Midterm Flashcards
These enforce a series of rules defining what kind of network traffic is allowed and what is not allowed
Firewall
The act of verifying the identity of a particular person
Authentication
Anything a person would use to access a network (device type)
Host device
What is the difference between a threat and an attack?
Threat: potential violation of security
■ Does not need to have occurred
Attack: actions that take advantage of potential threats
■ People causing the attack are called attackers
What are the three goals of security
Protect
● Try to stop the attack from happening
Detect
● Quickly identify when an attack is happening
Respond & Recovery
● Stop, assess, repair
● Maintain functionality during an attack
Why is anti-virus not perfect?
Anti-viruses have to be manually updated
This part of the operating system creates and manages files and directories
File system
Passwords are stored on a system as these, which vary based on operating system
Hashes; keeps passwords from being readily available
How does a system authenticate a user password attempt?
The system compares the attempt to a stored hash
Systems on a network that include files and/or programs in use by multiple people on or outside a network
Server
Set of devices, software, and cables that enables the exchange of information
Networking
Describe two network topologies
Bus - Every component is connected to a single line, with “taps” for each
component
Advantages: quick to deploy, cheap
■ Disadvantage: lots of collisions, unreliable, a break in the line causes
the network to fail, performance is directly related to number of
components and usage
■ Example: Cable internet
Ring - Every component has 2
connections – a left and a right
side
■ Basically a bus with a
connection back around to
the beginning
■ Disadvantages:
Performance is generally
poor, not scalable, break in
one connection causes
complete network failure
Star
● Each node is connected to a
central point
● Most common physical topology
(Ethernet)
● Advantages: fast, non-central
failure does not bring down the
network, scalable
● Disadvantages: used to be very
expensive, but not anymore,
single point of failure, lots of
cabling
Mesh
● Advantages: self-healing, failure
tolerant, potentially fast
● Disadvantages: no known route
traversal, difficult to control and
filter traffic
● Example: Wireless ad-hoc
network
This device inspects the data of a packet to see if it is malicious in nature
IDS/IPS
(intrusion detection/prevention system)
What occurs when two hosts try to use the same connection at the same time
Collision
What are the 3 types of authentication and an example of each?
● Something you know
e.g. Password/passphrase
● Something you have
e.g. Smart card, USB key, your phone
● Something you are
e.g. Biometrics (retina, fingerprint, DNA, etc.)
What is the term used if 2 or more types of authentication are in use?
Two-factor
What is the purpose of CSMA/CD?
Carrier Sense Multiple Access with Collision Detection
Method to detect collisions before they occur in ethernet cables
What was the first operating system and service pack to include a firewall enabled by default?
Windows XP Server Pack 2
What is CIA and why is it important?
Confidentiality
Only those with sufficient privileges and a demonstrated need may access certain information
Integrity
Quality or state of being whole, complete, or uncorrupted
Availability
Enables user to access information without interference or obstruction and in a useable format
Traits of well-implemented security
This part of the operating system
determines when to allocate programs,
processes, and threads to the processor
Kernel
What is the best method of cracking a password and why?
Brute-force attacks
■ Will try every possible character combination until it finds the password
■ This method can be extremely slow based on password length and complexity
■ It will always find the password in some amount of time
■ Most systems now limit number of password guesses to thwart brute-force attacks
Dictionary Attacks
■ Functions by trying a list of pre-defined potential passwords, one after another
■ Very fast method
■ Can be useful if you know the user and can compile an intelligent list of potential
passwords
■ If the password is not an exact match to the list, the attack will fail
Hybrid Attacks
■ Uses a list like the dictionary attack, but is able to detect slight variations
■ Example: if “hello” is in the list, but the password is “Hello” or “HellO”, the
dictionary attack will fail but the hybrid attack will succeed
■ It is not as fast as the dictionary attack because it has more variables to account for
Rainbow Tables
■ They are not coffee tables painted with bright colors
■ They are actual data tables containing every single hash value for every possible password possibility up to a certain number of characters
■ You simply take the hash value you have extracted from the system and search for it – once it is found in the table, you will have the password
■ You must have the Rainbow Table for the specific type of hash you are trying to crack
■ Rainbow Tables for even a small amount of characters can be quite large in size and so storage and searching can be an issue
Adversary-in-the-middle attacks formerly known as person-in-the-middle
■ If a system is authenticating to a network or accessing resources on another system, it will be passing hashes over the network to authenticate
■ MITM attacks attempt to sniff and gather these hashes in transit
■ Example: The program Cain and Abel uses a process called ARP poisoning to route the traffic between the two systems through your computer. It then sniffs the traffic for the hashes
What are some advantages and disadvantages of wireless networks?
Reliability, range, accessibility (swings either way)
What is responsible for address at Layer 2 - Data Link?
MAC address (media access control)
What happens when there is not enough RAM for memory?
Paging allows for memory to be “swapped” out to the hard disk when there is not enough RAM to hold everything attempting to be stored
