Security Technologies Flashcards
Stateful Firewall
Inspects traffic as a part of a session & recognizes where the traffic originated
NGFW (NextGen Firewall)
Third-generation firewall that conducts deep packet inspection & packet filtering (Layer 7)
ACL
Access Control List:
A set of rules applied to router interfaces that permit/deny traffic
(IP/MAC)
Switch Firewall
IP address or port:
Source/destination IP
Source/destination Port
Source/destination MAC
NIDS/NIPS & HIDS/HIPS
Admin defines patterns:
NIDS/NIPS (Network-Based): A network device protects the network
HIDS/HIPS (Host-Based): Software-based & installed on servers/clients
Network & Host-Based systems can work together for more complete protection
RDG
Remote Desktop Gateway:
Provides a secure connection using SSL/TLS protocols to the server via RDP
Encrypted connection
Control access to network resources based on permissions/group roles
Maintain/enforce authorization policies
Monitor the status of the gateway & any RDP connections passing through the gateway
VNC
Virtual Network Computing (Port 5900):
Designed for thin client architectures & things like VDI
In-Band Management
Managing devices using Telnet/SSH protocols over the network
VPN
Extends a private network across public networks & enables sending/receiving data cross shared/public networks
(Site-to-site, Client-to-site, Clientless)
Full Tunnel VPN
Routes & encrypts all network requests through the VPN connection back to the headquarters
Split Tunnel VPN
Routes & encrypts only the traffic bound for the headquarters over the VPN, & sends the rest of the traffic to the regular internet
(Better performance than full tunnel, less secure)
Clientless VPN
Creates a secure, remote-access VPN tunnel using a web browser without requiring a software/hardware client
SSL
Secure Socket Layer:
Provides cryptography/reliability using the upper OSI layers (5/6/7)
TLS
Transport Layer Security:
Provides secure web browsing over HTTPS
SSL/TLS use TCP to establish secure client/server connections
DTLS
Datagram Transport Layer Security:
UDP-based version of the TLS protocol which operates a bit faster due to having less overhead
L2TP
Layer 2 Tunneling Protocol:
Lacks security features like encryption by default
Needs to be combined with extra encryption layer for protection
L2F
Layer 2 Forwarding:
Provides a tunneling protocol for the P2P protocol, but also lacks native security/encryption
PPTP
Point-to-Point Tunneling Protocol:
Supports dial-up networks but also lacks native security
(Except for when using with Windows)
SNMP: Managed Device
Any device that can communicate with an SNMP manager known as the MIB (Management information base)
SNMP
Simple Network Management Protocol (Port 161):
Used to send/receive data from managed devices back to a centralized network management station
SNMP: Granular
Sent trap messages get a unique objective identifier to distinguish each message as a unique message being received
SNMP: MIB
Management Information Base:
An SNMP Manager
The structure of the management data of a device subsystem using a hierarchical namespace containing object identifiers
SNMP: Verbose
SNMP traps may be configured to contain all the info about a given alert/event as a payload
SNMPv1 & SNMPv2
Use a community string to give them access to the device as their security mechanism
Default community strings of public (read-only) or private (read-write) devices are considered a security risk
SNMPv3
Provides 3 security enhancements which added integrity, authentication, & confidentiality to the SNMP protocol
Integrity - Message hashing
Authentication - Source validation
PoE+ 802.3at Confidentiality - DES 56-bit encryption
Syslog
System Logging Protocol:
Sends system log or event messages to a central server, called a syslog server
SIM - Security Information Management
SEM - Security Event Management
SIEM - Security Information & Event Management
Syslog Levels
0 - Emergency - System has become unstable
1 - Alert - A condition should be corrected immediately
2 - Critical - A failure in the system’s primary application requires immediate attention
3 - Error - Something is preventing proper system function
4 - Warning - An error will occur if action is not taken soon
5 - Notice - The events are unusual
6 - Information - Normal operational message (no action required)
7 - Debugging - Useful info for developers
Syslog: Traffic Log
Contains info about the traffic flows on the network
Allows for investigation of any abnormalities
Syslog: Audit Log/Audit Trail
Contains a sequence of events for a particular activity
Syslog: Application Log
Contains info about software running on a client/server
Informational, Warning, Error
Syslog: Security Log
Contains info about security of client/server
Syslog: System Log
Contains info about the operating system itself
SIEM
Security Information & Event Management:
Provides real-time or near-real-time analysis of security alerts generated by network hardware & applications
SIEM: Systems it gathers data from…
Log Collection
Normalization - Maps log messages into a common data model
Correlation - Links logs/events form different systems into a single feed
Aggregation - Reduces volume of event data via consolidation of duplicate events
Reporting
