Module 3 Flashcards by parabellum smith

are responsible for maintaining data assurance for an organization and ensuring the integrity and confidentiality of information.

Network security professionals

How well did you know this?

Not at all

Perfectly

Security specialist job roles within an enterprise include

Chief Information Officer (CIO),
Chief Information Security Officer (CISO),
Security Operations (SecOps) Manager,
Chief Security Officer (CSO),
Security Manager, and
Network Security Engineer.

How well did you know this?

Not at all

Perfectly

Regardless of job titles, network security
professionals must always stay one step ahead of the hackers:

They must constantly upgrade their skill set to keep abreast of the latest threats.
They must attend training and workshops.
They must subscribe to real-time feeds regarding threats.
They must peruse security websites daily.
They must maintain familiarity with network security organizations. These organizations often have
the latest information on threats and vulnerabilities.

How well did you know this?

Not at all

Perfectly

Network Intelligence Communities

SANS
Mitre
FIRST Forum of Incident Response and Security Teams
SecurityNewsWire
(ISC)2 International Information Systems Security Certification Consortium
CIS Center for Internet Security

How well did you know this?

Not at all

Perfectly

Institute resources are largely free upon request and include:

The Internet Storm Center - the popular internet early warning system
NewsBites, the weekly digest of news articles about computer security.
@RISK, the weekly digest of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked
Flash security alerts
Reading Room - more than 1,200 award-winning, original research papers.
SANS also develops security courses.

SANS

SysAdmin, Audit, Network, Security (SANS)

How well did you know this?

Not at all

Perfectly

maintains a list of common vulnerabilities and exposures (CVE) used by prominent security organizations making it easier for them to share data. The CVE serves as a dictionary of common names (i.e., CVE Identifiers) for known cybersecurity vulnerabilities.

The Mitre Corporation

How well did you know this?

Not at all

Perfectly

is a security organization that brings together a variety of computer security incident response teams from government, commercial, and educational organizations to foster cooperation and coordination in information sharing, incident prevention and rapid reaction.

Forum of Incident Response and Security Teams (FIRST)

How well did you know this?

Not at all

Perfectly

A security news portal that aggregates the latest breaking news pertaining to alerts, exploits, and vulnerabilities.

SecurityNewsWire

How well did you know this?

Not at all

Perfectly

provides vendor neutral education products and career services to more than 75,000+ industry professionals in more than 135 countries.

International Information Systems Security Certification Consortium (ISC2)

How well did you know this?

Not at all

Perfectly

is a focal point for cyber threat prevention, protection, response, and recovery for state, local, tribal, and territorial (SLTT) governments through the Multi-State Information Sharing and Analysis Center (MS-ISAC). The MS-ISAC offers 24x7 cyber threat warnings and advisories, vulnerability identification, and mitigation and incident response.

Center for Internet Security (CIS)

How well did you know this?

Not at all

Perfectly

To remain effective, a network security professional must:

Keep abreast of the latest threats -
This includes subscribing to real-time feeds regarding threats, routinely perusing security-related websites, following security blogs and podcasts, and more.

Continue to upgrade skills -
This includes attending security-related training, workshops, and conferences.

How well did you know this?

Not at all

Perfectly

Information security deals with protecting information
and information systems from unauthorized access,
use, disclosure, disruption, modification, or
destruction. The ___ serves as a conceptual
foundation for the field.

CIA Triad

How well did you know this?

Not at all

Perfectly

Only authorized individuals, entities, or processes can access sensitive information.

Confidentiality

How well did you know this?

Not at all

Perfectly

This refers to the protection of data from unauthorized alteration.

Integrity

How well did you know this?

Not at all

Perfectly

Authorized users must have uninterrupted access to the network resources and data that they require.

Availability

How well did you know this?

Not at all

Perfectly

There are 14 network security domains specified by the International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC).

Described by ISO/IEC 27001, these 14 domains serve to organize, at a high level, the vast realm of information and activities under the umbrella of network security.

These domains have some significant parallels with domains defined by the Certified Information Systems Security Professional (CISSP) certification.

CONT

The 14 domains are intended to serve as a common basis for developing organizational security standards and effective security management practices.

They also help to facilitate communication between organizations.

These 14 domains provide a convenient separation of the elements of network security. While it is not important to memorize these 14 domains, it is important to be aware of their existence and formal declaration by the ISO. In the ISO 27001 standard these are known as the 14 control sets of Annex A. They will serve as a useful reference in your work as a network security professional.

How well did you know this?

Not at all

Perfectly

14 Network Security Domain

Information Security Policies
Organization of Information Security
Human Resources Security
Asset Management
Access Control
Cryptography
Physical and Environmental Security
Operations Security
Communications Security
System Acquisition, Development, and Maintenance
Supplier Relationships
Information Security Incident Management
Business Continuity Management
Compliance

How well did you know this?

Not at all

Perfectly

This annex is designed to ensure that security policies are created, reviewed, and maintained.

Information Security Policies

How well did you know this?

Not at all

Perfectly

This is the governance model set out by an organization for information security. It assigns responsibilities for information security tasks within an organization.

Organization of Information Security

How well did you know this?

Not at all

Perfectly

This addresses security responsibilities relating to employees joining, moving within, and leaving an organization.

Human Resources Security

How well did you know this?

Not at all

Perfectly

This concerns the way that organizations create an inventory of and classification scheme for information assets.

Asset Management

How well did you know this?

Not at all

Perfectly

This describes the restriction of access rights to networks, systems, applications, functions, and data.

Access Control

How well did you know this?

Not at all

Perfectly

This concerns data encryption and the management of sensitive information to protect confidentiality, integrity, and availability of data.

Cryptography

How well did you know this?

Not at all

Perfectly

This describes the protection of the physical computer facilities and equipment within an organization.

Physical and Environmental Security

How well did you know this?

Not at all

Perfectly

This describes the management of technical security controls in systems and networks including malware defenses, data backup, logging and monitoring, vulnerability management, and audit considerations. This domain is also concerned with the integrity of software that is used in business operations.

Operations Security

How well did you know this?

Not at all

Perfectly

This concerns the security of data as it is communicated on networks, both within an organization or between and organization and third parties such as customers or suppliers.

Communications Security

How well did you know this?

Not at all

Perfectly

This ensures that information security remains a central concern in an organization’s processes across the entire lifecycle, in both private and public networks.

System Acquisition, Development, and Maintenance

How well did you know this?

Not at all

Perfectly

This concerns the specification of contractual agreements that protect an organization’s information and technology assets that are accessible by third parties that provide supplies and services to the organization.

Supplier Relationships

How well did you know this?

Not at all

Perfectly

This describes how to anticipate and respond to information security breaches.

Information Security Incident Management

How well did you know this?

Not at all

Perfectly

This describes the protection, maintenance, and recovery of business-critical processes and systems.

Business Continuity Management

How well did you know this?

Not at all

Perfectly

This describes the process of ensuring conformance with information security policies, standards, and regulations.

Compliance

How well did you know this?

Not at all

Perfectly

are the guidelines that are developed by an organization to govern its actions. The policies define standards of correct behavior for the business and its employees. In networking, policies define the activities that are allowed on the network. This sets a baseline of acceptable use. If behavior that violates business policy is detected on the network, it is possible that a security breach has occurred.

Business policies

How well did you know this?

Not at all

Perfectly

These policies establish the rules of conduct and the responsibilities of both employees and employers.

Policies protect the rights of workers as well as the business interests of employers.

Depending on the needs of the organization, various policies and procedures establish rules regarding employee conduct, attendance, dress code, privacy and other areas related to the terms and conditions of employment.

Company policies

How well did you know this?

Not at all

Perfectly

These policies are created and maintained by human resources staff to identify employee salary, pay schedule, employee benefits, work schedule, vacations, and more.

