Section 3 Flashcards
What are firewalls
a barrier that intercepts and inspects traffic moving from one area of the network to another and either allows it or denies it
What is a packet filter
a firewall that operates at Layers 3 and 4 of the OSI network model. That equates to the IP address L3 and the TCP or UDP port number L4. denies or allows based on:
Protocol (typically IP)
Source IP Address
Destination IP Address
Source TCP or UDP port number
Destination TCP or UDP port number
These firewalls are only concerned with the address label (header) of the packets and perform no level of inspection on the contents of the packet (the payload).
What is a circuit-level gateway
a device that operates as a middleman between two or more systems to help conceal the true identity of the client and server. The gateway may change the IP address and the TCP/UDP port number of the traffic to allow two networks to communicate that otherwise could not (for example, your home network and the internet).
What are stateful inspection firewalls
A stateful firewall tracks the state of network connections, and uses this information to automatically permit response traffic from an already allowed session to flow back to the sender. This reduces the need for creating individual rules for each connection and each direction of traffic flow. Instead, you only need a rule that allows the initial establishment of a session.
They works at L3, L4, and L5 of the OSI model
What do the 2 different VLAN port modes do
access mode (untagged) ports are used by servers and workstations and are assigned to a single VLAN
Trunk mode (tagging) ports are used for the ports which interconnect multiple switched or routers and carry the traffic of multiple VLANs
What is port redirection
network administrators redirect a commonly known port number such as TCP port 80, which runs HTTP, to a less expected port number such as TCP port 8080, in hopes of obscuring or hiding the fact that the computer is running a web server.
What is an SQL Injection attack and what is a possible security solution
Layer 7 attack where code is injected into a server. To mitigate, use a reverse proxy system that is able to scan the incoming packet for malicious behavior instead of simply forwarding the malicious payload to the destination. An IPS will also work.
What is an Man-in-the-middle attack and what is a possible security solution
Layer 6 where attacker is able to see everything the victim does without encryption. Many of these attacks can be mitigated using an Application-layer proxy or an IPS, though training the users about fake security certificates is equally important.
What is an RPC attack and what is a possible security solution
Layer 5 attack that allows attacker to execute functions and procedures on other computers. with regular operating system and application patching, you can mitigate most of these attacks.
What is a Port scanner and what is a possible security solution
Layer 4 attacks which allows the attacker to scan the victim’s computer for open ports that they could later attack. A packet-filtering firewall is an appropriate defense against port scanners.
What is an Ping sweep attack and what is a possible security solution
Layer 3 attack sends pings to a large number of IP addresses to detect which computers are online and may, therefore, be susceptible to other attacks. Fortunately, these attacks can be easily mitigated by using a packet-filtering firewall.
What is VLAN hopping and what is a possible security solution
Layer 2 attacks which an attacker can join a network that would normally not be available to them. The good news is that this attack can be mitigated by following the switch vendor’s recommendations for VLAN configuration, as well as by designating all computer switch ports as access mode instead of trunk mode.
What is an Wiretapping and what is a possible security solution
Layer 1 threat which involves tampering with the physical cables of a victim’s network. Copper-based wiring, such as Category 6 cabling, is susceptible to electronic sniffing or listening devices because the electrons flowing through the cables create a perceptible electromagnetic field (EMF). Physical security will protect against this attack
What is symmetric key encryption
also known as private key encryption, uses the same key to encrypt the data as it does to decrypt the data, meaning that when used for data transmission, both sender and receiver need the same key
What does a key management system (KMS) do
generates a key to encrypt data, and then generates a master key to encrypt the key stored with the data. The master key does not leave the KMS
How is the master key of a KMS protected
by encrypting the master key with another key, and then encrypting it again with another key through the key encryption hierarchy
What is asymmetric key encryption
uses PKI to encrypt and decrypt. Retrieve the receiver’s public key, encrypt the message, and then the receiver can decrypt with their private key
How is a key pair generated
created using an algorithm that enables one key to decrypt ciphertext that the other key has encrypted. Once the pair is created, the public key is published to a public repository, whereas the private key is kept secret by the owner of the key.
What is end-to-end encryption
when the data is both encrypted in transit and at rest
