Logical Security( Comptia Objective 2.2) Flashcards
1
Q
What is commonly used in the work environment to provide a centralized management of Windows Domain Services and provide a way to manage groups of users on the network?
A
- Active Directory
- Centralized Management( Windows Domain Services Limit and control access)
- Login scripts, map network drives, update security software signatures and update application software.-
- Provides Group policy/Updates and define specific policies depending on the user who is login. Also may restrict access depending on the time of day.
- Demands password complexity and provides login restrictions.
2
Q
How are active directories commonly laid out?
A
- Commonly organized into Organizational units
- Structure Active Directory.
- Can be based on the company( Locations, departments etc)
- Usually a user will have what’s called a Home Folder. Which allows them to assign a network share as the user’s home folder e.g. \server1\users\jackblack where the user can store all of their files into one place.
- To help prevent a user storing files on a systems local folder often active directory will have built in Folder redirection so that instead of using a local folder they get redirected to the server instead.
- E.G. Store documents folder on \server1 and then it doesn’t matter which computer the user logs into they will have access to their saved files on the server.
3
Q
What is commonly used to centrally manage mobile devices and their security?
A
- Mobile Device Management( MDM)
- Manage company owned and user owned mobile devices( BYOD. Bring Your Own Device)
- Centralized management of mobile devices. Specialized functionality.
- Provides a way to set policies for apps, data, camera etc.( Control the device remotely)
- The entire device or a “partition”.
- Can also provide a way to Manage access control( Force screen locks and PIN’s on these single user devices)
4
Q
What is Port Security and what is it used for?
A
- Prevent unauthorized users from connecting to a switch interface. ( Alert or disable the port)
- Based on the source MAC address Even if forwarded from elsewhere.
- Each port has it’s own config. Unique rules for every interface.
5
Q
What would be an example of Port Security?
A
- You would configure a maximum number of source MAC addresses on an interface.
- You decide how many is too many.
- You can also configure specific MAC addresses.
- The switch monitors the number of unique MAC addresses. Maintains a list of every source MAC address.
- Once you exceed the maximum, port security activates. Default is to disable the interface.
6
Q
When it comes to MAC Filtering what is one concern in the work environment when it comes to administration?
A
- Have to find a way to allow visitors access to the network as the MAC filtering will prevent them having access to the network by default.
7
Q
What is a security concern with MAC Filtering?
A
- MAC addresses can be easily spoofed with a WIFI analyzer. ( Spoofing)
- Security through obscurity( Not really secure at all)
8
Q
What are smart cards? -
A
- A physical card that provides digital access to a laptop or other device and is inserted into the device itself.( This is a digital certificate)
- Usually used in conjunction with other security factors/ methods such as PIN or fingerprint.
9
Q
What are some examples of Certificate-based authentication?
A
- Smart Card( Private key is on the card)
- PIV (Personal Identity Verification) card commonly used by the US Federal Government is also a type of smart card that has your picture and identification information on it
- CAC( Common Access Card) commonly used by the US Department of Defense. Also a type of smart card and includes photo ID and personal information.
- IEEE standard 802.1X allows you to gain access to the network using a certificate.
On device storage or separate physical device.
10
Q
When it comes to Anti-virus and anti-malware what are some things you must take into consideration particularly in the office environment
A
- Updates need to be completed on all devices( This becomes a scaling issue)
- Large organizations need enterprise management in order to track updates, push updates, confirm updates and manage engine updates.
- Mobility adds to the challenge. ( Needs additional management)
11
Q
What are Host-based firewalls?
A
- “Personal” firewalls( Software based)
- Included in many operating systems including Windows and Linux.( 3rd party solutions also available)
- Stops unauthorized network access “stateful” firewall. Blocks traffic by application
- Examples of this would be Windows Defender Firewall that blocks traffic based upon port number and application.
12
Q
Where are Network-based firewalls commonly used? And how do they operate?
A
- The ingress or egress to the network
- Filters traffic by port number( E.G. HTTP is port 80, SSH is port 22)
- Next generation firewalls can identify the application
- Can encrypt traffic into and out of the network.( Protect your traffic between sites)
- Can proxy traffic( A common security technique)
- Most network based firewalls can be layer 3 devices( such as routers). Usually sits on the ingress/egress of the network.
13
Q
What is user authentication and how does it work?
A
- Identifier( Something unique). In Windows, every account has a unique Security Identifier(SID)
- Credentials. The information used to authenticate the user( Password, smart card, PIN code etc. )
- Profile( Information stored about the user). Name, contact information, group memberships etc.
14
Q
What are some important things to know when it comes to strong passwords?
A
- Weak passwords can be difficult to protect against things like Interactive brute force. Hashed passwords can be brute forced offline
- Passwords need complexity and constant refresh. This helps reduce the chance of a brute force and also reduces the scope if a password is found.
- Annual password analysis from Splash Data examines leaked password files. Most commonly used passwords are :#1 123456/ 2/: password, 3/: 12345, 4/: 12345678 and #5 qwerty
15
Q
What is Multi-factor authentication?
A
- More than one factor. E.g Something you are( Biometrics), Something you have(Smart card, or smartphone), Something you know( Passwords), Somewhere you are(GPS check), Something you do(Signature)
- These factors are usually used together to form multi-factor authentication
- Downside can be is that it’s expensive to use multi-factor authentication.( Such as hardware tokens)
- Sometimes however it can be inexpensive such as free smartphone applications or a Software based token generator.
