Domain 4 Flashcards
1
Q
communications and internetworking
A
- bottom line is to exchange information and ideas so that they can get work done
- provide services by dealing with six basic questions
- who needs to send it to who
- what needs to be sent
- where are both sender and recipient
- why do they need to send or receive it
- when must it be sent and received
- how should it be sent - the questions should be answered in terms of the security policy
- most used networking models
- TCP IP model
- OSI model - goals for the network can be expressed as
- provide reliable managed communication
- isolate functions in the layers
- use packets as the basis of communication
- standardized routing addressing and control
- allow layers beyond Internet working to add functionality
- vendor agnostic scalable resilient - internetworking describes how two different sets of servers and communication elements communicate and coordinate activities
- TCP IP model does not address sessions of any kind IE users logging on to remote servers
- TCP IP was created to provide straightforward means of establishing network communications
- management of host to host communications and end to end transport - OSI model broke down into two parts
- media layers (lower 3)
- host layers (top 4)
2
Q
What about models
A
- Threat surface is the largest at the application layer (on both models)
- vulnerability modeling and reduction efforts focus on the application not the underlying communication system
- Both models have forms that show up in elements of hardware firmware software and virtualized services
- US focuses heavily on TCP IP model while European and other international markets are the opposite
3
Q
threat modeling and Internetworking
A
- Hazards are not deliberately caused by an actor but have the potential for damage
- caused by corrosion wear and tear or weather damage accidents utility power interruptions fire and smoke
- mechanical and other systems damaged by errors or accidents during installation are hazards - threats are deliberate actions taken with the intention and purpose of causing disruption for damage
- include both inappropriate and malicious damage or disruption - the key distinction between the two is intent
4
Q
Advanced persistent threat models
A
- refers to the term that demonstrates an unusually high level of technical and operational sophistication
- can span over months or years from initial Recon to completion
- often conducted by groups of attackers or organizations
- refer to the actors that conduct the threats to threats they represent and the attacks themselves
- SolarWinds was an attack against the US nuclear fuel industry spanning across multiple nuclear power stations and multiple companies and their supply and support chains
- Kill chains major operational phases
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- command and control
- actions on objectives
5
Q
OSI layer 2 data link layer
A
- immediate peers who can communicate with each other
- Strictly 1 to one Mac address to a specified receiver
- These two sub layers
- mac Layer
- logical link control provides the interface between the Mac and the logical addressing provided at the network layer
6
Q
Layer 2 protocols
A
- most important layer is the address resolution protocol (ARP)
- used to provide direct communication between two devices within the same segment - Point to point
- point to point over Ethernet
- provide mechanisms for establishing the layer 2 connection
- like the Internet service provider and the customer device
7
Q
address resolution protocol
A
- ARP spoofing involves spoofing traffic onto the network segment to cause one or more machines to erroneously update their local ARP cache
8
Q
Polling protocols
A
- each station is permitted a specific amount of time where they have exclusive access to the infrastructure
- the more devices the more the bandwidth degrades
9
Q
contention based protocols
A
- the absence of the polling mechanism means the devices must compete for bandwidth
- two general approaches to stopping this problem are
- CSMA/CD
they listen to a carrier before transmitting data if one is not detected it will be transmitted
best suited to a bound network where physical connections must exist
a part of the IEEE 802.3 standard
- CSMA/CA
best used in a wireless environment
checks whether the media is clear for transmission it is it sends out a special control frame called the request to send (RTS)
10
Q
Layer 2 devices
A
- bridges
- filter traffic between segments based on Mac addresses
- can connect lans with unlike media types like connecting a UTP segment with a segment that uses coaxial cables - switches
- One collision domain per port
11
Q
Layer 2 threats and countermeasures
A
- Mac address spoofing
- V LAN hopping also known as 802.1 Q attacks
- broadcast storms
12
Q
OSI layer three network layer
A
- Home of the IP and IP addresses
- two primary purposes
- managing the logical addressing for networks
- forwarding packets to the correct logical network - Make it possible to extend the physical limits for communication defined in the lower layers of the OSI model
- routers and routing ticket important role
13
Q
layer 3 concepts and architecture
A
- Five different forms of communication
- Unicast
one to one conversation
- broadcast
one to many conversation
use by systems for administration functions
major element in the product are handshaking
- multicast
one host to a discrete group of hosts
designed to deliver a stream of traffic to only a designated subnet
14
Q
Internet Protocol networking
A
- subdivided into two parts the network number and the host
- network number can be assigned at the external organization and represents the organization’s network
- Class A uses the left most octet
- Class B uses the two leftmost octets
- the part of the address not used as the network number specifies the host
- Loop back address is used to provide a mechanism for self diagnosis and troubleshooting at the machine level
- allows the network admin to treat a local machine as if it were remote machine and ping the network interface
15
Q
Layer 3 routing protocols
A
- Routing protocols
- use my routers to communicate and coordinate with each other 5 handshaking the information needed to build and maintain routing tables - routed protocols
- routed protocols define how data can be routed over a network for example I PV 4 and I PV 6
- does not define how they coordinate and communicate with each other
