5.0 Network Architecture Flashcards
The selection and placement of media, devices, protocols/services, and data assets.
Network architecture
The media, appliances, and addressing/forwarding protocols that support basic connectivity.
Network infrastructure
Provides the addressing mechanism for logical networks and subnets.
Internet Protocol (IP)
All the points at which a threat actor could gain access to hosts and services.
Attack surface
this is a box with ports for incoming and outgoing network cabling and an inductor or optical splitter that physically copies the signal from the cabling to a monitor port. There are types for copper and fiber optic cabling
Test access point (TAP)
this means that the sensor is attached to a specially configured port on a switch that receives copies of frames addressed to nominated access ports (or all the other ports). This method is not completely reliable. Frames with errors will not be mirrored , and frames may be dropped under heavy load.
SPAN (switched port analyzer)/mirror port
control is one that does not require any sort of client or agent configuration or host data transfer to operate. For example, network traffic can be directed or copied to a sensor and scanned by an analysis engine
passive security
that performs scanning must be configured with credentials and access permissions and exchange data with target hosts. An _____ that performs filtering requires hosts to be explicitly configured to use the control. This might mean installing agent software on the host or configuring network settings to use the control as a gateway
active security control
Portions of the network or system that have specific security concerns or requirements.
Security zone
A network that does not require a physical connection.
Wireless network
A network that grants internet access only to guest users. A guest network has a firewall to regulate guest user access.
Guest network
A host (honeypot), network (honeynet), file (honeyfile), or credential/token (honeytoken) set up with the purpose of luring attackers away from assets of actual value and/or discovering attack strategies and weaknesses in the security configuration.
Honeynet
A decentralized network that allows connections without a traditional base station or router. It allows users to connect two or more devices directly to each other for a specific purpose.
Ad hoc
A temporary DNS record that redirects malicious traffic to a controlled IP address.
DNS sinkhole
A hardened server that provides access to other hosts.
Jump server
Agent-based web filtering involves installing a software agent on desktop computers, laptops, and mobile devices. The agents enforce compliance with the organization’s web filtering policies.
Agent-based filtering
A network that contains publicly accessible resources and is located between the private network and an untrusted network, such as the internet. It is protected by a firewall.
Screened subnet
A _______ acts on behalf of a client or user when attempting to access resources over the internet. The _______, in this position of an intermediary, provides a layer of protection to the client. A ______ works on a store-and-forward model. This means the ______deconstructs each packet, performs analysis, then rebuilds the packet and forwards it on, if it conforms to the rules it’s been configured with. Client computers connect to a specified point on the perimeter network for web access.
Benefits a ________ can provide:
Traffic management
Protection
Anonymity for users by masking their IP addresses
Caching engines
Content filtering
Content monitoring
Incoming network traffic distribution across multiple servers to help balance the load
Proxy server
Internet content filter
Internet content filter
Deception strategy that returns spoofed data in response to network probes.
Fake telemetry
An appliance that combines many security functions into a single device.
All-in-one
security appliance
A device that has the ability to analyze and manage network traffic based on the application-layer protocol.
Application-aware devices
A ______ is a hardened server that provides access to other hosts. ________ are often used for administrative tasks where administrators connect to the _______ first and then use it to access other internal systems, like servers or devices. A ________ is primarily used to enhance security by controlling access to sensitive resources. It acts as a gateway to access certain systems that are kept isolated from the external network. The ________ is typically locked down and secured to a higher degree, ensuring that only authorized users can access it, reducing the risk of unauthorized access to critical systems.
Jump server
A ________, while primarily used to distribute network traffic across multiple servers to optimize performance, can also serve as a security appliance in certain scenarios. A ______ distributes client requests across available server nodes in a farm or pool. This is used to provision services that can scale from light to heavy loads and to provide mitigation against denial-of-service attacks.
Load balancer
There are two main types of load balancers:
Layer 4 — A layer 4 load balancer makes forwarding decisions on IP address and TCP/UPD port values, working at the transport layer of the OSI model.
Layer 7 — A layer 7 load balancer, or content switch, makes forwarding decisions based on application-level data, such as a request for a particular URL web address or data types like video or audio streaming, which requires more complex logic.
Sensor
A packet sniffer is referred to as a _________. Typically, the packet capture sensor is placed behind a firewall or close to a server of particular importance. The idea is to identify malicious traffic that has managed to get past the firewall. A single sniffer can record a large amount of traffic data so it’s best to not put multiple sensors all over the network without provisioning the resources to manage them properly. Depending on network size and resources, one or only a few sensors are deployed to monitor key assets or network paths.
The traffic captured by each sensor is transferred to a host or appliance running an intrusion detection system (IDS), such as Snort, Suricata, or Zeek. When traffic matches a detection signature, the IDS raises an alert or generates a log entry but does not block the source host. This type of passive sensor does not slow down traffic and is undetectable by the attacker.
An IDS is used to identify and log hosts and applications and to detect password-guessing attempts, port scans, worms, backdoor applications, malformed packets or sessions, and other policy violations.
An __________ incorporates multiple security functions into a single piece of hardware. Unified Threat Management, or UTM, is the most common all-in-one appliance.
UTM puts several key security components into a single device that’s usually managed using a web interface. A manufacturer subscription for updates may also be required.
Commonly implemented functionality of all-in-one-security devices include the following:
URL filtering—prevents users from accessing URL restricted categories.
Content inspection—helps ensure HTTP connections and content meet specified criteria. For example, many content filters actively monitor data streams by inspecting the packets in search of viruses, Trojans, worms, and other malicious code.
Spam filtering—reduces junk mail in mailboxes of users.
Firewall—can be configured with rules and used to log traffic to and from the network.
Intrusion detection system—An IDS sends an alert if a network attack is detected.
Intrusion prevention system—An IPS sends an alert if a network attack is detected or prevented.
A UTM usually includes networking features as well, such as the following:
Switch
Router
Traffic shaping management
All-in-one security appliance
A wirelessly broadcasted network is used on most internal networks so that internal users do not require a physical connection to a router or switch.
Wireless
A _______ network at an organization often grants internet access only to guest users, but it also has some type of firewall to regulate that access. There could be limited internal resources made available on a _______ network. Normally, it is just a way for guests to access the internet without being allowed on the intranet or internal network.
Guest
is a private network (LAN) that employs internet information services for internal use only. For example, your company network might include web servers and email servers that are used by company employees.
Intranet
