Security Flashcards
Spoofing - what is it? Why do hackers do it?
Spoofing is when a hacker assumes a trusted IP or physical (MAC) address to gain access to your network.
This can be done in order to:
• gain root access
• inject malicious data into your
network
- divert packets to themselves
- perform a DoS attack
- set up a larger attack.
DoS
Denial of Service attack - hacker will monopolize a networks resources, keeping legitimate users from being able to get service.
Zero-day attacks
Attack involving a virus that has never been seen “in the wild” before. Zero day attacks are more threatening because the malicious software is unrecognizable and often unidentifiable.
Pharming
Altering a host file to divert traffic intended for a legitimate site to another site (often an imposter site built by the attacker).
Brute Force Attack
A password attack in which all possible password combinations are tried sequentially until the correct one is guessed.
Packet Sniffer
A program that can intercept and log traffic passing over a digital network.
Keylogger
A program that detects and logs every keystroke made. Can be used to capture passwords and other confidential information.
Software keyloggers may be augmented with features that capture user information without relying on keyboard key presses as the sole input. Some of these features include: •clipboard logging - captures anything copied to the clipboard •screen logging - takes screen shots periodically or in response to user behavior •programmatically capturing the text in a control •recording all search engine queries, IM convos, etc.
What is the purpose of risk analysis?
To quantify the impact of a potential threat.
What are the two types of risk analysis? What does each type use to measure the impact of a threat?
• Quantitative - uses a mathematical
model
• Qualitative - uses a scenario
model
What are the five stage of the secure network life cycle?
- Initiation
- Acquisition and development
- Implementation
- Operations and maintenance
- Disposition
What are the four different models and frameworks regarding security?
- COBIT
- ISO 27000
- ITIL
- NIST
COBIT
Control Objectives for Information and Related Technology
ISO 27000
International Organization for Standardization
ITIL
Information Technology Infrastructure Library
NIST
National Institute of Standards and Technology
What is war dialing? Why might a network administrator do it?
War dialing or wardialing is a technique of using a modem to automatically scan a list of telephone numbers, usually dialing every number in a local area code to search for computers, Bulletin board systems and fax machines.
Hackers can use the resulting lists for various purposes. It may also be used by security personnel, for example, to detect unauthorized devices, such as modems or faxes, on a company’s telephone network.
What is wardriving?
Wardriving is the act of searching for Wi-Fi wireless networks by a person in a moving vehicle, using a portable computer, smartphone or personal digital assistant (PDA).
What is an event? What is an incident?
Even - Any observable occurrence in a system or network.
Incident - Any observable occurrence that has a negative consequence.
MTD
Maximum Tolerable Downtime - total amount of time the system owner or authorizing official is willing to accept for a mission or a business process outage or disruption; includes all impact considerations
RTO
Recovery Time Objective - the total amount of time a system resource can be unavailable before there is an unacceptable impact on other system resources, supported mission or other business processes.
RPO
Recovery Point Objective - the point in time (prior to a disruption or system outage) to which business or mission data can be recovered after an outage.
IaaS
Infrastructure as as Service
SaaS
Software as a Service - software existing in the cloud and being accessed as a service by end-point devices
SGA
Security Group Access
Cisco ASA
Adaptive security appliance
Five Nines
The goal of 99.999% up time
What are the three device planes?
- Control
- Management
- Data
What happens in the Control Plane?
Exchanges of routing information take place. Routing protocols run on the control plane.
What happens on the Data Plane?
Data is actually forwarded.
What happens on the Management Plane?
Management processes run.
NFP
Network Foundation Protection
What are two Control Plane security measures and what do they do?
• CoPP - control plane policing :
regulates the amount of traffic
on the control plane to prevent
DoS attacks
• Routing Protocol Authentication:
authentication solutions that verify
the identity of routers participating
in routing protocols
What are some security features associated with the Data Plane and what do they do?
• Private VLANs keep data from
different sectors separate.
• ACLs permit or deny specified
traffic over particular links
What are some Management Plane security features and what do they do?
• AAA - authentication, authorization
and accounting: implements role-
based access control
• NTP, Syslog, SNMP, SSH, TLS
Cisco Autosecure
One-step automatic security for all three planes.
RBAC
Role-based access control
CCP
Cisco Configuration Professional - GUI-based tool that allows you to configure Cisco equipment by using wizards rather than by typing commands at the CLI
What does the security audit feature in CCP do?
It reviews the security settings on a device and suggests changes. Allows you to select which security features you want activated.
For management data what should you use instead of telnet to improve security?
SSH
AAA
- Authentication
- Authorization
- Accounting
Describe the two modes for Cisco AAA:
Administrative - trying to access the router itself (user will be in character mode)
Remote Access - simply using the router as a transit point (users will be in packet mode)
How many security levels are there in Cisco secure log? What’s the most severe level?
Eight (0-7)
0 is the most severe, 7 is the least
What are the two tools you can use to log information about occurrences in your network?
Syslog and SNMP
What is the major vulnerability SNMP versions up to v3 can create? How does SNMPv3 address this issue?
It’s well known that the default community string is “Public”. If you use SNMPv1 or v2 and you don’t change the community string it’s easy for a hacker to use the set and get commands to gain information about a device or change its configuration.
SNMPv3 authenticates the NMS before accepting any community strings from it.
What are the two protocols used for communicating between AAA servers and authenticating devices?
TACACS+ and RADIUS
What protocol does TACACS+ use? What port number?
TCP
49
What transport layer protocols(s) does RADIUS use? What port numbers?
UDP
1645, 1646 (old radius ports)
1645=authentication messages
1646=accounting messages
UDP
1812 and 1813 (new radius ports)
1812=authentication
1813=accounting
Which is more secure, RADIUS or TACACS+? Why?
TACACS+, because it encrypts the entire packet
Which is more universally supported, TACACS+ or RADIUS? Why?
RADIUS, because it is a non-proprietary protocol, whereas TACACS+ is a Cisco protocol.
When both regular and secret passwords are configured on a device which password is it necessary to use in order to enter privileged executive mode?
The secret (encrypted) password
What command should be used to encrypt enable, VTY and other passwords in the configuration files?
service password-encryption
What does IDS stand for?
Intrusion detection system
What does IPS stand for?
Intrusion prevention system
What is Syslog and what does it do?
Syslog is a way for network devices to send event messages to a logging server – usually known as a Syslog server. The Syslog protocol is supported by a wide range of devices and can be used to log different types of events. For example, a router might send messages about users logging on to console sessions, while a web-server might log access-denied events.
Set the line console timeout to 5 minutes:
R1>enable
R1#config t
R1(configure)#line console 0
R1(config-line)#exec-timeout 5 0
What is a one-way hash?
An algorithm that turns messages or text into a fixed string of digits, usually for security or data management purposes. The “one way” means that it’s nearly impossible to derive the original text from the string. A one-way hash function is used to create digital signatures, which in turn identify and authenticate the sender and message of a digitally distributed message.
What commands would you use to prevent non-ssh access to your router?
Router1(config)#line vty 0 4
Router1(config-line)#transport input ssh
transport input ssh allows only ssh connections on the specified line/s
What are the 4 steps to configure a router to act as an SSH client?
- Configure the hostname command.
- Configure the DNS domain.
- Generate the SSH key to be used.
- Enable SSH transport support for the virtual type terminal (vtys).
How do you calculate yearly downtime?
100 ([525,600 - d] / 525,600)
Allow only SSH traffic on vty lines:
Router1> enable
Router1# conf t
Router1(configure)# line vty 0 4
Router1(config-line)# transport input ssh
What is the encrypted counterpart to plain text called?
Cipher text
Designate an NTP server:
Router#ntp server [x.x.x.x]
What is a type 5 password? Configure a username of Myark with a type 5 password of myarkymyark. How would you configure the same type 5 password without associating it with a username?
A password that is encrypted using md5 and stored in the running config. It’s much more secure than a type 0 (plaintext) password, and more secure than a type 7 password.
en
conf t
username Myark secret 0 myarkymyark
en
conf t
enable secret myarkymyark
What is a type 0 password? Configure type 0 password thomsowe11 as an enable password. Configure username TomWaits with type 0 password thomsowe11.
An unencrypted (plaintext) password. A type zero password is not secure and can be viewed in the running configuration.
enable
conf t
enable password thomsowe11
en
conf t
username TomWaits password thomsowe11
What is a type 7 password? Configure a type 7 enable password of econ101. Configure user name Thomas with a type 7 password of econ101.
A plain text password that has been encrypted using a weak encryption and stored in the running configuration.
en
conf t
enable password econ101
service password-encryption
en
conf t
username Thomas password econ101
service password-encryption
