Security Flashcards
What’s the purpose of a Access Control Vestibule/mantrap?
Provides high physical security by controlling the flow of people through a building.
Only allows authorised individual into a secure area via biometric/badge/pin authentication.
When one door opens all others lock.
May log access to know who was where any given time.
What is the purpose of bollards outside a building/secure data center?
To allow people through but prevent vehicles entering the area.
What is a Magnetometer?
A metal detector/scanner like at an airport.
What does BYOD stand for?
Bring Your Own Device
What’s MDM?
Mobile Device Management - Centralised management of mobile devices, enforce security measures and control/monitor devices remotely.
What is meant by the “least privilege principle”?
Setting the access, rights and permissions of user accounts to the bare minimum of what they need to do their job. Assigning anything beyond this increases security risks and potential problems for no reward/gain.
Least Privilege Principle - limits the scope of malicious intent (e.g. of disgruntled employees)
What is an ACL?
Access Control List is a list of users that can or cannot access/join a particular network, (use a specific router) or view a particular file/data on a system.
ACL’s evaluate users based on Source IP address, Destination IP address, Port Numbers, ICMP.
Used for NAT, QoS.
Benefits of Email filtering?
Can scan and block any malicious emails (like phishing attacks) before they reach users by stopping Unsolicited emails at the gateway. Either on-site or cloud-based.
Which version of WPA wireless encryption uses CCMP block cipher mode?
WPA2 uses CCMP block cipher mode to encrypt blocks of data before transmitting them across a wireless network.
This includes AES (Advanced Encryption Standard) encryption and Message Integrity Check (MIC) for data integrity.
What is Message Integrity Check (MIC) used for?
To verify that received data over a wireless network is the same as what is sent.
Data integrity check.
Which block cipher mode does WPA3 use?
GCMP block cipher mode - WPA3 uses:
AES
MIC + Galois Message Authentication Code (GMAC)
In wireless security what is a PSK?
Pre-Shared Key (PSK) - a key/shared secret/password used to encrypt/decrypt messages sent via secure connection between two parties. Both parties know the secret/password and is used to authenticate/login to the wireless network.
The PSK is hashed (garbled by an algorithm). But WPA2 PSK has a brute-force vulnerability/security issue in which the hashed (garbled) PSK is captured by someone listening in to the 4 step handshake. The hash can then be brute-forced/try every combo until the PSK is cracked.
What is the vulnerability of WPA2?
WPA2 PSK has a brute-force hash vulnerability/security issue in which the PSK hashing algorithm is captured by someone listening in to the 4 step handshake. The hash can then be brute-forced/try every combo until the PSK is cracked.
What versions of WPA use PSK’s? What are the differences in the PSK authentication process between them and why?
WPA2 is the only version that uses PSK’s authentication process - hashed secret password/shared secret used to establish a secure connection between two wireless devices via a 4 step handshake.
Someone can listen in to the handshake (while data/etc is in transit/wireless transmission) and capture the hash (hashed password).
They can then brute force/crack the hash to reveal the password and connect to the wireless network with it and do all sorts of damage!
WPA3 uses a different authentication process SAE:
Doesn’t send/share the hashed PSK across the network
No four-way handshakes.
Each device has a different session key.
How many steps are involved in the WPA2 authentication handshake?
WPA2 uses a 4 way authentication handshake that involves sharing a hashed PSK over the wireless network (can be captured by pirates and hashed to break into the network!).
What is the role of an authentication server on a network?
To manage logins to all devices on the network.
E.g. if you want to login to a password protected printer on a network the printer forwards your REQUEST (containing your username and password) to the centralised Authentication Server which checks it against a list of stored passwords/usernames and if it matches the server sends a message back to the printer telling it to let you access it as you have passed the security check.
What does AAA stand for in reference to network security?
Authentication
Authorisation
Accounting
E.g. an AAA protocol is any protocol that communicates with an Authentication Server
What is the difference between TACACS and TACACS+ (Authentication Server communication protocol versions)?
TACACS is an older protocol that uses UDP and is largely obsolete - less secure
TACACS+ is a new version of TACACS that uses TCP and is widely used today.
Commonly associated with CISCO devices.
What OS uses Kerberos for network authentication?
Windows uses Kerberos - provides you a ticket on successful login to the Kerberos system which grants you automatic access to all other devices on the network without having to login again. (You are a trusted user/single sign on/SSO).
Which AAA protocol supports single-sign-on/SSO (whereby once you are logged into to the system you don’t have to login to other devices on the network (you are kept logged in)?
Kerberos - Windows - supports single/one-time sign-on, which lets you access/connect to all devices within a network whilst only needing to login once.
What is meant by MFA?
Multi-Factor Authentication is a security measure in which you provide multiple types of evidence (factors) to prove your identity.
Using any 2+ of the following types of evidence to login is called MFA:
Something you Are
Something you Have
Something you Know
Something you Do
SomeWhere you Are
What’s the main difference between 2FA and MFA?
2FA is limited to 2 factors specifically.
What’s a worm?
Malicious software (Malware) that clones itself and spreads to other systems, generally across a network by exploiting network vulnerabilities.
Doesn’t need to attach to a host program.
What’s a Trojan Horse?
Malware that appears as something it’s not. E.g. as a free game. This allows it to bypass a lot of security as you are willingly trying to install it!
What’s a rootkit?
Very deep-rooted/embedded malware that modifies the core system files/kernel. As such it’s invisible to the OS/Antivirus software and therefore very hard to remove!
If you can identify the specific rootkit (via spotting unusual things happening/running) then you may be able to remove (uproot) it by using a specific removal tool designed for that rootkit.
