Security Apps

Question 1

What’s a personal firewall ?

Network firewall?

Answer 1

Software apps protecting your computer from unwanted internet traffic.

Question 2

What’s an IDS?

Answer 2

Intrusion Detection System.
A device/software that analyses all data passing through it trying to identify attacks, logging and alerting on anything suspicious.
(HIDS and NIDS)

Question 3

Signature based detection methods?

Answer 3

Where system looks for a specific string of bytes to alert.

Question 4

Policy based detection?

Answer 4

Relies on specific declarations from security policy

e.g company might not allow use of Telnet.

Question 5

Anomaly based detection ?

Answer 5

Analyses current traffic against an established baseline and triggers an alert if outside the statistical average.

E.g if employees work from 9-5 then a large download happens at 2 in the morning it would get flagged.

Question 6

Alerts
True positive...
True negative...
False positive...
False negative...

Answer 6

True positive = when ids correctly identifies an attack
True negative= when ids correctly identifies legitimate traffic
False positive=when ids misidentifies legit activity as an attack
False negative= when ids misidentifies an attack as legit.

Question 7

What’s an IPS?

Answer 7

Intrusion Prevention System.

Functions as a IDS but can also stop malicious activity being executed.

Question 8

What are the logs from an IDS used for?

Answer 8

Used to recreate the events after an attack so we can learn from it and how to stop that attack next time.

Question 9

BIOS and UEFI

What’s flashing the bios?

Answer 9

-Basic Input Output System

Firmware that tells a computer instructions for how to accept input and send output.

-Unified Extensible Firmware Interface(same +)

Controls things like boot order.
Does only basic tasks.
Flashing = updating

Question 10

Removable media controls

Answer 10

Technical limitations placed on a system against the USB port and other hardware devices.

Question 11

NAS system

Answer 11

-Network Attached Storage
Storage devices connected directly to the network (Hardware room in office cliche hacker room.)
NAS systems implement RAID arrays for good availability.

Question 12

SAN

Answer 12

Storage Area Network

-network designed to perform block storage functions consisting of NAS devices combined.

Question 13

How to Secure a NAS system.

Answer 13

1. Use data encryption (full disk data encryption)
2. Use proper authentication
3. Log NAS access (helps figure out past breaches)

Question 14

What’s Encryption?

Some software based encryption?
What’s TPM?

Answer 14

Encryption = scrambled data into unreadable information without key.

Hardware based= self encrypting drive (SED) but expensive

Software based= (majority use) e.g FileVault,Bitlocker.

All encryption requires a key to read.

TPM is a hardware chip on a computers motherboard containing encryption key.

Question 15

What’s AES?

Answer 15

Advanced Encryption Standard

Symmetric key encryption that supports 128 bit and 256 bit keys

BUT full disk encryption lowers performance of your system, so people may rely on file level encryption (EFS)
Also hardware based encryption is faster because the hardware is designed for encrypting
(Hardware Security Module HSM- secure hardware acting as a secure cryptoprocessor)

Question 16

What’s an endpoint?

Answer 16

Any device used to connect to our network.e.g computer, phone

Question 17

Endpoint protection tool examples

Answer 17

• Anti-Virus(AV)
• HIDS/HIPS(Host intrusion … systems)
• EPP(Endpoint Protection Platforms)
• EDR(Enpoint Detection Response platforms)
• User and Entity Behavioural Analytics (UEBA)

All merging together as security product market improves (AEP,ATP,NGAV)

Question 18

Whats EPP (Endpoint Protection Platform)

Answer 18

Software monitoring system that acts as antivirus ,HIDS/HIPS,firewall ,Data loss prevention and file encryption in one product.

Question 19

What’s EDR (Endpoint Detection and Response)?

Answer 19

Software product that collects system data and logs for analysis and monitoring for early detection of threats[ comprise for better runtime]

Question 20

What’s UEBA? ( User and Entity Behvaioural Analytics)

Answer 20

Solution less focused on data collection and more on data analysis. Dependent on AI learning.
E.g Microsoft Advanced Threat Analytics and Splunk.