Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CS4203: Computer Security > Network Defence > Flashcards

Network Defence Flashcards

1
Q

What is a firewall?

A

Special reference monitor that mediates access to a network and hide the stucture of the network.

May have a default permit or default forbidden state.

May be ingress or egress filtering devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What can firewalls do?

A 
Permit or block traffic
Log accesses
Provide CPN link
Authenticate users
Shield hosts
Cache data
Filter content
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How are decisions made on where to place firewalls?

A

Need to assess the application it’s protecting and allow for the application to work while securing it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the generic types of firewall?

A

Packet filters
Stateful inspection filters
Stateless inspection filters
Application proxies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What do packet filter firewalls do?

A

Look at packet header for addresses, ports and protocols

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What do stateful inspection filters firewalls do?

A

Maintains state information and keeps common ports open

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What do stateless inspection filters firewalls do?

A

Blocks or allows packets based on header information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What do application proxy firewalls do?

A

Simulates application and performs access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do personal firewalls deal with traffic?

A

Block blacklisted traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What actions do firewalls take on IP packets?

A 
Bypass
Drop
Protect (IPSec channel)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What rules might be specified on a packet when using packet filtering?

A

Actions
Specification of source/dest IP or ports
Dictate traffic in both directions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why is stateful inspection stateful?

A

Packet filtering examines the packet data as well as the state of the connection.

This information is used to build the state table which is held in cache.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How are rules defined in a state table?

A

Need only specify packet in one direction, replies and further packets in the connection are automatically processed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What happens when a packet doesn’t match the State Table?

A

The stateful firewall defaults to Rule Base checking to check if the packet can be forward.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How do application level proxies work?

A

Proxy analyses the application layer of the IP packet.

Uses this information to complete the data request of the client and return the result to the client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is faster, proxies or packet filters?

A

Packet filters as proxies scan the whole log file.

They are usually used in tandem to provide defence in depth.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the limitations of firewalls?

A

Can be too restrictive

Encryption prevents the firewall blocking malicious traffic

Protocol tunneling means that programs can still be executed but under the guise of http.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What do firewalls not provide any protection against?

A

No protection against attacks based on bugs

No protection against insider threat

No protection inside the network once a firewall has been compromised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a bastion server?

A

Firewall, runs all external services and acts as a packet filter or proxy.

Alternatively it is a packet filter that passes traffic to servers.

20
Q

What is a screened subnet? (DMZ)?

A

Has an interface towards both the external and internal networks.

Third interfaces screens the screened subnet. This screened subnet provides services to external users ie. Web or SMTP servers.

21
Q

What are dual firewalls?

A

Use 2 firewalls with a screened subnet between them to protect the network.

The area between them is the DMZ.

22
Q

What are the fields of a firewall?

A 
Rule number
Type of rule
Direction of traffic
Transport protocol
Source socket
Destination Socket
Policy number
23
Q

What is a permissive rule base?

A

Allow by default, block some.

24
Q

What are the limitations of using a permissive rule base?

A

Easy to make mistakes

If you forget to block something, allowing it into the system unchallenged

Protocol management is required to prevent staff chaning on the fly.

25
Q

What is a restrictive rule base?

A

Block by default, allow some

More secure, if you forget something someone will notice

26
Q

What are the problems with matching rules?

A

Packets can contain several headers so when setting a policy one must know which order the rules and headers are evauluated.

27
Q

What are two options for evaluating rules in a firewall?

A

Apply first matching entry in the list of rules

Apply the entry with the best match for the packet.

28
Q

How should firewalls be tested?

A

Outside-in approach should look at architectural risks, code scanning and security requirements.

Vulnerable systems and high priority system should be more secured.

29
Q

What is a vulnerability assessment?

A

Examines the security state of the network:

Open ports
Software packages running
Network topology
Prioritised lists of vulnerabilities

30
Q

What is an IDS?

A

Intrusion Detection System

Can be based at either the network or the host, these are response tools used for the deterrence, detection, damage assessment as well as attack anticipation.

31
Q

What are the common features of an IDS?

A 
Event Logging
Traffic Analysis
Integrity checking
Configuration management
notification
Network tapping/sensors
Response system
Handling and containment of intrusions
32
Q

What is an intrustion?

A

Anything from a benign exploration, corporate data modification or the copying/deletion of a file.

33
Q

What types of detection are there for IDPS?

A

Misuse detection - Rule based

Anomaly detection - Statistical anomaly based.

34
Q

How does anomaly detection work?

A

Attack signatures are network traffic patterns that have been learned and, when detected, combatted.

Produces profiles of users or system workload.

IDPS only as good as it’s trained to be.

Important not to pick up false positives.

35
Q

What is the limitation of a knowledge-based IDS?

A

Only as good as the database it uses, which needs to be kept up to date.

Large number of vulnerabilities and exploit methods so effective databases are difficult to build

Large database is slow.

36
Q

What are examples of signatures used in a knowledge-based IDS?

A

Number of recent failed login attempts

Bit patterns in an IP packet indicating a buffer overflow.

Some types of SYN packets.

37
Q

How does anomaly IDS detect attacks?

A

Deviations from the baseline raise an alarm.

Baseline is normal operating parameters

38
Q

What are the limitations of Anomaly-based IDS?

A

Legitimate users may deviate from the baseline

Baseline can be shifted over time by a patient attacker.

39
Q

What is a CIDS?

A

Centralised intrusion detection system.

Central console manages sensor network, analyses data, reports data and reacts.

40
Q

What’s does the ideal CIDS architecture have?

A

Protected communications between sensors and console.

Protected storage for signature DB.

Secure console config

41
Q

What is a NIDS?

A

Network Based IDS

Can be trained to recognise attack signatures by pattern matching frequency or threshold crossing.

Looks for attack signatures in network traffic, in realtime.

42
Q

What is HIDS?

A

Host Based IDS
Look at logfiles to verify message digests/checksums of key system files.

Verifies checksums of key system files and executables.

Use regex and port usage to check attack signatures.

43
Q

What are the IDS response options?

A

Notify
Store
Action

44
Q

How does NIDS do IDS response?

A

Notify: alarm to console, email, snmp trap, views active session

Store: Log summary, log network data

Action: kill connection, reconfigure firewall

45
Q

How does HIDS do IDS response?

A

Notify: alarm to console, email, snmp trap

Store: Log summary

Action: Terminate user login, disable user account, restore index.html

46
Q

What are the dangers of automated response?

A

Attacker can trick IDS to respond to innocent targets.

Can lock users out of accounts

Repreated email to sysadmin is a form of DoS

Repeated restoration of index.html reduces website availability

CS4203: Computer Security (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions