11. Network Security Fundamentals Flashcards
1
Q
List out the 4 types of threats
A
- Information Theft
- Data Loss and Manipulation
- Identity Theft
- Disruption of Service
2
Q
What will result in when network are being attacked?
A
- Loss of Time & Money due to damange
- Theft important information or assets
3
Q
How does attacker access network? ( )
A
- Software Vulnerabilities ( Bug )
- Hardware Attacks
- Guessing someone Username and Password
- Modifying software or exploiting vulnerabilities
4
Q
What is vulnerability ?
A
- Degree of weakness in a network or a device
5
Q
What device that may have some vulnerability? ( 5 )
A
- Routers
- Switches
- Desktops
- Servers
- Security Devices
6
Q
List out the 3 primary vulnerabilities or weakness
A
- Technological Vulnerabilities
- Configuration Vulnerabilities
- Security Policy Vulnerabilities
7
Q
What does Technological Vulnerabilities might include ( 3 )
A
- TCP/IP Protocol Weakness
- Operating System Weakness
- Network Equipment Weakness
8
Q
What does Configuration Vulnerabilities might include?
A
- Unsecured user accounts
- System accounts with easily guessed passwords
- Misconfigured internet services
- Unsecure default settings
- Misconfigured netwoek equipment
9
Q
What does Security Policy Vulnerabilities might include?
A
- Lack of a written security policy, politics
- Lack of authentication continuity
- Logical access controls not applied
- Software and Hardware Installation
- Changes not following policy
- Nonexistent disaster recovery plan
10
Q
List out the 4 classes of physical threads
A
- Hardware Threats
- Environment Threads
- Electrical Threats
- Maintenance Threats
11
Q
What does Hardware Threads includes?
A
- Physical Damage to
- Servers
- Routers
- Switches
- Cabling Plant
- Workstations
12
Q
What does Environment Threats includes?
A
- Extreme Temperature
- Extreme Humidity
13
Q
What does Electrical Threats include?
A
- Voltage Spikes
- Insufficient Supply Voltage
- Unconditioned Power
- Total power loss
14
Q
What does Maintenance Threats includes?
A
- Poor handling of key electrical components
- Lack of critical spare parts
- Poor cabling
- Poor labeling
15
Q
What is the short form for Malicious Software?
A
- Malware
15
Q
What is viruses?
A
- A malware that propagates by inserting a copy of itself into, and becoming part of, another program
- Spreads from one computer to another, leaving infections as it travels
15
Q
What are the types of malware?
A
- Viruses
- Worms
- Trojan Horses
16
Q
What is worms?
A
- Similar to viruses in that they replicate functional copies of themselves and can cause the same type of damage.
17
Q
What is the difference between viruses and worms?
A
- Viruses need to spread from an infected host file
- While worms are standalone software and do not require a host program or human help to propagate
18
Q
What is Trojan Horses?
A
- Harmful piece of software that looks legimate
19
Q
Do trojan horses reproduce by infectting other files?
A
- No
- It must spread through user interaction ( Opening and email attachment , Downloading a file from the internet )
20
Q
List out 3 major categories for network attacks
A
- Reconaissance Attacks
- Discovery and Mapping of Systems, Services or Vulnerabilities
- Access Attacks
- The unauthorized manipulation of data system access, or user privileges
- Denial Of Service
- The disabling or corruption of networks, systems, or services
21
Q
List out the 4 types of access attacks
A
- Password Attacks
- Trust Exploitation
- Port Redirection
- Man-in-the middle
22
Q
How does attacker attacks password?
A
- Brute Force
- Trojan Horse
- Packet Sniffers
23
How does attacker uses trust exploitation for attacking?
1. A threat actor uses unauthorized privileges to gain access to a system, possibly compromising the target
24
How does attacker users port direction for attacking?
1. A threat actor compromised system as a base for attacks against other targets.
* A threat actor using SSH ( Port 22 ) to connect to a compromised host A. Host A is trusted by Host B and, therefore, the threat actor can use Telnet ( port 23 ) to access it
25
How does attacker uses man-in-the middle for attacking?
1. The threat actor is positional in between two legitimate entities in order to rad or modify the date that passes between the 2 parties
26
What is teh most publicized form of attack and among the most difficult to eliminate?
1. Denial of Service Attack
27
What is a network or zombie PC called?
1. Botnet
28
List out the devices and services implemented to protect and organization's users and assets against TCP/IP threats
1. VPN
2. ASA Firewall
3. IPS
4. ESA / WSA
5. AAA Server
29
What is one of the most effective ways of protecting against data loss?
1. Keep Backups
* Should be performed on a regular basis as identified in the security policy
30
List out the backup considerations ( 4 )
1. Frequency ( Backup on a regular basis )
2. Storage
3. Security
4. Validation ( Strong password )
31
What is the most effective way to mitigate a worm attack ?
1. Download security updates from the OS vendor and patch all vulnerable systems
* One solution to the management of critical security patches is to make sure all end systems automatically download updates
32
What does Authentication, Authorization and Accounting Network Security ( AAA Server ) primary purposes?
1. Set up access control on network devices
* A way to control who is permitted to access a network ( authenticate ) what actions they perform while accessing the network and making a record of what was done while they are there ( accounting )
33
List out the types of firewalls
1. Packet Filtering
2. Application Filtering
3. URL Filtering
4. Stateful Packet Inspection ( SPI )
- Incoming packets must be legitimate responses to requests from internal hosts. Unsolicited packets are blocked unless permitted speci fically. SPI can also include the capability to recodnize and filter out specific types of attacks , such as denial of service ( DoS )
34
Why securing endpoint devices is one of the most challenging jobs of a network administrator?
1. It involves human nature
* A company must have well-documented policies in place and employees must be aware of these rules
* Often include the use of antivirus software and host intrison prevention
35
List out some steps that should be taken that apply to most operating system
1. Default usernames and passwords should be changed immediately
2. Access to system resources should be restricted to only the individuals that are authorized to use those resources
3. Any unecessary services and applications should be turned off and uninstalled when possible
4. Ofen, devices shipped fromthe manufacturer have been sitting in a warehouse for a period of time and do not have the most up-to-date patches installed. It is important to update any software and install any security patches prior to implementation
36
List out the standard guidelines for a strong password
1. Use a password length of at least eight characters, preferably 10 or more characters.
2. Make passwords complex. Include a mix of uppercase and lowercase letters, numbers, symbols, and spaces, if allowed.
3. Avoid passwords based on repetition, common dictionary words, letter or number sequences, usernames, relative or pet names, biographical information, such as birthdates, ID numbers, ancestor names, or other easily identifiable pieces of information.
4. Deliberately misspell a password. For example, Smith = Smyth = 5mYth or Security = 5ecur1ty.
5. Change passwords often. If a password is unknowingly compromised, the window of opportunity for the threat actor to use the password is limited.
6. Do not write passwords down and leave them in obvious places such as on the desk or monitor.
37
