Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Security con > Based Security > Flashcards

Based Security Flashcards

1
Q

are two different types of programs that mitigate exposure to viruses and other types of malicious software. As we already know, all viruses are malware, but not all malware is a virus. This is an important fact, because these programs perform different things

A

Anti-virus and Anti-malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

is software utility that is designed to specifically defend AGAINST viruses, and prevents viruses from infecting corrupting the system. Antivirus software will frequently scan the system that it is installed on in search of viruses that may have infected it. If any viruses are identified by the antivirus software, it will then take action by quarantining the virus and removing it from the system.

A

Anti-virus

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

software however, is VERY similar to antivirus software, though as the name suggests it’s main goal is to defend against ALL MALWARE, this includes viruses, as well as trojans, rootkits, bots, spyware, ransomware, etc.

A

Anti-malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

McAfee Internet Security (Anti-Malware Software)

A
  • McAfee provides continuous protection against threats like viruses, ransomware, and even phishing attacks (more accurately, some of the malware that the exists within the links and attachments of phishing emails).
  • We can use common processes that are associated with McAfee, in order to identify when it is running on a targeted device.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

are indicators of McAfee running on a targeted device: Processes

A
  • McScript.exe
  • UpdaterUI.exe/UdateUI.exe
  • naPrsMgr.exe
  • FrameworkService.exe
  • Cleanup.exe
  • CmdAgent.exe
  • McScrip_InUse.exe
  • McTray.exe
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

are indicators of McAfee running on a targeted device: Registry Keys

A

HKLM\SOFTWARE\McAfee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

are indicators of McAfee running on a targeted device: DIR structures / Associated Ports

A

Directory Structures Associated Ports
C:\Program Files\McAfee\ Port 6646

C:\Program Files\Common Files\McAfeeData Port 8081 (Open if sending
logs to ePO server)

C:\Program Files\Common Files\McAfee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

is an anti-malware and firewall solution, designed specifically for servers and workstations

A

Symantec Endpoint Protection (SEP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The main goal for ________ is to reduce attack surfaces, prevent attacks and breaches, as well as detect and respond to attacks

A

Symantec Endpoint Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

_______ provides flexibility through the ability to be configured as a cloud-based, on-premise or hybrid implementation

A

Symantec Endpoint Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

______________ provides intrusion prevention, file behavior monitoring and defends servers and workstations against malware, to include Zero-Day Attacks

A

Symantec Endpoint Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

indicators of SEP (Anti-Malware Software) running on a targeted device: Processes

A
  • SymCorpUI.exe
  • Semsvc.exe
  • ccSvcHst.exe
  • ccApp.exe
  • LUALL.exe
  • SMC.exe
  • SMCgui.exe
  • Rtvscan.exe
  • LuComServer.exe
  • ProtectionUtilSurrogate.exe
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

SEP DIR structures / Registry Key

A

Directory Structures :

C:\Program Files\Common Files\Symantec Endpoint

Registry Key :

HKLM\SOFTWARE\Symantec\Symantec Endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

_______ opens various ports depending on enabled features, making it difficult to ID via port scan

A

SEP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

_______________ is endpoint security software developed by Kaspersky Lab, that protects against viruses, trojans, works, rootkits, keyloggers, man-in-the-middle attacks, sophisticated botnets and other threats to endpoint devices

A

Kaspersky Internet Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

_____________ provides proactive detection through frequent scanning, blocks threats before they occur and if it detects an immediate threat, it will then quarantine and remove it from the system. __________________ also prevents email spam, phishing attempts and data leaks

A

Kaspersky Internet Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

indicators of Kaspersky Internet Security (Anti-Malware Software) running on a targeted device: Processes

A

Processes:
avp.exe

Kaspersky Internet Security is known to open a port listener on:
Port 1110

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

indicators of Kaspersky Internet Security (Anti-Malware Software) running on a targeted device: Directory / Registry Keys

A

Directory Structure:
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security

Registry Keys:
HKLM\SOFTWARE\KasperskyLab

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

indicators of Kaspersky Internet Security (Anti-Malware Software) running on a targeted device: Internet Security is known to open a port listener on _____

A

Port 1110

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What type of software protects against viruses, rootkits, trojans, worms and other harmful software?

A

Anti-Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

(True or False)Malware and Viruses are synonymous?

A

false

22
Q

______ is any type of hardware that is capable of permitting access to a network. A host can provide this capability through a user interface, specialized software, network address, protocol stack or other means.

A

Host

23
Q

Because of the increase in attack surfaces, network engineers and administrators, and the network security/cybersecurity industry as a whole, on hosts; yo protect against these threats, today many host devices on a network utilize ___________ and ____________

A

Host-Based Intrusion Detection Systems (HIDS) and Host-Based Intrusion Prevention Systems (HIPS)

24
Q

monitor and analyze the internal operations of the system that it is installed on, analyzes the traffic on its network interfaces and logs any malicious behavior that it identifies. HIDS provide deep visibility into the happenings of critical systems.

A

Host-Based Intrusion Detection Systems

25
Q

______ solely identify malicious behavior and DO NOT act on this information in a capacity that would prevent an attack from occurring, hence the name “Intrusion Detection”

A

HIDS

26
Q

(also sometimes referred to as end-point security) essentially play a very similar role to their HIDS counterparts, and that is for good reason.

A

Host-Based Intrusion Prevention Systems

27
Q

______ will also monitor, log and alert malicious behavior that occurs on a system like a HIDS would; the key difference though is that the HIPS attempts to block intrusions and limits damage to the system and then reports intrusion attempts

A

HIPS

28
Q

Is a type of software security solution that aggregates log and event data that is generated from live IDS and IPS data, organization applications, security devices and host systems, and brings it into a centralized location.

A

Security Information and Event Management (SIEM)

29
Q

The ______ sorts this aggregated information into various categories, such as malware activity and failed/successful logins.

When the _____ identifies anything that deviates from normal behavior, it will send an alert and suggests appropriate actions to remediate the possible threat.

Numerous functions built into _____, like incident management, reporting and dashboards provide a comprehensive view of the overall security of the environment.

A

SIEM

30
Q

What security device or application provides management, reporting and dashboards provide a comprehensive view of the overall security of the environment?

A

SIEM

31
Q

(True or False) Host-Based Intrusion Detection Systems include threat remediation countermeasures?

A

false

32
Q

To defend the network against threats, network engineers and administrators utilize ____________ and ___________

A

Network-Based Intrusion Detection Systems(NIDS) and Network-Based Intrusion Prevention Systems(NIPS).

33
Q

_______________________ are passive devices that typically require a promiscuous network and monitor and analyze all traffic, to include unicast traffic, that is on a network, searching for any malicious activity.

A

Network-Based Intrusion Detection Systems (NIDS)

34
Q

Because ______ are passive in their security role they might sit on the inner side of the network firewall, on the DMZ, or on the WAN side.

When placed either on the DMZ or the inner network, it will make less noise.

On a typical network _____ sniffs the internal interface of the firewall in a read-only mode and sends an alert to the _____server on a different network interface if it detects malicious or suspicious activity. It does NOT act on this information.

A

NIDS

35
Q

are far more active in their approach to network security.

A

Network-Based Intrusion Prevention Systems(NIPS)

36
Q

Upon detecting malicious or suspicious activity, ______ will take an active role in effort to secure the network.

______ is considered an inline security solution because it sits between the firewall and the rest of the network.

The _____ provides a defensive layer of protection, in addition to the firewall, not instead of it.

If the ____ identifies suspicious or malicious activity matches a signature or anomaly the ____ will then shoot down the traffic by forging TCP RST segments to the source destination, or sending ICMP port, host or network unreachable to the source.

A

NIPS

37
Q

(True or False) NIDS are considered an inline network security solution?

A

false

38
Q

What type of network security device sits between the firewall and the rest of the network?

A

either

39
Q

Most IDSs utilize central monitoring systems and network sensors that will communicate over various ports. These ports are key to enumerating IDSs and to possibly identify different types of IDS that are implemented within a target device or operate on a target network.

A

Intrusion Detection System Enumeration

40
Q

The known associated/common port numbers for an IDS, can provide great insight as to what IDSs a target may be using on their devices and/or network.

When you run a port scan on a target, the results can be cross-referenced with these known associated ports in order to enumerate and identify the IDS that is running on the targets infrastructure.

A

Intrusion Detection System Enumeration

41
Q

Intrusion Detection System Enumeration (image)

A

Note: Everything to the left of the firewall is considered to be “Public Facing”. Everything to the left is the private network. The Internal security devices, on both the network and

42
Q

What can be used to enumerate IDSs that may be used by a target?

A

ports

43
Q

Conducting what activity can allow for the enumeration and identification of the type of IDS used by a target?

A

port scanning

44
Q

IDS Evasion Techniques:

  • First evasion technique is a basic one, ________.
  • The basic core function of any _____ attack is to simply deny service. The goal specifically for evading IDS/IPS devices is to overload and ideally crash the device, rendering ineffective and no longer being able to identify or prevent an intrusion.
  • If it doesn’t work, it can’t find us!
A

Denial of Service (DoS)

45
Q

___________ takes place when a malicious packet is accepted by the target host but is rejected by the IDS. There are multiple types of evasion attacks, namely Fragmentation, Established, Pattern Change, Out-of-Order Sequencing, and Obfuscation.

A

Evasion

gets to the host; IDS didn’t catch it, but the IDS would have rejected

46
Q
  • IDS’ compare exploits with a well known exploit signature. In order to evade the IDS, an attacker can break up an exploit into fragmented frames.
  • IDS’ do not typically have enough memory storage to adequately store the packets and/ or reassemble them when comparing against a known signature. This vulnerability allows packets to get through
A

Fragmentation

47
Q

IDS Evasion Techniques:

  • This technique manipulates a three-way handshake when establishing a connection with a target. The attacker will initiate the handshake with a SYN flag set, while also including part of the attack payload. When the attacker completes the handshake, the rest of the payload is then sent in the next packet.
  • In this example, the IDS did not pick up the data in the initial packet, instead the target host stored it. The target then receives the rest of the payload and then reassembles the attack payload in its entirety.
    This allows for the payload to reach the target without tripping the IDS
A

Established

48
Q

IDS Evasion Techniques:

  • IDS’ store pieces of known exploit signatures that they use to compare against and match any exploits that they may detect.
  • The rules for these known exploit signatures are usually open-source.
  • Attackers can use this information to modify these known signatures in such a way that will allow the exploit to be undetectable when the IDS compares it against a known signature, while still carrying out the effects of the original exploit.
A

Pattern Change

49
Q

IDS Evasion Techniques:

  • The TCP sequence and the acknowledgment numbers let the IDS know that packets are received and are reassembled in the appropriate order.
  • The _____________ technique seeks to evade the IDS by sending the exploit out of order.
  • If the IDS is unable to reassemble the out of sequence packets into the appropriate order, it is not able to compare the exploit with a known signature.
A

Out-of-Order Sequencing

50
Q

IDS Evasion Techniques:

  • The goal of obfuscation is to encapsulate an exploit with Unicode, encryption, or ASCII shellcode and masks it within the application.
  • This method is typically used in web server attacks, where the exploit is submitted through the URL.
  • IDS’ cannot decode hex equivalent characters within the URL, effectively masking the exploit and allowing it to go undetected.
A

Obfuscation

51
Q

Obfuscation works as an evasion technique because IDS’ cannot decode what?

A

hex equivalent characters within the URL

52
Q

What type of attack takes place when a malicious packet is accepted by the target host, but is then rejected by the IDS ?

A

evasion

Security con (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions