Network Hardening Techniques Flashcards
1
Q
Footprinting
A
- Enumeration or information gathering attack
- Allows threat actor to discover topology and configuration of network and security.
- Can be done through social engineering or port scanning, eg.
2
Q
Fingerprinting
A
- Identifies OS types and versions
- uses port scans or responded from application servers
3
Q
On-Path attack
A
- Kind of spoofing attack
- Compromises connection between two hosts
- intercepts and relays communication between them
- Could modify information as well
- Man in the Middle attack
4
Q
MAC or IP Spoofing
A
- Host can arbitrarily select address and attempt to use it on network
- Used to get around control lists or impersonate a host
- Usually legit host must be disabled
- Also used in DoS attacks
5
Q
ARP Spoofing
A
- Broadcasting unsolicited ARP reply packets with source address that spoofs legit host or router
- All devices trust it because ARP has no security
- Usual target is subnets default gateway
- If successfully all traffic will be sent to attacker instead
- They could then read, manipulate or not forward packets for DoS attack.
6
Q
Rogue DHCP
A
- On-path attack run by launching rogue DHCP server
- Those communications are not authenticated so host will trust first it receives.
- Can then change DCHP options
7
Q
DNS Poisoning
A
- Compromises name resolution process
- Replace valid IP for trusted website with attacker IP
- They can then redirect traffic or steal information
- Can also be done by changing servers that resolving queries
8
Q
VLAN Hopping
A
- Designed to send traffic to wrong VLAN
- Can double tag frames to go to wrong VLAN
- This can be mitigated by ensuring native VLAN uses different ID to any other user accessible VLAN
- Can also be done by attaching device to network that spoofs operation of switch and creating trunk port.
- Can be mitigated by preventing auto-configuration of trunk ports
9
Q
Deauthentication attack
A
- Sends stream of spoofed management frames to disconnect from AP
- This may allow attacker to interpose evil twin AP or perform DoS attack
- Can be mitigated with MFP (802.11w)
10
Q
DDoS
A
- DoS attack launched by many hosts at once
- Can consume network bandwidth or resource exhaustion
11
Q
DRDoS
A
Distributed Reflection DoS/Amplification Attack
- Powerful type of TCP SYN flood attacks
- Spoofs Ip address and attempts to open connections with many servers
- Servers direct SYN/ACK to victim server
- Same thing can be done with responses to DNS requests
12
Q
Hardening
A
- Deploying devices in secure configuration
- Changing default passwords/enfrocing password requirements
- Role based acess
- Disable uneeded network services and protocols
13
Q
Endpoint security
A
- Security procedures at a device level
- Contrasts with perimeter security, but supplements it
14
Q
Disabling Switch Ports
A
- turning off uneeded switch ports or sending them to black hole VLAN
- Not the best method as it can introduce other errors
- Attacker can also potentially unplug device from active port
15
Q
MAC Filterintg and Dynamic ARP Inspection
A
- Defining MAC addresses that are permitted on particular port
- Attackers can use spoofed MACs
- ARP inspection prevents host attached to untrusted port from flooding with ARP replies
16
Q
DHCP Snooping
A
- Causes swithc to inspect DHCP traffic arriving on acces ports to ensure its MAC is not beeing spoofed
- Can also be used to stop rogue DHCP servers
17
Q
ND Inspection and RA Guard
A
- Perform similar fucntions to DAI and DHCP Snooping on IPV6
18
Q
Port Security
A
- Refers to PNAC ( Port based Network Access)
- Switch performs authentication before activiating port
- Device requesting acces is supplicant
- Authenticator (switch) enabled EAP over LAN and waits for authentication data
- Data is verified by authentication server like RADIUS
19
Q
PVLAN
A
Private VLAN
- Restrcits ability of hosts within VLAN from communicating with each other
- Used by hosting companies to stop servers owned by differnet companies from communicating
20
Q
Default VLAN
A
- VLAN with ID1
- All switch ports default to this
- Should be left unused and all unused ports should not be assigned to VLAN 1
21
Q
Native VLAN
A
- Where any untagged traffic is put when receiving frames over a trunk port
- Initally set with same VID as default VLAN
- This should be changed.
22
Q
Implicit Deny
A
- Default Rule on firewall
- Blocks all traffic not matched by a rule
23
Q
Tuple
A
- Parameter by which traffic is blocked or allowed on firewall
24
Q
Control Plan Policing
A
- Policy designed to mitigate risk from route processor vulnerabilities
- Malicious worms or tools may appear to be high priority traffic on the control plane
- This can place high demands on routers and switches managing control plane traffic
- ACLs and rate limiting can be used to address these issues
25
Q
PSKs
A
Preshared Keys
- Group authenticationi allwows stations to connect to network using passphrase
26
Q
EAP
A
Extensible Authetication Protocol
- Allows users to authenticate against a RADIUS server using regular network credentials
