MODULE 7

Question 1

Intruder behavior steps:

Answer 1

1. Target acquisition
2. Initial access
3. Privilege escalation
4. System exploit
5. Maintaining access
6. Covering tracks

Question 2

Initial attacks often exploit system vulnerabilities to:

Answer 2

• Execute backdoor code
• Gain protected information

Question 3

IDS types:

Answer 3

• Host-based
• Network-based
• Distributed or hybrid

Question 3

Requirements of IDS

Answer 3

• Fault tolerant
• Minimal overhead
• Graceful degradation
• Adapt to changes
• Run continually
• Dynamic reconfiguration

Question 4

Intrusion detection problems:

Answer 4

• False positives
• False negatives
• Must compromise

Question 5

IDS analysis approaches:

Answer 5

• Anomaly detection
• Signature/Heuristic/Misuse detection

Question 6

IDS signature detection:

Answer 6

Matching malicious data patterns against stored data

Question 6

IDS heuristic detection:

Answer 6

Using rules to identify penetrations

Question 7

HIDS sensor:

Answer 7

A component of intrusion detection used to collect data

Question 7

Information logged by an NIDS sensor:

Answer 7

• Timestamp
• Event
• IP addresses
• Ports
• Protocols
• Number of bytes

Question 7

NIDS sensor types:

Answer 7

• Inline
• Passive

Question 8

Honeypots:

Answer 8

Decoys with fake info to lure attackers

Question 9

Snort IDS:

Answer 9

Lightweight open-source IDS that captures packets and analyze them

Question 10

Snort rules:

Answer 10

• Simple rule definition language
• Fixed header
• Header includes action, protocol, source IP, source port, direction, destination IP, and destination port
• Many options possible