GAURA - SISR, 2025 session

Mission A1 - Penetration testing (SCAPY on VLAN 90)

a) Targeted service: the DHCP service.

b) How it works: the attacker floods the DHCP server with fake requests (DHCPDISCOVER/REQUEST with forged MAC addresses generated by SCAPY) to exhaust its address pool (DHCP starvation).

c) Objective and type: this is a denial-of-service attack: the server has no more addresses to distribute, and legitimate clients can no longer obtain a configuration. It often paves the way for a man-in-the-middle attack.

d) Two countermeasures: enable DHCP snooping (only trusted ports can respond to or relay DHCP) and port security to limit the number of MAC addresses per port.

a) Steps: once the legitimate server's pool is exhausted, the attacker sets up a rogue DHCP server (rogue DHCP) that responds to clients requesting a new configuration and assigns itself as the default gateway.

b) Purpose: carry out a man-in-the-middle (MITM) attack: all client traffic routes through the attacking machine, which can intercept, analyse, or redirect it.

c) Countermeasure: DHCP snooping blocks DHCP responses from unauthorised ports → the rogue server is neutralised.

Mission A2 - Securing the DMZ (reverse proxy WAF)

a) The HTTP protocol transmits in clear text: no confidentiality (eavesdropping possible), no integrity (modification in transit), and no server authentication → exposure to MITM and spoofing.

b) Consequences for the local authority: leak of citizens' data (CNIL/GDPR penalties), damage to reputation and trust, and legal liability for the authority (RGS/GDPR obligations).

If the same private key is shared, compromising a single server (theft of the key) compromises all servers and requires a full certificate revocation. There is no isolation: a single weak link jeopardises the entire cluster.

Using separate keys and certificates on the reverse proxy and web servers applies defence in depth / segmentation: the proxy terminates external TLS (public certificate), then re-encrypts to the backend using an internal certificate. A compromise of one certificate does not expose the others.

Encrypting all the way to the web servers (and not just up to the reverse proxy) protects data even on the internal segment (intermediate DMZ): it prevents clear-text traffic between the proxy and backend, where an attacker who has breached the DMZ could eavesdrop on it. Confidentiality and integrity are ensured along the entire path.

a) Configuration of the NGINX ModSecurity WAF reverse proxy to the backend: enable the WAF, then forward via HTTPS to the web servers.

server {
    listen 443 ssl;
    ssl_certificate     /etc/nginx/certs/public.crt;   # certificat public
    ssl_certificate_key /etc/nginx/certs/public.key;
    modsecurity on;                                     # WAF activé
    modsecurity_rules_file /etc/nginx/modsec/main.conf; # règles OWASP CRS
    location / {
        proxy_pass https://backend_web;                 # re-chiffrement vers le backend
        proxy_ssl_verify on;
    }
}

b) On the Apache servers (backend): listen only on HTTPS, present the internal certificate, and only accept connections from the reverse proxy (IP filtering) - direct internet access is removed.

a) Single points of failure (SPOF): the single reverse proxy, the internal firewall, or an isolated web server - their failure cuts off access.

b) High availability: add redundancy to the reverse proxy (two instances behind a load balancer / VRRP), cluster the firewall, and keep the web server cluster load-balanced.

Mission B1 - 802.1X on the wired network

• Client (supplicant): enable 802.1X on the wired network adapter of the laptop, using the chosen authentication method (certificate or username/password).
• RADIUS server: declare the switch as a NAS client and define the policy: upon successful authentication → assign the port to the TEL-PERSO VLAN; otherwise → block all traffic.
• Switch (authenticator): enable 802.1X on the relevant desk ports (the CCPG fixed workstation remains on the TEL VLAN).

Allow RADIUS authentication traffic between the switch (authenticator) and the RADIUS server: UDP port 1812 (authentication), and UDP 1813 for accounting (accounting).

1. Personal devices must have an up-to-date system and antivirus (regular security updates) before any network access.
2. Ban on storing work data locally on personal devices and an obligation to maintain confidentiality (and accept potential checks).

Mission B2 - Remaining risks and the Cisco ISE solution

Recommended measure	Technology used	Risk covered
Isolate personal devices	Dedicated VLAN (TEL-PERSO)	propagation / internal network access
Encrypt information flows	TLS / VPN (IPsec)	eavesdropping, breach of confidentiality/integrity
Robust user access control	802.1X + RADIUS	unauthorised network access

Cisco ISE is a centralised network access control (NAC) solution: it handles device profiling, posture assessments (checking that personal devices have an antivirus and updates before granting access), and applies dynamic access policies by profile, based on 802.1X/RADIUS. It specifically meets the need to onboard unmanaged personal devices while controlling risks.