3.1

Question 1

Protocol

Answer 1

Allow different components from a computer to talk using using a commonly shared set of commands.

Question 2

Domain Name System Security Extensions (DNSSEC)

Answer 2

DNSSEC is a set of extensions to the DNS protocol that enable origin authentication of DNS data, authenticated denial of existence, and data integrity. DNSSEC responses are authenticated but not encrypted so that unauthorized DNS responses won’t be interpreted as correct. Authenticated denial of existence allows a resolver to validate if a domain doesn’t exist.

UDP/TCP port 53.

Question 3

Secure Shell (SSH)

Answer 3

Encrypted remote terminal program for servers. SSH uses asymmetric encryption but may also require an independent source of trust with a server.

TCP port 22

Question 4

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Answer 4

While MIME sends binary data in plaintext via email, S/MIME uses a public key encryption for signing of MIME data in emails. It provides cryptography. It is built into a majority of modern email software today. It provides authentication, message integrity, and nonrepudiation in e-mails.

Question 5

Secure Real-time Transport Protocol (SRTP)

Answer 5

Used to securely deliver audio and video over IP networks. SRTP provides encryption, message authentication and integrity, and replay protection to the RTP data.

Port 5004(UDP)

Question 6

Lightweight Directory Access Protocol over SSL (LDAPS)

Answer 6

LDAPS uses an SSL/TLS tunnel to connect LDAP services and transmit them securely.

LDAPS communication: TCP 636

LDAPS communication to a global server: TCP 3269

Question 7

File Transfer Protocol, Secure (FTPS)

Answer 7

Implementation of FTP over an SSL/TLS secure channel. Only TLS is used for FTPS

Data connection port: TCP 989
Control connection port: TCP 990

Question 8

SSH File Transfer Protocol (SFTP)

Answer 8

Use of FTP over an SSH channel. Leverages SSH to secure FTP transfers. SFTP uses TCP port 22.

Question 9

Simple Network Management Protocol, Version 3 (SNMPv3)

Answer 9

An application-layer protocol that is a part of the IP suite of protocols and can be used to manage and monitor devices. These include network devices, computers, and other devices over an IP network.

Port 161/162.

If presented with a network device management scenario, remember the only secure version of SNMP is SNMPv3.

Question 10

Hypertext Transfer Protocol over SSL/TLS (HTTPS)

Answer 10

The use of SSL/TLS (now mainly TLS) to encrypt a channel that HTTP traffic is transmitted. TLS replaced SSL because it was outdated and not as secure.

Uses port 443

Question 11

IPSec

Answer 11

IPSec is a set of protocols that securely exchange packets at the network layer. The set of protocols are designed to provide access control, connectionless integrity, traffic-flow confidentiality, rejection of replayed packets, data security (encryption), and data origin authentication.
IPSec has two defined modes: transport and tunnel
IPSec has three modes of connection: host-to-server, server-to-server, and host-to-host.

Question 12

Authentication Header (AH) / Encapsulated Security Payload (ESP)

Answer 12

To provide traffic security, AH and ESP have been defined for IP datagrams.
AH ensures the integrity of the data and also the authenticity of the data’s origins. AH protects the IP and this enables data origin authentication.
ESP provides security services for the higher-level protocol portion of the packet only.
AH protects integrity, but not privacy. ESP provides confidentiality, but no integrity.

Question 13

Tunnel/Transport

Answer 13

Transport mode encrypts only the data portion of the packet but not the source or destination IP addresses.

Tunnel mode provides encryption of source and destination IP addresses as well as the data itself. It can only be done between IPSec servers or routers because final destination needs to be known for delivery.

Question 14

Post Office Protocol (POP) / Internet Message Access Protocol (IMAP)

Answer 14

110 for POP3
143 for IMAP

POP3S TCP port 995
IMAPS TCP port 993

Question 15

Voice and Video

Answer 15

Voice and video are frequently streaming media and, as such, have their own protocols for the encoding of the data streams. To securely transfer this material, you can use the Secure Real-time Transport Protocol (SRTP), which securely delivers audio and video over IP networks.

Question 16

Time Synchronization

Answer 16

Network Time Protocol (NTP) is the standard for time synchronization across servers and clients. NTP is transmitted over UDP port 123. NTP has no assurance against a man-in-the-middle attack, and although this has raised concerns over the implications, to date, nothing has been done to secure NTP directly, or to engineer an out-of-band security check.

Question 17

E-mail and Web

Answer 17

Use of HTTPS is widespread and common. Keep in mind that SSL is no longer considered secure. E-mail is a bit more complicated to secure, and the best option is via S/MIME, also discussed previously in this chapter.

Question 18

E-mail and Web

Answer 18

Use of HTTPS is widespread and common. Keep in mind that SSL is no longer considered secure. E-mail is a bit more complicated to secure, and the best option is via S/MIME, also discussed previously in this chapter.

Question 19

File Transfer

Answer 19

Secure file transfer can be accomplished via a wide range of methods, ensuring the confidentiality and integrity of file transfers across networks. FTP is not secure, but as previously discussed, SFTP and FTPS are secure alternatives that can be used.

Question 20

Directory Services

Answer 20

Directory services use LDAP as the primary protocol. When security is required, LDAPS is a common option, as described previously. Directory services are frequently found behind the scenes with respect to logon information.

Question 21

Remote Access

Answer 21

Depending on the device being accessed, a variety of secure protocols exist. For networking equipment, such as routers and switches, SSH is the secure alternative to Telnet. For servers and other computer connections, access via VPN, or use of IPSec, is common.

Question 22

Domain Name Resolution

Answer 22

From an operational perspective, both TCP and UDP port 53 can be used for DNS, with the need of firewall protection between the Internet and TCP port 53 to prevent attackers from accessing zone transfers.

Question 23

Routing and Switching

Answer 23

SNMPv3 enables applications to manage data associated with networking and devices. Local access to the boxes may be accomplished by Telnet, although for security reasons SSH should be used instead.

Question 24

Network Address Allocation

Answer 24

Managing network address allocation functions in a network requires multiple decision criteria, including the reduction of complexity and the management of device names and locations.

SNMPv3 has many functions that can be employed to manage the data flows of this information to management applications that can assist administrators in network assignments.