CCNA - Capitulo 16

CCNA - Capitulo 16

1. SECURITY THREATS AND VULNERABILITIES

   • TYPE OF VULNERABILITY / WEAKNESS
     • CONFIGURATION VULNERABILITY
       • UNSECURED USER ACCOUNTS
       • EASILY GUESSED PASSWORDS
       • MISCONFIGURED
         • INTERNET SERVICES
           • TURNING JAVA SCRIPT IN WEB BROWSERS
             • ENABLES ATTACKS
         • NETWORK EQUIPMENT
           • ACCESS LIST , ROUTING PROTOCOLS , SNMP COMMUNITY STRINGS
         • TERMINAL SERVICE
           • FTP , WEB SERVERS - SUCH IIS AND APACHE
       • DEFAULT SETTINGS WITHIN PRODUCTS
         • EX : ROOT AND ROOT ; ADMIN AND ADMIN
     • TECHNOLGICAL VULNERABILITY
       • WEAKNESS TCP/IP
         • HTTP , FTP , ICMP
           • INHERENTLY INSECURE
         • SNMP , SMTP
           • INHERENTLY INSECURE
       • OPERATION SYSTEMS WEAKNESS
         • EACH OS HAS SECURITY PROBLEMS
           • EX : LINUX , WINDOWS 10 , 11 , MacOS
         • WHERE ARE THEY DOCUMENTED?
           • WWW.CERT.ORG
       • NETWORK EQUIPMENT WEAKNESS
         • ROUTERS , SWITCHES , FIREWALLS
           • EX : PASSWORD PROTECTION , LACK OF AUTHENTICATION , ROUTING PROTCOLS , FIREWALL ROLTES
     • POLICY VULNERABILITY
       • LACK
         • WRITTEN SECURITY POLICY (PSI)
         • AUTHENTICATION CONTINUITY
           • POORLY CHOSEN; EARLY CRACKED ; DEFAULT PASSWORDS
       • LOGICAL ACCESS CONTROLS NOT APPLIED
         • INADEQUATE MONITORING AND AUDITING
       • SOFTWARE AND HARDWARE INSTALLATION AND CHANGES DO NOT FOLLOW POLICY
         • UNAUTHORIZED CHANGES
           • NETWORK TOPOLOGIES
           • INSTALLATION UNAUPPROVED
       • DISASTER RECOVERY PLAN IS NONEXISTENT
         • ALLOWS CHAOS , PANIC
       • POLITICS
         • POLITICAL BATTLES AND TURF WARS DIFICULT
           • CONSISTENT SECURITY POLICIES
     • WHATS IS VULNERABILITY ?
       • DEGREE OF WEAKNESS IN A NETWORK OR DEVICE
     • INHERENT
       • ROUTERS , SWITCHES , DESKTOPS , SERVERS
   • AFTER THREAT ACTORS OBTAIN ACCESS TO THE NETWORK
     • WHO ARE THE THREAT ACTORS ?
       • INTRUDERS CAN GAIN ACCESS TO A NETWORK THROUGH
         • SOFTWARE VULNERABILITIES
         • HARDWARE ATTACKS
         • ETC
     • - FOUR TYPES OF THREATS
       • INFORMATION THEFT
         • BREAKING INTO A COMPUTER
           • TO OBTAIN CONFIDENTIAL INFORMATION.
         • INTEGRITY
       • DATA LOSS MANUPULATION
         • BREAKING INTO A COMPUTER
           • DESTROY AFATER DATA RECORDS
             • BREAKING INTO A RECORDS SYSTEM
               • TO CHANGE INFORMATION
                 • EX : VIRUS THAT REFORMATS A COMPUTER HARD DRIVE
         • INTEGRITY
       • IDENTITY THEFT
         • PERSONAL INFORMATION IS STOLEN
           • PURPOSE OF TAKING OVER THE IDENTITY OF SOMEONE.
         • CONFIDENCIALITY
       • DISRUPTION OF SERVICE (DDOS)
         • PRVENT LEGITIME USERS FROM
           • ACCESSING SERVICES
   • PHYSICAL SECURITY
     • ELECTRICAL THREATS
       • VOLTAGE SPIKES
       • INSUFFICIENT SUPPLY VOLTAGE
     • HARDWARE THREATS
       • PHYSICAL DAMAGES
         • SERVERS , ROUTERS , SWITCHES
     • ENVIRONMENTAL THREATS
       • TEMPERATURES EXTREMES (HOT OR COLD)
     • MAINTENANCE THREATS
       • HANDLIG OF KEY ELETRICTRICAL COMPOENTS

Bilder und Dateien der Mindmap