CIS 473 Final Question Set 3 Flashcards
(38 cards)
What does Pretty Good Privacy (PGP) do ?
-Provides a confidentiality and authentication service that can be used for electronic mail and file storage applications
Selected the best available cryptographic algorithms as building blocks
- Integrated these algorithms into a general-purpose application that is independent of operating system and processor and that is based on a small set of easy-to-use commands
- Made the package and its documentation, including the source code, freely available via the Internet, bulletin boards, and commercial networks
- Entered into an agreement with a company to provide a fully compatible, low-cost commercial version of PGP
What is Secure/Multipurpose Internet Mail Extension (S/MIME) ?
Secure/Multipurpose Internet Mail Extension (S/MIME) is a security enhancement to the MIME Internet e-mail format standard based on technology from RSA Data Security
What is the traditional e-mail format standard ?
RFC 822
Note: To understand S/MIME, we need first to have a general understanding of the underlying e-mail format that it uses, namely MIME. But to understand the significance of MIME, we need to go back to the traditional e-mail format standard, RFC 822, which is still in common use
What is RFC 5322 ?
- Defines a format for text messages that are sent using electronic mail
- Messages are viewed as having an envelope and contents
- The envelope contains whatever information is needed to accomplish transmission and delivery
- The contents compose the object to be delivered to the recipient
- RFC 5322 standard applies only to the contents
- The content standard includes a set of header fields that may be used by the mail system to create the envelope
What is Multipurpose Internet Mail Extensions (MIME) ?
- An extension to the RFC 5322 framework that is intended to address some of the problems and limitations of the use of Simple Mail Transfer Protocol (SMTP)
- Is intended to resolve these problems in a manner that is compatible with existing RFC 5322 implementations
How can an MIME be secured ?
S/MIME secures a MIME entity with a signature, encryption or both.
- The MIME entity is prepared according to the normal rules for MIME message preparation
- The MIME entity plus some security-related data, such as algorithm identifiers and certificates, are processed by S/MIME to produce what is known as a PKCS object
- A PKCS object is then treated as message content and wrapped in MIME
What do IPsec provide ?
provides the capability to secure communications across a LAN, across private and public WANs, and across the Internet
What are the exmaples in make use of IPsec ?
- Secure branch office connectivity over the Internet
- Secure remote access over the Internet
- Establishing extranet and intranet connectivity with partners
- Enhancing electronic commerce security
In IP security chapter, what are the fucntions of Transport Modes?
- Provides protection primarily for upper-layer protocols•Examples include a TCP or UDP segment or an ICMP packet
- Typically used for end-to-end communication between two hosts
- ESP in transport mode encrypts and optionally authenticates the IP payload but not the IP header
- AH in transport mode authenticates the IP payload and selected portions of the IP header
In IP Security chapter, What are the fuctions of Tunnel Mode ?
- Provides protection to the entire IP packet
- Used when one or both ends of a security association (SA) are a security gateway
- A number of hosts on networks behind firewalls may engage in secure communications without implementing IPsec
- ESP in tunnel mode encrypts and optionally authenticates the entire inner IP packet, including the inner IP header
- AH in tunnel mode authenticates the entire inner IP packet and selected portions of the outer IP header
What are three classes of Intruders ?
- Masquerader
- Misfeasor
- Clandestine user
What is Masquerader ?
•An individual who is not authorized to use the computer and who penetrates a system’s access controls to exploit a legitimate user’s account
What is Misfeasor ?
•A legitimate user who accesses data, programs, or resources for which such access is not authorized, or who is authorized for such access but misuses his or her privileges
What is Clandestine user ?
•An individual who seizes supervisory control of the system and uses this control to evade auditing and access controls or to suppress audit collection
What are Intrusion Detection Systems (IDSs) and Intrusion prevention Systems (IPSs) ?
- are designed to counter hacker threats
- In addition to using such systems, organizations can consider restricting remote logons to specific IP addresses and/or use virtual private network technology
What does CERTs stand for ?
- Computer emergency response teams
- These cooperative ventures collect information about system vulnerabilities and disseminate it to systems managers
- Hackers also routinely read CERT reports
- It is important for system administrators to quickly insert all software patches to discovered vulnerabilities
What are Intrusion Techniques ?
- Objective of the intruder is to gain access to a system or to increase the range of privileges accessible on a system
- Most initial attacks use system or software vulnerabilities that allow a user to execute code that opens a backdoor into the system
What are the Honeypots ?
What is it designed for?
•Decoy systems that are designed to lure a potential attacker away from critical systems
Designed for:
- divert an attacker from accessing critical systems
- collect information about the attacker’s activity
- encourage the attacker to stay on the system long enough for administrators to respond
What is Base-Rate Fallacy ?
•To be of practical use, an intrusion detection system should detect a substantial percentage of intrusions while keeping the false alarm rate at an acceptable level
What happen if Honeypot deploy outside the firewall ?
A honeypot outside the external firewall (location 1 ) is useful for tracking attempts to connect to unused IP addresses within the scope of the network. A honeypot at this location does not increase the risk for the internal network. The danger of having a compromised system behind the firewall is avoided. Further, because the honeypot attracts many potential attacks, it reduces the alerts issued by the firewall and by internal IDS sensors, easing the management burden. The disadvantage of an external honeypot is that it has little or no ability to trap internal attackers, especially if the external firewall filters traffic in both directions
What happen if Honeypot deploy near Servic Network ?
The network of externally available services, such as Web and mail, often called the DMZ (demilitarized zone), is another candidate for locating a honeypot (location 2 ). The security administrator must assure that the other systems in the DMZ are secure against any activity generated by the honeypot. A disadvantage of this location is that a typical DMZ is not fully accessible, and the firewall typically blocks traffic to the DMZ that attempts to access unneeded services. Thus, the firewall either has to open up the traffic beyond what is permissible, which is risky, or limit the effectiveness of the honeypot
What happen if Honey is deployed ar Internal Network ?
A fully internal honeypot (location 3 ) has several advantages. Its most important advantage is that it can catch internal attacks. A honeypot at this location canalso detect a misconfigured firewall that forwards impermissible traffic from the Internet to the internal network. There are several disadvantages. The most serious of these is if the honeypot is compromised so that it can attack other internal systems. Any further traffic from the Internet to the attacker is not blocked by the firewall because it is regarded as traffic to the honeypot only. Another difficulty for this honeypot location is that, as with location 2, the firewall must adjust its filtering to allow traffic to the honeypot, thus complicating firewall configuration and potentially compromising the internal network.
What are Firewall Characteristics ?
•Design goals for a firewall:
- All traffic from inside to outside, and vice versa, must pass through the firewall
- Only authorized traffic, as defined by the local security policy, will be allowed to pass
- The firewall itself is immune to penetration
What are the techniques that Firewall use ?
- Service Control: Determine the types of Internet services that can be accessed, inbound or outbound
- Direction control: Determine the direction in which particular service requests may ne intiated and allowed to flow through the firewall
- User Control: Controls access to a service according to which user is attempting to access it
- Behavior control: Controls how particular sevices are used
