Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

3630 - Info Assurance and Security > Quiz 2 Ch.9, 10, 11, 17 > Flashcards

Quiz 2 Ch.9, 10, 11, 17 Flashcards

1
Q

Ch. 9 Need for firewalls

A

Internet connectivity is essential but creates threat

FW inserted between premises network and internet to establish link

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

FW characteristics

A

Design goals

  • all traffic from inside to outside must pass through FW
  • FW immune to penetration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

FW access policy

A

this lists types of traffic authorized to pass through FW

- includes address ranges, protocols, applications, content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

FW Filter Characteristics

A

IP address and protocol values

  • Application protocol
  • User identity
  • Network activity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

FW Capabilities and limits

A

C: Defines single choke point
- can serve as platform for IPSec
L: Cannot protect against attacks bypassing firewall
- may not protect fully against internal threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Types of FW

A
  • Packet Filtering FW
  • Stateful inspection FW
  • Application-level gateway
  • Circuit-level gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Packet Filter

A

adv.
- Simplicity
- typically transparent to users and fast
weaknesses.
- cant prevent attacks that employ application specific vulnerabilities
- applies rules to each incoming and outgoing ip packet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Stateful Inspection FW

A

Tighten rules for TCP traffic by creating directory of outbound TCP connections
- Reviews packet info but also records info about TCP connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Application Level gateway

A

acts as relay of application level traffic

  • must have proxy code for each application
  • tend to be more secure than packet filters
  • disadv. is additional processing overhead on each connection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Circuit level gateway

A

Sets up 2 TCP connections, one between itself and a TCP user on inner host and one on an outside host
- used when inside users are trusted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SOCKS circuit level gateway

A

To provide framework for client-server applications in TCP/UDP domains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Bastion Hosts

A
  • System identified as critical strong point

- Serves as platform for an application level or circuit level gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Characteristics of BH

A
  • runs secure OS only essential services
  • may require user authentication to access proxy
    each proxy:
  • restrict features
  • small, simple
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Host-based FW

A

used to secure an individual host

- available in OS or can be provided as an add-on package

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Personal FW

A
  • Controls traffic between a PC and internet

- software module

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

FW Topologies

A
  • Host-resident FW
  • Screening router
  • Single bastion inline
  • Single bastion T
  • Double bastion inline
  • Double bastion T
  • Distributed FW configuration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

DMZ demilitarized zone

A

Systems that are externally accessible but need some protections are usually located on DMZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Intrusion Prevention Systems IPS

A

Capability to attempt to block/prevent detected malicious activity

  • host-based, network-based, distributed/hybrid
  • use anomaly detection to identify behavior that is not that of legit users
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Host-Based IPS (HIPS)

A

Can make use of either signature or anomaly detection techniques to identify attacks
Sig: focus is on the specific content of app. network traffic
Ano.: IPS is looking for behavior patterns that indicate malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

HIPS Examples of the types

A

Modification of system resources

  • Privilege-escalation exploits
  • Buffer-overflow exploits
  • access to email contact list
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

HIPS capabilities

A

Can be tailored to specific platform

  • set of general purpose tools may be used for desktop or server
  • Use sandbox approach
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Role of HIPS

A

provide an integrated, single-product suite of functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Network-Based IPS NIPS

A

Inline NIDS with authority to modify or discard packets and tear down TCP connections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

NIPS

A

Makes use of signature/heuristic detection and anomaly

- provide flow data protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

NIPS- methods used to identify malicious packets

A
  • Pattern matching
  • Stateful matching
  • Protocol anomaly
  • Traffic anomaly
  • Statistical anomaly
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Distributed or hybrid approach

Digital Immune System

A

Comprehensive defense against malicious behavior caused by malware
- gathers data from a large number of host and network-based sensores, relays this info to central analysis system to analyze then send respond/defend

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Snort inline

A
  • Enables Snort to function as an intrusion prevention system
  • includes a replace option which allows the snort user to modify packets rather than drop them
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Ch. 10 Buffer overflow

A
  • very common attack mechanism - first - Morris Worm in 1988
  • a condition at an interface under which more input can be placed into buffer or data holding area than the capacity allocated, overwriting other info
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

BO basics

A

Programming error when a process attempts to store data beyond the limits of a fixed-sized buffer

  • Overwrites adjacent memory locations
  • Buffer could be located on stack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

BO Attacks

To exploit a BO an attacker needs:

A
  • to identify a BO vulnerability in some program that can be triggered using externally sourced data under the attackers control
  • to understand how that buffer is stored in memory and determine potential for corruption
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Stack BO

Occur when buffer is located on stack

A
  • also called as stack smashing - used by Morris Worm
  • exploits included an unchecked BO
    Stack frame - when one function calls another it needs somewhere to save return address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Shellcode - Code supplied by attacker

- function was to transfer control to user command-line interpreter, or shell, which will give access to any program

A
  • Machine code -specific to processor and OS
  • need good assembly language skills to create
  • Metasploit project - provides useful info to people who perform penetration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

BO Defenses

A
  • Compile time defenses

- Run-time defenses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Compile time defenses

A

Use modern high-level language
- not vulnerable to BO attacks
DISADV.
- additional code must be executed at run time to impose checks
- flexibility and safety comes at a cost in resource use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

CTD

- C designers placed much more emphasis on space efficiency and performance than on type safety

A
  • Programmers need to inspect the code and rewrite any unsafe coding
  • P have audited existing code base, including OS, standard libraries and common util.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

CTD Stack Protection

A

add function entry and exit code to check stack for signs of corruption

  • use random canary
  • Stackshield and Return Address Defender (RAD)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Run-time Defenses: Executable address space protection

A

use virtual memory support to make some regions of memory non-executable

38
Q

RTD: Address Space Randomization

A
  • Manipulate location of key data structures
  • Randomize location of heap buffers
  • Random location of standard library functions
39
Q

RTD: Guard Pages

A
  • Place guard pages between critical regions of memory

- Further extension places guard pages between stack frames and heap buffers

40
Q

Other forms of overflow attacks

- Replacement stack frame

A

Variant that overwrites buffer and saved frame pointer address
- off by one attacks - allows 1 more byte to be copied than there is space available
Defenses - any stack protection
- use non-executable stacks
- randomization

41
Q

Return to System call

A
  • Defenses - any stack protection, non executable stacks, randomization of stack
  • Stack overflow variant replaces return address with standard library function
42
Q

Heap overflow

A

Attack buffer located in heap - located above program code
- no return address - no easy transfer of control
Defenses - make heap non-executable, randomizing allocation of memory on heap

43
Q

Global data overflow

A

Defenses - non-executable or random global data region, move function pointers, guard pages
- Can attack buffer located in global data - may be located above program code

44
Q

Ch. 11 Software Security

A

Vulnerabilities result from poor programming practices

- consequence from insufficient checking, validation of data, error codes

45
Q

Software quality and reliability: concerned with accidental failure of program

  • improve using structured design and testing; eliminate as many bugs as possible
  • concern is not how many bugs but how often they are triggered
A

SS: Attacker chooses probability distribution

46
Q

Defensive Programming

A

Designing software that it continues to function even when attacked
Key rule is to never assume anything, check all assumptions and handle any possible error states

47
Q

DP

- Programmers often make assumptions about the type of inputs a program will receive

A
  • Requires a changed mindset to traditional programming practices
48
Q

Security by design

A

Software Assurance Forum for Excellence in Code SAFECode

49
Q

Handling Program input

A
  • incorrect handling is a very common failing
  • input is any source of data from outside and whose value is not explicitly known by programmer
  • must identify all data sources
  • explicitly validate assumptions on size and type
50
Q

Input size & Buffer Overflow

A

Allocated buffer size isnt confirmed

  • resulting in BO
  • Testing may not identify vulnerability
  • safe coding treats all input as dangerous
51
Q

Writing safe program code

A
  • Correct algorithm implementation - compare machine code with original source
  • ensuring that machine language corresponds to algorithm
  • correct interpretation of data values -
  • correct use of memory
  • prevent race conditions with shared memory
52
Q

Interpretation of program input

A

may be binary or text

  • character sets being used
  • failure to validate may result in an exploitable vulnerability
  • 2014 Heartbleed OpenSSL bug
53
Q

Injection attacks

A

occur in scripting languages

- encourage reuse of other programs

54
Q

Cross Site Scripting XSS ATTACKS

A

where input provided by one user is subsequently output to another user
- in scripted web apps

55
Q

Validating Numeric Input

A
  • internally stored in fixed sized value - 8, 16, 32, 64 bit integers
  • must correctly interpret text form and process consistently
  • issues comparing signed to unsigned
56
Q

Input fuzzing

A

1989 UNI of Wisconsin

  • software testing technique that uses randomly generated data as inputs to program
  • can also use templates to generate classes of known problem inputs
57
Q

Operating System interaction

A
  • programs execute on systems under the control of OS - systems have concept of multiple users
58
Q

Environment variables

A

collection of string values inherited by each process from its parent
- common use is by local user attempting to gain increased privileges

59
Q

Use of least privilege

A

run programs with least privilege needed to complete their function
- determine appropriate user and group priv.

60
Q

System calls and standard library functions

A
  • programs use system calls and standard library functions for common operations
61
Q

Preventing race conditions

A

programs may need to access common system resource

- need suitable synchronization mechanisms - lockfile

62
Q

Safe temporary files

A

secure temp file creation and use requires use of random names

63
Q

Ch. 16 Physical and Infrastructure Security

A

Logical security
Physical security
Premises security

64
Q

Physical Security Threats

A 
- protects physical assets that support the storage of processing info
Threats:
- Environmental threats
- Technical threats
- human-caused threats
65
Q

Water damage

A
  • primary danger is an electrical short
  • pipe may burst
  • sprinkler set off
  • floodwater leaving muddy residue
66
Q

Chemical, Radiological, Biological hazards - discharges can be introduced through vents, windows,

A

Dust and infestation

- block ventilation

67
Q

Technical Threats

A

Power util. problems:

  • under-voltage - dips/brownouts/outages; interrupts service
  • over-voltage - surges/faults; destroy chips
  • noise - powerlines; may interfere with device operation Electromagnetic interference EMI
68
Q

Human -caused threats

A
  • less predictable
  • unauthorized physical access
  • theft of equipment
  • vandalism
  • misuse of resources
69
Q

Physical Security Prevention and Mitigation measures

A
  • one prevention measure is use of cloud computing
  • inappropriate temp
  • fire and smoke alarms
  • water; cutoff sensors
70
Q

Mitigate Tech threats

A

critical equipment should be connected to emergency power source
- deal with EMI with filters and shielding

71
Q

Mitigate Human caused threats

A

Restrict building access

  • patrol and guarded
  • locks at entry points
  • tracking device on movable resources
  • sensors alarms
  • surveillance
72
Q

Recovery from Physical security breaches

A

Redundancy - provides recovery from loss of data

  • important data available off-site
  • encrypted remote backup
73
Q

Physical and logical security integration

A
  • numerous detection and prevention devices
  • personal identity verification
  • use of PIV credentials in physical access control systems
74
Q

Ch. 17 Human Resources Security

A

Security Awareness, Training and Education

75
Q

Benefits to Organizations

A

improve employee behavior, accountability, liability, comply with regulations

76
Q

Awareness

A
  • Seeks to inform and focus an employee’s attention on security issues within org.
  • program tailored to needs of org.
77
Q

Training

A

What people should do and how

  • focus on computer security practices
  • develop secure mindset
  • how to make tradeoffs involving security risks, costs, benefits
  • risk management goals, measurement, leadership
78
Q

Education

A

Targeted at security pros whose jobs require expertise in security

  • career development
  • most in depth program
79
Q

Employment Practices and Policies

A
  • Managing personnel with potential access is an essential part of information security
    Employee involvement
80
Q

Security in Hiring process

A

to ensure employees understand their responsibilities and are suitable for the roles they are considered for
- need appropriate background checks and screening

81
Q

During employment

A

Objectives with respect to current employees - reduce risk of human error

  • 2 elements of personnel security: - comprehensive security policy document
  • an ongoing awareness and training program
82
Q

Termination of employment

A
  • termination security objectives: - ensure employees exit org. in an orderly manner
  • critical actions:
  • remove name from all authorized access lists
  • inform guards that ex employees is not allowed
83
Q

Email and internet use policies

A

concerns for employers:

  • work time consumed in non-work related activities
  • risk of importing malware
  • possible harm, harassment
84
Q

Security incident response

A
  • procedures need to reflect possible consequences of an incident
  • systematic incident response
  • quicker recovery to minimize loss, theft, disruption of service
85
Q

Computer Security Incident Response Team (CSIRT)

A

Rapidly detecting incidents

  • Minimizing loss and destruction
  • Mitigating weaknesses that were exploited
  • restoring computing services
86
Q

Security incidents

A

unauthorized access to system

modification of info on system

87
Q

Detecting incidents

A
  • by users or admin. staff

- automated tools - system integrity veification, log analysis, network, host IDS

88
Q

Triage Functions

A

Ensure that all info destined for incident handling service is channeled through a single focal point
- responds to incoming info by:
requesting additional info in order to categorize incident

89
Q

Responding to incidents

A

procedures should:

  • detail how to identify the cause
  • describe action taken to recover
  • identify categories of incidents and approach taken
  • identify management personnel responsible
  • identify circumstances when security breaches should be reported
90
Q

Documenting incidents

A

should immediately follow a response to an incident

3630 - Info Assurance and Security (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions