Chapter 4 Flashcards
Securing Your Network (66 cards)
IDS
Intrusion detection systems monitor a network and send alerts when they detect suspicious events on a system or network.
IPS
Intrusion prevention systems react to attacks in progress and prevent them from reaching systems and networks.
HIDS
Host-based intrusion detection system
Software installed on a system to detect attacks
It protects local resources on the host
A host-based intrusion prevention system (HIPS) is an extension of HIDS
It is software installed on a system to detect and block attacks
NIDS
Network based intrusion detection system
A device that detects attacks and raises alerts
A NIDS is installed on network device, such as routers or firewalls, and monitors network traffic
Port Mirror
A monitoring port on a switch
All traffic going through the switch is also sent to the port mirror
Taps
Monitoring ports on a network device
IDSs use taps to capture traffic
Signature-based
A type of monitoring used on intrusion detection and intrusion prevention systems
It detects attacks based on known attack patterns documented as attack signatures
Heuristic/behavioral-based
A type of monitoring on intrusion detection and intrusion prevention systems
It detects attacks by comparing traffic against a baseline
It is also known as anomaly detection
NOC
Filler
False Negative
A security icident that isn’t detected or reported
As An example, A NIDS false negative occurs if an attack is active on the network but the NIDS does not raise an alert
NIPS
Network-based intrusion prevention system
A device that detects and stops attacks in progress
A NIPS is placed inline (In-Band) with traffic so that it can actively monitor data streams
Inline
A configuration that forces traffic to pass through a device
A NIPS is place inline, allowing it to prevent malicious traffic from entering a network
Sometimes called in-band, as opposed to out-of-band
Out-of-Band
A configuration that allows a device to collect traffic without the traffic passing through it
sometimes called passive, opposed to inline
ACLs
Access control lists are lists of rules used by routers and stateless firewalls
These devices use the ACL to control traffic based on networks, subnets, IP addresses, ports, and some protocols
SCADA
Supervisory control and data acquisition
A system used to control an ICS such as a power plant or water treatment facility
Ideally, a SCADA is within an isolated network
RATs
Remote access Trojans are malware that allows an attacker to tak control of a system from a remote location
DMZ
Demilitarized zone is a buffer zone between the internet and an internal network
Internet clients can access the services hosted on servers in the DMZ, but the DMZ provides a layer of protection for the internal network
SSL/TLS Accelerators
Devices used to handle TLS traffic
Servers can off-load TLS traffic to improve performance
SSL Deccryptors
Devices used to create separate SSL (or TLS) sessions
They allow other security devices to examine encrypted traffic sent to and from the Internet
SDN
A Software Defined Network is a method of using software and virtualization technologies to replace hardware routers
SDNs separate the data and control planes
Honeypot
A server designed to attract an attacker
It typically has weakened security encouraging attackers to investigate it
Honeynet
A group of honeypots in a network
Honeynets are often configured in virtual networks
IEEE 802.1x
An authentication protocol used in VPNs and wired and wireless networks
VPNs often implement it as a RADIUS server
Wired networks use it for port-based authentication
Wireless networks use it in Enterprise modee
IEEE 802.1x
An authentication protocol used in VPNs and wired and wireless networks
VPNs often implement it as a RADIUS server
Wired networks use it for port-based authentication
Wireless networks use it in Enterprise mode
