4.5-4.6 Flashcards
network based fw
can also be layer 3 router, can do NAT, dynamic routing, can VPN between sites
ips rules
signature based if signature matches then reject it. anomaly based, unusual traffic patterns flagged.
url scanning
allow or restrict based on a url. managed by category.
agent based web filter
deploy software on the user’s device to collect data.
dns filtering
harmful sites don’t have their ip address resolved so they can’t connect to their website
active directory (AD)
a database of everything on the network
-computers users, file sharess, printers, groups, and more
SELinux
Security Enhanced Linux.
Adds mandatory access control (MAC) to Linux
which allows central admin to decide who gets access to what security level
dac
discretionary access control. user has their own discretion as to what rights and permissions to assign to different resources in linux os.
how to secure traffic over wifi or in general?
use wpa3 which encrypts all traffic over wifi
use vpn tunnel
mail gateway
evaluates all emails to see if it is legit. decides if it goes to inbox or spam
spf protocol
sender policy framework.
identifies authorized mail servers so you know if it is coming from a legit source
dkim
domain keys identified mail. mail server digitally signs all outgoing mail
dmarc
domain based message authentication, reporting, and conformance.
extension of spf and dkim. allows you to decide what receiving email servers should do with emails that weren’t validated with spf and dkim. also sends compliance reports
fim
file integrity monitoring. monitor important os and app files and identify when changes occur.
sfc
system file checker. windwos fim
tripwire
linux fim
endpoint
the user’s access.
edr
xdr
endpoing detection and response many ways to detect threat, can investigate and respond.
extended detection and response. evolution of edr, has network based detection, correlateds endpoint, network, and cloud data for improved detection rates.
persistent agent
permanently installed onto system
dissolvable agent
no install required, runs during posture assessment deletes itself when scan is over
agentless nac
integrated with active directory, checks made during login and logoff dont need download
iam
identity and access management. identity lifecycle management. form onboard to leaving. nobody gets admin access
Ldap
protocol for reading and writing directories over an ip network
samL
security assertion markup language. you can autheticate through a third party to gain access. not made for mobile devices
OAuth
authorization framework for modern and mobile devices. created by twitter,google and many others. allows for different types of authentication throught third parties to authorize access
federation
when a website allows you to make an account using your google or facebook account
interoperability
protocols and authentication or authorization method work well with each other
rule based access control
generic term for following rules. access determined through system-enforced rules
abac
attribute based access control, can consider many parameters when authorizing.
hard/soft
key card or usb (physical things), hardware or software tokens (logical)
