Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security > Lecture 2 - Network Security > Flashcards

Lecture 2 - Network Security Flashcards

1
Q

Basic Network Definition

A

Set of devices connected together.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Four points of network security

A

Scalability (grow in users)
Availability (continuous)
Manageability (Staff able to manage)
Security (Not after thought)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Seven Domains of IT infra

A
  • User
    _ Workstation
  • LAN
  • LAN to WAN
  • WAN
  • Remote Access
  • System/App
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

User domain

A

Any individual associated with the org, with or without logins.

Threats: Social engineering/phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Workstation domain

A

Workstations/standalone systems and home computers.

Threats: Malware, port scanning, default pass, unpatched OS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

LAN Domain

A

Hosts on private LANs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

LAN to WAN Domain

A

Routers/firewalls at LAN/WAN connection point

Threats: Port scanning Dos

Vulnerabilities: Weak permeter security, default config, misconfig

Risks: Instability and malicious traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Remote Access Domain

A

Org resources via remote access

Threats: Malware, rogue access point

Vulnerabilities: Unencrypted wireless, weak security controls

Risks: Compromise of remote sys results in org compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

WAN Domain

A

Routers, switches and firewalls that ensure connectivity between LANs

Threats: Eavesdropping, Availability

Vulnerabilities: DNS Poisoning

Risks: Attacks on DNS root, clear text traffic intercepted, disaster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Sys/ App Domain

A

Servers, apps, databases etc

Threats: SQL injection, XSS, DoS

Vulnerabilities: Unpatched OS, misconfig, insecure code

Risks: Instability, Data loss, loss of function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Network Analysis Steps

A
  1. Create network baseline using Nmap/Zenmap
  2. Capture data at specific points on net
  3. Analyse captured data
  4. Investigate/resolve, update baseline,
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Security Controls 3 sections

A

Physical
Procedural
Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Physical Controls

A
  • Door locks, guards etc
  • Fire detection and suppression, other environmental
  • Electrical grounding etc
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Procedural Controls

A
  • Policies/procedures
  • Insurance
  • Background and financial checks
  • Data loss prevention
  • Awareness training
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Technical Controls

A
  • Login ID
  • TImeouts
    – Logs and audit trails
  • Firewalls and routers
  • Encryption/Public Key Infrastructure
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Firewall

A

Integrated colleciton of security mesaures that prevent unauthorised access to a network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A Firewall can/is:

A
  • Security Gateway
  • Traffic Control Device
  • Packet Filtering
  • Routing
  • ENforce security policy
  • Loggin
  • Secure the net from external attack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Firewalls are not/cannot:

A
  • Be the only security
  • Not an auth server
  • Not a remote acces server
  • Cannot see the content of encrypted packets
  • Cannot see all traffic if positioned incorrectly
  • Not a malicious code scanner
  • Not an IDS.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Firewall Ingress/Egree filtering

A

Monitoring and filtering directional inbound/outbound traffic

20
Q

Packet filtering

A

Examines network protocol headers and parameter.s

Stateless (rules) or stateful (conneciton states)

21
Q

Content Filtering

A

Focuses on network protocol payloads

22
Q

Firewall risks and disadvantages

A
  • Central point of attack.
  • Can degrade system performance
  • May restrict legitimate users
  • Do not provide data integrity and confidentiality
23
Q

Firewall rules

A

An instruction set that indicates what actions a firewall should take

24
Q

Firewall rule structure

A
  • Protocol
  • Src Address
  • Src Port
  • Target Address
  • Target Port
  • Action
25
Q

Why log?

A
  • Validate rules
  • Historical and reactive tracking
26
Q

WHat data to log?

A
  • Connections
  • Traffic to successfully traverse through the firewall
  • Configuration Chagnes
  • Firewall system access
27
Q

General rule for what protocols to allow

A

Allow encrypted protocols and only allow unencrypted for users that require it with sufficient training.

If it is internal you might allow it but again, risk assess.`

28
Q

DMZ Design

A

Segregate devices etc based on risk.
Isolate certain services + functions.
Adds additional security layer.

29
Q

DMZ

A

A zone with an intermediate trust level, between the internet and trusted internal network

30
Q

DMZ Architecture

A

Uses firewall to restrict access from internet to private LAN.

Single or dual firewall.

31
Q

DMZ single firewall

A

At least 3 network interfaces:

1st: External net
2nd: internal net
3rd: DMZ

32
Q

DMZ Dual Firewall

A

First firewall (frontend) configured to allow traffic destined to DMZ only
Second (backend) allows DMZ to internal.

33
Q

DMZ single vs dual

A

Cost
More rules and isngle point failure with single.

34
Q

RFC 1918

A

Address Allocation for Private Internets.

Most recommended for firewall configuration

35
Q

Private VLAN in DMZ

A

If one DMZ server is compromised, then can be used to access other DMZ servers.

Use VLANs to separate servers in the DMZ.

36
Q

DMZ general rules

A

Traffic to DMZ is authorised.
Traffic from the DMZ is prohibited/denied.
Traffic from internal to external is authorised but not in return.

37
Q

IDS

A

Intrusion Detection Systems

38
Q

Define an intrusion

A

Set of actions aimed to compromise security

39
Q

Activity is suspicious (IDS) if

A
  1. Matches a pattern for known malicious activity
  2. Differs significantly from previous patterns of use.
40
Q

IDS Components

A

Audit Data Preprocessor
Detection Engine (+Models)
Decision Engine (+Table)

41
Q

IDS Functions

A
  1. Monitor activity
  2. Audit Sys config
  3. Assess system integrity
  4. Recognise known attacks
  5. Indentify abnormal activity
  6. Manage audit trails
  7. Correct config errors
  8. Install/open traps to record info
42
Q

IDS Types

A
  • Network (links/backbones)
  • Host (OS)
  • Distributed (group of remote sensor IDSes)
  • Gateway (deployed at gateway)
43
Q

IDS responses

A

Alarm
Cut user access
Reject traffic
…

44
Q

IDS Problems

A
  • Inaccuracy for exploit based signatures
  • Cannot recognise unknown intrusions
  • Cannot provide quality forensics info
45
Q

IDS before or after firewall

A

Before can be very slow but after might be quicker.

Before might be required to protect firewall

Cyber Security (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions