Security Appliances Flashcards
1
Q
Network Segmentation Enforcement
A
- Dividing network into clear areas for placement of security appliances
- Applied at layers 2 and 3 with use of VLANS and subnets
- Each segment is a separate broadcast domain
- All traffic between them must be routed
2
Q
Security Zone
A
- Area of a network where the security configuration is the same for all hosts
- Traffic between zones should be controlled by firewall
3
Q
Perimeter network Zone
A
- Contains internet-facing hosts (that accepts inbound connections from the internet)
- Traffic cannot pass through it directly
- Allows external clients access to data
4
Q
Proxy server
A
- Host in perimeter zone configured to communicate to internal network
- If a host on local network require connection with internet, proxy in perimeter zone takes request and retransmits it if valid
- External hosts have idea what is behind perimeter
5
Q
Bastion Hosts
A
- Hosts in the perimeter zone
- Typically web, mail, proxy and remote access servers
- Not fully trusted by internal network
6
Q
Screened Subnet
A
- Uses two firewalls placed on either side of the perimeter network zone
- Edge firewall interacts with public interface
- Internal (choke) firewall filters communication between hosts in perimeter and LAN
7
Q
Firewall
A
- Processes traffic according to rules
- Blocks traffic that does not conform
8
Q
Packet Filtering Firewal
A
- Earliest type of firewall
- Configured with rules in ACL (Access Control List)
- Defines data packet type and what to do with it.
- Works at layer 3 and scans headers of IP packets
- Can make decisions based on source/destination IP, Protocol or source or destination port
- Stateless, does not preserve information about connection between hosts
- Vulnerable to attacks spread over packets
9
Q
Stateful Inspection Firewall
A
- Addresses problems of security and traffic flow from packet filtering FWs
- Maintains stateful information about the session established
- Info on sessions is stored on state table
- Operates at Level 5
- Checks each packet to see if it belongs to existing session
10
Q
Appliance Firewall
A
- Stand-alone firewall that performs only firewall functions
- Monitors all traffic in and out of network segment
- Can be implemented as layer 2 or virtual wire (transparent)
11
Q
Router Firewall
A
- Functionality built into router firmware
- Used by SOHO routers
12
Q
Proxy Server
A
- Forwards requests and responses on behalf of client
- Deconstructs and analyzes packets before forwarding them
- Placed in the perimeter network
13
Q
Forward Proxy
A
- Provides for protocol-specific outbound traffic
- must understand application it is serving
- Usually contain caching engines as well to negate the need to refetch pages
14
Q
Transparent vs nontransparent proxy servers
A
- Nontransparent: the client must be configured with proxy server address and port number
- Often port 8080
- Transparent intercepts traffic without having the client to be configured
- must be configured inline on switch or router
15
Q
Reverse proxy
A
- Provides for protocol specific in bound traffic
- Often used for messaging or Voip servers which should not be in perimeter network
- Publishing web server, message or conferencing applications and enabling pop/Imap retrieval
16
Q
NAT
A
Network Address Translation
- Translates private addressing scheme used by LAN and public addressing scheme used by internet-facing device
- Configured on border device
- not a security tool
- Supports multiple connections, but is limited by the number of public IP addresses
17
Q
PAT
A
Port Address Translation
- AKA Network Address Port Translation
- Allocates each new connection an ephemeral TCP or UDP port
- Allows multiple connections on the same external IPs
18
Q
Defense in Depth
A
- Placing security controls throughout the network
- Examples are NAC, honeypots, separation of duties and intrusion detection
19
Q
NAC
A
- Authenticates endpoints at the point they connect to network.
- Uses 802.1x port security, EAP, and AAA model of supplicants
- Enables devices to be authenticated when they connect to the network
- Authentication is done by certificates or passwords or health policy, which requires up to date security on the device
20
Q
Honeypot
A
- System set up to attract attackers
- Honeynet is entire decoy network.
- Provides early warning and information on attacks
21
Q
Separation of Duties
A
- Dividing duties and responsibilities between individuals to prevent conflicts or abuses
22
Q
IDS
A
Intrusion Detection System
- Performs real-time analysis of traffic and logs
- Configured with signature patterns
- Requires sniffer to read frames
- Does not slow down network or take actions again attackers
23
Q
IPS
A
Intrusion Prevention System
- Provides active response to threats that match
- Ends sessions with reset packets
- Applies temporary filters or blocks
- Commonly built into firewalls and proxy servers
24
Q
Triple Homed Router
A
- Perimeter network configuration
- 3 network interfaces
- One faces public, one is perimeter subnet and one connects to LAN
- Routing and filtering rules determine what filtering is allowed between interfaces
- Can achieve similar configuration to screened subnet
