CHAPTER 5.1 Flashcards
Common Type of Attacks
Network scanner applications that probe systems for unguarded ports, which can used to gain
access to the system.
Common Type of Attacks
Trojan horse
* applications that open a connection to a computer on the Internet, enabling
an attacker on the outside to run programs and store/retrieve data.
Common Type of Attack
Social engineering
* Attackers obtain passwords by illicit means and then use remote access
technologies to log on to a computer from another location and compromise
its data and programming.
Common Type of Attack
Denial of service attacks
* uses authorized access points to bombard a system with traffic, preventing
legitimate traffic from reaching the computer
Motivation for Network Attacks
Profit .An individual who wants to hack valuable information for
resale or obtain a ransom to stop an attack
Motivation for Network Attacks
Revenge A discontented employee who feels offended by an
organization
Motivation for Network Attacks
Publicity A person or team that performs a high-profile attack to
obtain notoriety
Motivation for Network Attacks
Espionage A person who spies on government or organizations to
obtain network information
Motivation for Network Attacks
Personal satisfaction A person or team that may attack networks as a hobby or
to boost their egos
Motivation for Network Attacks
Terrorism A person or group that may impair societal infrastructure
and apply pressure on groups or governments
Common Network Vulnerabilities
Account passwords * Password is either too simple or shared among users
Audit settings.
. Auditing is not enabled, thus unable to detect or
report an attack that has occurred
User rights
User rights are not restricted to the minimum
User rights requirements to perform necessary tasks
Service
Any service or application may have flaws, making the
computer vulnerable to attacks
Key Security Principles
Defense-in-Depth * Provide multiple layers of protection
Key Security Principles
Least privilege
* Grant the least amount of permission necessary to
perform required tasks
Key Security Principles
Minimized attack surface
* Reduce the number of vulnerable points on the
network
Defense-indepth
Defense-in-depth uses a
layered approach to
security
Server Hardening
Server Hardening is the process of enhancing server security through
a variety of means which results in a much more secure server
operating environment.
Best practices to increase security:
Stop and/or uninstall unneeded services
* Close unneeded ports
* Minimise software installations
* Keep security patches up to date
Vulnerability Scanning
Microsoft Baseline Security Analyzer
* Analyze server security state in accordance with
Microsoft security recommendations
It detects
common administrative vulnerabilities
* missing security updates
what is security templates
Security templates are files that you use to manage and
configure security settings on Windows-based computers.
Areas where security settings can be applied:
Account Policies, Local Policies, * Event Log, Restricted Groups
User Account Control (UAC)
Security mechanism that prevents unauthorized changes to the OS without the approval
from the administrator
User Account Control (UAC)
UAC prompt notifies the user if a program is about to make a system change that requires
the approval of an administrator or request for the administrator’s password or pin.
Secure Desktop
The secure desktop is an alternative to the interactive user desktop
that Windows normally displays
what does secure desktop do
When an elevation or credential prompt is generated, the system
switches to the secure desktop
AppLocker
An application control policy designed to identify software
and control its execution.
what does applocker do
It control in preventing potentially dangerous
applications from running.
* Control who is affected by the policies.
Creating Rules Manually
Use a wizard-based interface
Action
Allow or deny the user or group access to the resource.
In AppLocker, explicit deny rules always override allow rules.
User or group
Specifies the name of the user or group to which
the policy should apply.
Conditions
Specifies type of rules : publisher, path, or file hash
rule. The wizard generates an additional page to configure the
parameter.
- Exceptions
Specify exceptions to the rule you create, using any
of the three conditions: publisher, path, or file hash.
what is firewall
A firewall is a software program
that
what does firewall do
protects a computer or a
network by allowing certain
types of network traffic in and
out of the system while blocking
others.
what does firewall do
uses filters to examine the
contents of packets and traffic
patterns to determine which
packets they should allow to
pass through the filter.
configure the firewall by using
Basic Firewall configuration in Control Panel
configure the firewall by using
Windows Firewall with Advanced Security
Firewall Settings
IP addresses
Firewall Settings
Protocol numbers
Firewall Settings
Port numbers:
