Security Infrastructure Flashcards
1
Q
Security Infrastructure
A
Combination of hardware, software policies, and practices used to protect information
2
Q
Ports
A
Logical communication endpoint that exists on a computer
3
Q
Inbound ports
A
A port that is open and is listening for connection from a client
4
Q
Outbound ports
A
Opening created by the server to call out to the client that is listening for its connection
5
Q
Well known Ports
A
Ports 0-1023 are considered assigned by the Internet Assigned Numbers Authority
6
Q
Registered Ports
A
1024-49151 are considered registered for proprietary protocols
7
Q
Dynamic Private Ports
A
49152-65535 can be used by any application
8
Q
File Transfer Protocol (FTP)
A
Port 21;TCP; Uses the transfer files from host to host
9
Q
(SSH, SCP,SFTP)
A
Port 22;TCP;provides secure remote terminal access, copies functions, and file transfers
10
Q
Telnet
A
Port 23;TCP;provides insecure remote control of a machine using a text-based environment
11
Q
Simple Mail Transfer Protocol (SMTP)
A
Port 25;TCP;provides the ability to send emails over the network
12
Q
Domain Name System (DNS)
A
Port 53;TCP/UDP;translates domain names into IP addresses
13
Q
Trivial File Transfer Protocol (TFTP)
A
Port 69;UDP;A lightweight file transfer method for sending configs or network booting and overfitting
14
Q
Hypertext transfer protocol (HTTP)
A
Port 80;TCP;used for insecure web browsing
15
Q
Kerberos
A
Port 88;UDP;network authentication protocol protocol
16
Q
Post office protocol version three (POP3)
A
Port 110;TCP;Responsible for retrieving mail from a server
17
Q
Network news transfer (NNTP)
A
Port 119;TCP;Used for accessing newsgroups
18
Q
Remote procedure call (RPC)
A
Port 135;TCP/UDP; Facilitates communication between system processes
19
Q
NetBios
A
Ports (137,138,139);TCP/UDP; Networking Protocol Suite
20
Q
Internet Message Access Protocol (IMAP)
A
Port 144;TCP;allows access to email messages on a server
21
Q
Simple Network Management Protocol (SNMP)
A
Port 161;UDP;Manages network devices
22
Q
SNMP Trap
A
Port 162;UDP;responsible for sending SNMP trap messages
23
Q
Lightweight Directory Access Protocol (LDAP)
A
Port 389;TCP;facilitates directory services
24
Q
HTTP Secure (HTTPS)
A
Port 443;TCP;provides secure web connection
25
Server Message Block (SNMP)
Port 445;TCP;used for file and printer sharing over a network
26
SMTP Secure
Ports (465,587);TCP;provides secure smtp connection
27
Syslog
Port 514;UDP;used for sending log messages
28
LDAP Secure
Port 636;TCP; LDAP communication over ssl/tls
29
Internet Message Access Protocol over ssl\tls
Port 993;TCP;Used for secure email retrieval
30
Post Office Protocol v3 over SSL/TLS (POP3S)
Port 995;TCP;used with secure email retrieval
31
Microsoft SQL
Port 1433;TCP; Used to create communication with Microsoft SQL Server
32
RADIUS TCP
Ports (1645,1646);TCP;Used for remote authentication, authorization, and accounting
33
RADIUS UDP
Ports (1812,1813);UDP;Used for authentication and accounting as defined by the Internet Engineering Task Force (IETF)
34
Remote Desktop Protocol (RDP)
Port 3389;TCP;Enables Remote Desktop Access
35
SYSLOG TLS
Port 6514;TCP;Used in a secure SYSLOG that uses SSL/TLS to encrypt the IP packets using a certificate before sending them across the IP network to a SYSLOG collector
36
Firewalls
Safeguards networks by monitoring and controlling traffic between networks of predefined security rules
37
Screen subnet (Dual-homed host)
Acts as a security barrier between external untrusted networks and internal trusted networks, using a protected host with security measures like packet filtering firewall
38
Packet filtering firewall
Checks packet headers for traffic allowance based on IP addresses and port numbers
39
Stateful firewall
Monitors all inbound and outbound network connection requests
40
Proxy firewall
Acts as an intermediary between inbound and outbound connections, making connections on behalf of other endpoints
41
Proxy firewall Circuit Level
Like a SOCKS firewall, operates at level 5 of the OSI model
42
Proxy firewall Application Level
Conducts various proxy functions for each type of application at the Layer 7 of the OSI
43
Kernel proxy firewall
Has minimal impact on network performance while thoroughly inspecting packets across all layers
44
Next generation firewall (NGFW)
Aims to address the limitations of traditional firewalls by being more aware of application and their behaviors. Uses a single engine
45
Unified Threat Management Firewall (UTM)
Most used that provides the ability to conduct multiple security functions in a single app. Uses separate and individual engines
46
Web Application Firewall (WAF)
Focuses on the inspection of HTTP traffic
47
Inline systems
See the network firewalls in a server, Outline will record a mirror copy of the traffic
48
Access Control List
A rule set that is placed on firewall, routers, and other network infrastructure devices that permit or allow traffic to a particular interface
49
Defined Action
IDS will (log,alert) where an IPS will (log,alert,take action)
50
Network Intrusion Detection System (NIDS)
Responsible for detecting unauthorized network access and attacks
51
Host-Based IDS (HIDS)
Looks at suspicious network going to and from a single server or endpoint
52
Wireless IDS (WIDS)
Detects attempts to find the cause the denial of service on a wireless network
53
IDS Signature Based Algorithm
Analyze traffic based on defined signatures can only recognize attacks based on previously identified attacks in a database
54
IDS Signature-Pattern Based Algorithm (NIDS,WIDS)
Specific pattern of steps
55
