Network Hardening Techniques Flashcards
1
Q
Footprinting
A
- Enumeration or information gathering attack
- Allows threat actor to discover topology and configuration of network and security.
- Can be done through social engineering or port scanning, eg.
2
Q
Fingerprinting
A
- Identifies OS types and versions
- uses port scans or responded from application servers
3
Q
On-Path attack
A
- Kind of spoofing attack
- Compromises connection between two hosts
- intercepts and relays communication between them
- Could modify information as well
- Man in the Middle attack
4
Q
MAC or IP Spoofing
A
- Host can arbitrarily select address and attempt to use it on network
- Used to get around control lists or impersonate a host
- Usually legit host must be disabled
- Also used in DoS attacks
5
Q
ARP Spoofing
A
- Broadcasting unsolicited ARP reply packets with source address that spoofs legit host or router
- All devices trust it because ARP has no security
- Usual target is subnets default gateway
- If successfully all traffic will be sent to attacker instead
- They could then read, manipulate or not forward packets for DoS attack.
6
Q
Rogue DHCP
A
- On-path attack run by launching rogue DHCP server
- Those communications are not authenticated so host will trust first it receives.
- Can then change DCHP options
7
Q
DNS Poisoning
A
- Compromises name resolution process
- Replace valid IP for trusted website with attacker IP
- They can then redirect traffic or steal information
- Can also be done by changing servers that resolving queries
8
Q
VLAN Hopping
A
- Designed to send traffic to wrong VLAN
- Can double tag frames to go to wrong VLAN
- This can be mitigated by ensuring native VLAN uses different ID to any other user accessible VLAN
- Can also be done by attaching device to network that spoofs operation of switch and creating trunk port.
- Can be mitigated by preventing auto-configuration of trunk ports
9
Q
Deauthentication attack
A
- Sends stream of spoofed management frames to disconnect from AP
- This may allow attacker to interpose evil twin AP or perform DoS attack
- Can be mitigated with MFP (802.11w)
10
Q
DDoS
A
- DoS attack launched by many hosts at once
- Can consume network bandwidth or resource exhaustion
11
Q
DRDoS
A
Distributed Reflection DoS/Amplification Attack
- Powerful type of TCP SYN flood attacks
- Spoofs Ip address and attempts to open connections with many servers
- Servers direct SYN/ACK to victim server
- Same thing can be done with responses to DNS requests
12
Q
Hardening
A
- Deploying devices in secure configuration
- Changing default passwords/enfrocing password requirements
- Role based acess
- Disable uneeded network services and protocols
13
Q
Endpoint security
A
- Security procedures at a device level
- Contrasts with perimeter security, but supplements it
14
Q
Disabling Switch Ports
A
- turning off uneeded switch ports or sending them to black hole VLAN
- Not the best method as it can introduce other errors
- Attacker can also potentially unplug device from active port
15
Q
MAC Filterintg and Dynamic ARP Inspection
A
- Defining MAC addresses that are permitted on particular port
- Attackers can use spoofed MACs
- ARP inspection prevents host attached to untrusted port from flooding with ARP replies
