8. Firewalls, IDS, DDoS

Question 1

Name 2 Firewall goals

Answer 1

Provide defense in depth by:
1. Blocking attacks against hosts and services
2. Control traffic between zones of trust

Question 2

What type of firewall placement protects the whole network?

Answer 2

Network-based firewall

Question 3

A host-based firewall is faithful to local configuration

Answer 3

True

Question 4

In the context of a TCP handshake, it’s possible to have a SYN/ACK packet without an originating SYN

Answer 4

False

Question 5

Describe a state holding attack

Answer 5

An attacker flooding Syn’s without Acknowledgments to a firewall under stateful TCP policy, causing an exhaustion of resources.

Question 6

What is the DMZ

Answer 6

A security layer between internal network and external network (internet).
E.g. company may have a web server in DMZ to give customers access from the internet, but web server can’t directly access internal database.

Question 7

Can Signature based IDS detect zero-based attacks? They have … false positive rate.

Answer 7

No they cannot. Low false positive rate.

Question 8

Can Anomaly based IDS detect zero-based attacks? They have … false positive rate.

Answer 8

Yes they can. High false positive rate.

Question 9

How do Signature based IDS flag potential threats?

Answer 9

Detects intrusions by comparing incoming data to database of known patterns or signatures of malicious activity. Requires frequent updates to db to remain effective.

Question 10

How do Anomaly based IDS flag potential threats?

Answer 10

By identifying deviations from normal network behaviour. Established a baseline of what ‘normal’ traffic looks like and flags significantly different activity.

Question 11

If IDS received 1000000 packets where 20 were intrusions. What is the intrusion rate?

Answer 11

20/1000000 =0.00002

Question 12

What would be the most important characteristic of a Firewall amongst effectiveness, security, transparency, expressiveness, efficiency and ease of use?

Answer 12

Efficiency (otherwise user’s won’t want to have it on their device)

Question 13

What’s a DNS amplification attack?

Answer 13

1. Send DNS query (60 bytes question)
2. Spoof IP source address
3. DNS server responds to target with large reply (3k bytes answer)

Question 14

‘DNS amplification’ style attack may also go to … server

Answer 14

Network time protocol (NTP) server

Question 15

What is comically considered the worst DDoS amplifier on the internet?

Answer 15

DNSSEC

Question 16

What is DNSSEC’s main goal?

Answer 16

Authentication and integrity of DNS requests and responses

Question 17

Most attacks are due to social engineering.

Answer 17

True