Misc Flashcards
Troubleshooting methodology
- Identify the problem.
- Establish a theory of probable cause.
- Test the theory to determine cause.
- Establish a plan of action.
- Verify full system functionality
- Document findings, actions and outcomes
Cloudborne attack
Cloudborne attacks occur as a result of a vulnerability in bare-metal server reclamation process used by MSPs (Managed Service Providers) that provide Infrastructure as a Service (IaaS). An attacker can install a firmware back door on a server that is later reclaimed and repurposed for another client. Because the back door on a server is installed at the firmware level, it enables the attacker to bypass any security measures added by the hypervisor or OS. Reflashing the firmware on a server before repurposing it mitigates Cloudborne attacks.
CASB
Cloud Access Security Blocker - (CASB)
A CASB is a security solution that sits between cloud service users and cloud applications to enforce security policies. It helps protect data by providing visibility, securing data transfers, monitoring user activity, identifying risks, and applying security policies like encryption, access control, and threat protection across cloud services.
A CASB protects the local network against the man-in-the-cloud attack (MITC). In an MITC attack, the attacker uses malware to steal synchronization tokens that are used by applications to authenticate and synchronize data with cloud providers. The malware is typically installed by using social engineering techniques, such as malicious email attachments. Once infected, the target system copies synchronization tokens and sends them to an attacker. The attacker can then access and download any information that the target has stored in the cloud provider.
OEM
Original Equipment Manufacturer
PXE
Some BIOS include a feature that enables a PC to use a preboot execution environment (PXE). A PXE enables you to boot a PC without any local storage by retrieving an OS from a server over a network. PXE uses multiple protocols such as IP, DHCP, and DNS to enable your computer to boot from a network location.
USMT
User State Migration Tool
The USMT’s primary use is in businesses because it has to be run in a Windows Server Active Directory domain. If you need to migrate many users, the USMT is the tool.
System Preferences
Where system settings are set up on a macOS. Renamed as System Settings in the latest version of the OS
UAC
User Account Control - The mechanism that pops up when a standard user requests privilege escalation
NTFS Permissions Propagation
Data Execution Prevention (DEP)
Data Execution Prevention (DEP) works in the background to stop viruses and other malware from taking over programs loaded in system memory. It doesn’t prevent viruses from being installed on your computer, but it does make them less effective. By default, DEP is only enabled for critical operating system files in RAM, but the Data Execution Prevention tab enables you to turn on DEP for all running programs. It works, but you might take a performance hit or find that some applications crash with DEP enabled for all programs. Like other options in Performance Options, leaving the default DEP settings is the best option most of the time.
Scripting Languages
Batch File - .bat - Batch files are the shell scripting language for the old-school Command shell on Windows and DOS (yes, that DOS).
PowerShell - .ps1 - PowerShell is a shell scripting language written from the ground up for automating modern Windows systems. Replaces batch files in most situations.
Bash (or Bourne Again) shell script - .sh - By convention, the first line of a UNIX shell script file specifies which shell should execute the script (and thus, which specific shell scripting language it is written in). These files often have a .sh file extension, but it is not necessary.
Python - .py - Python is a flexible programming language with simple syntax that makes it well suited for writing both simple scripts and large applications.
JavaScript - .js - JavaScript is a browser scripting language developed back in the 1990s to enhance Web pages, but these days you can find it in command-line programs, extensions for many desktop applications, and much more.
Visual Basic Script - .vbs - Visual Basic Script is a legacy scripting language for Windows and other Microsoft applications. Slowly being replaced by other languages like PowerShell.
Language | File Extension | Description |
QoS
Quality of service (QoS) enables busy networks to prioritize traffic. While we’ll look at QoS from the router’s perspective in Chapter 21, individual systems play an important role in the QoS process by tagging their frames, enabling networking hardware to treat them according to rules defined by network administrators. Support for QoS tagging (or priority) should be enabled by default on most network adapters—but if you need to modify this setting, you can find the VLAN option on the Advanced tab of your NIC’s Properties dialog box (see Figure 19-20).
SMB
Windows file and print sharing is powered by the Server Message Block (SMB) protocol, which uses TCP port 445 and UDP ports 137–139. Unixes used to use their own Network File System (NFS) protocol, but they have generally settled on SMB as well. Make sure you’re prepared to recognize both Common Internet File System (CIFS) and Samba as forms of SMB. CIFS is a deprecated Microsoft dialect of SMB, while Samba is the name of the Linux implementation.
AAA
The CompTIA A+ 1101 objectives want you to know about a server role called authentication, authorization, and accounting (AAA)—a server that authenticates users, authorizes what resources they may access, and logs all these actions for accountability. Real-world AAA is complex and often entails multiple servers—but RADIUS and TACACS+ are the main protocols that power AAA whether it involves one server or several.
-
RADIUSis a completely open standard developed by the Internet Engineering Task Force (IETF) in a whole boatload of RFCs. RADIUS is partially encrypted and usually uses UDP ports 1812 and 1813. It’s more likely to be interoperable between different device manufacturers. -
TACACS+was developed as a proprietary protocol by Cisco, though Cisco has released an “open” description of it so that other companies can also implement it. TACACS+ is fully encrypted and uses TCP port 49. It won’t be as well supported on non-Cisco hardware.
Kerberos
Good network authentication and authorization doesn’t stop at the gate! Well-designed networks also validate authentication and authorization when clients access network resources. The Kerberos authentication protocol enables a central authorization server to pass out keys that individual clients can present to access resources as needed. You may never deal directly with Kerberos, but it’s extremely common—it’s even hard at work under the hood of Microsoft Active Directory.
