Module 7 Flashcards
(103 cards)
Firewalls - Fw
filter (permits or denies) traffic based on a set of criteria. Attempts to control in/out traffic with set rules for inbound & outbound connections. Physical hardware firewalls are at the edge of the network. Host-based firewalls are computer-based software.
Network Firewall - NF
can usually be routers (firewall feature can be enabled) or can also be an in-line filter. Capable of NAT. Dedicated firewalls can provide multiple features such as firewalls, VPN services, anti-malware, & content filters aka Unified Threat Management (UTM).
Stateless Fw
employs only ACL 2 control inbound & outbound traffic.
Stateful Fw
keeps track of connections & allows return traffic as long as it was generated inside the network 1st.
Deep-Packet Inspection-DPI aka packet sniffer
an advanced method of examining and managing network traffic. Inspects in detail the data packets and may take actions such as alerting, blocking, re-routing, or logging it accordingly (network-based anti-malware). AKA Application-Aware firewall (AAF) or Context-Aware firewall (CAF).
Virtual Private Network - VPN
provides a private network connection between 2 endpoints.
VPN concentrator
a device dedicated 2 handling large amounts of VPN connections. A firewall can perform as a VPN concentrator.
Point-To-Point Tunneling Protocol (PPTP) -
uses PPP 4 authentication & modified GRL 4 tunnel. It is absolute & insecure don’t use it.
Generic Routing Encapsulation GRE Tunnel
used w/ router to create a generic tunnel & in combination w/ IPSec to create an encrypted VPN tunnel. Used a lot w/ other protocols.
Internet Protocol Security - IPSec
provides a method 4 authentication & negotiation of crypto keys. Uses Internet Key Exchange (IKE) to negotiate the key & (ISAKMP) 4 internet key exchange.
IPsec algorithms
Authentication Algorithms: HMAC-MD5, HAMC-SHA-1.
Encryption Algorithms: DES, 3DES, Blowfish, AES
Secure Socket Layer - SSL VPN
uses SSL 2 establish VPN connections, 4 hosts, 2 site VPNs a web browser can be used & easier.
Demilitarized Zone (DMZ)
is a private network that sits b/w a private LAN & the public internet. Used 2 expose web-server & other services 2 the internet w/o exposing private LAN. If a machine on the DMZ is compromised by an attacker, they won’t have access 2 the private LAN. Done 4 security reasons to not open port 80 inside the LAN.
Honeypot
a host that is fully/partially exposed 2 the internet 2 invite attack while monitoring & collecting info.
Honeynet
a network replica with live production & has weak security to invite attacks 4 monitoring purposes.
Testing Lab
important to have a testing environment separate from the production network. Test patches, updates, new/different hardware/software, fix complex problems, & training.
Malware
software written specifically 2 harm & infect a host system. Such as viruses, worms, trojans horses, spyware, adware, ransomware, etc.
Compromised System
a host, server, network node, or other computing systems that has been infected w/ malware or attacked & exploited. Such compromised systems will give themselves up by generating strange & unexplainable traffic.
Denial of Service - DoS
it is a coordinated attack that floods the target w/ traffic. Sometimes done by an attacker, botnet, or zombie computers controlled by one user.
Distributed DoS - DDoS
the attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Also makes it difficult to distinguish legitimate vs fake traffic.
Smurf Attack
flood traffic via a “spoofed ICMP”. The attacker sends an IP-directed broadcast ping 2 a large network with a spoofed (changed) IP source of the target victim then the ICMP replies go to the target causing a DDoS.
VLAN- Hopping
a malicious user on 1 VLAN gains access 2 traffic on another VLAN that shouldn’t have access 2. This malicious user either acts as a trunking switch (Sw spoofing) or double tags its frames w/ 2 VLANs. Can also exploit VOICE & Data VLANs.
Man-in-the-middle - MITM
the attacker causes traffic b/w 2 endpoints to go through the attacker. Allows an attacker to intercept & manipulate the data. Can be done on a local private LAN or public internet. Many different types of MITMs.
ARP Poisoning
a malicious user poisons the ARP cache of devices communicating w/ each other so that the L2 frames will be redirected to a machine, (used 2 intercept communication). A type of MITM attack.
