07 - Network Security Controls - Techincal Controls Flashcards
Describe these email protocols:
1) PGP
2) S/MIME
3) SMTP
4) POP3
5) IMAP
1) Provides cryptographic privacy and authentication for emails.
2) Is used for sending digitally signed and encrypted emails.
3) Sends messages from one email server to another.
4) Retreives email from a server, once retrieved it is deleted from the server.
5) Retrieves email from a server. Synchronizes to the email server.
Describe these protocols:
1) RADIUS
2) TACACS
3) Kerberos
4) DNSSEC
5) HTTPS
1) Centralized authentication, authorization, and accounting for remote servers to communicate with a central server.
2) Provides AAA of network devices through one or more centralized servers.
3) An authentication method to access a network based on TGT and TGS.
4) A suite of specifications for securing certain tpes of information provided by DNS.
5) Is used to secure communications across the Internet.
Describe these protocols:
1) TLS
2) SSL
3) SRTP
4) LDAP
5) IPSec
1) Ensures secure communcation between client-server application. Supercedes SSL.
2) Uses RSA to ensure secure communcations between client-server models.
3) Used to deliver real-time data such as audio and video streams.
4) Is used to accesss and managing directory services such as AD.
5) Secures IP communications. Mainly used in VPNs and remote user access.
Describe these components of IPSec:
1) Authentication Header (AH)
2) Enscapsulation Security Payload (ESP)
1) Provides the data authentication of the sender.
2) Provides both the data authentication and encryption of the sender.
Describe these protocols:
1) FTP
2) SNMP
3) SSH
4) OAuth
5) OpenID (OIDC)
1) It used for secure file transmission and file access.
2) Used to monitor and manage devices over a network.
3) Is used by Linux and Unix for secure remote login.
4) Allows user to grant limited access to resources from one site to another.
5) Is an authentication protocol that is built into OAuth
What is Network Segmentation?
Is the practice of splitting a network into smaller networks segments.
Describe these types of Network Segmentation:
1) Physical
2) Logical
3) Virtualization
1) Networks are segmented based on physical components.
2) Utilizes VLANs which are isolated logically without considering physical locations of devices.
3) Combines all available network resources to share these resources amongst the network users using a single admin unit.
What is a Bastion Host?
Is a computer system that is designed and configured to protect network resources from attacks.
Describe these types of Bastion Hosts:
1) Single-homed
2) Multi-homed
3) Internal
1) A firewall with one network interface. All incoming/outgoing traffic is routed through the bastion host.
2) A firewall device with at least 2 network interfaces. Seperates internal and external networks.
3) Resides inside the internal network. Can be single/multi-homed. Network devices communcate directly with bastion host.
What is a DMZ?
A computer subnetwork that is placed between the organizations private network and the Internet. Allows for external users to access organzations servers.
Describe these types of traffic:
1) East-West
2) North-South
1) Traffic between servers in a data centre
2) Traffic between an outside client and a server.
What is a Zero-Trust Network?
Is a model where every user is not trusted by default and needs to verify every incoming connection before allowing access to the network.
What is a Firewall?
Is a hardware/software that is used to monitor and filter incoming and outgoing traffic and prevents unauthorized access to private networks.
Describe these firewalls:
1) Host-based
2) Network-based
3) External
4) Internal
1) Filters inbound/outbound traffic of an individual computer.
2) Filters inbound/oubound traffic across a LAN.
3) Limits access between protected and public networks. Provides protection for DMZ.
4) Protects one network segment from another.
Describe these Firewall technologies:
1) Packet Filtering
2) Circuit-Level Gateway
3) Application Layer Gateways
4) Stateful Multilayer Inspection
5) Application Proxy
6) NAT
7) VPN
8) NGFW
1) Resides in routers; each packet is compared to a set of criteria before being forwarded.
2) Monitor the TCP handshake to determine whether a session is legitimate or not.
3) Filter packets at the application layer such as HTTP-GET and POST.
4) Combines Application, Circuit-Level and Packet Filtering technologies.
5) Is a proxy server that filters connections between services.
6) Allows multiple LAN devices to use a single IP address.
7) Is a service that creates a secure, encrypted connection over a less secure network, typically the internet. It allows users to send and receive data as if their devices were directly connected to a private network.
8) Is a firewall that is also capable of inspecting packet content, not just port/protocol inspection.
Describe the following:
1) IDS
2) IPS
1) Is a system that sits ‘off to the side’ that monitors traffics and alerts admins about suspicious activites.
2) Is an ‘in-line’ system that allows or block packets depending on established policies.
Describe the following IDS detection methods:
1) Signature Recognition
2) Anomaly Detection
3) Protocol Anomaly Detection
1) Identifies events based on packet content that indicate an abuse of a system.
2) Detects instrusions based on the established behavioural characteristics of users and components of a computer system.
3) Models are used to detect anomalies in the way TCP/IP protocols behave.
Give examples of the following types of intrusions:
1) File System
2) Network
3) System
1) Presence of new unfamiliar files, change in file permissions, change in file size, rogue files, missing files.
2) Repeated probes of service, connections from unusual locations, repeated login attempts from remote hosts, influx of login data.
3) Short/incomplete logs, slow system performance, missing logs, modified config files, unusual graphics/text, gaps in system accounting, systems crashes/boots, unfamiliar processes.
Describe the following classifications of IDS:
1) Approach-based
2) Behaviour-based
3) Protection-based
4) Structure-based
5) Analysis Timing-based
6) Source Data Analysis-based
1) Uses the signature, anomaly, and protocol anomaly detection systems to monitor suspicious behaviour.
2) How an IDS responds to events, Active/Passive; Active detects and responds, Passive only detects.
3) What an IDS offers protection to, HIDS/NIDS; HIDS protects the host, NIDS protects the network.
4) Where the IDS is placed, Centralized/Distributed; Centralized is all data is sent to one authority, Distributed uses several IDS to communicate with each other.
5) Ttime between event occurring and analysis, Interval/Real-time; Interval performs analysis offline, Real-time performs analysis on the fly.
6) The data source that is used to detect intrusions, Audit Trails/Network Packets.
Describe the components of an IDS:
1) Network Sensors
2) Command Console
3) Alert Systems
4) Response System
5) Attack Signature Database
1) Hardware/software components that monitor network traffic and trigger alarms.
2) Is the installed software that is dedicated to the IDS.
3) Sends an alert message when an anomaly or misuse is detected.
4) Issues countermeacures against any intrusion that is detected.
5) Attacks are compared against known signatures and then a decision is made.
List the four locations where an IDS should be deployed.
1) Behind the external firewall and in the network DMZ,
2) Outside the external firewall.
3) On major network backbones
4) On critical subnets.
Describe the following types of alerts:
1) True-positive
2) False positive
3) False Negative
4) True Negative
1) An alarm when an attack occurs.
2) An alarm when no attack has actually taken place.
3) When no alarm is raised when an attack occurs.
4) When no alarm is raised when an attack hasn’t occured.
What is a Honeypot?
Is a information system resource that is set up to attract and trap people who attempt to hack a network.
Describe these types of Honeypots:
1) Low-interaction
2) Medium-interaction
3) High-Interaction
4) Pure
1) Simulate a limited number of services and applications of a system.
2) Simulate real OS, applications and service of a network.
3) Simulate all services and applications of a network.
4) Emulate the real production environment of a network.
