Book 2 Flashcards
NCDOC Platform Specific
State the function of JTF-GNO and discuss their relationship with NNWC
Plans, coordinates, integrates, synchronizes, and conducts activities to direct the operations and defense of specified DoD information networks. USCYBERCOM issues Orders & Directives to DoD and NNWC pushes them out to the Navy
Who is currently designated as the Navy’s Level 2 accredited CNDSP?
NCDOC
State who JTF-GNO reports to directly:
USSTRATCOM
Explain what a CNDS Certification Authority (CNDS/CA) is.
Responsible for CNDSP Accreditation
Explain who the central manager for all DoD Enterprise incident sets is.
DISA
State who the Area Coordinators are for NCDOC and NNWC.
SWO, BWC, and DCOWO
State who has TACON of NCDOC watch floor personnel and is responsible directly to the Commanding Officer, Operations Officer, and the Commander USSTRATCOM, via the JTF-GNO Network Defense Watch Officer.
Commanding Officer of 10th Fleet
Name the DoD agency that is tasked with handling Electronic Spillage issues and incidents.
NCDOC/NNWC
In the event of Electronic Spillage originating at NCDOC, list the personnel or agencies that should be contacted in order.
NCDOC watch standers create ticket. ISSM and SSO is informed.
State who has tactical control over NCDOC and NNWC:
10th Fleet
JTF-GNO is dual-hatted IRT CND operations at NCDOC and NNWC. Explain what these two positions are.
CO is commander of NCDOC and CTF 1020 (NIOCS, NCTAMS, etc.)
State who, by direction of the Operations Officer, is responsible to the Commanding Officer for the assignment and general supervision of all NCDOC watch standers.
SWO (Senior Watch Officer)
List the duties and responsibilities of the Senior Watch Officer (SWO)
Manning of the watch, delegate tasks to DCOWO, as well as liaise with BWC from NNWC.
Define Computer Network Attack (CNA).
Operations to disrupt, deny, degrade, or destroy information resident on computers and computer networks or the computers and networks themselves
Explain the standard reporting procedures for reporting a computer network incident
Depends on the type of incident as to overall mitigation, however, CER is created, analysis is conducted of activity, PCAP is pulled as necessary, and upon QC, an NCD is created and passed to Incident Handling to be communicated to site for remediation
Define deconfliction as it applies to CND operations
Deconfliction is the communication that occurs between NCDOC and satellite locations (other NIOCs, EDU sites, etc.) to ensure that duplicate efforts are eliminated.
Define Incident Handling as it applies to Computer Network Operations (CNO).
Provides CND with the following:
1. Protect
2. Monitor, analyze, and detect
3. Respond
List the four phases of CNDS Certification and Accreditation:
Phase 1
Registration: initiates the CNDS C&A process
List the four phases of CNDS Certification and Accreditation:
Phase 2
Verification: includes activities related to the on-site C&A evaluation.
List the four phases of CNDS Certification and Accreditation:
Phase 3
Validation: the evaluation team prepares a Deficiency Report and a Certification Report for CNDSICA review.
List the four phases of CNDS Certification and Accreditation:
Phase 4
Post Accreditation: includes activities by the Provider to maintain C&A status, monitor changes to the CNDS mission, and prepare and apply for recertification.
State what the Commander’s Critical Information Requirements (CCIR) identify
Identify events that require immediate or time-sensitive reporting or notification
State what a NAR is, and name what department creates and maintains them.
Network Analysis Report, Threat Analysis is typically tasked with their creation and maintenance.
List the four steps in creating a Network Analysts Report
- Assessment
- Research
- Analysis
- Reporting
Explain what a Cyber Alert is (CA).
Provides initial analysis of unusual activity, threats, or mass malware outbreaks on the Navy Network. This type of report serves as a time sensitive notification for mitigation of potential threats, and may include preliminary, unfinished assessments.
Name where listings of all NAR’s, CA’s, and CCIR’s can be found?
Within the SIPR Threat Analysis share folder.
List the 3 firewall types used to protect Navy Networks
- Network firewalls
- Host-based firewalls
- Hybrid firewalls (combination of network & host-based)
Explain what an Intrusion Detection System is (IDS) and what mode it functions in.
Is a passive system designed to monitor network activity and operates in promiscuous mode.
Explain what an Intrusion Prevention System is (IPS) and what mode it functions in.
Is an active system that monitors network activity and makes attempts to stop potential attacks and operates in inline mode
State what Thinnet (10Base2) is.
Uses coaxial cable with BNC connectors. Maximum transmission speed of 10Mbps, IEEE 802.3 standard.
