Notes From Lynda Course Flashcards
1
Q
Port 21
A
FTP
2
Q
Port 22
A
SSH
3
Q
Port 389
A
RDP
4
Q
Ports 137-139
A
NetBIOS
5
Q
Port 25
A
SMTP
6
Q
Port 110
A
POP
7
Q
Port 143
A
IMAP
8
Q
Port 80
A
HTTP
9
Q
Port 443
A
HTTPS
10
Q
Symmetric Algorithms
A
Encryption and decryption operations use the same key
11
Q
Asymmetric Algorithms
A
Encryption and decryption operations use different keys
12
Q
Salting
A
Adds a value to the encryption key to make it more complex
13
Q
Hashing
A
Adds time to the verification process by requiring more math
14
Q
WPA
A
WiFi Protected Access - Uses the Temporal Key Integrity Protocol (TKIP) to implement strong encryption
15
Q
WPA2
A
Wifi Protected Access v2 - Adds time to the verification process by requiring more math
16
Q
LEAP
A
Lightweight EAP - Insecure protocol that relies upon MS-CHAP
17
Q
EAP
A
Broad framework with many variants, some are secure, some are not
18
Q
PEAP
A
Protected EAP - Tunnels EAP inside an encrypted TLS session
19
Q
Spyware
A
Gathers information
20
Q
Adware
A
Displays advertisements
21
Q
Ransomware
A
Blocks access
22
Q
Christmas Tree Attack
A
Uses packet flags to exploit a system
23
Q
DNS/ARP Poisoning
A
Redirects or intercepts traffic
24
Q
Typosquatting
A
Exploits typos to get web traffic
25
Two components of every malware
1. Propagation Mechanism
| 2. Payload
26
Propagation Mechanism
The way a malware object spreads
27
Payload
The malicious action that the malware performs
28
Virus
Type of malware that is spread by user interaction (User education is the best preventative measure)
29
Worm
Type of malware that spreads by itself - require vulnerable systems to spread (Keeping systems updated is the best preventive measure)
30
Trojan Horse
Type of malware that disguise themselves as a beneficial program with a malicious payload (Application control is the best protection from this)
31
Remote Access Trojans (RAT)
Provides backdoors to hacked systems
32
Three types of malware payloads
Adware, Spyware, Ransomware
33
Three types of propagation techniques
Virus, Worm, Trojan Horse
34
Backdoor
Provides unregulated workaround access to a system using modified code
35
Backdoor mechanisms
Hardcoded accounts, default passwords, and unknown access channels can provide access
36
Logic Bomb
Uses modified code to deliver a triggered payload
37
Three advanced malware concepts
Rootkits, Polymorphism, and armored viruses
38
Rootkits
Software techniques used to hide other software on a system
39
Polymorphism
Changes signature to avoid detection, they use a different encryption key with each system they infect
40
Armored Viruses
Prevents reverse engineering, sandboxing, and blocks system debuggers to prevent detection
41
Root Account
A special superuser account that provides unrestricted access to system resources
42
Rootkit Payloads
Backdoors, Botnet agents, Adware/spyware, Antitheft mechanisms
43
User Mode Rootkits
Run with normal user privileges, easy to write and difficult to detect
44
Kernel Mode Rootkits
Run with system privileges, difficult to write, and easy to detect
45
Signature detection
Identifying viruses by detecting known code patterns from a database
46
Christmas Tree Attack
All of the flags are set to 1 in the header packet which can crash a system or can be used to do OS fingerprinting
47
DNS
Domain Name Service - A service that translates common domain names into IP addresses for the purpose of network routing
48
ARP
Address Resolution Protocol - Protocol that translates logical IP addresses into the hardware (MAC) addresses on the LAN
49
Typosquatting
AKA URL Hijacking - an attack that consists of registered domain names similar to official sites, hoping that users will make a typo and visit their site
50
Domain Hijacking
Steals a domain registration or alter DNS records
51
MAC Spoofing Attack
Alters hardware addresses
52
IP Spoofing Attack
Alters IP Addresses - often used in DoS attacks - not useful in attacks that require return data because receiving data on a spoofed IT is not easy
53
Ingress Filtering
Blocks incoming traffic from external networks bearing an internal source IP address - useful for blocking spoofing attacks
54
Egress Filtering
Blocks outbound traffic from internal networks bearing a source IP address that you don't control
55
Four Common types of password attacks
1. Brute Force,
2. Dictionary Attack,
3. Hybrid Attack
4. Rainbow Table Attack
56
Brute Force Attack
Attempts all combinations for a password - only works for short non-complex passwords. AKA Known Ciphertext Attacks
57
Dictionary Attack
All English language words are attempted
58
Hybrid Attacks
Adds common variations to the Dictionary Attack
59
Rainbow Table Attack
Pre-computed hashes are used
60
Keyspace
The set of all possible encryption keys usable with an algorithm
61
Frequency analysis
Studies the patterns of letters in cipher text
62
Known-Plaintext Attack
Attacker has both the encrypted and unencrypted versions of a password and uses this as a decryption key for other messages
63
Chosen-Plaintext attack
The attacker creates an encrypted message and attempts to determine the key that is being used
64
Downgrade Attack
When a system supports many different types of encryption, the attacker uses a MITM attack to force two other systems that are attempting to communicate to switch to a weaker algorithm and the attacker can eavesdrop on and crack the password
65
Watering Hole Attacks
Client side attack that exploits vulnerabilities in the client accessing the server. Usually using a highly targeted (usually trusted websites) website and bundling a botnet to infect other systems
66
Clickjacking Attack
An attack where the attacker hides elements of a webpage behind other elements so that a used cannot see what he or she is actually clicking - Form of CSRF
67
Cursorjacking
Specialized form of clickjacking that tricks the used about the cursor's location on the screen
68
Directory Traversal Attacks
Allows an attacker to manipulate the file system structure on a web server - the attacker uses directory navigation references to search for unsecured files on a server
69
Buffer Overflow Attacks
If user input exceeds the space allotted for the data
70
Code Execution Attacks
An attacker exploits a vulnerability in a system that allows the attacker to run commands on that system.
71
Arbitrary Code Execution
Code execution attacks where the attacker runs commands of his or her choice
72
Remote code execution
Code execution attacks that take place over a network connection
73
Preventive measures for code exwecution attacks
1. Limit administrative access
| 2. Patch systems and applications with all available security updates
74
Driver Refactoring
Driver manipulation technique that modifies a driver to carry out malicious activities. It requires access to the driver source code
75
Driver Shimming
Driver manipulation technique that wraps a malicious driver around the outside of the driver. Does not require access to the legitimate driver's source code.
76
Six reasons social engineering attacks are successful
1. Authority/Trust
2. Intimidation
3. Consensus and Social Proof (Herd mentality)
4. Scarcity (Act quickly or you will miss out)
5. Urgency
6. Familiarity and Liking
77
Spear Phishing
Highly targeted phishing attack
78
Whaling
Subset of spear phishing - focuses on senior executives
79
Pharming
A fake website is sent to users and looks like a familiar website
80
Vishing
Voice phishing attacks asking for credentials over the phone or tell them to go to a website to download something
81
SPIM
Spam via IMs
82
Bridges
Connects two networks together at Layer 2 using MAC address
83
Media Gateways
Connect different telecommunications networks together
84
TCP/IP
Transmission Control Protocol/Internet Protocol
85
IP (Internet Protocol)
Responsible for routing information across the networks
Provides an addressing schema (IP Addresses)
Delivers packets from the source to its destination
Network Layer Protocol
86
Two main transport layer protocols
TCP and UDP
87
TCP (Transport Layer Protocol)
Responsible for the majority on internet traffic
Connection-oriented protocol
Establishes connections between to systems before transmitting data
Guarantees delivery through acknowledgement
Widely used for critical applications because of its reliability
88
TCP Flags
Used to identify packets in the three way handshake process
89
TCP Flag Types
SYN - Establish a connection
FIN - Close a connection
ACK - Acknowledges a SYN or FIN request
90
UDP (User Datagram Protocol)
More lightweight than TCP
Connectionless/ no handshake
No Acknowledgements or guaranteed delivery
Good for voice and video applications
91
Physical Layer
Wires, Radios, Optics
92
Data Link Layer
Data transfers between two nodes
93
Network Layer
IP
94
Transport Layer
TCP and UDP
95
Session Layer
Exchanges between two systems
96
Presentation Layer
Data translation and encryption
97
Application Layer
User programs
98
DNS Servers
Translates domain names into IP addresses
99
UDP Port 53
DNS
100
Network Ports
16-bit binary number
2 to the 16th power or 65,536 possible
Ranges from 0-65,535
101
Port 21
FTP
102
Port 22
SSH
103
Port 3389
RDP
104
Ports 137, 138, 139
NetBIOS
105
Port 53
DNS
106
Administrative Service Ports
21: FTP
22: SSH
53: DNS
137-139: NetBIOS
3389: RDP
107
Port 25
SMTP (Simple Mail Transfer Protocol)
108
Port 110
POP (Post Office Protocol)
109
Port 143
IMAP (Internet Message Access Protocol)
110
Mail Services Ports
25: SMTP
110: POP
143: IMAP
111
Port 80
HTTP
112
Port 443
HTTPS
113
ICMP (Internet Control Message Protocol) Functions
```
Function shows:
Destination unreachable
Redirects
Time exceeded
Address mask requests and replies
```
114
ICMP commands
ping
| traceroute
115
Stateful inspection
Tracks open connections
116
Firewall Rule Contents
Source system address
Destination system addresses
Destination port and protocol
Action (allow or deny)
117
Implicit Deny
Any traffic not explicitly permitted by a rule should be automatically denied
118
Web Application Firewall
Specifically protect web applications by using application awareness to peer deep into the application layer and block web attacks
119
Benefits of a Proxy Server
Anonymization
Performance boosting because the proxy server caches website
Content filtering increases security
120
Proxy server
Sits between the user and web server
121
Forward proxies
Work on behalf of the client, web server does not detect the proxy server
122
Reverse proxies
Work on behalf of the server, Client does not detect proxy server
123
Transparent proxies
Are not seen by the client or server. AKA inline proxies or forced proxies. Sits between the client and the outside network. Causes issues with SSL and TLS encrypted communications
124
Load Balancer Security Functions
SSL Cert Mgmt
URL Filtering
Other Web Application Security tasks
125
Round-Robin Scheduling
A type of load balancing where each server gets an equal number of requests (Simplest)
126
Session Persistence
Type of load balancing that routes an individual user's requests to the same server every time
127
Load Balancer Approaches
Active-Active and Active-Passive
128
Active-Active Load Balancing
Tow or more load balancers actively handle network traffic and continue to function with diminished capacity if one fails
129
Active-Passive Load Balancing
One load-balancer handles all traffic while a second monitors activity and assumes responsibility of the primary load balancer fails
130
Two important security functions of VPNs
1. They allow secure interconnection of remote networks
| 2. They provide mobile workers with a way to securely connect from a remote location to an organization's network
131
IPSec
Network layer VPN protocol commonly used for site-to-site VPNs but is difficult to configure. May be blocked by the firewall. Adds security to TCP/IP networks
132
SSL/TLS
Application layer VPN protocol commonly user for remote access VPNs and easier to configure. Uses port 443 because it is typically allowed through every firewall
133
Two type of remote access VPNs
Full-Tunnel VPN
| Split-Tunnel VPN
134
Full-Tunnel VPN
Everything is encrypted, including web browsing. All network traffic leaving the connected device is routed through the VPN tunnel. regardless of its final destination.
135
Split-Tunnel VPN
Only traffic destined for the corporate network is sent through the VPN tunnel. Other traffic is routed directly over the Internet
136
Always-On VPN
All mobile devices are configured automatically to connect to the VPN
137
IPSec's two protocols
ESP (Encapsulating Security Payload) and AH (Authentication Headers)
138
ESP (Encapsulating Security Payload)
Provides confidentiality and integrity protection for packet payloads
139
AH (Authentication Headers)
Provides integrity protection for packet headers and payloads. Makes sure that no changes are made to the packet while it is in transit
140
SA (Security Association)
Each pair of cryptographic protocol and hash function
141
Three common firewall errors
Shadowed rules
Promiscuous rules
Orphaned rules
142
Shadowed rules
Rules that are placed in a lower priority position and are overlooked by a firewall
143
Promiscuous rules
Allow more access than necessary
144
Orphaned rules
When something likes a service is decommissioned and the rules are never removed.
145
Router Access Control Lists
Restrict network traffic
146
WORM Repository
"Write Once, Read Many" - The centralized log repository should be configured this way to prevent log tampering
147
NTP (Network Time Protocol)
Standardized way to quickly and easily synchronize all of the system clocks within an organization. Install on a centralized time server.
148
Continuous Security Monitoring
Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. (Formal definition from NIST)
149
Three core characteristics of Continuous Monitoring
1. Maps to risk tolerance
2. Adapts to ongoing needs
3. Actively involves management providing leadership and resources
150
Six Steps of the Continuous Monitoring Process
1. Define a strategy
2. Establish a monitoring program
3. Implement the program as automated as possible to collect the metrics, perform assessments and build reports
4. Analyze and report the findings from the collected data
5. Respond by mitigating, avoiding, transferring, or accepting the risk
6. Review and update the monitoring program to fit needs
