Lecture 2 Flashcards
Attacks & Monitoring
The goal of _____ is to prevent unauthorized access to objects
access control
Malicious users are called what?
Crackers (attackers)
True/Flase: A hacker is someone who is just a technology enthusiast, not intent on causing harm.
True
the process of identifying, understanding, and categorizing potential threats is what?
Threat modeling
A group of attackers that work together to go after targets (are can be government funded), regardless of ease of access, are called what?
Advanced persistent threats (APT)
The process of detecting unauthorized or abnormal activities is called what?
monitoring
This ensures that people are held accountable for their actions and can help reconstruct events for prosecution, and to create reports.
monitoring
Audit and logging tools help with _____.
monitoring
What are 5 common logs?
Security logs System logs application logs firewall logs change logs
An___________ is a tool that automates the inspection of audit logs and real-time system events. It provides accountability and enables timely and accurate responses to an intrustion.
Intrusion Detection System (IDS)
What are the 3 types of responses for an IDS?
Passive- records the intrusion and alerts
Active- affects/attempts to stop the intrusion. (limited capabilities)
Hybrid- records and affects/stops the intrusion
What are the 4 types of IDS?
Host-based
Network-based
Knowledge-based
Behavior-based
A ______ is a system placed on the network that is usually an easy target (not patched, vulnerable to attacks). It is designed to attract an intruder and keep them busy on the system.
Honepot
This is used to test a system for known security vulnerabilities and weaknesses.
Vulnerability scanner
An_____ seeks to actively block unauthorized connection attempts or illicit traffic patterns as they occur
Intrusion Prevention System (IPS)
Penetration testing is used for what?
To determine the strength of the security measures
_______ is used to find any and all detectable weaknesses in the security perimeter.
Penetration testing
True/False: Penetration testing should be done whenever you think there is a weakness and you want to prove it.
False.
Penetration testing should only be done with prior approval/coordination of the security staff.
A _____ attack is testing all possible valid combinations of a given character set.
Brute Force
Using a table of predefined words/potential passwords is what type of attack?
Dictionary
A _____ is when a reverse hash is matched from a possible password and the hash value stored in the database file.
Birthday attack
What attack is used to prevent a system from processing or responding to legitimate traffic or requests.
Denial of Service (DoS)
This type of attack is when someone uses other systems as zombies/slaves to send illegitimate traffic to a destination to prevent legitimate traffic from getting through.
Distributed Denial of Service (DDoS)
A SYN Flood attack is a type of DoS attack where multiple SYN packets are sent to a system. What is the purpose of the SYN flood?
Break the TCP/IP 3-way handshake. It leaves sessions open but not connected, taking up system resources.
A _____ attack occurs when an amplifying server or network is used to flood a victim with useless data
smurf
An attack where a valid source and/or destination IP address is replaced with false ones, is called what?
Spoof attack
What are 2 countermeasures for spoofing attacks?
source/destination verification on routers
IDS
When someone is intercepting traffic (sniffing) as it goes between a source and destination it is called what?
Man in the middle attack
When someone intercepts traffic as a store and forward mechanism what type of attack is it?
Man in the middle attack
A type of Man in the middle attack where an attacker captures traffic and records it, then re-transmits it to that server with slight variations.
Replay or playback attack
Gathering information on the network to obtain information about the network or traffic going over the network is called what?
Sniffer attack
_____ is unwanted or unsolicited messages and can cause DoS attacks.
Spam
Numerous types of attacks are designed to bypass access control.
In addition to specific countermeasures for each of these attacks, certain measures can be used to help compensate for access control violations.
What are these called?
Access Control Compensations
Access control compensations include (list at least 3)
Insurance
Business Continuity plan
Backup and recovery
fault-tolerance
