Flashcards
Security+ Other Vocabulary
Flashcards do conjunto (37)
- 1Packet Filtering Firewallnetwork and transport layers of OSI
inspects packet headers
least expensive but also least effective - 2Stateless Firewallinspects packets one at a time
does not track sessions - 3Stateful Firewallincoming packets checked against a state table to see if part of a known session
if so, allowed through. If not part of known session, regular firewall rules apply - 4North-South Traffictraffic to and from the cloud or data center
- 5East-West Traffictraffic internal to a cloud or data center
- 6Fog Computingdevices on network edge that process data from IoT devices
used in cloud computing - 7Edge Computingdevices on the edge of a network that pre-process data
used in cloud computing - 8Port Mirroringspecific application in which all traffic in and out of one port is mirrored to another port for collection and inspection
- 9Packet Sniffing 8 toolsintercept and log network traffic
common tools used: Wireshark, SolarWinds Network Packet Sniffer, ManageEngine NetFlow Analyzer, WinDump, TCPDump, ColaSoft Capsa, Kismet, Telerik Fiddler - 10Protocol Analysis/Analyzercapture network packets and perform a statistical analysis to analyze the sequence of packets captured
analyzer works along with a packet sniffer - 11Wiresharkpacket sniffing and analysis tool
deep inspection, live capture and offline analysis, display and capture filters, VoIP analysis, decryption capabilities, output to XML CSV or plain text - 12SyslogUnix systems
centralized logging system
has own format for displaying info
UDP port 514 - 13Types of Security AssessmentsVulnerability Assess.
Penetration Testing
Threat Hunting - 14Vulnerability Scannersused to discover and map network hosts
gather info on devices including missing patches, outdated software, misconfigs
common tools: OpenVAS, Lynis, Nikto - 15OpenVASset up different templatized or customized scans for different sets of assets
- 16Lynisused in Kali Linux
security auditing, compliance testing, pen testing, vulnerability detection, system hardening, system auditing (system binaries, boot loaders, startup services, run level, loaded modules, kernel config, core dumps, etc) - 17Niktoweb server scanner
identifies vulnerabilities and provides suggestions to close the vulnerability - 18Intrusive vs Non-Intrusive Scansintrusive: attempts to exploit found vulnerabilities
non-intrusive: does not go beyond scanning process. less likely to identify vulnerabilities but ideal for live systems - 19Authenticated vs Non-Authenticated Scansauthenticated: use privileged credentials to dig deeper into a network
non-authenticated: inspect a target system's security from an outside perspective - 20Network Monitoring Tools 11 toolsManageEngine, OpManager, PRTG Network Monitor, Atera, SolarWinds NPM (diagnostic), NinjaRMM, Obkio, Site 24x7 Network Monitoring, Nagios, Zabbix, Datadog
- 21Pen Test Life Cycle1. Persistence
2. Privilege escalation
3. Lateral movement
4. Pivoting
5. Actions on objectives
6. Cleanup - 22Threat Intelligence TypesStrategic: used to make strategic business decisions
Tactical: info related to TTPs, highly technical info
Operational: threats against an org made by a human - 23IoC Examples 10 examplesUnusual outbound traffic
Anomalies in privileged user activity
Geographical irregularities
Login red flags
Increased database reads
increased HTML response time
Mismatched traffic
Same file requested multiple times
Suspicious OS changes
DNS request anomalies - 24Types of Malware 13 typesVIRUSES - attach to files, need human interaction
WORMS - self-propagating, consumes all resources, can carry other types of malware as a payload
TROJANS - hides inside seemingly legit software
RATS - can create a backdoor, typically initiated though SPAM
RANSOMWARE - demands ransom to gain access to the files they encrypted
CRYPTO-MALWARE - class of ransomware that demands cryptocurrency
ROOTKITS - obtains access to kernel of OS, may reside in firmware
BOTS - infected computer under the control of a hacker
BOTNETS - network of bots, typically used to send large amounts of SPAM or create a DDoS, controlled with C2
LOGIC BOMBS - activates at a specified time or when a specified action/event takes place
SPYWARE - records and sends out data and/or keystrokes, can use screenshots and/or webcam/microphone
ADWARE - many ads, but not real websites
KEYLOGGERS - records keystrokes - 25Types of Viruses 8 typesBOOT SECTOR - moves and replaces MBR
MULTIPARTITE - multiple vectors, hybrid virus, eats up memory
ARMORED - protection or evasion techniques built-in
POLYMORPHIC - changes its code dynamically to evade detection
METAMORPHIC - rewrites itself every time it infects a new executable
RETROVIRUS - actively defend themselves by shutting down antiviruses when they run a scan
MEMORY-RESIDENT OR FILELESS - resides in memory, processes, or inside system calls
MACRO - run in apps, not OSs, spreads whenever an infected document is opened or closed - 26Prependinginvolves adding text to a message (generally the subject line) to make it appear more authentic
ex: "RE:" - 27Pretextingattackers story/scenario
alluding to specific info, as if they already have it - 28Incident Response Steps 6 steps1. preparation
2. identification
3. containment
4. eradication
5. recovery
6. lessons learned - 29Standards, Procedures, and GuidelinesStandards - will have #s in it
Procedures - steps involved
Guidelines - recommendations - 30Change Management vs Change Controlchange management is managing what happens after the implementation
change control is submitting a request for approval to make the change (submit to the CAB) - 31Geofencinguses location as an attribute in the access request evaluation
device has to be within the geofence to access - 32Geotaggingadds geolocation metadata to files or devices
ex: tagging the geolocation on a picture - 33Time of Dayauthorized logon hours for an account
- 34Colocationa facility hosting several companies' servers
- 35Attestationa statement made by a system can be trusted
a hardware root of trust automatically has attestation - 36Secure Boot vs Measured BootSecure - prevents a boot loader or kernel that has been infected by malware from being used
Measured - do not usually prevent a boot but will record the presence of unsigned kernel-level code - 37DNS Sinkholeroutes malicious traffic to a honeynet
Informações
- Descrição
- CompTIA Information Technology (Security+ ) FlashCards sobre Security+ Other Vocabulary, criado por Lyndsay Badding em 25-04-2023.
- Criado por
- Lyndsay Badding
- Visualizações
- 31
- Tags
- Avaliação