IDS Signatuve Stateful-Matching (HIDS)
Known system baseline
56
IDS Anomaly-based/Behavior-based algorithm
Analyze traffic and compares it to a normal baseline of traffic to determine if a threat is occurring
57
Intrusion Prevention System (IPS)
Scans traffic to look for a malicious activity and takes actions to stop it
58
Network Appliance
Dedicated hardware w/ pre-installed software that is designed to provide specific networking services
59
Load balancers
Designed to distribute network or application traffic across multiple servers
60
Proxy servers
Intermediary between a client and a server to provide functions; (caching,request filter)
61
Network sensors
Designed to monitor, detect traffic and data flows across the network
62
Jump server box
Dedicated gateway used by system admins to securely access devices located in different security zones within the network
63
Port security
Allows administrators with devices to connect to a specific port based on the network MAC address. Switches that are used today are duplex where they send/receive and allow/deny at the same time
64
Content Addressable Memory (CAM) Table
Used to store information about the MAC addresses that are available on any port of the switch
65
Network Switches
Broadcast the data on a specific MAC address in the CAM
66
Network Hub
Broadcast information to every device connected
67
MAC flooding
Where you'll overflow the CAM table with the MAC addresses so that it reverts to a hub to read data from there
68
Persistent (Sticky)MAC Learning
Feature in network port security with a switch automatically learns and associate MAC addresses with specific interfaces
69
802.1x Protocol
Framework that is used for port based authentication for both wired and wireless networks;Wraps the EAP which is used to conduct the authentication
70
EAP-MD5
Uses simple passwords and challenge handshake authentication process to provide remote authentication
71
EAP-TLS
Form of EAP that uses public key infrastructure with a digital signature being started on both the client and the server
72
EAP-TTLS
Only requires a digital certificate on the server
73
EAP-FAST
Uses a protected access credential instead of a certificate to establish a mutual authentication
74
PEAP
Supports mutual authentication by using server certificates and Microsoft AD for authentication with passwords from a client
75
LEAP
Variant that only works on Cisco-based devices
76
Virtual Private Network
Extends a private network over a public one enabling use of securely sending and receiving data
77
Site-to-Site VPN
Connects the networks together
78
Client-to-Site VPN
Connects the client-to-network
79
Full tunnel
Encrypting all traffic to a headquarters while integrating clients with the network
80
Split tunnel
Divides traffic and network requests then routes them to the appropriate network
81
ClientLess VPN
Secures remote access through browser-based VPN tunnels without using client software
82
Transport-Level Security (TLS)
Protocol that provides cryptographic solutions for secure connections and views for secure web browsing and data transfer; HTTPS is technically a client-less VPN
83
Transmission-Controlled Protocol (TCP)
Used by TLS to establish connections between client and the server
84
Datagram TLS (DTLS)
A UDP version of TLS with the same security but better performance
85
IPsec (Internet Protocol Security)
A protocol suite for security and connections through authentication and data encryption on IP networks; IPsec order of use request to start Internet Key Exchange (IKE), IKE Phase 1, IKE Phase 2, Data Transfer, and then termination
86
Data Transfer Transport Mode
Uses the original IP header ideal for client-to-site VPNs and is advantageous when dealing with MTU constraints
87
Data Transfer Tunneling Mode
Use for site-to-site VPNs and adds an extra header that increases packet size and exceeds the MTU
88
MTU
Is typically 1500 by default; Tunneling essentially wraps a packet within a packet making big size
89
Authentication Header
Offers connectionless data integrity and data origin authentication for IP datagrams using cryptographic hash as an ID
90
Encapsulating Security Payload (ESP)
Employed for providing authentication integrity, replay production, and data confidentiality by encrypting the package payload
91
Software-defined Wide-Area Network
Approach to managing and optimizing wide-area network connections to efficiently route traffic between sites
92
Secure Access Service Edge
Consolidates networking security functions into a SQL Cloud-native service to ensure secure connections can be made
93
Security Zone
Distinct segments within a network created by logically isolating the segment using the firewalls or security device
94
Screen Subnet Purpose
Hosts public-facing servers, web servers, email, DNS, and acts as a buffer to the internal network
95
Attack Surface Of A Network
All the points where an unauthorized user can (enter/extract) data
96
Fail Open
Allows for all traffic to flow when an error occurs
97
Fail Close
Blocks all traffic on an error
98
Infrastructure Control
Measures put in place to safeguard and reduce risks
99
Control Types
Least privileged,defense in depth,risk-based approach,lifestyle management,and open design principle
100
Defense In Depth
The use of multiple layers of security to mitigate threats
101
Risk-Based Approach
Prioritizing controls based on the risks and vulnerabilities it brings
102
Lifestyle Management
Regularly reviewing, updating, and retiring controls to adapt
103
Open-Design Principle
Transparency and accounting through rigorous testing and observation of the infrastructure
