Network Security Flashcards
TCP/IP Architecture
Application Layer
Transport Layer
Internet Layer
Network Interface Layer
IPv4 allowed private ip addresses
Range
10.0.0.0 to 10.255.255.254
172.16.0.0 to 172.31.255.254
192.168.0.0 to 192.168.255.254
ftp sftp ports
21ftp
22 sftp
telnet
ssh
23 telnet
22 ssh
smtp
smtp w/ tls
25 smtp
587 smtp w/ tls
time
ntp
37 time
123 ntp
dns
dot (dns over tls)
53 dns
853 dot
http
https
http 80
https 443
imap (internet message access protocol)
imap for ssl/tls
143 imap
993 imap ssl/tls
snmp
161/162 snmp
smb (server message block)
nfs (network file system)
445 smb
2049 nfs
ldap
ldaps
389 ldap
636 ldaps
three-way handshake between client and server
syn, syn-ack, ack
spoofing
An attack with the goal of gaining access to a target system through the use of a falsified identity.
Phishing
An attack that attempts to misdirect legitimate users to malicious websites through the abuse of URLs or hyperlinks in emails could be considered phishing.
Virus
A virus is a self-replicating piece of code that spreads without the consent of a user, but frequently with their assistance (a user has to click on a link or open a file).
Worm
They contain the same destructive potential as other malicious code objects with an added twist—they propagate themselves without requiring any human intervention.
Trojan
a software program that appears benevolent but carries a malicious, behind-the-scenes payload that has the potential to wreak havoc on a system or network.
Side-channel attack
A side-channel attack is a passive, noninvasive attack to observe the operation of a device. Methods include power monitoring, timing and fault analysis attacks.
Malware
A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity or availability of the victim’s data, applications or operating system or otherwise annoying or disrupting the victim.
HIDS
A HIDS monitors activity on a single computer, including process calls and information recorded in system, application, security and host-based firewall logs. It can often examine events in more detail than a NIDS can, and it can pinpoint specific files compromised in an attack. It can also track processes employed by the attacker. A benefit of HIDSs over NIDSs is that HIDSs can detect anomalies on the host system that NIDSs cannot detect.
NIDS
A NIDS monitors and evaluates network activity to detect attacks or event anomalies. It cannot monitor the content of encrypted traffic but can monitor other packet details. A single NIDS can monitor a large network by using remote sensors to collect data at key network locations that send data to a central management console. These sensors can monitor traffic at routers, firewalls, network switches that support port mirroring, and other types of network taps. A NIDS has very little negative effect on the overall network performance, and when it is deployed on a single-purpose system, it doesn’t adversely affect performance on any other computer. A NIDS is usually able to detect the initiation of an attack or ongoing attacks, but they can’t always provide information about the success of an attack. They won’t know if an attack affected specific systems, user accounts, files or applications.
Security Information and Event Management (SIEM)
The general idea of a SIEM solution is to gather log data from various sources across the enterprise to better understand potential security concerns and apportion resources accordingly.
Preventing threats
Keep systems and applications up to date.
Remove or disable unneeded services and protocols.
Use intrusion detection and prevention systems.
Use up-to-date anti-malware software.
Use firewalls.