They are often provided to new employees to review and sign.

Employee policies

How well did you know this?

Not at all

Perfectly

These policies identify a set of security objectives for a company, define the rules of behavior for users and administrators, and specify system requirements.

These objectives, rules, and requirements collectively ensure the security of a network and the computer systems in an organization.

Much like a continuity plan, a security policy is a constantly evolving document based on changes in the threat landscape, vulnerabilities, and business and employee requirements.

Security policies

How well did you know this?

Not at all

Perfectly

are used to inform users, staff, and managers of an organization’s requirements for protecting technology and information assets. A______also specifies the mechanisms that are needed to meet security requirements and provides a baseline from which to acquire, configure, and audit computer systems and networks for compliance.

Security policies

How well did you know this?

Not at all

Perfectly

A comprehensive security policy has a number of benefits, including the following:

Demonstrates an organization’s commitment to security

Sets the rules for expected behavior

Ensures consistency in system operations, software and hardware acquisition and use, and maintenance

Defines the legal consequences of violations

Gives security staff the backing of management

How well did you know this?

Not at all

Perfectly

Specifies authorized persons that can have access to network resources and identity verification procedures.

Identification and authentication policy

How well did you know this?

Not at all

Perfectly

Ensures passwords meet minimum requirements and are changed regularly.

Password policies

How well did you know this?

Not at all

Perfectly

Identifies network applications and uses that are acceptable to the organization. It may also identify ramifications if this policy is violated.

Acceptable Use Policy (AUP)

How well did you know this?

Not at all

Perfectly

Identifies how remote users can access a network and what is accessible via remote connectivity.

Remote access policy

How well did you know this?

Not at all

Perfectly

Specifies network device operating systems and end user application update procedures.

Network maintenance policy

How well did you know this?

Not at all

Perfectly

Describes how security incidents are handled.

Incident handling procedures

How well did you know this?

Not at all

Perfectly

One of the most common security policy components is an ____. This can also be referred to as an _____ This component defines what users are allowed and not allowed to do on the various system components. This includes the type of traffic that is allowed on the network. The ___ should be as explicit as possible to avoid misunderstanding.

AUP / Appropriate use policy

How well did you know this?

Not at all

Perfectly

Many organizations must now also support _____. This enables employees to use
their own mobile devices to access company systems, software, networks, or information. This can bring an
increased information security risk because ____ can lead to data breaches and greater liability for the
organization.

Bring Your Own Device (BYOD)

How well did you know this?

Not at all

Perfectly

BYOD security best practices to help mitigate BYOD vulnerabilities are:

Password protected access
Manually control wireless connectivity
Keep updated
Back up data
Enable “Find my Device”
Provide antivirus software
Use Mobile Device Management (MDM)

How well did you know this?

Not at all

Perfectly

BYOD provides several key benefits to enterprises, including

increased productivity,
reduced IT and operating costs,
better mobility for employees, and
greater appeal when it comes to hiring and retaining employees.

How well did you know this?

Not at all

Perfectly

Use unique passwords for each device and account.

Password protected access

How well did you know this?

Not at all

Perfectly

Turn off Wi-Fi and Bluetooth connectivity when not in use. Connect only to trusted networks.

Manually control wireless connectivity

How well did you know this?

Not at all

Perfectly

Always keep the device OS and other software updated. Updated software often contains security patches to mitigate against the latest threats or exploits.

Keep updated

How well did you know this?

Not at all

Perfectly

Enable backup of the device in case it is lost or stolen.

Back up data

How well did you know this?

Not at all

Perfectly

Subscribe to a device locator service with remote wipe feature.

Enable “Find my Device”

How well did you know this?

Not at all

Perfectly

Provide antivirus software for approved BYOD devices.

Provide antivirus software

How well did you know this?

Not at all

Perfectly

MDM software enables IT teams to implement security settings and software configurations on all devices that connect to company networks.

Use Mobile Device Management (MDM) software

How well did you know this?

Not at all

Perfectly

Network security professionals must be familiar with the laws and codes of ethics that are binding on ___ professionals.

Information Systems Security (INFOSEC)

A common analogy used to describe a defense-in-depth approach is called

“the security onion.”

Security Onion

Hardened devices
Authentication, Authorization, and Accounting (AAA)
Content filtering
Intrusion Prevention Systems (IPS)
Firewall

The changing landscape of networking, such as the evolution of borderless networks, has changed this analogy to the ____ which benefits the threat actor.

threat actors no longer have to peel away each layer. They only need to remove certain _____ The bonus is that each “leaf” of the network may reveal sensitive data that is not well secured.

“security artichoke”

“artichoke leaves.”

Security Artichoke

Passwords
Client-side Attacks
Databases
Web Applications
Buffer Overflows

involves using different types of tools to test the network and end devices to validate the
security of the network.

Ethical hacking

uses hacker techniques and tools to evaluate the strength of network security measures. Cybersecurity personnel must also know how to use these tools when performing
network ____

Penetration testing

are an integrated security solution that combines traditionally independent tools into a suite of tools that are made to work together

Data Security Platforms (DSP)

One such DSP _____ is a cloud-based security operations
platform that enables organizations to integrate many
security functionalities into a single platform. ____
provides event management, network behavior
analytics, advanced threat detection, and incident
security orchestration, automation, and response
(SOAR) for response to threats as they are detected.

FireEye Helix

platform works with
diverse products that combine to safeguard your
network, users and endpoints, cloud edge, and
applications. SecureX functionality is built in to a
large and diverse portfolio of Cisco security
products including next-generation firewalls, VPN,
network analytics, identity service engine,
advanced malware protection (AMP), and many
other systems that work to secure all aspects of a
network. SecureX also integrates a range of thirdparty security tools.

Cisco SecureX

___ is one of the largest commercial threat
intelligence teams in the world. The goal of ___ is to help
protect enterprise users, data, and infrastructure from
active adversaries. The ____ team collects information
about active, existing, and emerging threats.____ then
provides comprehensive protection against these attacks
and malware to its subscribers.

Cisco Talos Threat Intelligence Group

Defending / Securing the Network

Develop a written security policy for the company.

Educate employees about the risks of social engineering, and develop strategies to validate identities over the phone, via email, or in person.

Control physical access to systems.

Use strong passwords and change them often.

Encrypt and password-protect sensitive data.

Implement security hardware and software such as firewalls, IPSs, virtual private network (VPN) devices, antivirus software, and content filtering.

Perform backups and test the backed-up files on a regular basis.

Shut down unnecessary services and ports.

Keep patches up-to-date by installing them weekly or daily, if possible, to prevent buffer overflow and privilege escalation attacks.

Perform security audits to test the network.

Mitigating Malware

Antivirus software (virus and trojan) helps prevent hosts from getting infected and spreading malicious code. It requires much more time to clean up infected computers than it does to maintain up-to-date antivirus software and antivirus definitions on the same machines.

Antivirus are host-based. antivirus software helps prevent hosts from getting infected and spreading malicious code.

These products are installed on computers and servers to detect and eliminate viruses.
However, they do not prevent viruses from entering the network.

Another way to mitigate
malware threats is to prevent malware files from entering the network at all. Security devices at
the network perimeter can identify known malware files based on their indictors of compromise.
The files can be removed from the incoming data stream before they can cause an incident.

Mitigating Worms (4 phase)

Containment
Inoculation
Quarantine
Treatment

involves limiting the spread of a worm infection to areas of the network that are already affected. This requires compartmentalization and segmentation of the network to slow down or stop the worm and to prevent currently infected hosts from targeting and infecting other systems. ______ requires using both outgoing and incoming ACLs on routers and firewalls at control points within the network.

The containment phase

runs parallel to or subsequent to the containment phase. During the inoculation phase, all uninfected systems are patched with the appropriate vendor patch. The ____ process further deprives the worm of any available targets.

The inoculation phase

involves tracking down and identifying infected machines within the contained areas and disconnecting, blocking, or removing them. This isolates these systems appropriately for the treatment phase.

The quarantine phase

involves actively disinfecting infected systems. This can involve terminating the worm process, removing modified files or system settings that the worm introduced, and patching the vulnerability the worm used to exploit the system. Alternatively, in more severe cases, the system may need to be reinstalled to ensure that the worm and its by-products are removed.

The treatment phase

Mitigating Reconnaissance Attacks

Implementing authentication to ensure proper access.

Using encryption to render packet sniffer attacks useless.

Using anti-sniffer tools to detect packet sniffer attacks.

Implementing a switched infrastructure.

Using a firewall and IPS.

are typically the precursor to other attacks that have the intent of gaining unauthorized access to a network or disrupting network functionality.

Reconnaissance attacks

provides intrusion prevention in a standalone device. Additionally, the Cisco Integrated Service Router supports network-based intrusion prevention through the Cisco IOS security image.

Cisco’s Adaptive Security Appliance (ASA)

is also effective for mitigating packet sniffer attacks. If traffic is _____, using a packet sniffer is of little use because captured data is not readable.

Encryption

____ detect changes in the response time of hosts to determine whether the hosts are processing more traffic than their own traffic loads would indicate. While this does not completely eliminate the threat, as part of an overall mitigation system, it can reduce the number of instances of threat.

Anti-sniffer software and hardware tools

It is impossible to mitigate port scanning, but using an _____ can limit the information that can be discovered with a port scanner.

intrusion prevention system (IPS) and firewall

Mitigating Access Attacks

Use strong passwords -
Strong passwords are at least eight characters and contain uppercase letters, lowercase letters, numbers, and special characters.

Disable accounts after a specified number of unsuccessful logins has occurred -
This practice helps to prevent continuous password attempts.

The network should also be designed using the principle of minimum trust.

True

is a critical component of any modern secure network.

Cryptography

Educate employees about the risks of social
engineering, and develop strategies to validate identities over the phone, via email, or in
person. _____ has become increasingly common.

Multifactor authentication (MFA)

Using ___ for remote access to a network is recommended. Routing protocol traffic should also be ____

encryption

One of the first signs of a DoS attack is a large number of user complaints about
unavailable resources or unusually slow network performance. A network utilization graph
showing unusual activity could indicate a DoS attack. To minimize the number of attacks,
a ___ should be running at all times.

network utilization software package

Historically, many DoS attacks were sourced from spoofed addresses. Cisco routers and
switches support many antispoofing technologies, such as

port security,
Dynamic Host Configuration Protocol (DHCP) snooping,
IP Source Guard,
Dynamic Address Resolution Protocol (ARP) Inspection, and
access control lists (ACLs).

____ provides comprehensive guidelines for protecting the network infrastructure. These guidelines form the foundation for continuous delivery of service.

The Cisco Network Foundation Protection (NFP) framework

NFP logically divides routers and switches into three functional areas,

Control Plane
Management Plane
Data Plane (Forwarding Plane)

Responsible for routing data correctly. Control plane traffic consists of device-generated packets required for the operation of the network itself, such as ARP message exchanges, or OSPF routing advertisements.
Control plane -

Control plane

Responsible for managing network elements. Management plane traffic is generated either by network devices or network management stations using processes and protocols such as Telnet, SSH, TFTP, FTP, NTP, AAA, SNMP, syslog, TACACS+, RADIUS, and NetFlow.

Management plane

Responsible for forwarding data. Data plane traffic normally consists of user-generated packets being forwarded between end devices. Most traffic travels through the router, or switch, via the data plane.

Data plane (Forwarding plane)

exchange of routing information <—–> routing protocol —–> ip routing protocol

Control plane

incoming IP packet —> IP forwarding table —> outgoing IP packet

ip routing table —-> ip forwarding table

Data plane

Management processes <—- Management Sessions

Management plane

______ consists of device-generated packets required for the operation of the network itself.

Control plane traffic

Securing the Control Plane

Routing protocol authentication
Control Plane Policing (CoPP)
AutoSecure

prevents a router from accepting fraudulent routing updates. Most routing protocols support neighbor authentication.

Routing protocol authentication or neighbor authentication

is a Cisco IOS feature designed to allow users to control the flow of traffic that is handled by the route processor of a network device.

Control Plane Policing (CoPP)

can lock down the management plane functions and the forwarding plane services and functions of a router.

AutoSecure

is designed to prevent unnecessary traffic from overwhelming the route processor. The ____ feature treats the control plane as a separate entity with its own ingress (input) and egress (output) ports. A set of rules can be established and associated with the ingress and egress ports of the control plane.

CoPP Control Plane Policing

Securing the Management Plane

Login and password policy
Present legal notification
Ensure the confidentiality of data
Role-based access control (RBAC)
Authorize actions
Enable management access reporting

Restricts device accessibility. Limits the accessible ports and restricts the “who” and “how” methods of access.

Displays legal notices. These are often developed by legal counsel of a corporation.

Present legal notification

Protects locally stored sensitive data from being viewed or copied. Uses management protocols with strong authentication to mitigate confidentiality attacks aimed at exposing passwords and device configurations.

Ensure the confidentiality of data

Ensures access is only granted to authenticated users, groups, and services. RBAC and authentication, authorization, and accounting (AAA) services provide mechanisms to effectively manage access control.

Role-based access control (RBAC)

Restricts the actions and views that are permitted by any particular user, group, or service.

Authorize actions

Logs and accounts for all access. Records who accessed the device, what occurred, and when it occurred.

Enable management access reporting

is generated either by network devices or network
management stations using processes and protocols such as Telnet, SSH, and TFTP, etc. The _____ is a very attractive target to hackers.

Management plane traffic

____ restricts user access based on the role of the user. Roles are created according to job or task functions, and assigned access permissions to specific assets. Users are then assigned to roles, and are granted the permissions that are defined for that role.

RBAC Role based access control

In Cisco IOS, the role-based CLI access feature implements RBAC for ____ . The feature creates different “views” that define which commands are accepted and what configuration information is visible. For scalability, users, permissions, and roles are usually created and maintained in a central repository server. This makes the access control policy available to multiple devices. The central repository server can be a Cisco Identity Services Engine (ISE) which can provide authentication, authorization, and accounting (AAA) network services.

router management access

Securing the Data Plane

Blocking unwanted traffic or users

Reducing the chance of DoS attacks

Mitigating spoofing attacks

Providing bandwidth control

Classifying traffic to protect the Management and Control planes

consists mostly of user packets being forwarded through the router via the_____ .

Data plane traffic

Data plane security can be implemented using

ACLs,
antispoofing mechanisms, and
Layer 2 security features,

____ can also be used as an antispoofing mechanism by discarding traffic that has an invalid source address. This means that attacks must be initiated from valid, reachable IP addresses, which allows the packets to be traced to the originator of an attack.

ACLs

Features, such as___ can be used to complement the antispoofing strategy.

Unicast Reverse Path Forwarding (uRPF),

Layer 2 security tools are integrated into the Cisco Catalyst switches:

Port security
DHCP snooping
Dynamic ARP Inspection (DAI)
IP Source Guard (IPSG)

Prevents MAC address spoofing and MAC address flooding attacks.

Port security

Prevents client attacks on the DHCP server and switch.

DHCP snooping

Adds security to ARP by using the DHCP snooping table to minimize the impact of ARP poisoning and spoofing attacks.

Dynamic ARP Inspection (DAI)

Prevents spoofing of IP addresses by using the DHCP snooping table.

IP Source Guard (IPSG)

The ____ uses Control Plane Policing (CoPP) to allow users to control the flow of traffic that is handled by the route processor of a network device.

control plane

The information flow between in the _____ can be out-of-band (OOB), where information flows within a network on which no production traffic resides. It can also be in-band, where information flows across the enterprise production network, the internet, or both.

management plane

The ___ is responsible for applying ACLs such as whether traffic from hosts, networks, or users, can access the network.

data plane

The control plane is responsible for

routing protocol authentication,
route processor traffic (CoPP), and
AutoSecure.

The management plane is responsible for the following features:

login and password policy;
present legal notification;
data confidentiality;
role-based access control (RBAC);
action authorization; and
management access reporting.

The data plane is responsible for

ACLs and
port security that block unwanted traffic
as well as mitigating spoof attacks.

is the primary means of mitigating both virus and Trojan horse attacks. By using up-to-date antivirus software, the spread of viruses and Trojan horse attacks can be reduced.

Antivirus software

The CIA triad contains three components: _____ . It is a guideline for information security for an organization.

confidentiality, integrity, and availability

Which section of a security policy is used to specify that only authorized individuals should have access to enterprise data?

The identification and authentication policy section of the security policy typically specifies authorized persons that can have access to network resources and identity verification procedures.

Which security implementation will provide control plane protection for a network device?

routing protocol authentication

Control plane traffic such as ARP messages or routing protocol advertisements are generated by a network device in order to support network operations. Routing protocol authentication provides an extra measure of security to authenticate the source of routing updates. Encrypting remote access connections, utilizing the NTP protocol, and using AAA, are all measures implemented to secure management plane traffic.

What threat intelligence group provides blogs and podcasts to help network security professionals remain effective and up-to-date?

The Cisco Talos Group provides blogs and podcasts on security-related topics from a number of industry experts. These blogs and podcasts provide advice, research, and recommended mitigation techniques.

What worm mitigation phase involves actively disinfecting infected systems?

The four phases of worm mitigation are:
Containment
Inoculation
Quarantine
Treatment

Disinfecting systems is accomplished in the treatment phase and involves terminating the worm process, removing infected files, and patching vulnerabilities exploited by the worm.

With the evolution of borderless networks, which vegetable is now used to describe a defense-in-depth approach?

The artichoke is now used to provide a visual analogy to describe a defense-in-depth security approach. The onion used to be descriptive because the attacker would “peel away” each layer of the network defense mechanisms. Now the artichoke is used because a single petal or leaf can be moved or removed to reveal sensitive information.

How does BYOD change the way in which businesses implement networks?

BYOD provides flexibility in where and how users can access network resources

A BYOD environment requires an organization to accommodate a variety of devices and access methods. Personal devices, which are not under company control, may be involved, so security is critical. Onsite hardware costs will be reduced, allowing a business to focus on delivering collaboration tools and other software to BYOD users.

What functional area of the Cisco Network Foundation Protection framework uses protocols such as Telnet and SSH to manage network devices?

Management plane

There are three functional areas of the Cisco Network Foundation Protection (NFP) framework:

Control plane: Responsible for routing functions. Consists of the traffic generated by network devices to operate the network
Management plane: Responsible for managing network devices
Data (Forwarding) plane: Responsible for forwarding user data

What security tool allows a threat actor to hack into a wireless network and detect security vulnerabilities?

Aircrack-ng, Kismet, InSSIDer, KisMAC, Firesheep, and NetStumbler are examples of tools used to hack into a wireless network.

What is the primary function of SANS?

One of the primary functions of the SysAdmin, Audit, Network, Security (SANS) Institute is the maintenance of the Internet Storm Center early warning system.

What method can be used to mitigate ping sweeps?

blocking ICMP echo and echo-replies at the network edge

To mitigate ping sweeps, ICMP echo and echo-reply messages can be blocked on network edge routers. This does come at a cost. Because ICMP is also used for network diagnostic data, this diagnostic data will be blocked as well.

Brainscape's Knowledge GenomeTM

Module 3 Flashcards

Brainscape's Knowledge Genome^TM