Other Technical stuff Flashcards
What can NetFlow be used for
Unusual Data Transfers:
Unusual Destinations:
Large transfers
Unusual Protocols:
Off-Hours Activity:
Data Encryption:
User Accounts and Anomalies:
Security Alerts and Alarms:
Historical Baseline Comparison:
File and Folder Access Logs:
What experience do have with SIEMs
The only exposure to a SIEM in a professional sense is getting the alearts that an account lockout event has occured, and then investigating the incident.
From an academic perspective, I have reviewed SIEM alerts as part of my Security + studies.
What experience do have with IDS/IPS
As part of my Security+ studies, I have been exposed to IPS alerts, and was expected to interpret them and select the answer that best summarizes what the alert is indicating.
I also have exposure to security onion which is an open source IPS where I had to report out my findings for an assignment requiring that I reconstruct an event.
What experience do you have with Vulnerability Scanners
I have used OpenVAS in class to both scan and find vulnerabilities that exist on my machines, but also to find vulnerabilities that exist on the machines of other students. I would then use this information to patch my systems or launch attacks on the other students systems.
What experience do you have with Endpoint security
I have worked with McAfee ePO to investigate user reported security events, and I have experience with troubleshooting the agents and the installation of the agent on workstations.
My company Centaris has a similar offering for their clients and I would routinely get alerts to investigate alerts, and troubleshoot agent issues
What experience do you have with email security
I would regularly work within Proofpoint to review emails that were blocked based on pre-set policies. I would look into the information within the email header, and work with the employees to determine if the email was safe to forward, or if it was spam/phishing
What experience do you have with MetaSploit
I had to develop a plan of attack for my final in my attack and defend class. I had to learn how to use metasploit to attack machines.
I can make use of metasploit to scan devices for vulnerabilities to exploits, and can run exploits against machines.
What experience do you have with nMap
Scanning for OSes
Scan for open ports
Scan for services running on machines.
Explain the use of NAC
Purpose: NAC is a security solution that ensures only authorized and compliant devices can access a network. It provides network administrators with the means to enforce security policies and maintain control over who and what can connect to the network.
Key Functions:
Device Authentication: NAC verifies the identity of devices trying to connect to the network, ensuring they are legitimate and meet security requirements.
Policy Enforcement: It enforces security policies, such as ensuring endpoint devices have up-to-date antivirus software, the latest patches, and proper configurations before granting access.
Quarantine and Remediation: If a device doesn’t meet security requirements, NAC can quarantine it in a segregated network segment (quarantine VLAN) and initiate remediation actions to bring it into compliance.
Continuous Monitoring: NAC continually monitors devices on the network, detecting changes in compliance status and reacting accordingly.
Components: NAC typically includes components like an authentication server, policy enforcement points (often within network switches or access points), and a management console for configuring policies and monitoring compliance.
Explain 802.1x
Purpose: 802.1X is an IEEE standard used for port-based network access control. It ensures that only authenticated devices can access network services by controlling access at the network port level.
Key Functions:
Port Authentication: 802.1X requires devices to authenticate themselves before they are granted access to a network port, such as an Ethernet port or a wireless access point.
Authentication Protocols: It supports various authentication protocols, including EAP (Extensible Authentication Protocol), which allows for flexibility in the authentication method used.
Dynamic VLAN Assignment: 802.1X can assign devices to specific VLANs based on authentication results, segregating them into appropriate network segments.
Components: 802.1X involves three main components:
Supplicant: This is the client device (e.g., a laptop or smartphone) that seeks access to the network.
Authenticator: The network device (e.g., a switch or access point) that enforces authentication before allowing access.
Authentication Server: The server responsible for verifying the supplicant’s credentials and deciding whether to grant network access.
How does NAC and 802.1x work together
NAC solutions often leverage 802.1X as a key mechanism for authenticating devices at the network port level.
When a device connects to a network port, 802.1X is used to perform authentication. If successful, the device is granted access.
NAC then assesses the device’s overall compliance with security policies. If the device passes this assessment, it is granted full access to the network. If not, NAC may relegate it to a quarantine network until it meets compliance requirements.
In summary, NAC and 802.1X are complementary technologies that provide a layered approach to network access control. 802.1X focuses on authenticating devices at the port level, while NAC adds additional layers of security policy enforcement, monitoring, and remediation to ensure that devices remain compliant and secure throughout their connection to the network. Together, they help organizations maintain a strong security posture by controlling and securing network access.
Can you provide examples of how you’ve collaborated with IT infrastructure teams to implement security measures without disrupting the organization’s operations?
At my former job we coordinated with leaders from each departments to update the NTFS permissions and group policies for their network drives. We had to do this in a way that was as minimally intrusive as possible.
What role does risk assessment play in your approach to cybersecurity, and how do you prioritize security measures based on potential risks?
Risk assessments are essential in understanding and prioritizing security measures within an organization. Risk is where vulnerabilities meet threats. If there is a system that has a vulnerability, but the threat of exploit is low, then I would prioritize a system that has a vulnerability, and also has the potential of being exploited by a threat actor. Mission critical systems that are high risk should take priority over any other system.
How would you address the challenge of ensuring security while allowing for the agility required in modern IT environments, including cloud services and remote work?
I believe that the balance and agility comes with working closely with the department leaders to identify their needs and desires and balance that with security. When an impass is reached, having a framework to address and work through the issues is key to success.
What is XSS and its types.
XSS exploits the trust a browser has in a web server.
: XSS is a type of security vulnerability commonly found in web applications. It occurs when an attacker injects malicious scripts (usually JavaScript) into web content that is then viewed by other users. These scripts run in the context of the victim’s browser, allowing the attacker to steal information, manipulate web pages, or perform actions on behalf of the user.
Reflected: The injected script is embedded in a URL or web form and reflected off a web server, affecting users who click on a malicious link or submit a manipulated form.
Stored XSS: The injected script is permanently stored on the target server and served to users who access the affected page.
