Network Components Flashcards
What is access control?
The process of making resources available to accounts that should have access while limiting the access to only what’s required. This is typically done through an Access Control List ( ACL).
What is a firewall?
It is a component consisting of hardware, software or both that is placed on computers and networks to help stop undesired access by the outside world. Its the first line of defense for a network and primarily functions to mitigate threats by monitoring traffic going to and from a network.
What is the difference between stateful and stateless firewalls?
Stateless firewalls essentially works as a basic ACL filter and does not inspect traffic, just observes it and allows/denies based on ACL. Stateful firewalls perform a deeper inspection that analyzes traffic patterns and data flows. They are better at identifying unauthorized communication attempts.
What is best practice for order of firewall rules?
Rules can be created for either inbound or outbound traffic. The order of the rules affects application. Most restrictive rules should be applied first and least restrictive should follow. Otherwise, if least restrictive is listed first, checking would stop at the first rule.
What is implicit deny?
It is an access control practice where resource availability is restricted to only logins that are explicitly granted access. Implicit deny is typically used by default in firewall configurations. Access lists have an implicit deny at the end of the list - unless you explicitly permit traffic to pass, it won’t pass.
What is the difference between application layer firewalls and network layer firewalls?
Application layer firewalls can examine application traffic and identify threats through deep pocket inspection techniques and function at layer 7 in OSI model. They are preferred to a network layer firewall.
What is a VPN concentrator?
A VPN concentrator allows multiple external users to access internal network resources using secure features built into the device. It can encrypt WLAN or wired traffic when the security of login and pw info is paramount. It can prevent login and pw info from being captured. Also, a VPN concentrator allows ACLs to be applied to remote sessions.
What is Internet Protocol Security (IPsec)?
IPsec secures transmissions between critical servers and clients. It offers authentication services and encapsulation of data through support of the Internet Key Exchange (IKE). Functions within the network layer of OSI model.
IPsec: What is the difference between tunnel mode and transport mode?
Transport mode is used between endpoints (like a client and server) or between a gateway and endpoint (if gateway is being treated like an endpoint). Tunnel mode is default mode. It’s mostly used between gateways, like a router and a firewall.
IPsec: What is an Authentication Header (AH)?
It provides authentication of the data’s sender as well as integrity and nonrepudiation. AH provides authentication for as much of the IP header as possible and for upper-level protocol data. Protocol 51.
IPsec: What is Encapsulating Security Payload (ESP)
It supports authentication of the data’s sender and encryption of the data being transferred, along with confidentiality and integrity protection. Protocol 50.
Difference with SSL/TLS VPNs and IPsec VPNs?
SSL/TLS VPNs have simple end-user implementation because they function via a browser and Internet connection. SSL/TLS are “always on” VPNs, meaning the user is always on the network.
What are site-to-sites VPNs?
They are implemented based on IPsec policies assigned to VPN topologies. They connect entire networks to each other. VPN gateways are responsible for setting up and breaking down the encapsulation and encryption traffic.
What is the difference between split tunnel and full tunnel mode for VPNs?
Full tunnel routes and encrypts all requests through the VPN. In split tunnel, internal traffic requests are routed over the VPN, other traffic like web and email traffic will directly access the internet. Split tunnel is ideal to reserve bandwidth while users are on the Internet and reduce the load on the VPN concentrator.
What is an intrusion detection system (IDS)?
IDS analyzes data, identifies attacks, and responds to the intrusion by sending alerts. It can also identify unauthorized activity and attacks in progress within the network. There are two methods: knowledge-based and behavior-based detection
What are 2 basic types of IDS?
Network IDS (NIDS) looks at the info exchanged between machines. They monitor the packet flow & attempt to locate packets that slipped through the firewall but shouldn’t have. Ideal for detecting DoS attacks and unauthorized user access. The other type is host-based IDS (HIDS). These look at info that originates on the individual machines and monitors communications on a host-by-host basis to try and filter malicious data. Ideal at detecting unauthorized file modifications and user activity.
What is an out-of-band device?
This type of device only listens passively and does not change or affect traffic. Essentially the system detects a potential security breach, logs the info, and signals an alert after the event occurs.
What is a network intrusion prevention system (NIPS)?
NIPSs can be either hardware or software based. It differs from IDS in that it actually prevents attacks instead of just detecting the occurrence of an attack. NIPSs are designed to sit inline with traffic flows and prevent attacks in real time. It sits between the systems that need to be protected and the rest of the network. NIPS solutions can look at application layer protocols such as HTTP, FTP, SMTP. This is an in-band device.
What is a signature-based detection method?
Only detects known signatures or patterns, so must be created for every suspicious activity. It’s a reactive method because an attack must be known before it can be added to database. Lower chance of false alarms compared to behavior-based methods.
What is the difference between behavior and anomaly-based detection methods?
Both methods use a baseline for network behavior. Behavior-based, an established profile is used as a comparison to current activity and looks for evidence of compromise rather than an attack itself. In anomaly-based, after the application is trained, the established profile is used on real data to detect deviations. Training an application involves inputting and defining data criteria in a database. Heuristic-based methods are similar to anomaly and are rule-based and look for abnormal behavior. It’s rules are categorized by: benign, suspicious, or unknown. Anomaly is less specific.
What is a false positive and a false negative?
A false positive is when a typical or expected behavior is identified as irregular or malicious. A false negative is when an alert that should have been generated did not occur.
