This title slide introduces "Scénarios d’attaque & défense – Architecture MedLogistics," focusing on attack and defense scenarios within the MedLogistics system. The subtitle describes it as a presentation of MedLogistics' security architecture, covering potential attacks and corresponding defenses.

Scénarios d’attaque & défense – Architecture MedLogistics

Présentation de l'architecture de sécurité de MedLogistics, couvrant attaques et défenses.

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

This introductory slide provides an overview of the MedLogistics security architecture, emphasizing key protective measures. It highlights network segmentation for isolation, deployment of firewalls and Suricata-based IDS/IPS, bastion hosts for secure access, SIEM using Loki and Grafana, and WAF for web application protection.

Introduction

• Present MedLogistics security architecture overview
• Highlight network segmentation for isolation
• Deploy firewalls and IDS/IPS with Suricata
• Implement bastion hosts for secure access
• Utilize SIEM via Loki and Grafana
• Apply WAF for web application protection

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

In the first scenario, an attacker performs a SQL injection attack on the MedLogistics website by injecting malicious code via a URL like http://site.com/login?id=1' OR '1'='1 to bypass authentication and illegally access the database. Defenses include a front firewall and DMZ for isolation, Suricata for detecting SQL injections, a ReverseProxy for filtering requests, and database isolation to protect sensitive data, resulting in effective containment of the attack.

Scénario 1 : SQL Injection sur le site web

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

In Scenario 2, an attacker launches a brute-force SSH attack on the SFTP server in the DMZ by repeatedly attempting to guess credentials using automated tools like Hydra. Defenses include SSH filtering restricted to the DMZ, anomaly detection with Suricata, and automatic IP blocking via scripts, with the system's key strength being its rapid automated response to prevent unauthorized access.

Scénario 2 : Brute-force SSH sur le SFTP

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

In Scenario 3, a local malware infection targets User2 on the Employees LAN, attempting to propagate via the network, but defenses like the backend firewall block unauthorized outbound connections, while Suricata detects suspicious traffic and Wazuh monitors for malware signatures and anomalies. The Bastion SSH secures remote access to prevent lateral movement, with the key strength being confinement of impact to the Employees LAN only.

Scénario 3 : Malware sur User2 (Employees LAN)

• Attack: Local malware infection on User2 with propagation attempts via network.
• Defenses: Backend Firewall restricts unauthorized outbound connections.
• Suricata: Detects and alerts on suspicious traffic patterns.
• Wazuh: Monitors endpoints for malware signatures and anomalies.
• Bastion SSH: Secures remote access to prevent lateral movement.
• Key Strength: Confinement limits impact to Employees LAN only.

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

In Scenario 4, an attacker exploits a vulnerability in the web application on WebServer1 in the DMZ to inject malicious code, gaining a remote shell and attempting access to sensitive resources. Defenses include the isolated DMZ, a Backend Firewall blocking unauthorized traffic, and Suricata for anomaly detection, preventing lateral movement and limiting impact to the compromised server.

Scénario 4 : WebServer compromis dans la DMZ

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

Scenario 5 depicts a DDoS HTTP attack where massive HTTP requests overwhelm the Reverse Proxy. Defenses include OPNsense filtering incoming traffic, the Reverse Proxy applying rate limiting, and Suricata detecting and blocking anomalies, with multiple layers effectively mitigating the impact.

Scénario 5 : DDoS HTTP sur ReverseProxy

• Attaque : Requêtes HTTP massives submergent le ReverseProxy.
• Défenses : OPNsense filtre le trafic entrant.
• Défenses : ReverseProxy applique limitation de taux.
• Défenses : Suricata détecte et bloque anomalies.
• Point fort : Couches multiples atténuent l'impact efficacement.

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

In Scenario 6, an attacker uses Nmap from a Kali Linux machine within the employees' LAN to scan the internal network, identifying active hosts, open ports, and vulnerable services to enable advanced exploitation. Defenses include VLAN segmentation to isolate network segments and limit spread, along with Suricata for detecting suspicious scans via IDS/IPS signatures, providing enhanced visibility and rapid containment to prevent extensive reconnaissance.

Scénario 6 : Scan Nmap depuis Kali (Employees LAN)

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

In Scenario 7, an admin account is compromised through password theft via phishing or similar methods, countered by defenses like a bastion host, SSH logs, and Loki/Grafana monitoring. This setup provides strong access control and full traceability, enabling rapid detection of potential administrative intrusions and limiting damage through continuous supervision.

Scénario 7 : Compromission d’un compte admin

• Attaque : Vol de mot de passe admin via phishing ou méthode similaire.
• Défenses : Bastion hôte, journaux SSH, surveillance Loki/Grafana.
• Point fort : Contrôle renforcé et traçabilité complète des accès.
• Avantage : Détection rapide des intrusions administratives potentielles.
• Conclusion : Limitation des dommages grâce à la supervision continue.

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

In Scenario 8 on data exfiltration, attackers attempt to steal sensitive files like logs or client information by transferring them from the internal network to an external server using methods such as HTTP, FTP, or DNS tunneling. Defenses include outbound firewalls to restrict unauthorized connections, Suricata for traffic anomaly inspection, real-time log analysis via Loki/Grafana and Wazuh, and proactive detection to contain outgoing flows and prevent leaks.

Scénario 8 : Exfiltration de données

Source: Architecture – Scénarios d’attaque & défense – MedLogistics

The conclusion slide recaps layered defense mechanisms, including network segmentation, IDS/IPS with Suricata, and SIEM tools like Wazuh and Loki/Grafana. It emphasizes that segmentation and continuous monitoring provide robust security against threats, promoting enhanced protection through ongoing vigilance.

Conclusion

Récapitulatif des mécanismes de défense en couches :

• Segmentation réseau
• IDS/IPS (Suricata)
• SIEM (Wazuh, Loki/Grafana)

Importance : Segmentation et supervision continue assurent une sécurité robuste contre les menaces.

Sécurité renforcée, vigilance continue.

Source: Architecture – Scénarios d’attaque & défense – MedLogistics