at 3:00 AM until the victim clicks "Approve"). Mitigated using Number Matching.
• FIDO2 / WebAuthn Hardware Security Keys (Gold Standard): USB/NFC physical hardware tokens (YubiKey) implementing public-key cryptography. The browser cryptographically binds the authentication assertion to the exact domain origin in the address bar, providing 100% phishing-resistant authentication.

MFA Factor Comparison Matrix

Single Sign-On (SSO) & Federation Architectures

Single Sign-On (SSO) enables a user to authenticate once with a centralized Identity Provider (IdP) and gain authorized access to multiple independent applications and resources across the enterprise without re-entering credentials.

+-----------------------------------------------------------------------------+
|                        FEDERATED IDENTITY PROTOCOLS                         |
|                                                                             |
|   [ KERBEROS ]            [ SAML 2.0 ]                [ OAUTH 2.0 / OIDC ]  |
|   - On-Premises Active    - Enterprise Web SSO        - Modern API & Cloud  |
|     Directory (Port 88)   - XML-based Assertions      - JSON / REST Tokens  |
|   - KDC: AS & TGS Tickets - Identity Provider (IdP)   - OAuth: Authorization|
|   - Symmetric Session Keys  to Service Provider (SP)  - OIDC: Identity (JWT)|
+-----------------------------------------------------------------------------+

1. Kerberos (Port 88): The default network authentication protocol for Microsoft Active Directory. It utilizes symmetric key cryptography and a trusted third-party Key Distribution Center (KDC) consisting of an Authentication Server (AS) and a Ticket Granting Server (TGS).
   • Workflow: User authenticates to AS $\to$ receives a Ticket Granting Ticket (TGT) $\to$ presents TGT to TGS to request a Service Ticket $\to$ presents Service Ticket to the target application server. Passwords are never sent across the network.
2. SAML 2.0 (Security Assertion Markup Language): An XML-based standard for federated web SSO across corporate domains. The user authenticates at the Identity Provider (IdP) (e.g., Okta, Azure AD), which generates a digitally signed XML assertion delivered via the user's browser to the Service Provider (SP) (e.g., Salesforce, ServiceNow).
3. OAuth 2.0 (Framework for Authorization): An open standard for token-based authorization over HTTP APIs. It allows a third-party application to obtain limited access to a user's resources (via scoped Access Tokens and Refresh Tokens) without exposing the user's master password.
4. OpenID Connect (OIDC - Identity Layer): A modern identity verification layer built directly on top of OAuth 2.0. While OAuth 2.0 handles authorization, OIDC provides authentication, issuing a digitally signed JSON Web Token (JWT) called an ID Token containing verifiable user identity claims.

---

3. Network & Endpoint Defense Architecture

Enterprise network security relies on perimeter firewalls, deep packet inspection, intrusion detection and prevention appliances, isolated demilitarized zones, and endpoint telemetry.

+-----------------------------------------------------------------------------+
|                     NETWORK DEFENSE TOPOLOGY & DMZ                          |
|                                                                             |
|   [ UNTRUSTED INTERNET ]                                                    |
|             |                                                               |
|             v                                                               |
|   [ EXTERNAL FIREWALL ]                                                     |
|             |                                                               |
|             +---> [ DEMILITARIZED ZONE (DMZ) ]                              |
|             |     - Public Web Servers (HTTPS 443)                          |
|             |     - External DNS & Reverse Proxies                          |
|             v                                                               |
|   [ INTERNAL FIREWALL ] (Inspects traffic entering private network)         |
|             |                                                               |
|             v                                                               |
|   [ TRUSTED INTERNAL LAN ]                                                  |
|     - Active Directory Domain Controllers                                   |
|     - Core SQL Database Servers & Financial Repositories                    |
|     - Internal Workstations (Monitored by EDR Agents)                       |
+-----------------------------------------------------------------------------+

1. Firewall Technologies

Firewalls enforce network boundary security by filtering traffic based on predefined security rulesets.

• Packet Filtering Firewalls (Stateless - Layer 3/4): Inspects individual packets in isolation, evaluating source/destination IP addresses, protocol types, and port numbers. Limitation: Does not track connection state; cannot detect attacks hidden inside valid port payloads.
• Stateful Inspection Firewalls (Layer 3/4/5): Tracks the active state of established network sessions in an internal State Table. When an internal client initiates an outbound TCP connection, the firewall dynamically opens a temporary pinhole to permit matching inbound return packets, automatically dropping unsolicited incoming traffic.
• Next-Generation Firewalls (NGFW - Layer 7): Operates at the Application Layer, performing Deep Packet Inspection (DPI). NGFWs identify specific applications regardless of port (e.g., differentiating legitimate HTTPS browsing from BitTorrent traffic running over port 443), integrate real-time threat intelligence feeds, decrypt and inspect SSL/TLS sessions, and include built-in IPS modules.
• Web Application Firewalls (WAF): Specialized reverse-proxy firewalls positioned in front of web servers to inspect incoming HTTP/HTTPS application payloads. WAFs block web-specific attacks including SQL Injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF).

2. Intrusion Detection (IDS) vs. Intrusion Prevention Systems (IPS)

Detection Methodologies:

• Signature-Based Detection: Compares packet payloads against a database of known exploit signatures (e.g., Snort rules). Highly fast and accurate with near-zero false positives for known threats, but completely blind to novel Zero-Day attacks.
• Anomaly / Behavioral-Based Detection: Establishes a baseline of normal network traffic patterns (bandwidth, protocol distribution, connection rates). Deviations from the baseline generate alerts. Capable of detecting zero-days, but prone to false positive alerts during legitimate network spikes.

3. Demilitarized Zone (DMZ)

A Demilitarized Zone (DMZ) (screened subnet) is a physical or logical network perimeter that isolates an organization's publicly exposed services (web servers, external email relays, public DNS) from the internal private network. If an external web server in the DMZ is compromised, the internal firewall blocks the attacker from pivoting laterally into internal database servers or Active Directory Domain Controllers.

4. Endpoint Detection and Response (EDR)

Traditional antivirus relies on static file signatures. Modern EDR agents installed on workstations and servers continuously record endpoint telemetry—process creation trees, registry modifications, memory injection, and network socket bindings. EDR leverages machine learning and behavioral heuristics to detect living-off-the-land techniques (e.g., suspicious PowerShell commands), enabling security teams to remotely isolate infected endpoints from the network in seconds.

---

4. System Hardening & Defense in Depth

System Hardening is the systematic process of securing an operating system, server, or application by eliminating operational vulnerabilities and shrinking the overall attack surface.

Core System Hardening Practices:

1. Disable Unnecessary Services and Ports: Shut down unused background daemons (e.g., Telnet, FTP, TFTP, Print Spooler) and close corresponding network firewall ports.
2. Remove Default Credentials: Immediately change default manufacturer administrative passwords (admin/admin, root/toor) upon hardware deployment.
3. Operating System & Application Patching: Implement automated patch management workflows to remediate known Common Vulnerabilities and Exposures (CVEs) across the fleet.
4. Full Disk Encryption (FDE): Deploy hardware-backed disk encryption—BitLocker paired with a Trusted Platform Module (TPM 2.0) on Windows, LUKS on Linux, and FileVault on macOS. FDE protects data at rest if a physical laptop or server drive is stolen.
5. Host-Level Firewalls: Enable and configure native host firewalls (Windows Defender Firewall with Advanced Security, Linux nftables/iptables/ufw) to block unsolicited inbound lateral connections across internal VLANs.

---

5. The Cyber Incident Response Lifecycle (NIST SP 800-61 Rev. 2)

When a cybersecurity breach occurs, chaotic, unorganized responses exacerbate data loss, destroy forensic evidence, and prolong downtime. The National Institute of Standards and Technology (NIST Special Publication 800-61 Rev. 2) defines the definitive 6-phase framework for managing cyber incidents.

+-----------------------------------------------------------------------------+
|                 NIST SP 800-61 REV. 2 INCIDENT RESPONSE LIFECYCLE           |
|                                                                             |
|   +-------------------+                                                     |
|   |  1. PREPARATION   |  --> Policies, CSIRT team, forensic toolkits,      |
|   +-------------------+      monitoring baselines, and employee training    |
|             |                                                               |
|             v                                                               |
|   +-------------------+                                                     |
|   | 2. DETECTION &    |  --> SIEM/EDR alert triage, identifying Indicators  |
|   |    ANALYSIS       |      of Compromise (IoCs), scoping attack severity  |
|   +-------------------+                                                     |
|             |                                                               |
|             v                                                               |
|   +-------------------+                                                     |
|   |  3. CONTAINMENT   |  --> Short-Term: Network host isolation, lock accts |
|   +-------------------+  --> Long-Term: Firewall blocks, forensic memory dump|
|             |                                                               |
|             v                                                               |
|   +-------------------+                                                     |
|   |  4. ERADICATION   |  --> Malware removal, wiping compromised hosts,     |
|   +-------------------+      rebuilding from golden images, patching flaws  |
|             |                                                               |
|             v                                                               |
|   +-------------------+                                                     |
|   |   5. RECOVERY     |  --> Restoring clean systems from verified backups, |
|   +-------------------+      re-enabling services, enhanced monitoring      |
|             |                                                               |
|             v                                                               |
|   +-------------------+                                                     |
|   | 6. POST-INCIDENT  |  --> Lessons learned meeting, root cause analysis,  |
|   |    ACTIVITY       |      updating playbooks to prevent recurrence       |
|   +-------------------+                                                     |
+-----------------------------------------------------------------------------+

The Six Phases of Incident Response:

1. Preparation

Establishing and training the Computer Security Incident Response Team (CSIRT), writing formal incident response plans, deploying logging/monitoring infrastructure (SIEM/EDR), securing forensic jump kits, establishing secure out-of-band communication channels, and conducting simulated tabletop exercises before an incident occurs.

2. Detection & Analysis

Identifying and validating security events to determine if an authentic cybersecurity incident is underway.

• Analyzing Indicators of Compromise (IoCs): Investigating SIEM alerts, unusual outbound network traffic spikes, unexpected administrative privilege elevations, or suspicious file modifications.
• Scoping & Triage: Determining the attack vector, assessing business impact, prioritizing response urgency, and notifying stakeholders.

3. Containment

Preventing the incident from expanding or causing additional damage while preserving digital forensic evidence for potential legal prosecution.

• Short-Term Containment: Isolating infected systems from the corporate network (disabling network interfaces or placing endpoints into EDR network quarantine), revoking compromised user credentials, and terminating active VPN sessions.
• Evidence Preservation: Capturing volatile system memory (RAM dumps), disk bit-stream forensic images, and firewall logs while maintaining a strict Chain of Custody.
• Long-Term Containment: Applying temporary firewall block rules, routing malicious domains to blackhole sinkholes, and segmenting vulnerable subnets.

4. Eradication

Completely expelling the adversary and removing all malicious artifacts from the environment.

• Actions: Deleting malware files, terminating rogue processes, dismantling rootkits, removing unauthorized backdoor user accounts, revoking compromised SSL/TLS certificates, and applying security patches to exploited vulnerabilities.
• Clean Rebuilds: In enterprise environments, standard practice requires completely wiping compromised hard drives and rebuilding systems from trusted, generalized Golden Images rather than attempting to clean malware piecemeal.

5. Recovery

Safely restoring systems to normal production operations and validating that infrastructure is fully functional and free of compromise.

• Actions: Restoring clean data from verified, uninfected backups; reconnecting systems to the production network; resetting master passwords; and enabling enhanced continuous monitoring (heightened logging and threat hunting) to detect potential re-infection attempts.

6. Post-Incident Activity (Lessons Learned)

Conducting a structured Post-Mortem / Lessons Learned meeting within two weeks of incident resolution.

• Actions: Documenting exact incident timelines, determining root cause, calculating financial/reputational damages, evaluating how effectively the CSIRT executed the response plan, and updating corporate security policies, firewall rules, and incident response playbooks to prevent recurrence.

NIST Incident Response Lifecycle Matrix