GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

1.1 Implement security configuration parameters on network devices and other technologies

Callie Smith Chapter 1: Network Security 1 English 92 cards

Cards in this deck (92)

  1. 1hardware, software, or a combination whose purpose is to enforce a set of network security policies across network connectionsfirewall
  2. 2to allow only necessary access for a function; block or deny all unneeded functionalitythe principle of least access
  3. 3Firewalls enforce the est security policies through a variety of mechanisms including:1) Network Address Translation (NAT)
    2) Basic packet filtering
    3) State-ful packet filtering
    4) Access Control Lists (ACLs)
    5) Application layer proxies
  4. 4allows an outside entity to communicate with an entity inside the firewall without truly knowing its address; used in IPv4 to link private addresses to public onesNetwork Address Translation (NAT)
  5. 5sets of addresses that can be used by anyone and by definition are not routable across the InternetPrivate IP Adresses
  6. 6benefit to NAT?less public IP addresses are needed so the internal address structure is not known to the outside world
  7. 7looking at packers, their ports, protocols, source and destination addresses, and checking that info against the rules configured on the firewallbasic packet filtering
  8. 8point of entry from a wireless device to a wired network is performed at a device calledwireless access point
  9. 9offer broadband high speed connections and the opportunity for continuous connections to the Internetcable and DSL modems
  10. 10covers the functions performed by the device as it converts analog signals to digital and vice versamodems
  11. 11network protocol that enable a server to automatically assign an IP address to a computer from a defined range of numbers configured for a given networkDynamic Host Configuration Protocol (DHCP)
  12. 12most common security device used in cable/DSL connectionsfirewall
  13. 13extension of the public telephone network into a businessprivate branch exchanges (PBX)
  14. 14distinct type of firewall designed to protect both the PBX and the data connectionstelecommunication firewall
  15. 15allows the connection between a client and a server via dial-up telephone connectionremote access service (RAS)
  16. 16when a user dials into a computer system, authentication and authorization are performed through a series of?remote access protocols
  17. 17server designed to permit remote users access to a network and to regulate their accessRemote Access Server (RAS)
  18. 18construct used to provide a secure communication channel between users across public networks such as the InternetVirtual Private Network (VPN)
  19. 19what can protect the identity of communicating parties when encrypting a virtual private networktunneling
  20. 20most common implementation of VPNIPsec (IP security)
  21. 21designed to detect, log, and respond to unauthorized network or host use, both in real time and after the factIntrusion Detection Systems (IDSs)
  22. 22two IDS categories arenetwork-based systems
    host-based systems
  23. 23two methods of IDS detection are1) signature-based
    2) anomaly-based
  24. 24enables only compliant, authenticated, and trusted endpoint devices and nodes to access network resources and infrastructure; also monitors and controls activity once they are on the networkNetwork Access Control (NAC)
  25. 25Microsoft technology for controlling network access of a computer hostNetwork Access Protection (NAP)
  26. 26Cisco technology for controlling network admissionNetwork Admission Control (NAC)
  27. 27enables a central monitoring and control center to maintain, configure, and repair network devices (switches and routers) as well as other network services (firewalls, IDSs, RAS)Simple Network Management Protocol (SNMP)
  28. 28allows operators to observe and interact with the network, using the self-reporting and in some cases self-healing nature of network devices to ensure efficient network operationNetwork Operations Center (NOC)
  29. 29NOCs can be a blessing and a security issue because?its efficient network operations management, but it provides an opportunity for unauthorized entry into a network
  30. 30What can you do to prevent unauthorized entry into a networkuse security controls(secondary networks and VPNs) and advanced authentication methods
  31. 31network traffic management devices used to connect different network segments togetherrouters
  32. 32how do routers operate?by examining each packet, looking at the destination address, and using algorithms and tables to determine where to send the packet next
  33. 33routers use these as a method of deciding whether a packet is allowed to enter the networkAccess Control Lists (ACLs)
  34. 34form the basis for connections in most Ethernet-based local area networks (LANs)switches
  35. 35a switch has separate?collision domains for each port
  36. 36What are the two collision domains in a port?one from port to client on downstream side, one from switch to network on upstream side
  37. 37when this is employed, collisions are virtually eliminated from the two nodes, host and clientfull duplex
  38. 38switches operate at the? and routers act at the?data link layer; network layer
  39. 39What is the device of choice for connecting machines on the Internet? What about the Intranet?routers; switches
  40. 40uses an algorithm to ________ ________ network traffic across a number of hosts, helping to enhance the scalability and availability of mission critical, IP-based services, such as Web, VPN, streaming media, terminal services, proxynetwork load balancing (NLB)
  41. 41enables a group of independent servers to be managed as a single system for higher availability, easier manageability, and greater scalabilityclustering
  42. 42network balancing servers are also called?hosts
  43. 43NLB does this by distributing its clients requests across multiple servers within the cluster, as traffic increases, additional services can be added to the clusterscalability
  44. 44NLB does this by automatically detecting the failure of a server and repartitioning client traffic among the remaining servers within seconds, while providing users continuous servicehigh availability
  45. 45can be used to filter out undesirable traffic and prevent employees from accessing potentially hostile websitesproxy servers
  46. 46designed to hide info about the requesting system and make a users web browsing experience anonymousanonymizing proxy
  47. 47Example of: when a request is made, a proxy server first checks to see whether is has a current copy of the requested content in the cache; if it does the client request is service immediately without reaching the destination server. If the content is old or the caching proxy does not have a copy of the requested content, the request is forwarded to the destination servercaching proxy
  48. 48keeps local copies of popular client requests and is often using large orgs to reduce bandwidth usage and increase performancecaching proxy
  49. 49what type of proxy supports user-level authentication so access can be controlled and monitored and activity through the proxy can be logged and analyzedcontent filtering proxy
  50. 50examines each client request and compare it to an established acceptable use policy; can be passed by requested URL, destination system, or domain namecontent filtering proxy
  51. 51proxy that is available to any internet user and often has some anonymizing capabilities as wellopen proxy
  52. 52proxy installed on server side of a network connection and intercepts all incoming web requestsreverse proxy
  53. 53what proxy can perform traffic filtering, SSL decryption, static content such as graphics, and performing load balancingreverse proxy
  54. 54proxy designed to handle web traffic and is sometimes called:web proxy; web cache
  55. 55security solution that prevents secured traffic from entering an internal network of an org; protects employees/users from accessing and being infected by malicious web trafficweb gateway security
  56. 56adds capabilities of a VPN router by adding advanced data and network security to the communications; has the ability to create and manage a large quantity of VPN tunnelsVPN concentrator
  57. 57level of VPN where a client is considered a virtual member of the connected network and can access the network as if locally connectedIPsec VPNs
  58. 58Pro and Con of IPSec VPNPro: apps run without any awareness that the client is coming from an outside network
    Con: additional security controls need to be configured
  59. 59level of VPN that allows admins to access a bit more precisely toward apps that are web enabledSSL VPNs
  60. 60Pro and Con of SSL VPNPro: admins can establish a finer level of control over uses with SSL VPN connections
    Con: only web based applications work with SSL VPN
  61. 61used to monitor and analyze network traffic to protect a system from network based threatsnetwork based intrusion detection system (NIDS)
  62. 62system where the IDS watches traffic, analyzes it, and generates alarms; does not react to traffic it is analyzingpassive NIDS
  63. 63contains same components as a passive NIDS but DOES react to traffic it is analyzingactive NIDS
  64. 64designed to examine the content of things such as network packets or log entries; look for simple things such as a certain string of characters or a certain flag set in a TCP packetcontent based signatures
  65. 65designed to match large patterns of activity and examine how certain types of activity fit into the other activities going on around themcontext based signatures
  66. 66Examples of Content-based signatures: 1) on a UNIX system, the names of valid user accounts are stored file called passwd located in an etc directory 2) Presence of all of these flags would indicate this packet was created by a potential attacker for a specific purpose 3) sending an email message to "decode" would cause the sys to execute the contents of the email1) Matching the characters /etc/passwd in a Telnet session
    2) Matching a TCP packet with the synchronize, reset and urgent flags all set within the same packet
    3) matching the characters to "decode" in the header of an email message
