Network Security Flashcards
What’s the difference between an IDS and an IPS in terms of taking action?
IDS tools don’t take action on their own.
IPS control system accepts and rejects a packet based on the rule set.
What three logical components make up an Intrusion Detection System?
Sensors: software and/or data sources that collect data.
Analysers: determines if intrusion has occurred.
User interface: views output or controls system behaviour.
What is an NIDS?
How does it work and where is analysis of traffic patterns performed?
Network-based Intrusion Detection System.
Monitors network traffic and analyses network, transport, application protocols to identify suspicious activity.
Works by monitoring traffic at selected points on a network, it examines traffic packet by packet in real or close to real time.
Analysis of traffic may be done at the sensor, the management server, or a combination of the two.
What is a HIDS?
Host-based Intrusion Detection System
It monitors the characteristics of a single host for suspicious activity, such as on a PC, phone or tablet.
What’s a honeypot and what’s it used for?
Decoy systems that can be fake services, databases or networks.
Filled with fabricated information and have no real production value.
Designed to lure a potential attacker away from critical systems
Collect info about the attacker’s activity
Encourage attacker to stay on system long enough for administrators to respond.
Is a firewall an IDS or an IPS and where is it inserted?
IPS - Intrusion Prevention System
Inserted between the premises network and the internet to establish a controlled link.
What are two capabilities and four limitations of a firewall?
- Defines a single choke point.
- Provides a location for monitoring security events.
-
- Cannot protect against attacks bypassing firewall.
- May not fully protect against internal threats.
- Improperly secured wireless LANs can be accessed from outside organisation.
- A laptop, PDA or portable storage devices may be infected outside the network then used internally.
Do client attacks require access to the remote host?
Give an example of a client attack.
No, the adversary attempts to achieve user authentication without access to the remote host or the intervening communications path.
Such as password guessing/cracking.
An IDS is composed of three logical components, what are they?
- Sensors - software/data sources that collect data. Common sources are system call traces, audit records, file integrity checksums, registry access.
- Analysers - determines if intrusion has occurred.
- User interface - views output or controls system behaviour.
How does a Distributed or Hybrid IDS work?
Combines information from sensors, both host and network based, in a central analyser.
They’re able to better identify and respond to intrusion activity.
Stores information with logs and analyses using algorithms.
