4 Network Security Flashcards
(138 cards)
1
Q
2 basic network connection options
A
1 Wired
2 Wireless
2
Q
Ethernet cable =
A
RJ-45 connector (8 pin connector - 8 wires)
3
Q
Telephone connectors =
A
RJ-11(6 pins)
4
Q
Wi-Fi networks create -
A
wireless LANs
5
Q
Internet Protocol main responsibilities (2)
A
1 providing an addressing scheme (IP addresses) that uniquely identify computers on a network
2 delivering information in chunks known as packets
6
Q
3 TCP flags
A
1 SYN
2 ACK
3 FIN
7
Q
The order of TCP flags
A
1 SYN
2 SYN/ACK
3 ACK
8
Q
OSI Layer 7
A
7 Application
- determines how users interact with data
- web browsers, other client applications
9
Q
OSI Layer 6
A
6 Presentation
- translates characters/bits
- encryption/decryption
10
Q
OSI Layer 5
A
5 Session
- opening/maintaining/closing sessions between devices
11
Q
OSI Layer 4
A
4 Transport
- (TCP/UDP)
- creates connections between systems and transports data in a reliable manner
12
Q
OSI Layer 3
A
3 Network
- IP
- expands networks to many different nodes
13
Q
OSI Layer 2
A
2 Data Link
- (MACs)
- transfers data between 2 nodes connected to the same physical network
14
Q
OSI Layer 1
A
1 Physical
- responsible for sending bits over the network using cables, radio waves, fiber optics, etc
15
Q
7 OSI layers
A
7 Application
6 Presentation
5 Session
4 Transport
3 Network
2 Data Link
1 Physical
16
Q
4 TCP layers
A
4 Application Layer (session, presentation, and application)
3 Transport Layer (same)
2 Internet layer (network)
1 Network interface (physical and data link)
17
Q
IPv4 —- bit
A
32 bit, dotted quad, each number represented using 8 binary bits
18
Q
NAT
A
(router/firewall) translates private IP addresses to public before sending packets
19
Q
2 parts of an IP address
A
1 Network Portion (identifies the network that the device is connected to)
2 Host Portion (uniquely identifies the device on that network)
20
Q
Subnetting is
A
The process of dividing a network into smaller networks
- network interfaces on devices within a subnet can communicate directly
- routers facilitate communication between different subnets
21
Q
IPv6 —- bit
A
128 bit
- consist of eight groups of 4 hexadecimal numbers
- each number has 16 possible symbols (0-F)
22
Q
Network ports are represented using a ____ with _____ possible values
A
16 bit binary number, 65,536 (0 - 65,535)
23
Q
Well known ports (range)
A
0 -1023,
- ensures everyone on the internet will know how to find common services on a system
24
Q
Registered ports (range)
A
1024 - 49151
- application vendors may register their applications to use these ports
25
Dynamic ports (range)
49152 - 65535
- applications may use these on a temporary basis
26
21
FTP control (the FTP uses port 21 to transfer data between systems)
27
22
SSH (the secure shell protocol uses port 22 for encrypted administrative connections)
28
25
SMTP (exchange email between servers)
29
53
used by DNS
Domain Name Server - translates human-readable domain names into machine-readable IP address equivalents.
30
443
HTTPS
31
110
POP (allows clients to retrieve email on port 110)
32
Network communications using the NetBIOS protocol for Windows (ports)
137, 138, 139
33
IMAP (port)
143
34
RDP (Remote Desktop Protocol) (port)
3389 - similar purpose to SSH
35
3 types of networks that use some form of authentication to limit access:
1 Pre-shared keys (encryption)
2 Enterprise Authentication (uses individual usernames and passwords)
3 Captive Portals (provide authentication on unencrypted wireless networks)
36
Encryption function
- takes radio waves (an insecure communications technology) and makes it secure
37
WEP -
Encryption protocol
(Wired Equivalent Privacy)
- insecure (don’t use)
38
WPA -
(WiFi Protected Access)
- 1st version (2003)
- used TKIP (Temporal Key Integrity Protocol)
- no longer secure
39
WPA 2
(2004) (WiFi Protected Access v2)
- uses CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol)
- an encryption protocol based on the AES (Advanced Encryption Standard)
- some potential issues, but is widely used and still considered secure
40
WPA 3
(2020)
- supports CCMP but adds SAE (new)
- SAE (Simultaneous Authentication of Equals)
- SAE = a secure key exchange protocol based on the Diffie-Hellman technique
41
Ping uses
ICMP (Internet Control Message Protocol)
- sends an ICMP echo request packet “hello, are you there?”
- remote system sends back ICMP echo reply “yes, I’m here”
42
Ping troubleshooting steps (4)
1 Ping the remote system
2 Ping another system on the internet
3 Ping a system on your local network
3 Try the same process from a different computer
43
creates customized ping requests (customized packets)
HPing
44
Traceroute
- determines the network path (how packets travel) between two systems (hosts)
- each line shows 1 hop on the network path
- lines with * show hops (systems) that are not answering ICMP echo requests
45
- Windows command combining ping and tracert (traceroute) functionality
Pathping
46
3 types of malware
(Viruses, worms, trojans)
- malicious software
47
2 components of malware
1 propagation mechanism
2 payload
48
Virus spreads
based on some type of user action
49
Worm spreads
on its own by exploiting system vulnerabilities, without user interaction
- then uses the infected system as a base to infect other systems on the LAN or internet
50
Trojan
- pretend to be legitimate software
- program runs as expected
- but also carries malicious hidden payload
51
Botnet =
- a network of infected computers used for malicious purposes
- attackers steal computing power, storage, or network connectivity
52
All eavesdropping attacks require
some compromise of the communication path between a client and server (after the attacker gains either physical or logical access to a network)
53
Man-in-the-middle attack
- tricks the sending system during the initial communication
- attacker may reconfigure a network device
- or use DNS or ARP poisoning
54
Eavesdropping methods:
- Network device or cable tapping
- DNS or ARP poisoning
55
Replay attack
- captures encrypted authentication token/info and creates a separate authenticated connection
56
Replay attacks are defeated by
- using session tokens (limited time span) or timestamps (packets must be sent within a similar time window
57
SSL Stripping (a variation on eavesdropping attacks)
- exploits a vulnerability and tricks the users browser into sending unencrypted communications
- stripping the SSL or TLS protection off of the communication
58
Implementation attacks
- exploit a cryptographic system’s design or implementation flaws
59
Fault Injection
- the attacker attempts to compromise the integrity of a device by causing some type of external fault (high-voltage spike, high or low temperature, etc)
- the fault may cause a malfunction and cause the system to fail to encrypt data properly
60
IDS
IDS
- monitors and detects
- alerts administrators to suspicious activity
61
IDPS
- can alert or block depending on the policy (can take immediate corrective action)
- 2 types of errors - false positives and false negatives
62
2 different technologies to identify suspicious traffic
1 Signature-based (Rule-based)
- vulnerable to 0-day attacks
2 Heuristic Detection (Anomaly Detection, Behavior-based Detection)
- can detect 0-day attacks but has high false positive rates
63
IPS deployment models (2)
1 in-band (inline)
- single point of failure (vulnerability)
2 out-of-band (passive)
- can react by blocking future traffic, but can’t stop the initial attack because it only learns about it after it has been sent
64
Anti-malware Software (‘antivirus software) - uses 2 different mechanisms
1 Signature detection
2 Heuristic/behavior detection
- uses EDR solutions (Endpoint Detection and Response)
65
Vulnerability Scanning Tools (3 major categories)
1 Port Scanners
- probe for open network ports
- NMAP (Network Mapper)
2 Vulnerability Scanners
- probe ports for known vulnerabilities
- Nessus
3 Application Scanners
- probe deep into web applications and tests for security flaws
66
Data center air temperature
- use the expanded environmental envelope (64.4 - 80.6 F)
67
Data center humidity
- maintain dew point between 41.9 and 50 F
68
Fire Triangle
heat, oxygen, fuel
69
Security Zones
- firewalls segment networks into security zones to protect systems of differing security levels
70
Border Firewalls (typical model)
- have 3 network interfaces because they connect 3 different security zones together
1 untrusted network (internet)
2 trusted network (intranet)
3 DMZ
71
Zero Trust
(replacing implicit trust)
- systems do not gain any trust based solely on their network location
72
Extranet
- intranet segments extended to business partners
- example using a VPN to access the ERP system (Enterprise Resource Planning)
73
2 Honeynet
- decoy network designed to attract attackers
74
3 Ad Hoc Networks
- temporary network that may bypass security controls
- may be planned
- may be careless (employee sets up wireless access point for better signal)
75
East-West Traffic
- network traffic between systems located in the data center
-may be regulated by a firewall if it crosses security zones
- network traffic between systems located in the data center
-may be regulated by a firewall if it crosses security zones
76
North-South Traffic
- network traffic between systems in the data center and systems on the internet
77
Switches
- each switch port is connected to one end of a network cable,
- wireless access points (contain radios) are also connected via cables to switches
- switches are limited to creating local networks
- operate at OSI layer 2 (data link) where they work with MAC addresses only
78
Routers
- connect networks together using IP addresses (OSI layer 3 network)
- make decisions about the best paths for traffic to follow
- stateless inspection
79
VLANs
- logically group LANs based on similar function
- use trunks to allow switches in different locations to carry the same VLANs
- OSI layer 2 (does not use routers or firewalls)
80
Micro Segmentation
Creates very small VLANs, often temporary
81
Stateless firewalls
- evaluate each packet separately when it arrives at the firewall
- inefficient
- older
82
Stateful Inspection
- allows the two systems (client/server) to communicate back and forth without reevaluating the request each time a new packet appears for the duration of the connection
- newer
83
Firewall Rules (5)
1 source system address
2 destination system address
3 destination port
4 protocol
5 action (allow or deny) the firewall should take when encountering traffic matching the rule
84
Implicit Deny Rule
- any traffic that isn’t explicitly permitted by a rule should automatically be denied
85
Next Generation Firewalls (NGFW)
- incorporate contextual information into their decision-making process
- identity of the user, time of day, etc.
86
NAT Gateway
- translates between the public IPs used on the internet and the private IPs used on local networks
87
Web Application Firewalls
- application aware (understand how the HTTP protocol works)
88
Firewall Deployment Options (2)
Network hardware vs. host-based software firewalls
89
Network firewalls
-physical devices that sit on a network
90
Host-based
- applications or OS components that reside on a server
91
Network Firewall Deployment Mechanisms (2)
1 Dedicated Hardware
- ship with firewall firmware built in
2 Virtual appliances
- loaded directly into a virtualization platform
92
VPNs and VPN Concentrators
- provide 2 important security functions
1 site-to-site VPNs allow secure interconnection of remote networks (branch offices, etc)
2 provide remote access for mobile workers
93
VPN mechanism
- uses encryption to create a virtual tunnel between two systems over the internet
- requires an endpoint on the remote network that accepts VPN connections
94
VPN Concentrators
- for high volume, are very efficient- high bandwidth
- VPN traffic requires resource-intensive encryption
95
IPSec
- VPN protocol
- usually used for static site-to-site VPNs
- works at layer 3 (Network)
- supports Layer 2 (Data Link) Tunneling Protocol (L2TP)
96
SSL/TLS VPNs
- works at the application layer over TCP port 443
97
HTML5 VPNs
- work entirely within the web browser
- uses the web server in a proxying role
98
Different tunneling approaches for remote access (3)
1 Full Tunnel VPN
- all traffic leaving the connected device is routed through the VPN tunnel, regardless of its final destination
- includes extraneous traffic
2 Split Tunnel VPN
- only traffic destined for the corporate network is sent through the VPN tunnel.
- extraneous traffic is routed directly over the internet
3 Always On VPN
- all corporate mobile devices are configured to automatically connect to the VPN whenever they are powered on
- takes control away from the end user
99
Network Access Control (NAC)
- intercepts network traffic and verifies that the system and user are authorized before allowing communication with other systems
- uses authentication protocol 802.1x
100
802.1x transaction (involves 3 systems)
1 connecting device
- runs a piece of software called a supplicant (performs NAC tasks)
- uses EAP (Extensible Authentication Protocol)
2 Authenticator (Switch or Wireless controller)
- receives credentials from user
3 Authentication Server
- sends back either a radius accept or radius reject message
- also decides where to place a user on the network
101
NAC Roles (3)
1 user and device authentication
2 performs role-based access
3 performs posture checking (health checking)
102
Quarantine VLAN
- for devices that fail
- limited internet access for updating posture
103
NAC approaches (2)
1 In-Band approach
- NAC device is directly involved in decision making and enforcement
2 Out-of-band
- NAC device makes the decision but other network components (Switch, wireless access point, etc) enforce the decision
104
Smart Device =
the device is computer controlled and network connected
105
Smart Device security issues (3)
1 slimmed-down OS - difficult for users to configure and update OS and software
2 a compromised device can be gateway to other devices on the network
3 cloud-based command and control can be a path for attackers that bypass a firewall
106
Application Firewalls
- governs HTTP traffic to and from an application or service using rules and policies
- IoT devices have web interfaces that are susceptible to traditional web application attacks (SQL injection, buffer overflows, cross-site scripting attacks, etc)
107
Network Security for smart devices - 2 techniques
1 Network Segmentation
- like DMZ for smart devices
2 Application Firewalls
108
Security Wrappers
- ‘mini firewall’ for the embedded device
- device is not directly accessible over the network, but is reached through a ‘wrapper’ system that monitors input and output for security issues and only passes vetted requests
109
Cloud Computing =
any case where computing services are delivered to a customer over a network
110
IaaS
- customer purchases server instances (and installs/configures the OS)
- service provider provides everything up to the OS (bare metal to virtualization)
- customer is responsible for the OS and up (middleware, runtime)
111
Middleware
- "software glue"
- lies between the OS and
- software that different applications use to communicate with each other (bridge between diverse technologies)
112
APIs =
Mechanisms that enable two software components to communicate with each other using a set of definitions and protocols (weather app and weather bureau’s software system)
113
Runtime
- instructions that are executed to keep a program running
114
PaaS
- customer purchases app platform to run their own application code without having to worry about server configuration
- service provider provides OS, middleware and runtime
115
IaaS shared responsibility
- vendor: data center and hardware (+ virtualization)
- customer: OS, middleware, runtime, applications, data
116
PaaS shared responsibility
- vendor: data center, hardware, OS (and middleware and runtime)
- customer: application, data (access control - provider is responsible for implementing your access control policies)
117
SaaS shared responsibility
- vendor: data center, hardware, OS, application
- customer: data (and access control)
118
Cloud Deployment Models (5)
1 private cloud
2 public cloud
3 hybrid cloud
4 multi-cloud
- combines resources from two or more public cloud vendors
5 community cloud
119
Managed Service Security Providers (MSSPs)
- provide security services for other organizations as a managed service
120
SECaaS (Security as a Service)
- a sub category of MSSPs
121
Cloud Access Security Brokers (CSAB)
- add a third-party security layer to the interactions users have with cloud services
122
CSABs work in 2 ways:
1 network-based CSAB
- broker sits between the users and the cloud service
2 API approach
- broker uses an API to regularly query the cloud service and monitor for security issues
123
Vendor Management Lifecycle (4)
1 Vendor Selection
- formal RFP (Request for Proposal)
2 Onboarding
3 Monitoring
4 Offboarding
124
NDAs
- usually the first document signed when two organizations explore a business partnership
- ensures the firms will keep each other’s information confidential
125
SLR (Service-level Requirements)
- system response time, acceptable down-time, availability, data preservation, etc.
126
SLA (Service Level Agreement)
- document SLRs in the SLA
- contract that defines the conditions of service and penalties for failure to maintain
- should include minimum security requirements
127
MOU (Memorandum Of Understanding)
- used when a legal dispute is unlikely but the customer and vendor still wish to document their relationship to avoid future misunderstandings
128
BPAs (Business Partnership Agreements)
- when two organizations agree to do business with each other in a partnership (joint development of a product, etc)
- defines each partner’s responsibilities and the division of profits
129
ISAs (Interconnection Security Agreements)
- defines the ways the two organizations will interconnect their networks, systems, data, etc
- provides details on connection security parameters (encryption, transfer protocols, etc)
130
Transport layer responsibilities (2)
- establishes basic data channels that applications use for task-specific data exchange
- application addressing (port numbers)
131
Simplex
One-way communication (one system transmits, the other listens)
132
half-duplex
only one system can transmit at a time
133
full-duplex
both systems can send/receive at the same time
134
2 MAC address schemes
48 bit (24/24)
64 bit (24/40) uses FF:FE for IPv6
135
20
FTP data transfer
136
23
Telnet - unencrypted text communications
137
138
