Study guide
3.6 Secure Network Protocols & Services
Cisco CCST Cybersecurity Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Introduction & Exam Strategy
1.1 About the Cisco CCST Cybersecurity Exam 1.2 Study Roadmap & Preparation Strategy
2 Chapter 2: Essential Security Principles
2.1 Information Security Principles & The CIA Triad 2.2 Confidentiality, Integrity & Availability Controls 2.3 Authentication, Authorization & Accounting (AAA) 2.4 Social Engineering & Human Vulnerabilities 2.5 Security Principles & Access Management 2.6 Encryption, Hashing, Certificates & PKI
3 Chapter 3: Basic Network Security Concepts
3.1 Network Architecture & The OSI/TCP-IP Models 3.2 Network Defense Infrastructure & Firewalls 3.3 Intrusion Detection & Prevention Systems (IDS/IPS) 3.4 Virtual Private Networks & Encryption Protocols 3.5 Network Segmentation, DMZ & Access Control Lists 3.6 Secure Network Protocols & Services
4 Chapter 4: Endpoint Security Concepts
4.1 Endpoint Protection & Host-Based Defense 4.2 Operating System Hardening & Security Baselines 4.3 Patch Management & Vulnerability Remediation 4.4 Mobile Device Management (MDM) & BYOD Security 4.5 Endpoint Detection & Response (EDR) & Compliance 4.6 Endpoint Assessment Tools & Malware Removal
5 Chapter 5: Vulnerability Assessment & Risk Management
5.1 Risk Assessment & Risk Management 5.2 Vulnerability Scanning & Penetration Testing 5.3 CVSS Scoring & Threat Intelligence 5.4 Business Continuity & Disaster Recovery
6 Chapter 6: Incident Handling & Response
6.1 NIST Incident Response Lifecycle & Frameworks 6.2 Incident Containment, Eradication, & System Recovery 6.3 Digital Forensics Fundamentals & Evidence Preservation 6.4 Post-Incident Activity & Compliance Reporting 6.5 SOC Operations, Log Triage, & Event Monitoring 6.6 Attack Attribution: Cyber Kill Chain, MITRE ATT&CK & Diamond Model
3.6 Secure Network Protocols & Services
Key Takeaways Explain This Topic AI
Insecure cleartext protocols (HTTP, Telnet, FTP, DNS, SNMPv1/v2c, LDAP) expose credentials and data to network sniffing and must be replaced with secure encrypted equivalents.
Secure Shell (SSH - TCP 22) replaces Telnet, utilizing public-key cryptography and symmetric AES encryption for remote CLI management and port forwarding tunnels.
DNSSEC adds cryptographic digital signatures (RRSIG, DNSKEY, DS) to DNS records to guarantee data origin authentication and integrity, preventing DNS cache poisoning.
SNMPv3 provides robust security over legacy SNMP via its authPriv mode, combining HMAC-SHA user authentication with AES payload encryption.
Centralized Syslog (UDP 514 / TCP 6514 TLS) and NTP (UDP 123) time synchronization enable SIEM correlation engines and SOAR automated playbooks to detect and mitigate multi-system security breaches.
Last updated: August 2026
3.6 Secure Network Protocols & Services
Quick Answer: Legacy unencrypted network protocols (HTTP, Telnet, FTP, DNS, SNMPv1/v2c) transmit sensitive credentials and payloads in cleartext. Enterprise security mandates replacing them with secure encrypted equivalents (HTTPS, SSH, SFTP, DNSSEC, SNMPv3 authPriv). Operational security monitoring relies on centralized Syslog (TCP 6514 TLS) , NTP time synchronization , SIEM log correlation , critical OS Event IDs, and SOAR automated playbooks .
Transmitting administration credentials or system telemetry using cleartext protocols allows attackers equipped with packet sniffers (like Wireshark) to harvest sensitive data. Replacing cleartext protocols with cryptographically validated alternatives protects enterprise systems against eavesdropping, spoofing, and session hijacking.
1. Master Protocol Security Replacement Table
Modern enterprise networks mandate replacing unencrypted legacy protocols with secure equivalents:
Functional Service Legacy Cleartext Protocol Default Port Vulnerability / Security Flaw Secure Encrypted Replacement Default Port Encryption & Security Mechanism
Web Traffic HTTP TCP 80 Transmits all web data and login cookies in cleartext. HTTPS TCP 443 Encrypted via TLS 1.3 ; authenticates server identity using X.509 Digital Certificates.
Remote Administration Telnet / RSH TCP 23 Transmits passwords and CLI commands in cleartext. SSH (Secure Shell) TCP 22 Encrypts sessions with AES; authenticates via Public Key Cryptography (RSA/Ed25519).
