Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CS 6035 > Firewalls and Intrusion Detection > Flashcards

Firewalls and Intrusion Detection Flashcards

1
Q

What is a firewall?

A

A security device that sits between the internet and an intranet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the goals of a firewall?

A

Enforces security policy (only authorized traffic passes)

Dependable (firewall is immune to subversion)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is allowed to pass through the firewall?

A

Traffic such as address ranges, protocols, applications and content types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How is a firewall access policy created?

A

Developed from an organization’s information security risk assessment and policy
Depends on what kind of traffic the organization needs to support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the limitations of a firewall?

A

Internal traffic
Traffic routed around the firewall
Can be misconfigured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What else can firewalls do?

A

Encryption
Network Address Translation
Additional information through logging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What kinds of filtering can firewalls do?

A

Packet filtering

Session filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is packet filtering?

A

Packets are allowed through based on individual packets (usually based on IP or TCP header)
No state information saved
Packets forwarded or discarded based on rule match

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the two default policies for packet filtering firewalls?

A

Discard: prohibit unless expressly allowed (visible to users)
Forward: permit unless expressly prohibited (easier to manage, less secure)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What happens when dynamic protocols are in use?

A

An entire range of ports must be open (normally >1024)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the advantages of packet filtering?

A

Simple
Transparent to users
Very fast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the disadvantages of packet filtering?

A

Cannot prevent attacks that use application specific vulnerabilities or functions
Limited logging ability
Vulnerable to attacks that take advantage of TCP/IP
Can be improperly configured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are defenses for packet filtering firewalls?

A

Discard packets with an inside source address that come in from the outside
Discard all packets where the source destination specifies the route to take
First fragment of a packet must contain the minimum amount of transport header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a Stateful Inspection Firewall?

A

Creates a directory of TCP connections
Packets must match profile of these directory entries
Keeps track of TCP sequence numbers
Inspects data for protocols like FTP, IM and SIPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an application level gateway?

A

Also called an application proxy
Acts as a relay of application level traffic
Requester connects to proxy. Proxy accesses internal resources on their behalf and returns results.
Must have proxy code for each application
Secure, but at expense of processing overhead for each connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a bastion host?

A

Serves as a platform for application level gateway

Critical strong point in network’s security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the characteristics of a bastion host?

A

Runs secure OS with only essential services
May require authentication
Each proxy can be restrictive
Each proxy is small, simple, checked for security
Limited disk use (read only code)
Each proxy runs as a non privileged user in private and secure directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are host based firewalls?

A 
Used to secure an individual host
Filters and restricts packet flows
Can be flexible to host environment
Independent of topology
Additional layer of protection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a personal firewall?

A

Controls traffic between workstation and internet
Usually a software module on computer
Less complex
Primary role is to deny unauthorized remote access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are some advanced firewall protective measures?

A

Stealth mode: drop unsolicited communication packets
Block UDP packets
Check for unwanted activity
Applications need authorization to provide services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are internal firewalls?

A

Firewalls that sit inside a network
Provides two way protection with respect to the DMZ
Can protection parts of internal network from each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is distributed firewall deployment?

A

Multiple firewalls (internal, external, host) operating under a centralized administrative control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are firewall topologies?

A 
Host-resident firewall
Screening router
Single bastion inline
Single bastion T
Double bastion inline
Double bastion T
Distributed firewall configuration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a screening router?

A

Single router between internal and external networks with stateless or full packet filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a single bastion inline?

A

A single firewall device between internal and external router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a single bastion T?

A

Third network interface on bastion to a DMZ where externally visible servers are placed

27
Q

What is a double bastion inline?

A

DMZ is sandwiched between bastion firewalls

28
Q

What is a double bastion T?

A

DMZ on separate network interface on a bastion firewall

29
Q

What is an Intrusion Detection System effective against?

A

Known, less sophisticated attacks

30
Q

What is an IDS ineffective against?

A

Zero day exploits

31
Q

What are the primary assumptions of intrusion detection?

A
  • System activities are observable

- Activities have distinct evidence

32
Q

What are the components of an IDS? (Algorithmic)

A

Features (capture evidence)

Models (draw conclusions from the evidence)

33
Q

What are the components of an IDS? (Sys Architecture)

A

Audit data processor
Knowledge Base
Decision Engine
Alarm generation and responses

34
Q

What is the order of components in an IDS?

