Week 3 - Intruders and Firewalls Flashcards
What are the 3 types of network intruders?
- Masquerader
Unauthorised user
Penetrates systems access control - Misfeasor
Misbehaving insider
Accesses unauthorized data/information; Misuses authorized privileges - Clandestine User
Outsider and/or Insider
Seizes supervisory control to avoid auditing
What are some examples of intrusions?
- Performing a remote root compromise of an e-mail server
- Defacing a Web server
- Guessing and cracking passwords
- Copying a database containing credit card numbers
- And many more!
What are 3 intruder behaviour patterns?
- Hackers:
- Often target opportunities and share information with others.
- Can be detected by IDSs, IPSs, CERTs. - Criminals:
- Target specific victims. - Insider Attacks:
- Pose significant detection challenges, as insiders have access and knowledge of the target system’s structure and content.
What are 4 intrusion technique examples?
- Guessing Attacks
Exhaustively try all short passwords (those of one to three characters). - Trojan Horse
Use a Trojan horse to bypass restrictions on access. - Physical Attacks
Tap the line between a remote user and the host system - Exploiting Attacks
Buffer overflow on a program that runs with certain privileges
What are the two intrusion detection approaches?
The two intrusion detection approaches are:
- Statistics-based:
Method:
- Collect data on legitimate user behaviour.
- Use statistical tests to predict behaviour.
- Effective against masqueraders.
- Ineffective against misfeasors. - Rule-based (Signature-based):
Method:
- Define rules to classify behaviour as intruder or legitimate.
- Effective at detecting penetrations.
What are the two different types of audit records?
The two different types of audit records are:
- Native Audit Records: Capture raw system user activities without requiring additional software. Advantage: No need for extra data collection. Disadvantage: May lack necessary information.
- Detection-Specific Audit Records: Generate only the information required by Intrusion Detection Systems, including subject, action, object, exception condition, resource usage, and timestamp.
What are honeypots?
Honeypots are decoy systems that divert attackers from critical infrastructure, lacking production value but collecting attacker activity. Placed at multiple locations, like outside the external firewall, externally available servers (e.g., web, email), and fully internal machines, they entice attackers to linger for admin response by appearing valuable.
What are the 4 intrusion detection outcomes?
Intrusion Detection Outcomes:
- True Positive: Correctly detect intrusion.
- True Negative: Correctly detect non-intrusion.
- False Positive: Incorrectly detect non-intrusion as intrusion.
- False Negative: Incorrectly detect intrusion as non-intrusion.
What is the base rate fallacy?
Base-Rate Fallacy of Intrusion Detection Systems:
Goal: Detect most intrusions while maintaining a low false alarm rate.
Challenge: Balancing high detection rates with low false alarms is difficult due to inherent probabilities.
What are the different kinds of password vulnerabilities/attacks?
Offline Dictionary Attack:
Method: Compares hashed commonly used passwords with those in the password file.
Countermeasures:
Prevent unauthorized access to the password file.
Identify compromise.
Specific Account Attack (Brute-force):
Method: Brute-force guessing on specific accounts.
Countermeasure: Limit the number of login attempts.
Popular Password Attack & Single User Guessing:
Method: Targets common passwords or guesses passwords for a single user.
Countermeasure: Prevent the use of common passwords.
Workstation Hijacking:
Method: Waits for unattended workstations.
Countermeasure: Automatically log out after inactivity.
Exploiting User Mistakes:
Method: Exploits user errors like writing down passwords.
Countermeasure: Provide proper training and use intrusion detection.
Exploiting Multiple Password Use:
Method: Multiple devices sharing the same password.
Countermeasure: Prohibit the use of the same password.
Electronic Monitoring:
Method: Monitors plaintext password transfers.
Countermeasure: Use encryption, though not always efficient.
How do hashed passwords work?
Hashed passwords are created by converting user passwords into unique strings of characters using a cryptographic hash function, which are then stored in the system. During authentication, the entered password is hashed and compared to the stored hash, allowing access if they match.
What are the 4 user password choices?
The User Password Choices are:
Education: Avoid common passwords, especially in large user populations.
Computer-generated passwords offer strong security but are difficult to remember.
Reactive password checking periodically scans for weak passwords, though efficiency can be an issue.
Proactive password checking enhances security by assessing password strength during setup.
What is a firewall?
A firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks, helping to prevent unauthorized access, malicious attacks, and the spread of malware.
What are the characteristics of a firewall?
Firewall Characteristics:
Definition: Implements an access policy to regulate network traffic.
Design Goals:
All traffic between internal and external networks passes through the firewall.
Only authorized traffic, as per the security policy, is allowed.
The firewall itself is resistant to penetration.
Filtering Criteria:
IP addresses, protocol values.
Source/destination IP address and port number.
Specific services.
Application protocol and data control.
User identity for insider control.
Network activity, such as time and requests.
What is the scope and limitations of a firewall?
Firewall Scope & Limitations
Firewall Scope:
- Acts as a single checkpoint to block unauthorized users and monitor security events.
- Provides functions like network address translation, auditing Internet usage, and supporting virtual private networks.
Limitations:
- Ineffective against attacks bypassing firewalls.
- Offers partial protection against internal threats.
- Unable to secure improperly secured wireless LANs.
- Does not prevent infection of portable devices externally and subsequent internal attachment.