File Transfer FTP TCP 20 / 21 Transmits user credentials and files in cleartext. SFTP / FTPS TCP 22 / TCP 990 SFTP: SSH File Transfer (TCP 22). FTPS: FTP over TLS (TCP 989/990).
Name Resolution DNS UDP/TCP 53 Susceptible to DNS Cache Poisoning and spoofing. DNSSEC / DoH / DoT UDP 53 / TCP 443 / TCP 853 DNSSEC: Cryptographic signatures (RRSIG). DoH/DoT: Encrypts queries via TLS.
Network Management SNMPv1 / SNMPv2c UDP 161 / 162 Uses cleartext Community Strings ( public / private ). SNMPv3 UDP 161 / 162 Provides user authentication (HMAC-SHA) and payload encryption ( AES-128/256 ).
Directory Access LDAP TCP 389 Active Directory queries and password binds in cleartext. LDAPS (LDAP over TLS) TCP 636 Wraps LDAP traffic inside a secure TLS tunnel.
Email Retrieval POP3 / IMAP TCP 110 / TCP 143 Email messages and account passwords in cleartext. POP3S / IMAPS TCP 995 / TCP 993 Encrypts mail retrieval sessions using TLS.
Email Transfer SMTP TCP 25 Inter-server mail transfer executed in cleartext. SMTPS / STARTTLS TCP 465 / TCP 587 Upgrades cleartext SMTP sessions to encrypted TLS tunnels.
- 2. Essential Secure Infrastructure Protocols
- 1. Secure Shell (SSH - TCP 22)
SSH replaces Telnet for secure command-line administration. SSH establishes a secure channel via an asymmetric key handshake, negotiating a symmetric AES session key for bulk data encryption.
SSH Port Forwarding (Tunneling): Allows users to securely tunnel insecure local port traffic through an encrypted SSH channel to a remote network.
2. Domain Name System Security Extensions (DNSSEC)
Standard DNS has no built-in authentication, making it vulnerable to DNS Cache Poisoning (Kaminsky attacks).
DNSSEC Solution: Adds cryptographic digital signatures to existing DNS record types. It guarantees Data Origin Authentication and Data Integrity .
Core DNSSEC Records: RRSIG (Resource Record Signature), DNSKEY (Public Key for verification), DS (Delegation Signer for Chain of Trust), and NSEC/NSEC3 (Proof of Non-Existence).
3. Simple Network Management Protocol Version 3 (SNMPv3 - UDP 161/162)
SNMPv3 introduces three security levels:
noAuthNoPriv : Community strings; no password hash, no payload encryption. (Insecure)
authNoPriv : Authenticates users using HMAC-SHA or MD5 password hashing; no payload encryption.
authPriv : Authenticates users via HMAC-SHA AND encrypts all SNMP payloads using AES-128/256 .
- 3. Centralized Security Logging, NTP & SIEM Operations
- Centralized Syslog Logging (RFC 5424)
Centralized logging streams audit records off-host immediately ( UDP 514 or secure TCP 6514 TLS ), defeating anti-forensics log wiping by attackers.
- Syslog Severity Levels (0 – 7)
- 0 Emergency: System unusable
- 1 Alert: Action must be taken immediately
- 2 Critical: Critical hardware/software failure
- 3 Error: Error conditions
- 4 Warning: Warning conditions
- 5 Notice: Normal but significant condition
- 6 Informational: Standard operational event
- 7 Debug: Verbose developer debugging output
- Network Time Protocol (NTP - RFC 5905)
NTP synchronizes clocks over UDP Port 123 to UTC. Without synchronized system time across Stratum hierarchies (Stratum 0 atomic/GPS -> Stratum 1 -> Stratum 2/3), cross-device SIEM log correlation and forensic timeline reconstruction are impossible.
SIEM Log Analysis & Operating System Events
SIEM platforms (Splunk, Sentinel, Elastic) ingest, normalize (CEF/ECS), and evaluate correlation rules across logs.
Critical Windows Security Event IDs: 4624 (Logon Success), 4625 (Logon Failure / Brute Force), 4672 (Admin Privileges Assigned), 4720 (User Account Created), and 1102 (Audit Log Cleared - HIGH-SEVERITY ALERT) .
Linux Log Paths: /var/log/auth.log (authentication), /var/log/syslog (system events), /var/log/audit/audit.log (auditd system calls).
SOAR: Security Orchestration, Automation, and Response platforms execute automated response playbooks (e.g., calling firewall APIs to block attacker IPs) to reduce Mean Time to Respond (MTTR).