A
  • Data preprocessor
  • Detection engine (detection models generate alerts)
  • Decision engine (decision table generates response/report)
35
Q

What are the types intrusion detection approaches are there?

A
  • Modeling and analysis
  • Deployment
  • Development and maintenance
36
Q

What is anomaly detection?

A
  • Analysis approach
  • Collects data of legitimate users over a period of time (baseline)
  • Compares baseline to new behavior to determine if behavior is normal or not
37
Q

What is misuse/signature detection?

A
  • Analysis approach
  • Compares known malicious data patterns (signatures) to current behavior
  • Only effective when rules are known
  • Signatures need to be large enough to minimize false alarm rate
38
Q

What is a statistical approach?

A

Analysis of observed behavior using variable models or time series models of observed metrics

39
Q

What is a knowledge based approach?

A

An expert classifies observed behavior according to a set of rules that model legitimate behavior

40
Q

What is a machine learning approach?

A

Automatically determines classification of behavior from training data using data mining techniques

41
Q

What are the problems with classification approaches?

A

Efficiency

Cost

42
Q

What are the advantages of a statistical approach?

A
  • Simple
  • Low computation cost
  • Lack of assumptions about expected behavior
43
Q

What are the disadvantages of statistical approaches?

A
  • Difficulty selecting suitable metrics

- Cannot model all behaviors

44
Q

What are the advantages of knowledge based approaches?

A
  • Robust

- Flexible

45
Q

What are the disadvantages of knowledge based approaches?

A
  • Difficult and time consuming to learn

- Need humans

46
Q

What are the advantages of using a machine learning approach?

A
  • Flexible
  • Adaptable
  • Able to capture relationships between data points
47
Q

What are the disadvantages of using a machine learning approach?

A
  • Depends on assumptions about acceptable behavior
  • High false alarm rate
  • High resource cost
  • Significant time and computational resources
  • Dependent on training data
48
Q

What are different machine learning intruder detection approaches?

A
  • Bayesian networks
  • Markov models
  • Neural networks
  • Clustering and outlier detection
49
Q

What are the advantages of the signature approach?

A
  • Low cost in time and resources

- Widely accepted and used

50
Q

What are the disadvantages of the signature approach?

A
  • Takes a lot of time and effort to create new signatures

- Cannot detect zero day attacks

51
Q

What is rule based detection?

A

Uses rules for identifying known penetrations or identify suspicious behavior

Rules are usually specific

52
Q

What do network intrusion detection systems do?

A
  • Perform passive monitoring (records and analyzes data)
  • Only acts if an alert is sent out and the response policy has a response
  • Monitors traffic at selected points on a network
53
Q

What are the parts of a NIDS?

A
  • Sensors
  • NIDS management servers
  • Human management consoles
54
Q

What are inline sensors?

A
  • Detects and prevents attacks on the network
  • Traffic that it is monitoring must pass through it
  • Firewall + NIDS combo
55
Q

What is a passive sensor?

A
  • Monitors a copy of network traffic, not actual traffic

- More efficient

56
Q

What is the difference between a firewall and a Network IDS?

A

Active vs passive

Fail close vs fail open

57
Q

What are honeypots?

A
  • Decoy systems that lure attackers away from critical systems
  • Collect information on attackers as soon as it is accessed
  • Delay attackers so that administrators can respond
58
Q

How do you know when a honeypot has been compromised?

A

Should be no outbound traffic from a honeypot

59
Q

What are the two types of honeypots?

A 
Low interaction (partial copy of the system)
High interaction system (full copy)
60
Q

How do we evaluate IDS?

A
  • Scalable
  • Resilient
  • How good they are at guessing attacks correctly
61
Q

What does the Bayesian Detection Rate tell us about IDS?

A
  • Need to reduce false alarm rates
  • Need a high base rate
  • Multiple independent detection models are needed
  • Want the BDR to be high
62
Q

What is the base rate at the packet level for a Network IDS?

A

Low

63
Q

How can an attacker avoid NIDS?

A
  • Ambiguities in protocols have led to different implementations in different OSes (TTL, fragmentation overlap)
64
Q

What is an IPS?

A
  • Intrusion Detection and Prevention System
  • Extension of an IDS
  • Can block or prevent malicious activity
  • Host-based, network-based, distributed/hybrid based
  • Can use anomaly detection

CS 6035 (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions