Simulation Module
CND (312-38) Network Defense Simulation
This simulation focuses on endpoint hardening and attack surface reduction. You will analyze the baseline traffic of newly deployed Windows workstations and identify the most effective initial steps to secure them against internal network threats.
Network Scenario
Byron, a newly hired network administrator for a sensitive government sector (FBI equivalent), is auditing a recent deployment of 50 Windows 10/11 PCs. These devices were deployed using a default imaging process. He notices a large amount of internal broadcast traffic and open ports on these new endpoints, indicating an unhardened baseline.
VLAN 20 (Workstations) Profile
- Subnet: 10.0.20.0/24
- Default Gateway: 10.0.20.1
- Domain Joined: Pending
- Configuration: Out-of-the-box defaults
Security Objective
"Reduce the attack surface to minimize internal security flaws. Prevent lateral movement and ensure the devices have foundational defenses before being fully integrated into the production domain."
Traffic & Logs
PCAP snippet from the core switch mirror port (VLAN 20) observing newly connected PC (10.0.20.45):
Analysis: The endpoint is broadcasting legacy name resolution protocols and running unnecessary listening services. Additionally, no endpoint protection (AV) is actively reporting.
Question
Byron, a new network administrator at FBI, would like to ensure that Windows PCs there are up-to-date and have less internal security flaws. What can he do?
Expert Analysis
1. What is happening in the network: Newly deployed Windows endpoints are booting with default configurations. They are utilizing legacy protocols (NetBIOS/LLMNR) and leaving ports open (SMB, RDP) that are unnecessary for baseline operations. This creates an immediate risk for lateral movement by an internal threat actor.
2. Identify the behavior: This is a classic "Large Attack Surface" problem. Unnecessary services acting as listeners or broadcasting sensitive naming queries allow attackers to easily perform enumeration, spoofing (e.g., LLMNR poisoning), and exploitation.
3. Why the correct answer is correct: Install antivirus software and turn off unnecessary services. Turning off unnecessary services directly removes internal security flaws by shrinking the attack surface—an unneeded service cannot be exploited if it is turned off. Coupling this with Antivirus/EDR ensures that local execution vectors are monitored and mitigated.
4. Why others are wrong:
• A (Group Policies): This is a management delivery mechanism, not a specific defensive control itself.
• B (NTFS): While NTFS supports file permissions (unlike FAT32), just formatting a disk does not secure the OS against network or malware threats.
• C (Patches): While critical, patching a system running 20 unnecessary services still leaves you with a wider attack surface than an unpatched system running only 2 essential services. Hardening (turning off services) is the fundamental first step to reducing "internal flaws."
5. Defensive Action: Network Defenders must apply a "System Hardening Baseline" (like CIS Benchmarks). This involves disabling SSDP, LLMNR, NetBIOS, Xbox Live services, and Print Spooler (if not a print server), followed by installing an active EDR/AV agent.
MINI LESSON: Attack Surface Reduction (ASR)
- Vulnerability Management focuses on fixing bugs in software you need to run.
- Attack Surface Reduction focuses on eliminating software/services you don't need to run.
- By disabling unused legacy protocols like LLMNR (UDP 5355) and NetBIOS (UDP 137), defenders prevent severe local network attacks like NTLM Relay and Responder poisoning.
- An updated AV signature database combined with disabled unnecessary services is the strongest foundational defense for endpoints.