  67. 673 examples of context based signatures 1) IDS analyzes all attempted to connection to port 80 then is able to determine which connection attempts are coming from the same source but are going to multiple different destinations 2) open source vulnerability scanner that allows system admins to quickly examine systems for vulnerabilities 3) IDS must recognize each ICMP packet and keep track of how many ICMP packets different systems have received in the past1) match a potential intruder scanning for open web servers on a specific network
    2) Identify a Nessus scan
    3) Identify a ping flood attack
  68. 68when an ID matches a pattern and generates an alarm for benign traffic, meaning the traffic was not hostile and not a threat (IDS raised an alarm when it didn't need to do so)false positive
  69. 69network installed systems used to create physical security zones that continuously filter attacks as they attempt to traverse the network and as a result, no damage occurs and no cleanup is requiredNetwork-Based Intrusion Prevention System (NBIPS)
  70. 70NBIPS are made possible through the deft blending ofApplication Specific Integrated Circuits (ASICS) and Network Processors
  71. 71designed to process a high speed flow of network traffic by executing tens of thousands of instructions and comparisons in parallelnetwork processor
  72. 727 layers of NBIPS1) Physical
    2) Data Link
    3) Network
    4) Transport
    5) Session
    6) Presentation
    7) Application
  73. 73NBIPS will improve NBIPS will protect NBIPS will protect NBIPS will limit1) corporate productivity and profitability
    2) sensitive info from being stolen
    3) key infrastructure from imminent global cyber attacks thus preserving standards of living and ways of life
    4) copyright infringement liability
  74. 74piece of software or an integrated hardware/software system that can capture and decode network trafficprotocol analyzers (packet sniffer, network analyzer, network sniffer)
  75. 75From a security perspective, protocol analyzers can be used for these 5 things: 1) Detecting 2) Capturing 3) Looking for 4) Looking for 5) Testing1) intrusions or undesirable traffic (IDS/IPS must have some type of capture and decode ability to be able to look for suspicious traffic
    2) traffic during incident response or incident handling
    3) evidence of botnets, Trojans, and infected systems
    4) unusual traffic or traffic exceeding certain thresholds
    5) encryption between systems or applications
  76. 76From a network perspective, protocol analyzers can be used for these 4 things: 1) Analyzing 2) Detecting 3) Gathering and reporting 4) Debugging1) network problems
    2) misconfigured applications or misbehaving applications
    3) network usage and traffic statistics
    4) client/server communications
  77. 77As a sniffer, the analyzer must process every packet crossing the wire, so the ability to place _____ into ___________ _________ is criticala NIC into promiscuous mode
  78. 78Promiscuous mode tells the NIC?to process every network packet it sees regardless of the intended destination
  79. 79software or hardware device that is used to observe traffic as it passes through a network on shared broadcast medianetwork sniffers
  80. 80A network cad that is listening to all network traffic and not just its own is said to be in"promiscuous mode"
  81. 81Network administrators can use network sniffers for monitoring network performance in 3 different ways1) perform traffic analysis
    2) network bandwidth analysis
    3) troubleshoot certain problems (such as duplicate MAC address)
  82. 82making data look like it has come from a different sourcespoofing
  83. 83a message is sent with a From email address that differs from that of the sending systememail spoofing
  84. 84how can you spoof an email address?you can Telnet to port 25 (port assoc with email) on a mail server
  85. 85what is a program that is used to detect unsolicited and unwanted email and prevent those messages from getting to a users inboxspam filter
  86. 86based on principle that most events are dependent and that the probability of an event occurring in the future can be inferred from the previous occurrences of that event; this principle is known as?Bayesian spam filtering; Bayes classifier
  87. 87how can mail be filtered using the Bayesian method?user needs to generate a database with words and tokens (such as the $ sign, IP addresses and domains) collected from a sample of spam mail and valid mail
  88. 88appliance, server plugin, or filter that applies a set of rules to an HTTP conversation; these rules cover common attacks such as?web application firewall (WAF); Cross-site scripting (XSS) and SQL injection
  89. 89work on application level of the network stack (ex: web browser, telnet, ftp traffic) and may intercept all packets traveling to or from an applicationnetwork-based application-layer firewalls
  90. 90—
  91. 91network-based application layer firewall can also be known as?proxy-based or reverse-proxy firewall
  92. 92application firewalls can prevent?all unwanted outside traffic from reaching protected machines

Information

Description
1 Chapter 1: Network Security Flashcards on 1.1 Implement security configuration parameters on network devices and other technologies, created by Callie Smith on 28/06/2017.
Created by
Callie Smith
Views
0
Rating

More on Securing Network Devices

Feedback

What is it about?

What do you think of the new look?

How do you like it?