Chapter 2 - Telecommunications and Network Security Flashcards
Network layering models
OSI - reference model - structured into 7 layers and TCP/IP or Department of Defense model - structured into 4 layers. Encapsulation is common to both - layers isolated on a technical level and operate independently
OSI - defined in 1984 Open System Interconnect ISO/IEC 7498-1. Latest revision 1994
Application Layer Presentation Layer Session Layer Transport Layer Network Layer Data Link Layer Physical Layer
OSI - Physical Layer - Layer 1
describes the networking hardware - such as electrical signals and bits and bytes such as network interfaces and cabling. Repeaters for communication trnsfer devices at this layer.
OSI - The Data-Link Layer - Layer 2
describes data transfer between machines, for instance by an Ethernet - prepares the packet it receives form the network layer to be transmitted as frames on the network, detects errorrs in frames, converts higher layers into bits. Has two sub layers - logical link control (LLC) - manages connections between peers; - Medai Access Control (MAC) - transmits and recieves frames between peers. Moves data to the next physically connected device. SLIP, CSLIP, PPP at this layer.
OSI - Network Layer - Layer 3
describes data transfer between machines for instance by the Internet Protocol (IP) - moves information between two hosts that are not physically connected. Uses logical addressing - Internet Protocol (IP) is the most important network layer protocol. IP uses the destination IP address to transmit packets thorugh networks - Addressing. Fragmentation - IP will subdivide a packet if its size is greater than the maximum size allowed. routers used as this layer, does not guarantee error free delivery. ICMP and IGMP at this layer. Single unit of IP data is a datagram.
OSI - Transport Lyer - Layer 4
describes data transfer between applications, flow control, and error detectection and correction for instance by TCP - end to end transport between hosts. User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) are important transport layer protocols. TCP provides error free transmission. Does not provide confidentiality. Unit of TCP data is a segment. Controls rate of packet transfers. End to End.
OSI- Session Layer - Layer 5
describes the handshake between applications, for instance authentication process - logical persistent connection between peer hosts - responsible for creating, maintaining, and tearing down the session. Full duplex - both host can exchange info simulateneously and independent; Half Duplex - hosts can exchange information but only one host at a time; Simplex only one host can send information to its peer. Information travels in one direction only. With Presentation layer can provide end to end security
OSI - Presentation Layer - Layer 6
describes the presentation of information, such as ASCII syntax - assures peer applications use a common format to represent data. Services: data conversion, character code translation, compresion, encryption and decryption. Two sublayer components: CASE - provides and request services; SASE - application specific services. With Session layer can provide end to end security
OSI - Application Layer - Layer 7
describes the structure, interpretation, and handling of information. In security terms it is relevant because it relies on all underlying layers. From the point of view of the (ISC)2 Common Body of Knowledge, the application layer is covered in the Operations section. Portal to Network based Services - determining the identity and availability of remote applications. HTTP, FTP, SMTP. Provides non-repudiation services - integrity of data
RIP in Layer 3
Routing information Protocol - uses only hop counts to determine routing metric
OSPF in layer 3
Open shortest path first - require large amounts of CPU power and memory
Border Gateway Protocol in Layer 3 (BGP)
allow fully decentralized routing - exchanges routing information between gateway hosts
ICMP in layer 3
Internet Control Message Protocol - means to send error messages and to probe network at Network layer.
TCP
client sends a SYN segment, server sends an ACL and a SYN, client sends an ACK. Stateful packet filter.
TCP/IP Reference Model
Link Layer, network layer, transport layer, application layer
Link layer
physical communication and routing - covers OSI 1&2
Network Layer
Covers OSI layer 3
Transport layer
covers OSI layer 4
Application Layer
Covers OSI layers 5,6,7
IP addresses
four octets; two parts network number and the host. Network number assigned by ICANN. Host represents the network interface within the network. Range of 0 -255
Class of IP Addresses for Network number
Class A - 1-127 (1 octet) Class B - 128-191 (2 octets) Class C- 192-223 (3 octets) Class D - 224-239 (multicast) Class E - 240-155 (Reserved)
Class A - Computer’s loop back address
127.0.0.0 - troubleshooting at machine level
IPV6
Modernization of IPV4 (32 bits). IPV6 is 128 bits and supports two hosts
TCP and UDP
map data connections through the association of port numbers managed by Internet Assigned Numbers Authority (IANA). 65,536 (216) ports exist. Port number length of 16. TCP connection oriented. UDP is not.
Well known ports
0 through 1023 - used by privileged processes and users
Registered ports
1024-49151 - can be registered with IANA by application developers but are not assigned by them - users may not have privileges to run an application on a well-known port
Dynamic or Private Ports
49152 -65535 can be freely used by applications; one typical use for these ports is initiation of return connections for requested data or services.
User Datagram Protocol
UDP - lightweight service for connectionless data transfer without error detection and correction - easy prey to spoofing techniques.
RFC 3550
Real-time protocol (RTP) and real-time control protocol (RTCP)
MBone - RFC 2960
Multicasting protocol, reliable UDP and Stream control transmission protocol (SCTP)
Extranet
differs from a DMZ - it is made available to authenticated connections - where DMZ hosts publicly available resources that support unauthenticated connections.
DHCP
Dynamic Host Configuration Protocol - automatically assigns IP addresses to workstations
RFC 3118
replaces normal DHCP messages with authenticated ones.
ICMP
Internet Control Message Protocol - exchange of control messages between hosts and gateways and is used for diagnostic tools such as ping and traceroute - can be leveraged for man-in-the-middle and denial-of-service attacks.
ping of death
An enormous number of operating systems would crash or become unstable upon receiving an ICMP eco greater than the legal packet limit of 65,536.
IGMP
Internet Group Management Protocol - manages multicasting groups. Version 1 - periodically sends queries to hosts, Version 2 - two types of queries: general and group-specific. Version 3 - specifies sources
RIP
Routing Information Protocol - dynamic routing designed for small networks - uses number of hops for best route less than or equal to 15 hops. cannot be used in a network with different subnet masks, exchange entire route table every 30 seconds, can’t verify trustworthiness. Version 2 - allowed different subnet masks and RFC 2082 MD5 authentication.
VRRP
Virtual Router Redundancy Protocol - supports automatic failover - appears as a physical router.
DNS
Domain named services - supports use and resolution of e-mail and WWW addresses. Prominent target of attacks. Port 53. RFC 882,1034, 1035
LDAP
Lightweight Directory Access Protocol - manages user information loosely based on X.500, front end. Uses backends like NIS, Active Directory, Java System directory. Weak authentication based on host name resolution. Port 389, RFC 1777. Clear text - easily intercepted. Deployment over SSL provides authentication, integrity, confidentiality.
NetBIOS
Network Basic Input Output System. Ports 137 and 138 (TCP) and 139 (UDP). 135 for remote procedure calls.
NIS and NIS +
network information service- manages user credentials
CIFS/SMB
common internet file system/ server message block - user level and tree level security - Windows
NFS
Network file system - file sharing UNIX
SMTP/ESMTP
Simple Mail Transfer Protocol & Enhanced Simple Mail Transfer Protocol - used to route email, Port 25/TCP managed thru DNS using mail exchange records - robust, nonexistent authentication and lock of encryption. Enhanced version offers authentication mechanisms
FTP
File Transfer Protocol - publishing data over the Internet, Port 20 - data, Port 21 - control, RFC 959. Original clear text simple authentication. Secure FTP with TLS encrypts session RFC 4217; SFTP - not FTP but uses secure shell to transfer files - encrypts both commands and data
HTTP
Hypertext Transfer Protocol - Port 80 RFC 1945, 2109, 2616 - supports exchange of information in HTML - does not support encryption and fairly simple authentication.
SCADA
Supervisory Control Data Acquisition - systems designed to operate with several different communication methods including modems, WANS and various networking equipment.
Dual Homed Host
has two network interface cards - each on a separate network
Bastion Host
serves as a gateway between a trusted and untrusted network - central host to resist attack
Hubs
all connected devices will receive each other’s broadcasts; single point of failure
Bridges
Layer 2 devices filter traffic based on MAC addresses. IEEE 802.11
Routers
read destination Layer 3 addresses
Twisted Pair
Cat 1 less than 1Mbps Cat 2 less than 4 Mbps Cat 3 16 Mbps Cat 4 20Mbps Cat 5 100 Mbps Cat 5e 1000 Mbps Cat 6 1000 Mbps Shielded and Unshielded - copper wires twisted together UTP does not require fixed spacing
Coaxial Cable
one thick conductor surrounded by a grounding braid of wire in a protective sheath - greater bandwidth and longer cable lengths, expensive and difficult to bend. Requires fixed spacing
Patch Panel
devices are connected to a patch panel instead of directly connecting to other devices
DSSS
Direct-Sequence Spread Spectrum - wireless technology spreads signal over a wider band
FHSS
Frequency-Hopping Spread Spectrum spreads signal over rapidly changing frequencies
CDMA
Code Division Multiple Access - wireless mostly used for cellular technology. CDMA 200 - Rate of 153.6 Mbps.
GSM
Global Service for Mobile Communications most popular cellular technology
Open System Authentication
most basic form of wireless authentication
Shared Key Authentication
encrypt a shared secret between the access point and the wireless client - WEP can be decrypted by an attacker in a very short time.