Defense Strategies

Question 1

VLAN Hopping is the act of gaining access to traffic on other VLANS that would not normally be accessible by jumping from one VLAN to another.
How do you defend against this?

Answer 1

Put unplugged ports on the switch into an unused VLAN
Configure the switch ports in charge of passing tagged frames to be trunks and to explicitly forward specific tags
Pick an unused VLAN as the default VLAN for all trunks, and do not use it for any other intent.

Question 2

Ping flood is an old type of DoS when an attacker attempts to send many ICMP echo requests (port 7) in an attempt to use up a victims bandwidth.
How do you defend against this?

Answer 2

Configure the system not to respond to ICMP Echosq

Question 3

Smurf attacks send large amounts of ICMP echo requests to the broadcast address of a network (.255) where every computer replies to a spoofed IP (spoof the victims IP, send them the traffic)
How do you defend against this?

Answer 3

Configure hosts not to respond to pings or ICMP echoes
Configure routers not to forward packets directed to broadcast addresses
Implement subnetting with smaller subnetworks
Employe network ingress filtering

Question 4

Fraggle attacks are similar to Smurf attacks except for the traffic is sent via UDP.
How do you defend against this?

Answer 4

Configure routers not to forward packets directed to broadcast addresses
Employ network filtering, disabling ports 7 and 19

Question 5

SYN flood is the most common type of DoS used in a DDoS. It is when an attacker sends a large amount of SYN requests packets to a server in an attempt to deny service.
How do you protect against this?

Answer 5

Recycle half-open connections after a predetermined amount of time
Use IDS to detect the attack

Question 6

A ping of death is an oversized and malformed packet sent via ICMP to another computer.
How do you defend against this

Answer 6

Configure hosts not to respond to pings or ICMP echoes.
Verify operating systems are running the latest service packs and updates.
Update the firmware on any hardware-based firewalls, and update any software-based firewalls

Question 7

Teardrop attack is a type of DoS which sends mangled IP fragments with overlapping and oversized payloads to the target machine.
How do you defend against this?

Answer 7

Upgrade operating systems

Consider third party downloads

Question 8

DDoS is when a group of compromised systems attack a single target, causing a DoS to occur at the target host.
How do you defend against this?

Answer 8

Update firewalls.
Use IPS.
Utilize a “clean pipe”

Question 9

Spoofing is when an attacker masquerades as another person by falsifying information (Email addresses, MAC addresses, IP addresses, etc)
How do you defend against this?

Answer 9

Carefully select applications.
User awareness.
In the case of IP spoofing, incorporate packet filtering and repeat authentication schemes.

Question 10

Session theft is when an attacker attempts to steal a user’s session using the owner’s cookie and authentication information.
How do you defend against this?

Answer 10

Use encryption.

Use CHAP

Question 11

TCP/IP hijacking is when a hacker takes over a TCP session between two computers without the need of a cookie or any other type of host access.
How do you defend against this?

Answer 11

Employ encrypted transport protocols such as SSL, IPsec, and SSH

Question 12

MITM is a form of eavesdropping that intercepts all data between a client and a server, relaying that information back and forth.
How do you defend against this?

Answer 12

Implement SSL/TLS using a mutually trusted third-party certification authority

Question 13

Replay attacks are when valid data transmissions are maliciously or fraudulently repeated or delayed.
How do you defend against this?

Answer 13

Use session tokens.
Implement timestamping and synchronization.
Use a nonce.

Question 14

A null session is a connection to the windows interprocess communications share (IPC$)
How do you defend against this?

Answer 14

Update computers

Filter ports 139 and 445

Question 15

Transitive access is when one computer uses a second computer to attack a third, based on the trust of the second and third computers.
How do you defend against this?

Answer 15

Authentication
Firewalls
IDS/IPS
Updates

Question 16

DNS Poisoning occurs when there is a modification of name resolution information that should be in a DNS server’s cache
How do you defend against this?

Answer 16

Use TLS

Utilize secure DNS

Question 17

How do you defend against an unauthorized zone transfer of DNS information from a DNS server?

Answer 17

Log the DNS server

Restrict and audit the DNS server

Question 18

How do you defend against an altered hosts file?

Answer 18

Change permission on the hosts file to read-only

Question 19

Domain name kiting is the process of deleting a domain name during the 5 day grace period and immediately reregistering it for another 5 day period.
How do you defend against this?

Answer 19

Not many ways to defend against this other than charging fees for domain name kiting

Question 20

MAC Flooding is when numerous packets are sent to a switch, each of which has a different source MAC address, in an attempt to use up the memory on the switch.
How do you defend against this?

Answer 20

Implement 802.1x (SSO)
Use port security
Implement dynamic VLANS and NIDS
Consistently monitor the network