Examkin

Question

Difficulty: MediumHost, Network, and Architecture Vulnerabilities

A system administrator captures network traffic between an application host and a centralized authentication server on an internal network segment:

text
14:22:05.819201 IP 172.16.40.12.51234 > 172.16.40.50.389: Flags [P.], length 88: LDAP
bindRequest(1) "cn=svc_auth,ou=services,dc=internal,dc=net" simple

Which of the following is the BEST mitigation strategy to resolve the infrastructure vulnerability demonstrated in this log snippet?

  1. Reconfigure the directory service and client application to enforce LDAPS over TCP port 636 or enable STARTTLS.Answer
  2. B
    Deploy a web application firewall (WAF) directly in front of the authentication server to inspect incoming HTTP payloads.
  3. C
    Maintain the current configuration because the traffic is confined to the internal corporate network segment behind external firewalls.
  4. D
    Configure an inline network intrusion prevention system (NIPS) with signature rules for SQL injection attack vectors.

Answer

Reconfigure the directory service and client application to enforce LDAPS over TCP port 636 or enable STARTTLS.
The packet capture shows an unencrypted LDAP simple bind request over standard TCP port 389. Simple bind sends directory credentials in cleartext. Enforcing LDAPS (which encrypts LDAP traffic over TCP port 636) or upgrading to STARTTLS establishes TLS encryption, protecting credentials from being intercepted by unauthorized network sniffing.

Step-by-Step Solution

1
Analyze the network packet capture snippet to identify the active protocol and port.
The log shows traffic destined for TCP port 389 using the LDAP protocol with a 'simple' bind request.
Port 389 running standard LDAP with simple bind authentication transmits directory credentials in cleartext across the network.
2
Determine the security risk associated with cleartext authentication traffic.
An attacker performing network sniffing on the internal segment can intercept and harvest administrative credentials.
Cleartext protocols violate confidentiality requirements and fail to secure credential transport.
3
Select the appropriate protocol-level remediation control.
Upgrade the transport protocol to LDAP over TLS (LDAPS) on port 636 or mandate TLS session negotiation via STARTTLS on port 389.
Encrypting the directory communication channel secures credentials in transit against network interception.

Key Concept

Host and Network Infrastructure Vulnerabilities - Unencrypted Legacy Protocols
Estimated Time:1m 30s
Rate this question

Topics

Host, Network, and Architecture Vulnerabilities