Module 11 Flashcards
What are zero-day attacks?
A cyberattack that tries to exploit software vulnerabilities that are unknown or undisclosed by the software vendor
What can help to identify whether an exploit has occurred, the diagnostic features of the exploit, and the extent of the damage within the enterprise?
Logfiles generated by the devices at each layer
How can the information gathered by log files help?
They help to inform measures taken in response to the exploit. Ex. Containment and mitigation
Why was Intrusion Detection System (IDS) implemented?
To passively monitor the traffic on a network
What does an IDS enabled device do?
It copies the traffic stream and analyzes the copied traffic rather than the actual forwarded packet
When IDS works offline, what does it do?
It compares the captured traffic stream with known malicious signatures (similar to software that checks for viruses)
Why is an IDS device physically positioned in the network?
The traffic needs to be mirrored in order to reach it
Why might network traffic not pass through an IDS?
The traffic is not mirrored
Is a lot or very little latency added to network traffic flow?
Very little
What happens after traffic is monitored, logged, and maybe reported to the IDS with something malicious?
Nothing. The IDS does not take action
