5.7 Identify these elements used for network profiling
📘Cisco Certified CyberOps Associate (200-201 CBROPS)
1. What is “Critical Asset Address Space”?
Critical asset address space refers to the IP addresses or IP ranges assigned to the most important systems in a network. These systems are called critical assets because they are essential for business operations, security, or sensitive data handling.
In simple terms:
- Critical assets = Important systems (e.g., servers, databases, security tools)
- Address space = The IP addresses used by those systems
So, critical asset address space = the IP ranges where important systems are located
2. What are Critical Assets?
Critical assets are systems that:
- Store sensitive data (user data, credentials, logs)
- Provide core services (authentication, applications)
- Control security operations (firewalls, SIEM systems)
- Support business continuity
Common Critical Assets in IT Environments:
- Domain controllers
- Database servers
- Application servers
- Email servers
- Security devices (firewalls, IDS/IPS)
- Backup servers
- SIEM systems
- Management systems (e.g., monitoring tools)
3. What is Address Space?
Address space means a range of IP addresses used within a network.
Examples:
192.168.1.0/2410.0.0.0/16
These ranges define where devices exist in the network.
4. Why is Critical Asset Address Space Important?
In network profiling, identifying critical asset address space helps analysts:
a. Focus on High-Value Targets
Security teams can prioritize monitoring of important systems.
b. Detect Suspicious Activity Faster
Any unusual traffic to/from these IP ranges is treated as high risk.
c. Improve Incident Response
During an incident, analysts quickly know:
- Which systems are critical
- Where they are located (IP ranges)
d. Apply Stronger Security Controls
Critical asset ranges may have:
- Stricter firewall rules
- Limited access
- Additional monitoring
5. Role in Network Profiling
Network profiling means understanding how a network behaves normally.
When profiling includes critical asset address space, analysts:
- Identify normal traffic patterns for critical systems
- Detect abnormal communication
- Understand who talks to critical systems and how often
6. How Critical Asset Address Space is Identified
Security teams define this using:
a. Asset Inventory
- List all systems in the network
- Identify which ones are critical
b. Network Segmentation
- Place critical systems in dedicated subnets/VLANs
Example:
- Critical servers →
10.10.10.0/24 - User devices →
192.168.1.0/24
c. Documentation
- Maintain records of:
- IP ranges
- System roles
- Ownership
7. Monitoring Critical Asset Address Space
Security tools monitor these IP ranges closely.
Key Monitoring Activities:
- Traffic entering/leaving critical systems
- Unauthorized access attempts
- Unusual protocols or ports
- Unexpected communication patterns
Example (IT-focused):
- A database server normally communicates only with application servers
- If it suddenly connects to unknown external IPs → suspicious activity
8. Security Controls Applied
Critical asset address spaces usually have stronger protections:
a. Network Segmentation
- Isolate critical systems from general users
b. Access Control Lists (ACLs)
- Only allow specific IPs to communicate
c. Firewalls
- Restrict incoming and outgoing traffic
d. Logging and Monitoring
- Enable detailed logs for all activity
e. Intrusion Detection/Prevention Systems (IDS/IPS)
- Detect attacks targeting critical assets
9. Indicators of Suspicious Activity
When monitoring critical asset address space, analysts look for:
- Connections from unauthorized IP addresses
- Use of unexpected ports or protocols
- High volume traffic (possible data exfiltration)
- Unusual session timing or duration
- Communication with unknown external networks
10. Exam Key Points (Must Remember)
- Critical asset address space = IP ranges of important systems
- Critical assets include:
- Servers, databases, security systems
- It is used in network profiling to:
- Identify normal vs abnormal behavior
- Prioritize monitoring
- These IP ranges are:
- Highly monitored
- Strongly protected
- Helps in:
- Threat detection
- Incident response
- Risk reduction
- Often implemented using:
- Network segmentation
- Dedicated subnets/VLANs
11. Simple Summary
- Every network has important systems.
- These systems are placed in specific IP ranges.
- Those ranges are called critical asset address space.
- Security teams monitor them closely to detect threats quickly.
