2.5 Flashcards
Segmentation and access control, mitigation techniques, hardening techniques
True/False
Segmentation can help with performance as well as security
True
If there is an application that requires high bandwidth, you can put it on its own network segment. That way, the traffic of any other user on the same network will not interfere with the throughput.
True/False
Segmentation makes change control more difficult
False
Segmentation makes change control much easier
4 ways that applications are identified by an allow list/deny list.
Application hash - only allow the application with this unique identifier
Digital certificate - only allow digitally signed apps from certain publishers
Path - only run applications in these folders
Network zone - only run apps from this network zone (private/public) - this can change as you physically change locations. If you’re in your private corporate network, the app works. If you’re in public, the app will not.
True/False
Auto-update is always the best option
False
It’s always best, in an enterprise environment, to test patches first before deploying them to other systems
True/False
Some applications encrypt their own data, separate from the OS
True
A check that makes sure you have the latest OS, applications are patched, virus signatures are updated, and configurations are secure.
This happens each time that a device logs into the network.
Also checks for certificate status, if your EDR are configured and turned on properly and the correct version, etc.
Posture assessment
What happens when a system fails the posture assessment?
Quarantine into a private VLAN with limited access. Here, the system can implement the necessary changes.
What is the first, most vital step to hardening a system?
Download the security updates
What 3 things should you encrypt in order to harden a system?
Files
Full disk
Communications
EDR stands for
Endpoint Detection and Response
A new age threat detection technology. It runs completely autonomously and is API driven. This is a LIGHTWEIGHT agent on the endpoint.
It can detect known-bad malware through signatures, but it can also conduct behavioral analysis, machine learning, and process monitoring (for new/different processes) to set baselines and detect when something malicious might be occurring.
After finding an anomaly, it conducts root cause analysis. Then, it immediately takes action: isolating the system, quarantining the threat, or rolling back to a previous backup/configuration.
EDR
What type of firewall is ideal when hardening a network? It has a lot of granularity in controlling both the port number and the service that uses the port number.
NGFW (Next-Generation Firewall)
NGFW stands for
Next-Generation Firewall
True/False
Applications can open ports without the user’s knowledge when installed
True
Nmap is a
Port scanner
