Flashcards
Ch. 3: Network Security
Cards in this deck (92)
- 1networking protocolsprovide the rules needed for computers to communicate with each other on a network
- 2TCP/IPTransmission Control Protocol/Internet Protocol
provide basic connectivity
full suite of protocols, not a single protocol - 3basic connectivity protocolsTCP
UDP
IP
ARP
NDP - 4TCPTransmission Control Protocol
provides connection-oriented traffic (guaranteed delivery) - 5TCP three-way handshake1. Client sends a SYN (synchronize) packet
2. Server responds with a SYN/ACK
(synchronize/acknowledgment) packet
3. Client completes handshake with an ACK packet to establish the connection - 6ICMPInternet Control Message Protocol
used for testing connectivity; includes tools such as ping, pathping, and tracert
DoS attacks use ICMP so it's common to block ICMP @ FWs & routers; blocking ICMP prevents attackers from discovering devices in NW w/ a host enumeration sweep - 7UDPUser Datagram Protocol
provides connectionless sessions aka w/o a three-way handshake
ICMP, like A/V streaming, uses UDP
DoS attacks use UDP - 8IPInternet Protocol
identifies host in TCP/IP network & delivers traffic from one host to another using IP addresses - 9IPv4 vs. IPv6uses 32-bit addresses represented in dotted decimal format; e.g., 192.168.1.100
vs.
uses 128-bit addresses using hexadecimal code; e.g., FE80:0000:0000:0000:20D4:3FF7:003F:DE62 - 10pingchecks for basic connectivity between two systems
- 11ARPAddress Resolution Protocol
resolves IPv4 addresses to media access control (MAC) addresses
TCP/IP uses MAC address to get packet to correct host; ARP required when packet reaches destination subnet - 12ARP poisoninguses ARP packets to give clients false hardware address updates and attackers use it to redirect or interrupt network traffic
- 13NDPNeighbor Discovery Protocol
-performs functions on IPv6, similar to IPv4's ARP
performs autoconfiguration of device IPv6 addresses & discovers other devices on the NW such as the IPv6 address of the default gateway - 14encryption protocolsSSH
SCP
SSL
TLS
IPsec - 15SSHSecure Shell; TCP port 22
encrypts wide variety of traffic, such as Secure Copy (SCP) and SFTP
used when remotely administering systems instead of Telnet - 16SCPSecure Copy; TCP port 22
based on SSH
encrypts TCP Wrappers
used to copy encrypted files over a network - 17SSLSecure Sockets Layer
secures HTTP traffic as HTTPS w/ use of certificates
can also encrypt SMTP, LDAP - 18TLSTransport Layer Security
designated replacement for SSL - 19IPsecInternet Protocol security; encrypts IP traffic
encapsulates & encrypts IP packet payloads; uses Tunnel mode to protect VPN traffic
uses Internet Key Exchange (IKE) over UDP port 500 to create a security association for the VPN - 20two main components of IPsecAuthentication Header (AH) identified by protocol ID #51
Encapsulating Security Payload (ESP) identified by protocol #50 - 21SFTPSSH File Transfer Protocol or
Secure File Transfer Protocol - 22TCP Wrapperhost-based networking ACL system, to filter network access to Internet Protocol servers on (Unix-like) operating systems
It allows host or subnetwork IP addresses, names and/or ident query replies, to be used as tokens on which to filter for access control purposes - 23application protocolsoperate on the Application layer of the Open Systems Interconnection (OSI), or the Application layer of the TCP/IP model
responsible for displaying info to the user in a readable format - 24examples of application protocolsHTTP
HTTPS
FTP
SFTP
FTPS
TFTP - 25HTTPHypertext Transfer Protocol
transmits web traffic on inter/intranets
web servers use to transmit web pages to clients' browsers
TCP port 80 - 26HTTPSHypertext Transfer Protocol Secure
encrypts web traffic so it is secure in transit
encrypted with SSL or TLS
TCP port 443 - 27FTPFile Transfer Protocol
up/downloads large files to and from an FTP server - 28FTP active mode portsTCP port 21 for control signals
TCP port 20 for data - 29FTP passive mode portsTCP port 21
- 30SFTPSecure File Transfer Protocol
secure implementation of FTP
extension of SSH using SSH to transmit files in encrypted format
TCP port 22 - 31FTPSFile Transfer Protocol Secure
extension of FTP
uses SSL or TLS to encrypt FTP traffic
TCP ports 989 and 990 - 32TFTPTrivial File Transfer Protocol
UDP port 69
transfer smaller amounts of data, such as when communicating w/ NW devices
commonly disabled - 33Telnetlegacy protocol; TCP port 23
connect to remote systems or NW devices over a NW
command-line interface; some admins use to connect to routers & make config changes
SSH=more secure alternative - 34SNMPSimple Network Management Protocol
monitors & manages NW devices (e.g., routers & switches)
UDP port 161
sends traps (error messages) via UDP port 162 - 35NetBIOSNetwork Basic Input/Output System
name resolution service for NetBIOS names on internal networks
includes session services for UDP and TCP communication
UDP ports 137 & 138; TCP port 139 - 36LDAPLightweight Directory Access Protocol
language used to communicate w/ directories like Micro AD
TCP port 389
TCP port 636 when encrypted w/ TLS or SSL - 37Kerberosauthentication protocol
uses Key Distribution Center (KDC) to issue timestamped tickets
UDP port 88 - 38Microsoft SQL Serverserver application that hosts databases accessible from webs servers and other applications
port 1433 - 39RDPRemote Desktop Protocol
used to connect to other systems from remote locations
TCP port 3389 or UDP 3389 - 40email protocolsSMTP
POP3
IMAP4 - 41SMTPSimple Mail Transfer Protocol (SENDS)
transfers email between clients and SMTP servers
TCP port 25
TCP port 465 w/ SSL or TLS - 42POP3Post Office Protocol v3 (RECEIVES)
transfers emails from servers down to clients
TCP port 110
TCP port 995 w/ SSL or TLS - 43IMAP4Internet Message Access Protocol version 4
used to store email on an email server; allows user to organize & manage email in folders on server
TCP port 143
TCP port 993 w/ SSL or TLS - 44RFC 1918 private address rangesRequest for Comments
10.x.y.z. = 10.0.0.0 through 10.255.255.255
172.16.y.z-172.31.y.z =
172.16.0.0 through 172.31.255.255
192.168.y.z = 192.168.0.0 thru 192.168.255.255 - 45subnettingdivides single range of classful IP addresses into 2 or more smaller ranges of IP addresses
to isolate traffic and increase efficiency
use to isolate systems on different subnets; increase efficiency by reducing collisions on each individual (sub)network - 46Class A0.0.0.0 through 127.255.255.255.255
- 47Class B128.0.0.0 through 191.255.255.255
- 48Class C192.0.0.0 through 223.255.255.255
- 49CIDR NotationClassless Interdomain Routing notation
used instead of writing out the subnet mask
example:
IP address 192.168.1.1, subnet 255.255.255.0
written as 192.168.1.1/24 - 50IANAInternet Assigned Numbers Authority
- 51IETFInternet Engineering Task Force
- 52IPv6IPsec is built in to IPv6 and can encrypt any type of IPv6 traffic
- 53DNSDomain Name System; UDP port 53
-resolves host names to IP addresses
-common to configure DNS servers to only use secure zone transfers
1. type google.com into browser
2. your system queries a DNS server for site's IP address - 54zones in DNS serversthink of like a database
A
AAAA
PTR
MX
CNAME - 55A (DNS zone)host record
holds host name and IPv4 address
most commonly used record in DNS server
client queries DNS w/ the name using a fwd lookup request, and DNS responds w/ IPv4 address - 56AAAA (DNS zone)this record holds host name and IPv6 address
- 57PTR (DNS zone)pointer record
opposite of an A record
DNS client queries DNS w/ IP address (instead of name) and server responds w/ the name (if server is configured to do so) - 58MX (DNS zone)mail exchanger
identifies a mail server used for email
linked to A or AAAA record of a mail server - 59CNAMEcanonical name, or alias
allows single system to have multiple names associated with a single IP address
e.g., server named Server1 in domain google.com might have an alias of FileServer1 in the same domain - 60BINDBerkeley Internet Name Domain software
most DNS servers run BIND and run on Unix or Linux - 61portslogical numbers used by TCP/IP to identity what service or application should handle data received by a system
65,536 TCP ports (0-65,536)
65,536 UDP ports (0-65,535) - 62well-known ports0-1023
commonly used protocols - 63registered ports1024-49,151
for companies as a convenience to the IT community
e.g., MS SQL Server uses port 1433 for database servers;
Point-to-Point Tunneling Protocol (PPTP) uses port 1723 - 64dynamic and private ports49,152-65,535
available for use by any application
commonly used by apps to to temporarily map an application to a port
ephemeral ports = they are short lived - 65hostany device with an IP address
- 66logical portnumber embedded in a packet and identifies services and protocols
- 67unicastmethod IPv4 uses when addressing TCP/IP traffic
one-to-one traffic; one host sends traffic to another using a destination IP address
only the host with the destination IP address will process the packet - 68broadcastmethod IPv4 uses when addressing TCP/IP traffic
one-to-all traffic; one host sends traffic to all other hosts on the subnet suing a broadcast address such as 255.255.255.255; every host that receives broadcast traffic will process it - 69hubpasses broadcast traffic between ports
multiple physical ports to provide basic connectivity to multiple computers
what goes in one port goes out to all other ports = security risk b/c sniffer can capture all traffic passing thru the hub - 70switchconnects devices together on network, by using packet switching to receive, process and forward data to the destination device
(knows which device is connected to which physical port)
internally switch unicast traffic while
passing broadcast traffic to all ports - 71security benefit of a switchpacket analyzers can't capture traffic that doesn't reach the port it's installed on
- 72switching loop or bridge loop problemwhen two ports of a switch are connected together so it's continuously sending unicast transmissions through the switch
this disables the switch and degrades overall NW performance - 73STP and RSTPSpanning Tree Protocol and Rapid STP
loop protections
protects against switching loop problems - 74VLANlogically groups several different computers together, or logically separate computers, without regard to their physical location
can create multiple VLANs with a single switch - 75port securitylimits the computers that can connect to ports on a switch
includes disabling unused ports & limiting # of MAC addresses per port (limits port's connectivity to a specific device using certain MAC address) - 76802.1x port securityport-based authentication protocol that provides stronger port security
ensures only authorized clients can connect to a NW, preventing rogue devices from connecting - 77routerconnect multiple NW segments together into single NW and route traffic between the segments
DON'T pass broadcasts - 78ACLsrules implemented on a router (and firewalls) to identify what traffic is allowed or denied
rule-based management
provide basic packet filtering based on IP addresses, ports, and some protocols based on the protocol identifiers - 79ACL rules: IP addresses and networksblock access from any single computer based on IP address
block traffic from one subnet to another by blocking traffic using subnet IDs - 80ACL rules: portsfilter traffic based on logical ports
e.g., block HTTP traffic, create rule to block traffic on port 80
can block incoming, outgoing, or both - 81implicit denyall traffic that isn't explicitly allowed is implicitly denied; last rule in an ACL
e.g., configure router to allow HTTP so router has explicit rule to allow HTTP traffic; if you don't define any other rules, the implicit deny rule blocks all other traffic - 82firewallfilters traffic between networks and can filter incoming and outgoing traffic
ensures only specific types of traffic are allowed into or out of your network - 83host-based firewallmonitors traffic going in and out of a single host, such as a server or a workstation
provides intrusion protection for the host - 84network-based firewallsdedicated servers or appliances that provide protection for the network
controls traffic going in and out of network by filtering traffic based on firewall rules, allowing only authorized traffic to pass through it; between internal NW and Internet - 85permission (FW rules)seen as PERMIT or ALLOW allowing traffic
DENY blocks traffic - 86protocol (FW rules)will see TCP or UDP, e.g., when blocking specific TCP or UDP ports
- 87source (FW rules)traffic comes from a source IP address
can allow or block an IP address or range of IP addresses - 88destination (FW rules)traffic is addressed to destination IP address
can allow or block IP address or range of addresses - 89port or protocol (FW rules)eq for equal
lt for less than
gt for greater than - 90web-application firewall (WAF)FW specifically designed to protect a web application; stand-alone appliance or software
placed btwn a server hosting web app and a client - 91network perimeterprovides boundary between an internal network (like an intranet) and the Internet
- 92DMZdemilitarized zone
buffered zone btwn private NW and the Internet
allows access to services (like mail and web) while segmenting access to the internal NW
Information
- Description
- Security+ Flashcards on Ch. 3: Network Security, created by ram4416 on 04/06/2015.
- Created by
- ram4416
- Views
- 5
- Rating