3-Network Security Flashcards
Networks based threats
a threat may have the ability to disrupt network communications, or be able to intercept communications in order to acquire sensitive information.
spoofing
This is the act of changing the configuration of a device or system in an attempt to masquerade as a different, known, and trusted system.
Access bypass
An individual can attach an unauthorized access device, such as a Wi-Fi access point or a dial-in modem, to the network, thereby permitting himself (or others) to access the network while bypassing security controls.
Man-in-the-browser attack
This attack involves the installation of a malicious “browser helper object” (BHO) onto a victim’s browser. The malicious BHO alters communication between the browser and the Internet without the victim’s knowledge.
Drive-by-attack
malware loaded on websites, that are in turn installed on site’s visitor computer
What attacks are propagated via email
Spam, phishing, pharming, and malware
What is a pharming attack
Pharming is a scamming practice in which malicious code is installed on a personal computer or server, misdirecting users to fraudulent Web sites without their knowledge or consent. Pharming has been called “phishing without a lure.”
Phishing
The fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers
Network Security Countermeasures - NSC
Controls to ensure the integrity and security of a network as one layer of defense in the protection of valuable or sensitive information.
They include: User authentication controls/Machine authentication controls/Anti-Malware/Encryption/ switched networks/IDS/IPS etc.
Machine Authentication controls
Ensure that only organization-managed devices can attach to the network.
IEEE 802.1X technology is used to enforce machine authentication controls.
Encryption controls
Tunnels between pairs of servers can be established at the OS level using IPsec or SSH
Tunnels between networks can be established using IPsec between pairs of routers
switched networks controls
With switched networks, only traffic that a node sees are packets sent explicitly to or from the node, as well as some broadcast traffic. This greatly reduces the risk of eavesdropping, since it may not be practical to encrypt all communications.
IDS
Systems used to detect anomalous activities on the network, sending alerts to appropriate personnel when these alerts occur.
Type os IDS
- Network based IDS - Usually takes the form of network appliances
- Host based IDS - Software agent installed on each host and a separate managemnet console
Snort
An Open source IDS, a software istalled on a server to monitor incoming tarffic.
Snort modes
- Sniffer
- Packet logger
- Network intrusion detection
IPS
These systems, like IDSs, detect anomalies on the network. However, IPSs are also able to block (internally and externally) malicious traffic
Drawback with IPs
A false positive can result in legitimate traffic being blocked.
Website filtering
Design to block users’access to categories of website. It limits employees’ access to non business related webiste, and also it block access to known vulnerable websites
Data leakage prevention
These systems are designed to detect the transmission of potentially sensitive information into or out of an organization’s network.
Application Whitelisting
They examine each executable that is launched; if the executable matches an entry in the tool’s whitelist, it is permitted to run. Otherwise, its execution is blocked.
Netwflow
Netflow systems are typically used to troubleshoot network issues (because they can reveal every packet transmitted on the network), but they are handy for security purposes as well, because they can show anomalous network traffic that could be a sign of an intrusion, malware, or data exfiltration.
What is a client-server application
A piece of software that runs on a client computer and makes a request to a remote server
Security countermeasure to threats and vulnerability in client-server environments.
- Access controls
- Encryption of communication between client-server
- Change management protocol
- Disruption of client software update - Use countermeasure such as synchronization of client-server with server software.
- Stealing of data - use countermeasure such the blocking the use of external storage devices
