701 - Chapter 4 Flashcards
What is the additional software installed on a system such as a workstation or server that monitors the host, can detect potential attacks and analyzes critical operating system files?
Host based intrusion detection system HIDS
What is the primary goal of an IDS?
To monitor traffic and then alert administrators to suspicious activity
For HIDS, where does the traffic pass through that it is monitoring?
The network interface card NIC
In some cases, HIDS can also detect this?
Malware
What is the IDS that monitors traffic on a network?
Network based intrusion detection system, NIDS
With NIDS, what is installed on network devices such as switches, routers or firewalls? What do they do? And what do they do with the data?
Sensors or collectors… They gather data from the network… They report to a central monitoring network appliance hosting a NIDS console…
True or false NDS is able to decrypt encrypted traffic
False
For NIDS, in addition to Switches, routers, firewalls…What else can be used to capture the network traffic?
a tap or port mirror
What are the two detection methods used by IDS?
Signature based and trend based
How does a signature based IDS work? And what do need to do to be continually effective?
They use a database of known vulnerabilities or known attack patterns… Both the signatures and antivirus definitions from the vendor need to be updated regularly to protect against current threats
How does a trend based IDS work?
It starts by identifying the networks regular operation or normal behavior and create a baseline… after the baseline is established, the IDS will monitor network traffic and compare the current network behavior to its baseline
Which type of IDS is effective against zero day exploits?
Trend based
True or false with a trend based detection IDS once the baseline is established, it’s good forever?
False… Anytime significant changes to a system or network are made that causes normal behavior to change they should re-create the baseline
What does an IDS include to store log entries from dissimilar Systems?
An aggregator
What can an IDS do if it detects an issue based on the rules created by the organization?
It can provide an alert or an alarm
What are the four possible responses of an IDS to an attack or perceived attack? And which two are problematic
False positive, false negative, true negative, true positive… the false positive and the false negative
With an IDS, what does an administrator configure within the rules? And how do administrators configure this number with regard to false positives and false negatives?
A threshold… it needs to be high enough to minimize false positives, but low enough that it does not allow false negatives
And IDS is what type of control and an IPS is what type of control?
Detective… Preventative
What are two differences between an IPS and an IDS?
An IPS can detect react to and prevent attacks whereas an IDS can only detect them… and IPS is in line with the network traffic, where as an IDS can only monitor the traffic using a network tap
Because an IPS is in line with traffic, it is sometime referred to as what? And an IDS which is out of band is sometimes referred to as what
Active and passive
Why is it important to have in some cases in IPS on the outside and on the inside of a network?
To protect against remote access Trojans installed internally through fishing or malware attacks
What is a device that it’s intention is to divert an attacker away from the live network?
A honeypot
What are the two objectives of a honeypot?
To deceive attackers and divert them from the live network and to allow observation of an attacker and learn from there methodologies
What is a group of honeypots called? And what does it mimic?
A honey net… the functionality of a live network
What is a file design to attract the attention of an attacker called?
A honey file
What is a fake record, inserted into a database and used to detect data theft called?
A honey token
What is where wireless clients connect to a wired network called
A wireless access point
True or false… All wireless routers are access points, but not all access points are wireless routers
True
What are the two primary radio bands for a wireless network?
2.4 GHz and 5 GHz
With which band do wireless signals travel farthest? and which one provides the widest bandwidth?
2.4 and 5
Wireless networks are identified by what? And why is it good practice to change its default?
SERVICE set identifier SSID… because the default name might indicate the type of access point it is
True or false with a wireless network it is relatively easy for an attacker to circumvent MAC filtering?
True
What kind of attack is a wireless network susceptible to with regards to MAC addresses? And how does that work?
A MAC cloning attack also called a MAC spoofing attack… it works when the attacker changes his computers MAC address to one allowed in an authorized system
What do administrators often perform when planning and deploying a wireless network?
A site survey
What does a site survey provide?
It identifies the potential problem areas
What identifies an analyzes activity on channels within the wireless spectrum and allow you to analyze one frequency range at a time to see each channels activity and power levels on a graph?
A Wi-Fi analyzer
With a site survey, what tool gives you a color-coded representation of the wireless signals (which shows the wireless coverage and dead spots if they exist)?
A heat map
What gives you a detailed diagram of wireless access points, hotspots, and dead spots within an organization?
Wireless footprinting
