Fichas
1.1 Implement security configuration parameters on network devices and other technologies
Fichas del conjunto (92)
- 1hardware, software, or a combination whose purpose is to enforce a set of network security policies across network connectionsfirewall
- 2to allow only necessary access for a function; block or deny all unneeded functionalitythe principle of least access
- 3Firewalls enforce the est security policies through a variety of mechanisms including:1) Network Address Translation (NAT)
2) Basic packet filtering
3) State-ful packet filtering
4) Access Control Lists (ACLs)
5) Application layer proxies - 4allows an outside entity to communicate with an entity inside the firewall without truly knowing its address; used in IPv4 to link private addresses to public onesNetwork Address Translation (NAT)
- 5sets of addresses that can be used by anyone and by definition are not routable across the InternetPrivate IP Adresses
- 6benefit to NAT?less public IP addresses are needed so the internal address structure is not known to the outside world
- 7looking at packers, their ports, protocols, source and destination addresses, and checking that info against the rules configured on the firewallbasic packet filtering
- 8point of entry from a wireless device to a wired network is performed at a device calledwireless access point
- 9offer broadband high speed connections and the opportunity for continuous connections to the Internetcable and DSL modems
- 10covers the functions performed by the device as it converts analog signals to digital and vice versamodems
- 11network protocol that enable a server to automatically assign an IP address to a computer from a defined range of numbers configured for a given networkDynamic Host Configuration Protocol (DHCP)
- 12most common security device used in cable/DSL connectionsfirewall
- 13extension of the public telephone network into a businessprivate branch exchanges (PBX)
- 14distinct type of firewall designed to protect both the PBX and the data connectionstelecommunication firewall
- 15allows the connection between a client and a server via dial-up telephone connectionremote access service (RAS)
- 16when a user dials into a computer system, authentication and authorization are performed through a series of?remote access protocols
- 17server designed to permit remote users access to a network and to regulate their accessRemote Access Server (RAS)
- 18construct used to provide a secure communication channel between users across public networks such as the InternetVirtual Private Network (VPN)
- 19what can protect the identity of communicating parties when encrypting a virtual private networktunneling
- 20most common implementation of VPNIPsec (IP security)
- 21designed to detect, log, and respond to unauthorized network or host use, both in real time and after the factIntrusion Detection Systems (IDSs)
- 22two IDS categories arenetwork-based systems
host-based systems - 23two methods of IDS detection are1) signature-based
2) anomaly-based - 24enables only compliant, authenticated, and trusted endpoint devices and nodes to access network resources and infrastructure; also monitors and controls activity once they are on the networkNetwork Access Control (NAC)
- 25Microsoft technology for controlling network access of a computer hostNetwork Access Protection (NAP)
- 26Cisco technology for controlling network admissionNetwork Admission Control (NAC)
- 27enables a central monitoring and control center to maintain, configure, and repair network devices (switches and routers) as well as other network services (firewalls, IDSs, RAS)Simple Network Management Protocol (SNMP)
- 28allows operators to observe and interact with the network, using the self-reporting and in some cases self-healing nature of network devices to ensure efficient network operationNetwork Operations Center (NOC)
- 29NOCs can be a blessing and a security issue because?its efficient network operations management, but it provides an opportunity for unauthorized entry into a network
- 30What can you do to prevent unauthorized entry into a networkuse security controls(secondary networks and VPNs) and advanced authentication methods
- 31network traffic management devices used to connect different network segments togetherrouters
- 32how do routers operate?by examining each packet, looking at the destination address, and using algorithms and tables to determine where to send the packet next
- 33routers use these as a method of deciding whether a packet is allowed to enter the networkAccess Control Lists (ACLs)
- 34form the basis for connections in most Ethernet-based local area networks (LANs)switches
- 35a switch has separate?collision domains for each port
- 36What are the two collision domains in a port?one from port to client on downstream side, one from switch to network on upstream side
- 37when this is employed, collisions are virtually eliminated from the two nodes, host and clientfull duplex
- 38switches operate at the? and routers act at the?data link layer; network layer
- 39What is the device of choice for connecting machines on the Internet? What about the Intranet?routers; switches
- 40uses an algorithm to ________ ________ network traffic across a number of hosts, helping to enhance the scalability and availability of mission critical, IP-based services, such as Web, VPN, streaming media, terminal services, proxynetwork load balancing (NLB)
- 41enables a group of independent servers to be managed as a single system for higher availability, easier manageability, and greater scalabilityclustering
- 42network balancing servers are also called?hosts
- 43NLB does this by distributing its clients requests across multiple servers within the cluster, as traffic increases, additional services can be added to the clusterscalability
- 44NLB does this by automatically detecting the failure of a server and repartitioning client traffic among the remaining servers within seconds, while providing users continuous servicehigh availability
- 45can be used to filter out undesirable traffic and prevent employees from accessing potentially hostile websitesproxy servers
- 46designed to hide info about the requesting system and make a users web browsing experience anonymousanonymizing proxy
- 47Example of: when a request is made, a proxy server first checks to see whether is has a current copy of the requested content in the cache; if it does the client request is service immediately without reaching the destination server. If the content is old or the caching proxy does not have a copy of the requested content, the request is forwarded to the destination servercaching proxy
- 48keeps local copies of popular client requests and is often using large orgs to reduce bandwidth usage and increase performancecaching proxy
- 49what type of proxy supports user-level authentication so access can be controlled and monitored and activity through the proxy can be logged and analyzedcontent filtering proxy
- 50examines each client request and compare it to an established acceptable use policy; can be passed by requested URL, destination system, or domain namecontent filtering proxy
- 51proxy that is available to any internet user and often has some anonymizing capabilities as wellopen proxy
- 52proxy installed on server side of a network connection and intercepts all incoming web requestsreverse proxy
- 53what proxy can perform traffic filtering, SSL decryption, static content such as graphics, and performing load balancingreverse proxy
- 54proxy designed to handle web traffic and is sometimes called:web proxy; web cache
- 55security solution that prevents secured traffic from entering an internal network of an org; protects employees/users from accessing and being infected by malicious web trafficweb gateway security
- 56adds capabilities of a VPN router by adding advanced data and network security to the communications; has the ability to create and manage a large quantity of VPN tunnelsVPN concentrator
- 57level of VPN where a client is considered a virtual member of the connected network and can access the network as if locally connectedIPsec VPNs
- 58Pro and Con of IPSec VPNPro: apps run without any awareness that the client is coming from an outside network
Con: additional security controls need to be configured - 59level of VPN that allows admins to access a bit more precisely toward apps that are web enabledSSL VPNs
- 60Pro and Con of SSL VPNPro: admins can establish a finer level of control over uses with SSL VPN connections
Con: only web based applications work with SSL VPN - 61used to monitor and analyze network traffic to protect a system from network based threatsnetwork based intrusion detection system (NIDS)
- 62system where the IDS watches traffic, analyzes it, and generates alarms; does not react to traffic it is analyzingpassive NIDS
- 63contains same components as a passive NIDS but DOES react to traffic it is analyzingactive NIDS
- 64designed to examine the content of things such as network packets or log entries; look for simple things such as a certain string of characters or a certain flag set in a TCP packetcontent based signatures
- 65designed to match large patterns of activity and examine how certain types of activity fit into the other activities going on around themcontext based signatures
- 66Examples of Content-based signatures: 1) on a UNIX system, the names of valid user accounts are stored file called passwd located in an etc directory 2) Presence of all of these flags would indicate this packet was created by a potential attacker for a specific purpose 3) sending an email message to "decode" would cause the sys to execute the contents of the email1) Matching the characters /etc/passwd in a Telnet session
2) Matching a TCP packet with the synchronize, reset and urgent flags all set within the same packet
3) matching the characters to "decode" in the header of an email message - 673 examples of context based signatures 1) IDS analyzes all attempted to connection to port 80 then is able to determine which connection attempts are coming from the same source but are going to multiple different destinations 2) open source vulnerability scanner that allows system admins to quickly examine systems for vulnerabilities 3) IDS must recognize each ICMP packet and keep track of how many ICMP packets different systems have received in the past1) match a potential intruder scanning for open web servers on a specific network
2) Identify a Nessus scan
3) Identify a ping flood attack - 68when an ID matches a pattern and generates an alarm for benign traffic, meaning the traffic was not hostile and not a threat (IDS raised an alarm when it didn't need to do so)false positive
- 69network installed systems used to create physical security zones that continuously filter attacks as they attempt to traverse the network and as a result, no damage occurs and no cleanup is requiredNetwork-Based Intrusion Prevention System (NBIPS)
- 70NBIPS are made possible through the deft blending ofApplication Specific Integrated Circuits (ASICS) and Network Processors
- 71designed to process a high speed flow of network traffic by executing tens of thousands of instructions and comparisons in parallelnetwork processor
- 727 layers of NBIPS1) Physical
2) Data Link
3) Network
4) Transport
5) Session
6) Presentation
7) Application - 73NBIPS will improve NBIPS will protect NBIPS will protect NBIPS will limit1) corporate productivity and profitability
2) sensitive info from being stolen
3) key infrastructure from imminent global cyber attacks thus preserving standards of living and ways of life
4) copyright infringement liability - 74piece of software or an integrated hardware/software system that can capture and decode network trafficprotocol analyzers (packet sniffer, network analyzer, network sniffer)
- 75From a security perspective, protocol analyzers can be used for these 5 things: 1) Detecting 2) Capturing 3) Looking for 4) Looking for 5) Testing1) intrusions or undesirable traffic (IDS/IPS must have some type of capture and decode ability to be able to look for suspicious traffic
2) traffic during incident response or incident handling
3) evidence of botnets, Trojans, and infected systems
4) unusual traffic or traffic exceeding certain thresholds
5) encryption between systems or applications - 76From a network perspective, protocol analyzers can be used for these 4 things: 1) Analyzing 2) Detecting 3) Gathering and reporting 4) Debugging1) network problems
2) misconfigured applications or misbehaving applications
3) network usage and traffic statistics
4) client/server communications - 77As a sniffer, the analyzer must process every packet crossing the wire, so the ability to place _____ into ___________ _________ is criticala NIC into promiscuous mode
- 78Promiscuous mode tells the NIC?to process every network packet it sees regardless of the intended destination
- 79software or hardware device that is used to observe traffic as it passes through a network on shared broadcast medianetwork sniffers
- 80A network cad that is listening to all network traffic and not just its own is said to be in"promiscuous mode"
- 81Network administrators can use network sniffers for monitoring network performance in 3 different ways1) perform traffic analysis
2) network bandwidth analysis
3) troubleshoot certain problems (such as duplicate MAC address) - 82making data look like it has come from a different sourcespoofing
- 83a message is sent with a From email address that differs from that of the sending systememail spoofing
- 84how can you spoof an email address?you can Telnet to port 25 (port assoc with email) on a mail server
- 85what is a program that is used to detect unsolicited and unwanted email and prevent those messages from getting to a users inboxspam filter
- 86based on principle that most events are dependent and that the probability of an event occurring in the future can be inferred from the previous occurrences of that event; this principle is known as?Bayesian spam filtering; Bayes classifier
- 87how can mail be filtered using the Bayesian method?user needs to generate a database with words and tokens (such as the $ sign, IP addresses and domains) collected from a sample of spam mail and valid mail
- 88appliance, server plugin, or filter that applies a set of rules to an HTTP conversation; these rules cover common attacks such as?web application firewall (WAF); Cross-site scripting (XSS) and SQL injection
- 89work on application level of the network stack (ex: web browser, telnet, ftp traffic) and may intercept all packets traveling to or from an applicationnetwork-based application-layer firewalls
- 90—
- 91network-based application layer firewall can also be known as?proxy-based or reverse-proxy firewall
- 92application firewalls can prevent?all unwanted outside traffic from reaching protected machines
Información
- Descripción
- 1 Chapter 1: Network Security Fichas sobre 1.1 Implement security configuration parameters on network devices and other technologies, creado por Callie Smith el 28/06/2017.
- Creado por
- Callie Smith
- Visitas
- 0
- Valoración
Más sobre Securing Network Devices