Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CSCI 4130 - Intro to Cybersecurity > Network Security > Flashcards

Network Security Flashcards

1
Q

Define

Network Protocol

Network Security

A

Transports data between nodes of a network and defines the syntax/semantics (how)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define

Layering

Network Security

A

Stacks of protocols for modularization (separation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the TCP/IP Layering?

Network Security

A

Link (data transfer)
Transport (process to process transport)
Netowrk (source to dest route)
Application (supporting network applications)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define

Internet Protocol

Network Security

A

Connectionless, unreliable, best-effort datagram delivery between any nodes on the Internt with reliance on lower-level layer protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define

IP Address

Network Security

A

4 byte value unqiue to each network separated by .

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Components of IP Datagram

Network Security

A
  • Expiration
  • Protocol
  • Source Address
  • Destination Address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Describe

Delivery of an IP datagram: same physical network

Network Security

A

Direct delivery in lower-level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Describe

Delivery of an IP datagram: different physical networks

Network Security

A

Pass through devices of intermediate networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the two intermediate networks?

Network Security

A

Inter-networks: routers
Intra-networks: switches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Define

Ethernet

Network Security

A

Link-layer protocol that includes dest address, source address, and type

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define

Switches

Network Security

A
  • Connects machines in the Local Area Networks (LAN)
  • Stores/forwards Ethernet
  • Examines incoming MAC addresses
  • Maintains a table that maps MAC addresses and their respective ports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Types of Network Attacks

Network Security

A
  • Local Area Network (LAN) Attacks
  • Network Layer Attacks
  • Transport Layer Attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Describe

Local Area Network (LAN) Attacks

Network Security

A
  • Impersonate host
  • Denial of service
  • Access information
  • Tamper with delivery mechanisms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define

Sniffing/Eavesdropping

Network Security

A

Gathering traffic from a local traffic (promiscuous mode) to collect credentials/emails/files, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Can sniffing go undetected?

Network Security

A

Mainly yes but can be detected by software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Define

Address Resolution Spoofing

Network Security

A

Sniffing all traffic between two hosts in a switched environment (intra-network)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How is Address Resolution Spoofing possible?

Network Security

A

Replies in a switched environments don’t need requests to be accepted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Define

Address Resolution Protocol (ARP)

Network Security

A

Mapping a host’s IP address to its link-layer address associated with peer’s hardware for direct delivery and sends messages through the underlying link-layer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Defenses against Address Resolution Spoofing

Network Security

A
  • Static ARP entities
  • Cache poisoning resistance
  • Monitor changes and report sus mappings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Describe

Defense to Address Resolution Spoofing: Static ARP Entities

Network Security

A

Ignores dynamic updates
Limitation: difficult to manage in a large system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Describe

Defense to Address Resolution Spoofing: Cache Poisoning Resistance

Network Security

A

Ignoring unsolicited ARP replies and updates based on timeouts
Limitations: susceptible to hijacking, timeouts have limited usefulness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Hijacking is the product of

Network Security

A

Sniffing and spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Describe

Process of hijacking

Network Security

A

Once the attacker sniffs and spoof the necessary information, they are racing against the legit host to reply to the client’s request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Define

Rogue Gateway

Network Security

A

First hop for all Internet traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What happens if an attacker gains control of a rogue gateway?

Network Security

A

Attacker can sniff, intercept, block, and modify traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Define

Broadcast Protocol

Network Security

A

Enables transmission of messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Securing LAN Mechanisms

Network Security

A
  • Do nothing and assume that it is secure
  • Smart switching/active monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Define

Smart switching/active monitoring

Network Security

A
  • Don’t broadcast traffic
  • Forward Ethernet to the right path
  • Filter requests to limit listening/filtering replies to limit replying
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Define

Dynamic Host Configuration Protocol

Network Security

A

Dynamically allocates the IP address to hosts of a network and provides information about DNS server, gateway, and period of lease

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Threats against Dynamic Host Config Protocol

Network Security

A
  • Fake DNS server => redirection of DNS lookups
  • Fake gateway router => interception of traffic, relay/modification of contents between host and remote machine
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Define

Network Layer Attack

Network Security

A

Gaining access to a system that is isolated from other networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the two types of Network Layer Attacks?

Network Security

A

IP Spoofing and Blind Spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Define

IP Spoofing

Network Security

A

Impersonating sources of security-critical information to exploit address-based authentication

33
Q

Define

Blind Spoofing

Network Security

A

Attacker sends IP packet and forges source IP with another host’s IP => receiver sends a response back (unaccessible by attacker)

34
Q

What are the two types of Internet spoofing?

Network Security

A

On-path and off-path spoofing

35
Q

What can an on-path Internet spoofer do?

Network Security

A

See all traffic

36
Q

What can an off-path Internet spoofer do?

Network Security

A

Has to blind spoof and guess header values/use brute force because they can’t see traffic

37
Q

Define

Autonomous System (AS)

Network Security

A

Network that manages its internal routing and is interconnected to form the Internet

38
Q

What does an Autonomous System (AS) do?

Network Security

A

Determines where its packets should be sent

39
Q

Who specifies the routing of an Automous System (AS)?

Network Security

A

Border Gateway Protocol

40
Q

What makes blind-spoofing and IP spoofing possible?

Network Security

A

Lack of edge-AS restricting IP spoofing or blocking packets with a different source IP address

41
Q

Define

User Datagram Protocol (UDP)

Network Security

A

Transport layer protocol that is connectionless, unreliable, best-effort datagram delivery service; best suited for multi-media and services based on requests

42
Q

Cons of User Datagram Protocol (UDP)

Network Security

A

No delivery, integrity, ordering, or non-duplication guaranteed

43
Q

What does User Datagram Protocol (UDP) introduce?

Network Security

A

Port abstraction

44
Q

Define

Port abstraction

Network Security

A

One can communicate with different components of the same IP address

45
Q

User Datagram Protocol (UDP) Packet components

Network Security

A
  • Length
  • Destination port
  • Source port (optional)
  • Checksum (error detection, optional)
46
Q

Types of User Datagram Protocol (UDP) Attacks

Network Security

A
  • UDP Spoofing ~ IP Spoofing
  • UDP Hijacking ~ UDP Spoofing variant
  • UDP Port Scan - finding vulnerable/open ports
  • Denial of Service
47
Q

Define

Transmission Control Protocol (TCP)

Network Security

A

Transport layer protocol that provides connection-oriented, reliable stream delivery service

48
Q

Guarantees of a Transmission Control Protocol (TCP)

Network Security

A

Ordering, delivery, non-duplication

49
Q

What are the ports associated with in UDP and TCP?

Network Security

A

OS Processes

50
Q

Function of TCP

Network Security

A

Allows 2 hosts to establish a connection identified by IP address/ports of source and destination (socket)

51
Q

Describe

TCP Window

Network Security

A

Performs flow control and is dynamic

52
Q

Describe

TCP Packet

Network Security

A

Includes source/dest ports, seq #, ack #, data

53
Q

Define

Sequence Number (Seq #)

Network Security

A

Relative position of TCP segment in stream

54
Q

Define

Acknowledgement Number (ACK #)

Network Security

A

Position of next byte expected from stream

55
Q

List TCP flags

Network Security

A
  • SYN
  • ACK
  • FIN
  • RST
  • PSH
56
Q

Define

TCP Flag: SYN

Network Security

A

Set only in the 1st packet to request sync of syn/ack nums and kickstart connection request

57
Q

Define

TCP Flag: ACK

Network Security

A

Validates ACK # in all packets except 1st

58
Q

Define

TCP Flag: FIN

Network Security

A

Indicates a request to terminate a stream in last packet from sender

59
Q

Define

TCP Flag: RST

Network Security

A

Request to reset a connection

60
Q

Define

TCP Flag: PSH

Network Security

A

Push buffered data request

61
Q

List TCP Threats

Network Security

A
  • Port Scan
  • Disruption
  • SYN Flooding
62
Q

Define

TCP Threat: Port Scan

Network Security

A

Finds vulnerable/open ports

63
Q

Types of TCP Port Scans

Network Security

A
  • Normal
  • SYN
  • FIN
64
Q

Describe

Port Scan: Normal

Network Security

A

Establish a connection with an arbitrary port and follows the TCP connection setup/shutdown (giveaway: lots of logs/connections)

65
Q

Describe

Port Scan: SYN

Network Security

A

If a port is available, server/target will return an ACK packet (unavailable = RST packet) => scanner sends RST packet to “terminate” connection

66
Q

Why is a SYN port scan not logged?

Network Security

A

A connection was never fully established

67
Q

Describe

Port Scan: FIN

Network Security

A

Scanner sends a FIN packet to a host/target => open port: FIN ignored, closed port: RST

68
Q

Define

TCP Threat: SYN Flooding

Network Security

A

Overload of connections

69
Q

What does SYN Flooding cause?

Network Security

A

Denial of Service (DoS)

70
Q

Defenses against SYN Flooding

Network Security

A
  • Filtering
  • Small time-outs for 1/2 open connections
  • Limiting the number of 1/2 open connections
  • Recyling oldest 1/2 open connections
  • Requesting a SYN cookie to finish connection (set up and validate => reconstructed state)
71
Q

Why can attackers spoof victim’s IP and SYN Flood?

Network Security

A

ACK packets are not needed

72
Q

Describe

TCP Threat: Disruption

Network Security

A

Abrupt termination request with RST packet and acceptance with correct seq #

73
Q

Two Injections following TCP Disruption

Network Security

A

RST and Data Injection

74
Q

Define

RST Injection

Network Security

A

MITM with port and sequence #

75
Q

Describe

Data Injection

Network Security

A

Control hijacking with port and sequence #

76
Q

Requirement to execute TCP Disruption

Network Security

A

TCP spoofing

77
Q

How to guess the sequence number?

Network Security

A

Establish a legit connection with target and predict based on information

78
Q

Describe

TCP Connection Setup Process

Network Security

A
  1. Server listens to ports
  2. Client sends requests (SYN packet) wtih initial sequence number (Sc)
  3. Server accepts and responds (SYN-ACK packet) with initial sequence number (Ss) and ACK # (Sc + 1)
  4. Client acknowledges with sequence number (Sc + 1) and acknowledgement number (Ss + 1)
  5. Data is sent
79
Q

Describe

TCP Connection Shutdown Process

Network Security

A
  1. End A sends FIN packet (Sc)
  2. End B replies with ACK packet (seq # = Ss, ACK # = Sc + 1)
  3. End B sends FIN packet to close stream (seq # = Ss, ACK # = Sc + 1)
  4. A replies with ACK packet (seq # = Sc + 1, ACK # = Ss + 2)
80
Q

If a TCP segment is accepted, what’s the order of the ack/seq/window?

Network Security

A

ACK # <= Seq # <= ACK # + Window

CSCI 4130 - Intro to Cybersecurity (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions