Network Security Flashcards
The physical layout of the network hardware
Physical topology
The arrangement of data and how it flows across the network
Logical topology
Main network zones include?
Private intranet
Limited-access extranet
Public internet
Local network protected by a single firewall
Often referred to as a SOHO DMZ
Uses a single firewall to protect a local network
Screened Host
Network Segmentation
To monitor and control how data moves between different parts of the network
Uses proxies to handle traffic and keep DMZ hosts (bastion hosts) minimal and secure.
They keep external-facing servers separate from the internal network to reduce exposure to attacks
Demilitarized Zones (DMZs)
This model continuously verifying all users and devices, not just trusting them based on their location
Zero Trust model
Monitors network to detect and alert on potential security threats. It uses sensors to capture and analyze traffic and can alert you if something is detected
Intrusion Detection System (IDS)
Actively responds to and mitigates threats in real-time
Intrusion Prevention System (IPS)
Divides the network into smaller, isolated segments ( single host zones) to enhance/ boost security
Microsegmentation
Combines multiple data streams into a single stream for analysis
Aggregation TAP
VLAN
Virtual local area network
Types of network design vulnerabilities
Single point of failure
Complex dependencies
Availability versus confidentiality integrity
Overdependence on parameter security
Solution for a single point of failure
Implement redundancy systems and fail logical things are over mechanisms
Solutions for complex dependencies
Simplified dependencies and enhance tolerance
To address vulnerability, such as availability versus confidentiality and integrity, you would?
Balance, all aspect of security, keeping things, private , safe and unchanging
Change control
How can you deal with overdependence on parameter defenses and security?
Regularly assess parameter defenses and avoid over reliance on parameter security by integrating, internal protections and follow best practices
Traffic filtering uses _____ between zones to prevent unauthorized access?
Firewalls
_________ traffic entering your network/receiving
southbound traffic
________ traffic leaving your work. Send it.
Northbound
Traffic happening between devices in the network
East west traffic
These zones are designed to isolate Internet facing hose from the internal network
Demilitarize Zones (DMZ)
These hosts in the DMZ are not fully trusted and run minimum services
Bastion hosts
Network zone segment the network into areas with similar?
Security needs clarification
______ captures network traffic data
Network sensor
Detection engine
Analyze traffic in real time to identify indicators of compromise
Components of intrusion detection systems
Network sensors
Detection engine
Passive logging / alerting
Does not rely solely on perimeter security it implements continuous in context based authentication. Verifies all users and devices
Zero trust model to
______ are used to capture an analyze traffic and can alert you as something suspicious as de
Sensors
Mirrors traffic from a switch port for analysis
Switch port analyzer (SPAN) great
Mirror port
Provide a copy of network traffic without affecting the network. If the machine works, but the tab structure stops working it will continue.
Passive test access point (TAP)
Allows for interaction with network traffic, potentially in introducing delays like a firewall
Active TAP
Identifies threats by matching patterns and network traffic against a database of known attack signatures
Signature based detection
Identifies anomalous by establishing a baseline of normal behavior and detecting deviation from this baseline
Behavior-based detection (NBAD)
Heuristic based anti attack structure
Learning from experience
Heuristic
Analyzes user and entity behavior to detect anomalies
User and entity behavior analytics (UEBA)
Monitors network traffic to identify irregularities
Network traffic analysis (NTA)
Includes application-aware filtering, user-base filtering, integrated IPS, and cloud inspection
Next-generation firewall
Combines various security controls to a single platform, including firewall, Auntie, Mauer, network, confusion, prevention, spam filter, content, filtering, data, loss prevention, VPN, cloud access gateway
Unified threat management (UTM) things here and there DLP prevention tools that will catch when you’re sending something you shouldn’t be sending out of the office hours. We’re gonna block it.
Focus on outgoing user traffic content, block list, and allow us
Content filter
DLP
Data loss prevention
Inspects and protects web applications by analyzing HTTP packets
Web application firewalls (WAFs)
DMZs
Demilitarized Zones
SOHO DMZ
Screened Host
IDS
Intrusion detection system
SPAN
Switched port analyzer
TAP
Test access point
IPS
Intrusion prevention system
NBAD
Network behavior and anomaly detection
WAP
Wireless access point
SSID
Service set identifier
BSSID
Basic service set identifier
NTA
Network traffic analysis
UEBA
User and entity behavior analytics
NGFW
Next generation firewall
UTM
Unified threat management
WAFs
Web Application firewall
SIEM
Security information and Event Management
Visualize signal strength from high (red) to low (green/blue)
Heat map
The action of assessing signal strength, and channel usage
Site surveys
SSID
Service set identifier
BSSID
Basic service set identifier
ACI
Adjacent channel interference
WPA
Wi-Fi protected access
AES
Advance encryption standard
TKIP
Temporal key integrity protocol
SAE
Simultaneous authentication of equals
What WiFi protected access uses AES
WPA2
What WiFi protected access uses TKIP
WPA1
What WiFi protected access uses SAE
WPA3
WPS
Wi-Fi protected set up
Provides enhanced security
Simultaneous authentication of equals (SAE)
PSK
Pre-shared key authentication
QoS
Quality of service
VPN
Virtual private network
This requires users to authenticate through a webpage before accessing the network
Captive portals
Control of traffic, flow and insurance compliance with policies
Traffic policing
TLS
Transport layer security
PKI
Public key infrastructure
TCP
Transmission control protocol
UDP
User datagram protocol
IPSec
Internet Protocol Security
AH
Authentication Header
ESP
Encapsulation Security Paylod
RDP
Remote desktop protocol
SSH
Secure shell
Collect logs from various sources, using agents, collectors, standard protocols, like Syslog, or sensory to gather data
SIEM
_______ Identifies the network
Service set identifier (SSID)
______WAPs handle most network functions independently
Fat WAPs
____ WAPs rely on a central controller for management
Thin WAPs
Enhanced security protocol
Simultaneous Authentication of Equals (SAE)
Secure communication between gateways across unrested network
Tunnel mode
Secure connections between individual hosts on a private network
Transport mode
All traffic is encrypted and protective by the network. Routes all Internet traffic through the VPN.
Full tunnel
Provide secure authentication with tickets
Kerberos
