1.0 Network Security Flashcards
What does security mean?
Security is the degree of protection against danger, damage, loss, and criminal activity.
What does CIAN stand for?
CIAN stands for Confidentiality Integrity Availability Non-repudiation.
What are the steps of an attack?
Then steps of an attack generally include Reconnaissance, Breach, Escalate privilages, Stage, Exploit.
What defense methodology is Layering?
Layering involves implementing multiple security measures to protect the same asset.
What defense methodology is the principle of least privilege?
The principle of least privilege states that users or groups are given only the access they need to do their job and nothing more.
What does access control mean?
Access control is the ability to permit or deny privileges that users have when accessing resources on a network or computer.
What processes are included in access control?
Some processes that are included in access control are Identification, Authentication, Authorization, and Auditing.
What is the MAC access control model?
The MAC access control model is Mandatory Access Control which uses authorization policies to determine if a resource can be accessed by a specific user.
What is the DAC access control model?
The DAC access control model is Discretionary Access Control which assigns access directly to users based on the discretion of the owner of the resource.
What is the RBAC access control model?
The RBAC access control model is Role-Based Access Control where access is allowed based on the role of the user in an organization.
What does authorization mean?
Authorization is the process of controlling access to resources.
What is an Access Control List?
An Access Control List identifies users or groups who have specific security assignments to an object.
What is a DACL type of access list?
A DACL access list is a Discretionary Access Control List which is the implementation of Discretionary Access Control (DAC)
What is a SACL type of access list?
A SACL access list is a System Access Control List which is used by Microsoft for auditing to identify past actions performed by users on an object.
What are Effective Permissions?
Effective permissions are the combined inherited permissions and explicit permissions.
Define ‘Need to know’.
Need to know describes the restriction of data that is highly sensitive and is usually referenced in government and military context.
Define ‘Separation of duty”.
Separation of duty is the concept of having more than one person required to complete a task.
Define ‘Job rotation’.
Job rotation is a technique where users are cross-trained in multiple job positions, and where responsibilities are regularly rotated between personnel.
Define ‘Defense-in-depth’.
Defense-in-depth is an access control method which implements multiple access control methods instead of relying on a single method.
What is creeping privileges?
Creeping privileges occurs when a user’s job position is changed and they are granted a new set of access privileges and their previous access privileges are not removed or modified.
What are the four stages in the remote access process?
The four stages in the remote access process are Connection, Authentication, Authorization, and Accounting.
Explain RADIUS.
Remote Authentication Dial-In User Service is used to centralize remote access administration. A RADIUS server combined authentication, authorization, and accounting and can use PPP, CHAP, and PAP. RADIUS uses UDP port 1812 and 1813.
Explain TACACS+
Terminal Access Controller Access-Control System Plus is used to centralize remote access administration. TACACS+ provides authentication, authorization, and accounting with the ability to host each service on separate servers. TACACS+ uses TCP port 49.
What is Telephony?
Telephony is the transmission of voice communications.
What is ‘convergence’?
Convergence refers to the intermingling of voice and data services on networks.
What are the layers of the OSI model?
Layer 7: Application Layer 6: Presentation Layer 5: Session Layer 4: Transport Layer 3: Network Layer 2: Data Link Layer 1: Physical
What are two types of Reconnaissance?
Organization (conducting research about a company to find information and create a profile about the organization) and Technical (using electronic means to scan systems to collect configuration and security data).
What is the difference between passive reconnaissance and active scanning?
Passive reconnaissance is characterized by gathering data while active scanning is coming into contact with the system.
What is a ping flood?
A ping flood is a simple DoS attack where the attacker overwhelms the victim with ICMP Echo Request packets.
What is the ping of death?
The ping of death is a DoS attack that uses the ping program to send oversized ICMP packets.
What is a smurf attack?
A smurf attack is a form or DRDoS attack that spoofs the source address in ICMP packets.
What is a SYN flood attack?
A SYN flood attack exploits the TCP three-way handshake by not sending the last message that would close the message.
What is a LAND attack?
A LAND attack is one in which the attacker floods the victim’s system with packets that have forged headers.
What is a Christmas Tree attack?
A Christmas tree attack uses an IP packet with every option turned on for the protocol being used.
What is a bastion host?
A bastion or sacrificial host is any host that is exposed to attack and that has been hardened against those attacks.
What is a demilitarized zone?
A demilitarized zone or DMZ is a buffer network that sits between the private network and an untrusted network.
What is a screening router?
A screening router is the router that is most external to your network and closest to the Internet.
What is a duel-homed gateway?
A dual-homed gateway is a firewall device that typically has three network interfaces: one connected to the internet, one connected to a private network, and one connected to a public network.
