26 - Understanding Enterprise Network Security Architecture Flashcards
What is the name for the multitude of types of threats and sources to the enterprise network?
Threatscape
A weakness that compromises either the security or functionality of a system. Weak or easily guessed passwords are considered this.
Vulnerability
The mechanism that is used to leverage a vulnerability to compromise the security or functionality of a system.
Exploit
Any circumstance or event with the potential to cause harm to an asset in the form of destruction, disclosure, adverse modification of data, or DoS. An example of a __ is malicious software that targets workstations
Threat
The likelihood that a particular threat using a specific attack will exploit a particular vulnerability of an asset that results in an undesirable consequence.
Risk
Attacks that attempt to consume all critical or computer network resource to make it unavailable for valid use
DoS/DDoS
An attacker injects traffic that appears to be source from a system other than the attacker’s system, itself. __ is not specifically an attack but can be incorporated into various types of attacks
Spoofing
Aype of DoS attack in which the attacker sends a flood of protocol request packets to various IP hosts. The attacker spoofs the IP address of the intended target. The IP hosts that receive these packets become “reflectors”. The reflectors respond by sending response packets to the spoofed address (the target), thus flooding the unsuspecting target.
Reflection
Manipulating people and capitalising on expected behaviours
Social engineering
Common social engineering technique. Typically, a __ email pretends to be from a large, legitimate organisation. The goal is to get the victim to enter personal information such as account numbers, social security numbers, usernames or passwords.
Phishing
The attacker will try to access protected resource by obtaining a users password. Methods include guessing, brute force, and dictionary attacks.
Password attacks
An attempt to learn more about the intended victim before attempting a more intrusive attack.
Reconnaissance attacks
When an attacker provides inputs that are larger than expected, and the service will access the input and write it to memory, filling up the associated buffer and overwriting adjacent memory. This may corrupt the system and cause it to crash, resulting in a DoS.
Buffer overflow attacks
Generally, in these attacks, a system that has the ability to view the communication between two systems imposes itself in the communication path between those other systems.
Man in the middle attacks
Malicious software that comes in several forms, including viruses, worms and trojan horses.
Malware
Refers to the means by which data leaves the organisation without authorisation. While not a direct attack itself, it is a major security concern in the enterprise network
Vector of data loss and exfiltration
An __ is a system that performs deep analysis of network traffic, searching for signs of suspicious or malicious behaviour. If it detects such behaviour, the __ can take protective action. Because it can perform deep packet analysis, an __ can complement a firewall by blocking attacks that would normally pass through a traditional firewall device.
IPS
There are several methods of traffic inspection that are used in various IPS’:
- signature-based inspection
* anomaly-based inspection
This traffic inspection method examines the packet headers or data payloads in network traffic and compares the data against a database or know attack signatures
signature-based inspection
This traffic inspection method observes network traffic and acts if a network event outside normal network behaviour is detected
anomaly-based inspection
What are the three types of anomaly-based network IPS?
- statistical anomaly detection (network behaviour analysis)
- protocol verification
- Policy-based inspection
___– observes network traffic over time and builds a statistical profile of normal traffic behaviour based on communication patterns, traffic rate, mixture or protocols and traffic volume. After a normal profile has been established, statistical anomaly detection systems detect or prevent activity that violates the normal profile
statistical anomaly detection (network behaviour analysis)
___ - observes network traffic and compares network, transport and application later protocols that are used inside network traffic to protocol standards. If a deviation from standards-based protocol behaviour is detected, the system takes action.
protocol verification
____ – a policy based IPS analyses network traffic and takes action if it detects a network event outside a configured traffic policy.
Policy-based inspection
