3.3 Flashcards

Question

What is MAC filtering?

Answer 1

-Media Access Control --The "hardware" address -Limit access through the physical hardware address --Keeps the neighbors out --Additional administration with visitors -Easy to find working MAC addresses through wireless LAN analysis --MAC addresses can be spoofed --Free open-source software

Answer 2

-The network isn't available --Or the device isn't accesssible from the network -Most devices have a seperate management interface --Usually a serial connection / USB -Connect a modem --Dial-in to manage the device -Console router / comm server --Out-of-band access for multiple devices --Connect to the console router, then choose where you want to go

Answer 3

-Quality of Service -Many different devices --Desktop, laptop, VoIP phone, mobile devices -Many different applications --Mission critical applications, streaming video, video, streaming audio -Different apps have different network requirements --Voice is real-time --Recorded streaming video has a buffer --Database application is interactive -Some applications are "more important" than others --Voice traffic needs to have priority over YouTube --Prioritize traffic performance --Voice over IP traffic has priority over web-browsing --Prioritize by maximum bandwidth, traffic rate, VLAN, etc. -Quality of service --Describes the process of controlling traffic flows -Many different methods --Across many different topologies

Answer 4

-More IP address space --More difficult to IP/port scan (but not impossible) --The tools already support IPv6 -No need for NAT --NAT is not a security feature -Some attacks disappear --No ARP, so no ARP spoofing -New attacks will appear --For example, Neighbor Cache Exhaustion

Answer 5

-Intercept network traffioc --Send a copy to a packet capture device -Physical Taps --Disconnect the link, put a tap in the middle --Can be an active or passive tap -Port Mirror --Port Redirection, SPAN (Switched Port ANalyzer) --Software-based tap --Limited functionality, but can work well in a pinch

Answer 6

-File Integrity Monitoring -Some files change all the time --Some files should NEVER change -Monitor important operating system and application files --Identify when changes occur -Windows - SFC (System file Checker) -Linux - Tripwire -Many host-based IPS options

Answer 7

-Filter traffic by port number or application --Traditional vs. NGFW firewalls -Encrypt traffic --VPN between sites -Most firewalls can be layer 3 devices (routers) --Often sits on the ingress/egress of the network --Network Address Translation (NAT) functionality --Authenticate dynamic routing communication

Answer 8

-Does not keep track of traffic flows --Each packet is individually examined, regardless of past history --Traffic sent outside of an active session will traverse a stateless firewall -- one that doesn't store information about the current state of a network connection.

Answer 9

-Stateful firewalls remember the "state" of the sessions --Everything within a valid flow is allowed --a kind of firewall that keeps track and monitors the state of active network connections while analyzing incoming traffic and looking for potential traffic and data risks.

Answer 10

-Unified Threat Management (UTM ) / Web security gaeway -All in one security appliance --URL filter / Content Inspection --Malware Inspection --Spam filter --CSU/DSU --Router, Switch --Firewall --IDS/IPS --Bandwidth shaper --VPN endpoint

Answer 11

-Web Application Firewall -Not like a "normal" firewall --Applies rules to HTTP/HTTPS conversations -Allow or deny based on expected input --Unexpected input is a common method of exploiting an application -SQL injection --Add your own commands to an application's SQL query -A major focus of Payment Card Industry Data Security Standard (PCI DSS)

Answer 12

-Open-Source vs. Proprietary --Open-source provides traditional firewall functionality --Proprietary features include application control and high-speed hardware -Hardware vs. software --Purpose-built hardware provides efficient and flexible connectivity options --Software-based firewalls can be installed almost anywhere -Appliance vs. host-based vs virtual --Appliances provide the fastest throughput --Host-based firewalls are application-aware and can view non-encrypted data --Virtual firewalls provide valuable East/West network security

Answer 13

-Control at the edge --Your internet link --Managed primarily through firewall rules --Firewall rules rarely change -Access Control --Control from wherever you are ==inside or outside --Access can be based on man rules ==By user, group, location, application, etc. --Access can be easily revoked or changed ==Change your security posture at any time

Answer 14

-Persistent agents --Permanently installed onto a system --Periodic updates may be required -Dissolvable agents --No installation is required --Runs during the posture assessment --Terminates when no longer required -Agentless NAC --Integrated with Active Directory --Checks are made during login and logoff --Can't be scheduled

Answer 15

-Sits between the users and the external network -Receives the users requests and sends the request on their behalf (the proxy) -Useful for caching information, access control, URL filtering, content scanning -Applications may need to know how to use the proxy (explicit) -Some proxies are invisible (transparent)

Answer 16

- One of the simplest "proxies" is NAT --A network-level proxy -Most proxies in use are application proxies --The proxy understands the way the application works -A proxy ay only know one application --HTTP -Many proxies are multipurpose proxies --HTTP, HTTPS, FTP, etc.

Answer 17

-An "Internal Proxy" --Commonly used to protect and control user access to the internet

Answer 18

-Inbound traffic from the internet to your internal service

Answer 19

-A third-party, uncontrolled proxy --Can be a significant security concern -Often used to circumvent existing security controls

Answer 20

-Examine a copy of the traffic --Port mirrir (SPAN), network tap - No way to block (prevent) traffic

Answer 21

-When malicious traffic is identified, IPS sends TCP RST (reset) frames --After-the-fact --Limited UDP response available

Answer 22

-IDS/IPS sits physically inline --All traffic passes through the IDS/IPS

Answer 23

-Malicious traffic is immediately identified --Dropped at the IPS --Does not proceed through the network

Answer 24

-Signature-based --Look for a perfect match -Anomaly-based --Build a baseline of what's "normal" -Behavior-based --Observe and report -Heuristics --Use artificial intelligence to identify

Answer 25

-Access secure network zones --Provides an access mechanism to a protected network -Highly-secured device --Hardened and monitored -SSH / Tunnel / VPN to the jump from there -A significant security concern --Compromise to the jump server is a significant breach

Answer 26

-Hardware Security Module -Used in large environments --Clusters, redundant power -High-end cryptographic hardware --Plug-in card or separate hardware device -Key backup --Secured storage -Cryptographic accelerators --Offload that CPU overhead from other devices

3.3 Flashcards

(50 cards)