Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Cybersecurity Bootcamp Study Aid > 11.2 Intrusion Detection, Snort, and Network Security Monitoring > Flashcards

11.2 Intrusion Detection, Snort, and Network Security Monitoring Flashcards

1
Q

An ______ both analyzes traffic and looks for malicious signatures.

A

An intrusion detection system (IDS) both analyzes traffic and looks for malicious signatures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

An IDS is like a ______ that reads the data in the packets it inspects, issues alerts, and blocks malicious traffic (if configured to do so).

A

An IDS is like a firewall that reads the data in the packets it inspects, issues alerts, and blocks malicious traffic (if configured to do so).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the world’s most popular open-source solution?

A

Snort

Network security monitoring (NSM) is the process of identifying weaknesses in a network’s defense.

It also provides organizations with situational awareness of their network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Security Onion?

A

Security Onion is a Linux distribution that contains many NSM tools.

Security Onion uses the Snort IDS engine as its event-driven mechanism.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Unlike firewalls, an IDS _____ and _____ of an attack.

A

Unlike firewalls, an IDS detects and alerts of an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

True or False

IDS are passive. They do not respond to attacks, they only log and document information for future analysis.

A

True

IDS helps organizations enforce the cyber kill chain by establishing situational awareness of attackers, allowing them to harden defenses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the two types of IDS?

A
  1. Signature-based IDS

2. Anomaly-based IDS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Explain a signature-based IDS

A

A signature-based IDS compares patterns of traffic to predefined signatures.

Good for identifying well-known attacks.

Can be updated as new attack signatures are released.

Vulnerable to attacks through packet manipulation.

Unable to detect zero-day attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Explain an Anomaly-based IDS

A

An anomaly-based IDS compares patterns of traffic against a well-known baseline.

Good for detecting suspicious traffic that deviates from well-known baselines.

Excellent at detecting when attackers probe and sweep a network.

Prone to false alerts.

Assumes network behavior does not deviate from well-known baselines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the two basic architectures of intrusion detection systems?

A
  1. Network intrusion detection (NIDS) filters an entire subnet on a network.
  2. Host-based intrusion detection (HIDS) runs locally on a host-based system or user’s workstation or server.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Explain NIDS

A

Network intrusion detection (NIDS) filters an entire subnet on a network.

  • Matches all traffic to a known library of attack signatures.
  • Passively examines network traffic at points that it’s deployed.
  • Relatively easy to deploy and difficult to detect by attackers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Explain HIDS

A

Host-based intrusion detection (HIDS) runs locally on a host based system or user’s workstation or server.

  • Acts as a second line of defense against malicious traffic that successfully gets past a NIDS.
  • Examines entire file systems on a host, compares them to previous snapshots or baselines, and generates an alert if there are significant differences between the two.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

True or False

An Intrusion Prevention System (IPS) can do everything an IDS can, but can also respond to attacks.

A

IPS can react to packets by blocking malicious traffic,

preventing it from being delivered to a host on the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

IDS connects via a _____ or ______.

A

IDS connects via a network tap or mirrored SPAN port.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a network tap?

A

Network TAP (Test Access Port) is a hardware device that provides access to a network. Network taps transit both inbound and outbound data streams on separate channels at the same time, so all data will arrive at the monitoring device in real time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a SPAN port?

A

SPAN (Switched Port Analyzer), also known as port mirroring, sends a mirror image of all network data to another physical port, where the packets can b captured and analyzed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

IPS connects _____ with the flow of data, typically between the firewall and network switch.

A

inline

IPS connects inline with the flow of data, typically between the firewall and network switch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

True or False

An IDS system generates alerts when a Snort rule detects malicious traffic that matches a signature.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

An _____ is a message that is sent to an analyst’s console as an indicator of attack (IOA).

A

An alert is a message that is sent to an analyst’s console as an indicator of attack (IOA).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

IDS Alerts

Indicators can be either:

A
  1. Indicators of attack

2. Indicators of compromise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Explain Indicators of attack alert

A

Indicators of attack indicate attacks happening in real time.

  • Proactive approach to intrusion attempts.
  • Indicate that an attack is currently in progress but a full breach has not been determined.
  • Focus on revealing the intent and end goal of an attacker, regardless of the exploit or malware used in the attack.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Explain Indicators of compromise alert

A

Indicators of compromise indicate previous malicious activity.

  • Indicate that an attack has occurred, resulting in a breach.
  • Used to establish an adversary’s techniques, tactics, and procedures (TTPs).
  • Expose all the vulnerabilities used in an attack, giving network defenders the opportunity to revamp their defense as part of their mitigation strategy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

True or False

Yopu have to purchase Snort

A

False

Snort is free

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How many modes can Snort operate in?

A

3

  1. Sniffer Mode - Reads network packets and displays them on screen.
  2. Packet Logger Mode - Performs packet captures by logging all traffic to disk.
  3. Network IDS Mode -Monitors network traffic, analyzes it, and performs specific actions based on administratively defined rules.
25
Q

Snort can perform ________ and can ________ on a network.

A

Snort can perform real-time traffic analysis and can log packets on a network.

26
Q

Rules can direct Snort to monitor the following information:

A
  1. OSI Layer - We can watch for IP and TCP data.
  2. Source and Destination Address Where the traffic is flowing from and to.
  3. Byte Sequences -Patterns contained in data packets that might indicate malware, etc.
27
Q

What does this Snort rule do?

alert ip any any -> any any {msg: “IP Packet Detected”;}

A

This rule logs the message “IP Packet Detected” when it detects an IP packet.

28
Q

What are the two main differences between a firewall and an IDS system?

A

An IDS differs from a firewall in that it detects and alerts when triggered by a rule.

29
Q

What’s the best physical placement for an IDS on a network, inline or mirrored port?

A

Mirrored port

30
Q

An IDS placed at the Perimeter layer of the DiD model is referred to as what?

A

Perimeter IDS

31
Q

Define each part of the following Snort alert:

alert ip any any -> any any {msg: “IP Packet Detected”;}

A
  • alert: The action that Snort will take when triggered.
  • ip: Applies rule to all IP packets.
  • any any: From any source IP address and from any source port.
  • -->: All traffic inbound from outside the network to inside the network.
  • any any: To any destination IP address and source port.
  • {msg: "IP Detected;}: The message printed with the alert when the rule is matched.
32
Q

An intrusion system that can act on an alert by blocking traffic is referred to as what?

A

Intrusion prevention system or IPS

33
Q

Name the two types of detection techniques used by intrusion detection systems.

A

Anomaly and signature

34
Q

True or False:

Signature-based IDS systems are not effective against zero-day attacks.

A

True

35
Q

When used together, which should be placed farthest from the data: a firewall, an IDS, or an IPS?

A

A firewall

36
Q

Name and define the three different Snort configuration modes.

A

Sniffer Mode: Reads network packets and displays them to screen.

Packet Logger Mode: Performs packet captures by logging all traffic to disk.

NIDS Mode: Monitors network traffic, analyzes it, and performs specific actions based on administratively defined rules.

37
Q

What is the difference between an IDS and an IPS?

A

An IPS can act on traffic by blocking it and preventing it from being delivered to a host based on the contents of the packet. An IDS cannot

38
Q

What is the difference between an IDS and an IPS?

A

An IPS can act on traffic by blocking it and preventing it from being delivered to a host based on the contents of the packet. An IDS cannot

39
Q

True or False:

An indicator of attack (IOA) occurs at some previous point in time, and an indicator of compromise (IOC) occurs in real time.

A

False

(IOC) occurs at some previous point in time and (IOA) occurs in real time

40
Q

True or False:

An IOA is “proactive” and an IOC is “reactive.”

A

True

41
Q

True or False:

An IPS is physically connected “inline” with the flow of traffic, processes entire subnets of data, and requires more robust hardware.

A

True

42
Q

_______ use a variety of data analysis tools to detect and stop threats after most front-end layers are compromised.

A

Network security monitoring use a variety of data analysis tools to detect and stop threats after most front-end layers are compromised.

43
Q

What are the NSM stregnths (6):

A

Allows organizations to:

  1. Track adversaries through a network and determine intent.
  2. Acquire intelligence and situational awareness.
  3. Be proactive by identifying vulnerabilities.
  4. Be reactive through incident response and network forensics.
  5. Provide insights about advanced persistent threats.
  6. Uncover and track malware.
44
Q

What are the NSM limitations (5)?

A
  1. Cannot read encrypted traffic.
  2. Powerful hardware and CPU requirements mean higher costs.
  3. Difficulty reading radio transmissions, meaning attackers can use mobile radio communications to obfuscate attacks.
  4. NSM is an invasive process that monitors and records all network data.
  5. Placement of an NSM can be limited at certain areas of the network.
45
Q

What are the two stages NSM operates in?

A
  1. Detection - An alert is generated in the Squil analyst console.
  2. Repsonse - A security team responds to a security incident.
46
Q

NSM Stages and Processes

Explain the NSM detection stage?

A

Detection is an alert is generated in the Squil analyst console.

Collection

The event is observed and the data is stored in the form of a PCAP file.

Host data
Net data
Application logs
Data from third party
Data from constituent

Analysis

The alert data is identified, validated, documented, and categorized according to its threat level.

IOC-centric analysis,
or “matching”

IOC-free analysis,
or “hunting”

47
Q

Intrusion detection systems are generally placed at strategic points in a network where traffic is______.

These devices are typically placed next to a _____ or _____ that filters traffic.

A

Intrusion detection systems are generally placed at strategic points in a network where traffic is most
vulnerable.

These devices are typically placed next to a router or switch that filters traffic.

48
Q

What is Security Onion?

A

A network security monitoring platform that provides context, intelligence, and situational awareness of a network.

Security Onion is an Ubuntu-based, open source Linux distribution that contains many NSM tools used to protect networks from attacks.

49
Q

What are 3 NSM tools for incident detection and response?

A
  1. Sguil - Pulls alert data from Snort, allowing us to more thoroughly analyze alerts.
  2. Transcript - Provides a view of PCAP transcripts that are rendered with TCP flow.
  3. NetworkMiner Performs advanced network traffic analysis through extraction of artifacts contained in PCAP files.
50
Q

Sguil has six key functions that help with analysis:

A
  1. Performs simple aggregation of alert data records.
  2. Makes available certain types of metadata.
  3. Allows queries and review of alert data.
  4. Allows queries and review of session data.
  5. Allows easy transitions between alert or session data and full content data.
  6. Counts and classifies events, enabling escalation and other incident response decisions.
51
Q

Sguil has four main sections:

A
  1. Alert Panel
  2. Snort Rule
  3. Packet Data
  4. IP Resolution
52
Q

True or False:

NSM is vulnerability-centric, with its primary focus on the vulnerability and not the adversary.

A

False

53
Q

True or False:

The strength of NSM is its focus on the visibility of an attack, not its control.

A

True

54
Q

True or False:

NSM can see inside encrypted traffic.

A

False

55
Q

True or False:

Alerts in Security Onion’s Sguil console are the equivalent of an Indicator of Attack, or IOA.

A

True

56
Q

True or False:

NSM provides organizations with the capability to track and uncover malware.

A

True

57
Q

True or False:

The Snort IDS engine drives the functionality of the Sguil analyst’s console.

A

True

58
Q

Name two methods for physically connecting an IDS to a network.

A

Network tap or SPAN/mirrorored port

59
Q

Name the two stages of NSM and their processes.

A

The first stage is Detection. Its processes are Collection and Analysis.

The second stage is Response. Its processes are Escalation and Resolution.

ag-Cybersecurity Bootcamp Study Aid (55 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions