Chapter 4: Securing Your Network Flashcards
______ and _____ inspect traffic using the same functionality as a protocol analyzer.
Intrusion detection systems (IDSs) and intrusion prevention systems (IPSs)
A _____ can detect attacks on local systems such as workstations and servers. The HIDS protects local resources on the host and can detect some malware that isn’t detected by traditional antivirus software.
host-based IDS (HIDS)
A ______ detects attacks on networks.
network-based
IDS (NIDS)
A signature-based IDS or IPS uses _____ to detect known attacks or vulnerabilities.
signatures
____-based or ______-based IDSs (also called anomaly-based IDSs) require a baseline and detect attacks based on anomalies or when traffic is outside expected boundaries.
Heuristic-based or behavioral-based
A _____ _____ incorrectly raises an alert indicating an attack when an attack is not active. They increase the workload of administrators.
false positive
A ____ _____ is when an attack is active, but not reported.
false negative
An IPS is similar to an active IDS except that it’s placed ____ with the traffic and can stop attacks before they reach the internal network. An IPS can actively monitor data streams, detect malicious content, and prevent it from reaching a network. In contrast, an IDS is out-of-band.
inline/ in-band
IDSs and IPSs can also protect internal private networks, such as ________ and _______
private supervisory control and data acquisition (SCADA) networks
_____ ______ are dedicated hardware devices that handle Transport Layer Security (TLS) traffic.
SSL/TLS accelerators
_____ _______ allow an organization to inspect traffic, even when traffic is using SSL or TLS.
SSL decryptors
A ______ _____ _____ uses virtualization technologies to route traffic instead of using hardware routers and switches. It separates the data and control planes.
software defined network (SDN)
_____ and _____ appear to have valuable data and attempt to divert attackers away from live networks. Security personnel use them to observe current attack methodologies and gather intelligence on attacks.
Honeypots and honeynets
An _____ provides strong port security using port-based authentication. It prevents rogue devices from connecting to a network by ensuring that only authorized clients can connect.
802.1x server
____ ____ ____ connect wireless clients to a wired network.
Wireless access points (APs)
A ____ _____, also known as a stand-alone AP, includes everything
needed to connect wireless clients to a wireless network.
fat AP
_____ _____ are controller-based APs. A controller configures and manages a thin AP.
Thin APs
The ___ ____ _____ is the name of the wireless network. Disabling the SSID broadcast hides a wireless network from casual users.
service set identifier (SSID)
You can restrict access to wireless networks with ___ ___ ___ filtering. However, attackers can discover authorized MACs and spoof an authorized MAC address.
media access control (MAC)
Most WAPs have _____ antennas. ____ antennas
have narrower beams and longer ranges.
omnidirectional antennas. Directional antennas
An ___ ___ wireless network is two or more devices connected together without an AP.
ad hoc
Wi-Fi Protected Access (WPA) can use Temporal Key Integrity Protocol (TKIP) or Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP). Both WPA and TKIP have been ______.
deprecated
Personal mode uses a ___ ____ ____. It is easy to implement and is used in many smaller wireless networks.
pre-shared key (PSK)
