CND (312-38) Network Defense Simulation

Welcome to this interactive network defense scenario. You will learn to identify core information security principles by analyzing network traffic to ensure sensitive data is protected from unauthorized disclosure.

Network Scenario

You are a Network Security Analyst for a financial services firm. During a routine network traffic analysis, you are verifying the communication streams between your core banking servers and a remote branch office over a site-to-site WAN link.

To comply with PCI-DSS regulations, you must verify that all Customer Personally Identifiable Information (PII) and credit card data cannot be intercepted and read by unauthorized threat actors performing packet sniffing on the public internet segment.

Traffic & Logs

You pull a PCAP file of the traffic passing through the perimeter firewall to verify the defensive controls. The payload of the packets reveals the following structure:

Frame 402: 1514 bytes on wire Ethernet II, Src: 10.0.50.11, Dst: 203.0.113.5 Internet Protocol Version 4, Src: 10.0.50.11, Dst: 203.0.113.5 Transmission Control Protocol, Src Port: 443, Dst Port: 52194 Transport Layer Security TLSv1.3 Record Layer: Application Data Protocol: http2 Opaque Type: Application Data (23) Version: TLS 1.2 (0x0303) Length: 1440 Encrypted Application Data: 8a4b3d9f1c7e... (Opaque binary ciphertext)

Question

Which of the following is a mechanism that helps in ensuring that only the intended and authorized recipients are able to read data?

Defensive Hint: Look at the packet capture showing "Encrypted Application Data". Which pillar of the CIA triad uses encryption algorithms (like AES) to prevent unauthorized disclosure (reading) of information during a MITM attack?

Incorrect Analysis: While the selected concept is a critical part of network security, it does not specifically prevent an unauthorized person (such as a network eavesdropper) from *reading* the intercepted payload. Think about the direct result of applying encryption.

Expert Analysis

1. What is happening in the network

The network defender is inspecting egress traffic traversing a public WAN link. The packet capture confirms that the communication is utilizing TLS 1.3. Instead of cleartext HTTP payload, the payload consists of "Encrypted Application Data", rendering it unreadable to anyone without the proper decryption keys.

2. Identify behavior or attack

Attackers frequently use packet sniffers (like Wireshark or tcpdump) or perform Man-in-the-Middle (MITM) attacks via ARP spoofing to capture traffic. If protocols like Telnet, FTP, or HTTP are used, the attacker can natively read the data. By enforcing strong encryption, the defender mitigates the risk of data disclosure.

3. Why correct answer is correct

C. Confidentiality is the core security principle ensuring that data is kept secret and is disclosed only to authorized individuals. In network defense, this is primarily achieved through encryption (e.g., TLS, IPsec) and strict access control lists (ACLs).

4. Why others are wrong

Integrity: Ensures the data has not been altered or tampered with in transit (typically using hashing like SHA-256), but it does not hide the data from being read.
Data availability: Ensures data and services are accessible when needed by authorized users (mitigating DoS attacks), completely unrelated to hiding the data contents.
Authentication: The process of verifying the identity of a user or system (e.g., passwords, certificates), not the act of making the data payload unreadable to third parties.

5. Defensive action

To enforce confidentiality across an enterprise, defenders must: disable cleartext protocols across all network segments; implement TLS 1.2/1.3 for web traffic; establish IPsec or WireGuard VPN tunnels for site-to-site communication; and utilize WPA2/WPA3 Enterprise for wireless networks.

6. MINI LESSON:

Traffic Pattern Recognition: Defenders must easily distinguish between structured cleartext protocols (where headers and payloads are readable strings) and high-entropy, encrypted traffic (opaque binary data).
Defense-in-Depth: Confidentiality is rarely implemented alone. A TLS tunnel uses asymmetric encryption for Authentication and Key Exchange, symmetric encryption for Confidentiality, and HMACs for Integrity.
Detection vs Prevention: Encryption is a preventative control against data disclosure. However, attackers can still capture encrypted packets to analyze metadata (source/destination IP, timing, size) leading defenders to also deploy traffic padding and encrypted SNI (ESNI/ECH).

Ready to master more defensive concepts?

Explore more realistic CND scenarios and elevate your Blue Team skills.

Explore more CND simulations