Chapter 4 - Securing Your Network Flashcards

Question

Captive portal

Answer 1

technical solution that forces clients using web browsers to complete a specific process before it allows them access to the network, often agreeing to specific terms. -Free or paid internet access, alternative to IEEE 802.1X

Answer 2

Effectively removes a wireless client from a wireless network by sending a disassociation frame to the AP with a spoofed MAC address, and the AP deallocates all its memory for the connection.

Answer 3

Wifi-Protected Setup, allows users to configure wireless devices without typing in the passphrase, using a PIN or pressing buttons on the AP and on the wireless device. Susceptible to brute force attacks. Security experts recommend disabling WPS on all devices.

Answer 4

Rogue Access Point is an AP placed within a network without official authorization, maybe by an employee bypassing security or installed by an attacker. Part of "shadow IT", this AP will likely not be adequately managed, increasing vulnerabilities to the network. Can be physically connected to network devices in a closet and act as a sniffer to capture traffic through the wired network device and then broadcast the traffic using the AP's wireless capability, and can capture the exfiltrated data files while sitting in the parking lot.

Answer 5

a rogue access point with the same SSID as a legitimate access point. An attacker can set up an AP using the SSID of a public wifi network in say a Starbucks and users will connect to this evil twin.

Answer 6

Attackers transmitting noise or another radio signal on the same frequency used by a wireless network, interfering with the wireless transmissions and can seriously degrade performance. Type of DoS attack, usually prevents all users from connecting to a wireless network or lose association with an AP.

Answer 7

Initialization vector attack. An IV is a number used by encryption systems, and a wireless IV attack attempts to discover the pre-shared key after first discovering the IV. If an encryption uses the same IV to encrypt data in transit, an IV attack can discover the IV easily. Often done via packet injection techniques.

Answer 8

Near-Field Communication is a group of standards on mobile devices that allow them to communicate with other mobile devices when they are close to them, ie sharing photos or other data. Many POS systems use this technology with credit cards. In a NFC attack, an attacker uses an NFC reader to capture data from another NFC device, sometimes in an eavesdropping attack with an antenna to boost the range, capturing a transaction. They can then do unauthorized charges on a credit card.

Answer 9

Radio-Frequency Identifier include an RFID reader and RFID tags placed on objects, often used to track and manage inventory and any type of valuable assets including objects and animals. Tags do not have a power source and instead include electronics that allow them to collect and user power to transmit data stored on the device, similar to how a proximity card receives a charge from a proximity card reader, with the distance being RFID transmitters can send to and from tags from a much greater distance. Common RFID attacks -Sniffing or eavesdropping. Since RFID transmits data over the air, an attacker can collect it by listening if they know the RFID system's frequency and have a receiver tuned to that frequency. Attacker would need to know protocols used by the RFID system to interpret the data. -Replay. Eavesdropping attacks allows the attacker to perform a replay attacl, ie stealing an object by placing a bogus attacker on another. -DoS. If an attacker knows an RFID system's frequency it's possible to launch a jamming or interference attack, flooding the frequency with noise that prevents the RFID system from operating normally.

Answer 10

Bluetooth is a short range wireless system used in personal area networks (PANs) and within networks. -BLUEJACKING: sending unsolicited messages to nearby bluetooth devices. Typically text but can also be images or sounds. Relatively harmless but can cause confusion. -BLUESNARFING: unauthorized access or theft of information from a Bluetooth device. These attacks can access information such as email, contact lists, calendars and text messages. -BLUEBUGGING: like bluesnarfing but goes a step further and installs a backdoor. Attacker can have the phone call the attacker at any time allowing the attack to listen in on conversations within a room, enable call forwarding, sending messages and more. Bluetooth devices uses MAC addresses and in Discovery mode the device broadcasts its MAC address, allowing other devices to see it and connect to it as with pairing devices. Attacks are rare today since you need to now manually pair devices, you can also use a Faraday cage.

Answer 11

War driving: the practice of looking for a wireless network. More common in cars, or by walking around a large city. Attackers can discover wireless networks that they can exploit and often use directional antennas to detect wireless networks with weak signals. War flying: similar, however instead people fly around in private plans, and some have intercepted wireless transmissions at altitudes of 2,500 feet, as those use 2.4GHz transmissions with can travel farther than 5GHz signals. Also there isn't much interference between APs a wnd the planes. Can also use a drone with a little added hardware.

Answer 12

Virtual Private Network, often used for remote access. Direct VPNs allow users to access private networks via a public network, ie the Internet, but can also be semiprivate leased line from a telecom company that can be leased to several companies. *Access over a public network is a core security concern with VPNs, which are now a popular attack vector with more people working from home and connecting to company networks via direct access VPNs. Different tunneling protocols encapsulate and encrypt the traffic to protect the data from unauthorized disclosure and prevent anyone from reading the data transferred through it.

Answer 13

You can configure a VPN by enabling services on a sever, such as a Windows server, which can enable Direct Access VPN role and configure the Routing and Remote Access console, as long as the server has two NICs. One NIC is accessible from the Internet, the second provides access to the private network. Could work if you are only supporting a few VPN clients. *Larger organizations often use a VPN appliance, which is a dedicated device used for VPN that contain all the services needed to create a secure VPN supporting many clients The appliance would normally be placed in a screened subnet with a firewall between the internet and screened subnet that forwards VPN traffic to the VPN appliance, such as a direct access VPN server, which is reachable via the public Internet. The VPN server would often send the user's credentials to a RADIUS server for authentication, which often passes the credentials on to another server to validate them, such as a LDAP server (a domain controller in Windows)

Answer 14

IPSec encrypts data in transit and supports both tunnel mode and transport mode, with tunnel mode often used with VPNs. ESP (Encapsulating Security Payload) provides confidentiality, integrity and authentication for VPN traffic, identified with protocol ID 50 for ESP. It uses IKE over port 500.

Answer 15

A full tunnel encrypts all traffic after a user has connected to a VPN, while a split tunnel only encrypts traffic destined for the VPN's private network. TLS is often used to secure VPN channels, often encrypting VPN traffic using TLS over port 443, which provides flexibility for admins and doesn't require opening additional firewall ports.

Answer 16

includes 2 VPN servers that act as a gateway for two networks geographically. Doesn't require additional steps from the user, can easily connect to servers in the HQ. The two VPN gateways connect to one another. Traditional remote access VPN (also called host to gateway model) have end user making the direct connection to the VPN server and is very much aware of the process.

Answer 17

can be used with both site to site VPNs and direct access VPNs, contrary to on-demand VPN connection that is established when it's needed. Can automatically connect when a computer is turned on or when a mobile device connects to the internet.

Answer 18

Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol that is also used for VPNs, most recent version being L2TPv3. None of these versions use encryption so it is not used by itself for VPN traffic. Instead data is encrypted with another protocol, like IPSec, then passed to L2TP for transport over VPN.

Answer 19

Allows users to connect to the VPN using their web browser, using TLS to encrypt the session, but it can be very resource intensive. Sometimes uses by organizations giving 1-2 users access to limited resources.

Answer 20

Network Access Control, provides continuous security monitoring by inspecting computers and preventing them from connecting to the network if they don't pass the inspection. -Up to date antivirus -Most recent OS patches -Firewalls enabled Can use for VPN clients and internal clients.

Answer 21

Agents on clients can be either permanent or dissolvable. Permanent (persistent) agent = is installed on a client and stays on the client, using the agent when the client attempts to log on remotely. Dissolvable agent = downloaded and runs on the client when the client logs on remotely. Collects the information it needs, identifies the client as healthy or not, and reports the status back to the NAC system. Some remove themselves immediately after reporting back to the NAC system, others remove themselves when the remote session ends.

Answer 22

Password Authentication Protocol is an authentication method that uses Point-to-Point Protocol (PPP) to authenticate clients. Weakness is it sends passwords over a network in cleartext. Previously used in dial-up connections, now used as a last resort, Uses a password or PIN.

Answer 23

Challenge Handshake Authentication Protocol (CHAP) is another authentication protocol that also uses PPP and authenticates remote users but it is more secure than PAP because CHAP doesn't send passwords over the network in cleartext. The client and server both know a shared secret (similar to a password) used in the authentication process, but the client hashes the password after combining it with a nonce (number used once) provided by the server. This handshake process is used when the client initially tries to connect to the server and at different times during the connection.

Answer 24

RADIUS (Remote Authentication Dial-In User Service) is a centralized authentication service. Instead of each individual VPN server needing a separate database to identify who can authenticate, the VPN servers forward the authentication requests to a central RADIUS server, which can also be used as an 802.1X server with WPA2 Enterprise mode. If you have multiple VPN servers you only have to update credentials one place, the RADIUS server. RADIUS uses UDP and only encrypts password by default versus encrypting the entire authentication process. RADIUS was created before EAP but does work with EAP and can use EAP to encrypt entire sessions.

Answer 25

Terminal Access Controller Access-Control System Plus (TACACS+). An alternative to RADIUS, provides 2 essential security benefits: 1. Encrypts the entire authentication profess. 2. Uses multiple challenges and responses between the client and server. Can interact with Kerberos even though created by Cisco, so can be active in Microsoft AD environment, which uses Kerberos for authentication. *Organizations also used TACACS+ for authentication of network devices, ie authenticating users before they're able to access a configuration page for a router or switch.

Answer 26

AAA protocols provide authentication, authorization and accounting. RADIUS, TACAS+ and Diameter are all considered AAA protocols because they provide all 3.