Class A IP Range
1.0.0.0 to 126.255.255.25
Class B IP Range
128.0.0.0 to 191.255.255.255
Class C IP Range
192.0.0.0 to 223.255.255.255
OSI to TCP/IP:
Transportation
Transportation
OSI to TCP/IP:
DATA
Application, Presentation, Session
OSI to TCP/IP:
Internet
Network
OSI to TCP/IP:
Network Interface
Physical & Data Link
List 2 types of fiber mode.
- Single-mode Fiber
- Multi-mode Fiber
Name the most secure transmission medium
Fiber optics
Explain the difference between Vulnerability and Exploit.
- Vulnerability is a weakness that could potentially be taken advantage of by an attacker.
- Exploit is the act of taking advantage of a vulnerability.
Describe two methods of attachment filtering
- Filtering based on file name or file name extension.
- Filtering based on file MIME content type.
With reference to network security, explain what is meant by CIA.
- Confidentiality
- Integrity
- Availability
Explain the importance of log file analysis
Looking at logs proactively helps organizations to better realize the value of their existing security infrastructure
State why Network Defense important
To manage and protect information through logical security with system configurations, passwords & data encryption
Define “Defense in Depth”.
A practical strategy for achieving Information Assurance in today’s highly networked environments. It is a “best practices” strategy. Add Layers of security.
State the current reporting system for IAVM compliancy
Vulnerability Remediation Asset Manager (VRAM)
Define RC-4
most used stream cipher use in protocols such as SSL and WEP
Define RC-6
symmetric key block cipher derived from RC-5. Meets AES requirements and supports 128, 192, and 256-bit keys. 128-bit block size.
Define SHA-1
Secure Hash Algorithm. Cryptographic hash function designed by NSA, most widely used of the SHA has functions. Produces 160-bit message digest
Define AES
Advanced Encryption Standard. Symmetric-key encryption standard. Comprises three block ciphers, AES-128, AES-192, and AES-256. Originally published as Rijndael, which was a 128-bit block size
Define Blowfish
a keyed, symmetric block cipher. 64-bit block size with a variable key length from 1 bit up to 448 bits
3-DES IRT
Triple Data Encryption Algorithm, block cipher which applies the Data Encryption Standard (DES). Uses a key bundle which uses three keys, each of 56 bits. Encrypts one block of 64 bits of data.
List the most commonly known types and columns of Log Server File Analysis (Splunk)
a. Date
b. Time
c. Source IP address
d. Destination IP address
e. Domain Name
f. HTTP Response Code
g. URI
h. Port
i. Protocol
State who has overall responsibility of Information Assurance Vulnerability Management (IAVM)
Assistant Secretary of Defense (Networks & Information Integration)
Who can serve as the Command Security Manager:
a. Every command in the Navy and Marine Corps eligible to receive classified information is required to designate a security manager in writing.
b. Anyone who is a GS-11 or above, or an officer appointed by the Commanding Officer can be a CSM. The CO must sign a designation letter officially appointing someone to be responsible as the CSM.
Command Security Manager duties.
a. Serves as the commanding officer’s advisor and direct representative in matters pertaining to the security of classified information held at the command as well as the eligibility of personnel to access classified information and to be assigned to sensitive duties.
b. Develops written command information and personnel security procedures, including an emergency plan which integrates emergency destruction bills where required.
c. Formulates and coordinates the command’s security awareness and education program.
d. Ensures all personnel execute a Classified Information Nondisclosure Agreement (SF 312) prior to granting initial access to classified information.
Define the following message codes
(R),(P),(O),(Z)
A. R Routine – within 6 hours
B. P Priority – within 3 hours
C. O Immediate – within 30 minutes
D. Z Flash – within 10 minutes
Name the current system for transmitting naval messages.
C2OIX
State what a Plain Language Address is (PLA) and what its purpose is.
Used to address Naval Messages to specific commands
State the primary difference between IPV-4 and IPV-6.
IPV-6 offers a larger number of IP addresses than IPV-4
Give the purpose of Active Directory.
Provides Domain Services, Rights Management Services, Federation Services, Certificate Services, and Lightweight Directory Services. Integrated with Windows Server, gives out-of-the-box functionality needed to centrally configure and administer system, user, and application settings.
State the purpose of the token ring protocol and the IEEE standard associated with it.
Token ring LAN technology is a local area network protocol which resides at the data-link layer of the OSI model. It uses a special three-byte frame called a token that travels around the ring. One system transmits what it needs to and passes that information and the token to the next computer in line until its data reaches its destination. This is one of the oldest data communication protocols and utilizes IEEE 802.5.
State what IEEE is and state its purpose.
IEEE’s (Institute of Electrical and Electronics Engineers) core purpose is to foster technological innovation and excellence for the benefit of humanity. The main function of IEEE is to create a set of standards for the interoperability of equipment and software to enable the sharing of information. This includes the prominent IEEE 802.11 standards for wireless networking.
