Telecommunications & Network Security Flashcards
1
Q
What is a LAN ?
A
Local Area Network, small in scope (building, floor), connects servers, workstations, printers.
Typically High Speed and cheap (compared to a WAN).
2
Q
What is a WAN ?
A
Wide Area Network - connects multiple LANs and other WANs by using telecommunications devices and facilities to form an internetwork. typically consists of Routers, CSU/DSU, FireWalls. VPN concentrators.
Typically Low Speed (compared to the LAN), Expensive.
3
Q
What is the OSI Model ?
A
The OSI model defines standard protocols for communication and interoperability by using a layered approach. This approach divides complex networking issues into simpler functional components that help the understanding, design, and development of networking solutions
4
Q
How many Layers does the OSI Model have ?
A
7
5
Q
What are the 7 Layers ?
A
Application, Presentation, Session, Transport, Network, Data link, Physical.
Adult People Should Try New Dairy Products.
6
Q
What is Data Encapsulation ?
A
encapsulation. Data encapsulation wraps protocol information from the layer immediately above in the data section of the layer immediately below.
7
Q
What is a PAN ?
A
Personal Area Network - Laptop, phone, PDA, (personal devices) that can be connected together via cables, bluetooth and wireless.
8
Q
What is a SAN ?
A
Storage Area Network - A Huge array of hard drives that appear as a logical entity to servers and the like. They uses technologies such as iSCSI, SCSI, Fibre Channel. They have redundency built into them.
9
Q
What is a VLAN ?
A
Virtual Local Area Network - it exists with a single or multiple switches and logically groups devices, users or groups together. Provide security and easy of management as well as layer 2 security. `
10
Q
What is a CAN ?
A
Campus Area Network - exists within a small area and connects buildings together with a ‘campus’
11
Q
What is a MAN ?
A
Metropolitan Area Network - A network that spans over a City.
12
Q
What is a VAN ?
A
A type of extranet that allows businesses within an industry to share information or integrate shared processes. For example, Electronic Data Interchange (EDI) allows organizations to exchange structured documents — such as order forms, purchase orders, bills of lading, and invoices — over a secure network.
13
Q
OSI Layer 1 ?
A
Physical Layer:
Sends and receives bits across the network. It specifies the electrical, mechanical, and functional requirements of the network, including network topology, cabling and connectors, and interface types, as well as the process for converting bits to electrical (or light) signals that can be transmitted across the physical medium.
14
Q
What is a Star Topology ?
A
All data communications must pass through the switch (or hub), which can become a bottleneck or single point of failure. A star topology is ideal for practically any size environment and is the most common basic topology in use today. A star topology is also easy to install and maintain, and network faults are easily isolated without affecting the rest of the network.
15
Q
What is a Mesh Topology ?
A
In a mesh topology, all systems are interconnected to provide multiple paths to all other resources.In most networks, a partial mesh is implemented for only the most critical network components, such as routers, switches, and servers (by using multiple network interface cards [NICs] or server clustering) to eliminate single points of failure.
16
Q
What is a Ring Topology ?
A
A ring topology is a closed loop that connects end devices in a continuous ring, this is achieved by connecting individual devices to a Multistation Access Unit (MSAU or MAU). Physically, this setup gives the ring topology the appearance of a star topology.
Ring topologies are common in token-ring and FDDI networks. In a ring topology, all communication travels in a single direction around the ring.
17
Q
What is a Bus (Linear) Topology ?
A
In a bus (or linear bus) topology, all devices are connected to a single cable (the backbone) that’s terminated on both ends.
- Small Networks
- Backbone is a single point of failure
- Problems tracing the fault.
- Originally cheap (this is no longer the case)
18
Q
What is BaseBand signaling ?
A
Baseband signaling uses a single channel for transmission of digital signals and is common in LANs that use twisted-pair cabling.
19
Q
What is BroadBand Signaling ?
A
Broadband signaling uses many channels over a range of frequencies for transmission of analog signals, including voice, video, and data. The four basic cable types used in networks are coaxial, twinaxial, twisted-pair, and fiber-optic.
20
Q
What is Co-Axial Cabling ?
A
Co-Ax, comes in two flavours - thinnet thicknet.
Coax cable consists of a single, solid-copper-wire core, surrounded by a plastic or Teflon insulator, braided-metal shielding, and (sometimes) a metal foil wrap, all covered with a plastic sheath. This construction makes the cable very durable and resistant to Electromagnetic Interference (EMI) and Radio Frequency Interference (RFI) signals.
21
Q
ThinNet vs ThickNet:
A
Thick: Also known as RG8 or RG11 or thicknet. Thicknet cable uses a screw-type connector, known as an Attachment Unit Interface (AUI). Thin: Also known as RG58 or thinnet. Thinnet cable is typically connected to network devices by using a bayonet-type connector, known as a BNC (Bayonet Neill-Concelman) connector.
22
Q
What is TwinAx Cabling ?
A
Twinaxial (also known as twinax) cable is very similar to coax cable, but it consists of two solid copper-wire cores, rather than a single core.
- high Speed Data Transfer
- High Speed, short distance, low cost.
Typical applications for twinax cabling include SANs and top-of-rack network switches that connect critical servers to a high-speed core.
23
Q
What is BER ?
A
Bit error ratio (BER) is the ratio of incorrectly received bits to total received bits over a specified period of time.
24
Q
What is Twisted Pair ?
A
Popular, Light Weight, Flexible, Cheap and easy to install.
Twisted-pair cable consists of four copper-wire pairs that are twisted together to improve the transmission quality of the cable by reducing crosstalk and attenuation. The tighter the twisted pairs, the better the transmission speed and quality.
25
What is CrossTalk ?
Crosstalk occurs when a signal transmitted over one channel or circuit negatively affects the signal transmitted over another channel or circuit.
26
What is Attenuation ?
Attenuation is the gradual loss of intensity of a wave (for example, electrical or light) while it travels over (or through) a medium.
Currently, ten categories of twisted-pair cabling exist, although only four (Cat 3, Cat 5e, Cat 6, and Cat 6a) are currently defined as standards by the TIA/ EIA. Cat 5, Cat 5e, and Cat 6 cable are typically used for networking today.
27
What is Tempest ?
TEMPEST is a (previously classified) U.S. military term that refers to the study of electromagnetic emissions from computers and related equipment.
Cat 7 and Cat 7a cable is available as STP only. In addition to the entire Cat 7 or Cat 7a cable, the individual wire pairs are also shielded.
28
What is Fibre Optic Cable ?
Fiber-optic cable, the most expensive type of network cabling — but also the most reliable — is typically used in backbone networks and high-availability networks (such as FDDI). Fiber-optic cable carries data as lightsignals, rather than as electrical signals.
29
What is a Repeater ?
A repeater is a non-intelligent device that simply amplifies a signal to compensate for attenuation (signal loss) so that one can extend the length of the cable segment.
30
What is a Hub ?
A hub (or concentrator) is used to connect multiple LAN devices together, such as servers and workstations. The two basic types of hubs are:
Passive - All data is sent to all ports.
Active - All data is sent to all ports and is amplified (repeater)
31
What is a Switch ?
A switch is used to connect multiple LAN devices together. Unlike a hub, a switch doesn’t send outgoing packets to all devices on the network, but instead sends packets only to actual destination devices.
A switch typically operates at the Data Link Layer but the physical interfaces (the RJ-45 input connections) are defined at the Physical Layer.
32
What is the Data Link Layer (Layer 2)
The Data Link Layer ensures that messages are delivered to the proper device across a physical network link.
* This layer also defines the networking protocol (for example, Ethernet and token-ring) used to send and receive data between individual devices.
* The Data Link Layer formats messages from layers above into frames for transmission, handles point-to-point synchronization and error control, and can perform link encryption.
* The Data Link Layer consists of two sub-layers: the Logical Link Control (LLC) and Media Access Control (MAC) sub-layers.
33
What is the Role of the Logical Link Sub Layer
The LLC sub-layer operates between the Network Layer above and the MAC sub-layer below.
* Provides an interface for the MAC sub-layer by using Source Service Access Points (SSAPs) and Destination Service Access Points (DSAPs).
* Manages the control, sequencing, and acknowledgement of frames being passed up to the Network Layer or down to the Physical Layer.
* Responsible for timing and flow control.
34
What are the role of the MAC Sub Layer ?
The MAC sub-layer operates between the LLC sub-layer above and the Physical Layer below. It’s primarily responsible for framing
* performs Error Control (CRC Checks)
* Identifies Hardware / MAC Addresses
* Controls Media Access Control
35
What is a MAC Address ?
The MAC address is a 48-bit address that’s encoded on each device by its manufacturer. The first 24 bits identify the manufacturer or vendor. The second 24 bits uniquely identify the device.
36
What are LAN Controls & Transmission Methods ?
These are LAN Access Protocols:
* ArcNet (Token Passing)
* Ethernet (CSMA/CD)
* Token Ring
* FDDI (redundent Token Ring)
* ARP
* RARP
37
What is ARP ?
* ARP (Layer2) maps Network Layer IP addresses to MAC addresses.
* ARP discovers physical addresses of attached devices by broadcasting ARP query messages on the network segment.
* IP-address-to-MAC-address translations are then maintained in a dynamic table that’s cached on the system.
38
What is RARP ?
RARP (layer 2) maps MAC addresses to IP addresses.
This process is necessary when a system, such as a diskless machine, needs to discover its IP address.
The system broadcasts a RARP message that provides the system’s MAC address and requests to be informed of its IP address. A RARP server replies with the requested information.
39
What are the three types of LAN Data Transmission ?
* Unicast - Single Source to a Single Destination
* Multicast - Single Source to Multiple destinations that are masked with a multi-cast IP Address.
* broadcast - Single Source to Every IP Address.
40
Wireless LAN Protocols, name them and their specs ?
802. 11a 54 Mbps Operates at 5 GHz (less interference than at 2.4 GHz)
802. 11b 11 Mbps Operates at 2.4 GHz (first widely used protocol)
802. 11g 54 Mbps Operates at 2.4 GHz (backward-compatible with 802.11b)
802. 11n 600 Mbps Operates at 5 GHz or 2.4 GHz
41
WAN Protocol - P to P ?
This is a point to point link. These links provide a single, pre-established WAN communications path from the customer’s network, across a carrier network (such as a Public Switched Telephone Network [PSTN]), to a remote network.
42
What is the Point to Point Protocol ?
The successor to SLIP. PPP provides router-to-router and host-to-network connections over synchronous and asynchronous circuits. It’s a more robust protocol than SLIP and provides additional built-in security mechanisms. PPP is far more common than SLIP in modern networking environments.
43
What PPTP ?
Point-to-Point Tunneling Protocol (PPTP): A tunneling protocol developed by Microsoft and commonly used to implement VPNs, specifically PPP traffic. PPTP doesn’t provide encryption or confidentiality, instead relying on other protocols, such as PAP, CHAP, and EAP, for security.
44
What is SLIP ?
Serial Line IP (SLIP): The predecessor of Point-to-Point Protocol (PPP), SLIP was originally developed to support TCP/ IP networking over low-speed asynchronous serial lines (such as dial-up modems) for Berkeley UNIX computers.
45
What is xDSL ?
Digital Subscriber Line (xDSL): xDSL uses existing analog phone lines to deliver high-bandwidth connectivity to remote customers. Table 5-4 describes several types of xDSL lines that are currently available.
46
What is ISDN ?
Integrated Services Digital Network (ISDN): ISDN is a communications protocol that operates over analog phone lines that have been converted to use digital signaling. ISDN lines are capable of transmitting both voice and data traffic. ISDN defines a B-channel for data, voice, and other services, and a D-channel for control and signaling information.
47
What are the two ISDN Service Levels ?
* Basic Rate Interface (BRI) One 16-Kbps D-channel and two 64-Kbps B-channels (maximum data rate of 128 Kbps)
* Primary Rate Interface (PRI) One 64-Kbps D-channel and either 23 64-Kbps B-channels (U.S.) or 30 64-Kbps B-channels (EU), with a maximum data rate of 1.544 Mbps (U.S.) or 2.048 Mbps (EU)
48
What is Frame Relay ?
* A packet Switched Network.
| * High speed, No Error Correction.
49
What is MPLS ?
Multi-Protocol Label Switching (MPLS): A packet-switched, high-speed, highly scalable and highly versatile technology used to create fully meshed Virtual Private Networks (VPNs). It can carry IP packets, as well as ATM, SONET (Synchronous Optical Networking), or Ethernet frames. MPLS is specified at both Layer 2 and Layer 3.
Disadvantaages: * Loss of visability into the cloud, so does an attacker.
50
What is a LER Router ?
Lable Edge Router - used in MPLS, they label and remove labels, capsulate and unencapsulate data packets as they leave the clouds.
51
What is SONET ?
Synchronous Optical Network - used in the USA by telco and energy companies. high speed multiplexed,low latency based on Fibre Optics.
52
What is SDH ?
Synchronous Digital Hierarichy - Successor to SONET, used throughout the world, save the USA. high speed multiplexed,low latency based on Fibre Optics.
53
What is a Datagram ?
A Datagram is a self contained unit that is capable of being routed between a source and a destination, commonly used in UDP and AppleTalk. Similar to an IP Packet.
54
What is X.25 ?
X.25 was the first packet switching network.
55
What is a Packet Switched Network ?
Packet Switched Networks are:
* ideal for on demand connections that occasionally 'burst' due to high traffic volumes.
* They are connectionless orientated
* Variable Delays
56
Characteristics of Asynchronous Communication
* data is transmitted serially
* it has start and stop bits
* communicate at the same speed
* parity bits reduce error
57
What is a Bridge ?
* Semi Inteligent Repeater
* connects two or more network segments
* maintains an ARP Cache
* Responsible for broadcast storms - can flood a network with ARP requests.
58
What is a Switch ?
* intelligent Hub that uses MAC addresses to route traffic.
* Can be used to implement VLANS
* traditionally layer 2, new switches function at layers 3 and 7.
59
What is DTE ?
Data Terminal Equipment, a general term used to classify end devices like workstation.
60
What is the DCE ?
Data Communications Equipement - It is the physical connection to the network from the DTE devices.
61
What is Layer 3 ?
The Network Layer
62
Network Layer (3) Functions ?
* Routing between systems on the same or interconnected networks.
* RIP, OSPF, BGP, IP, IPX are all defined at this layer.
63
What are Static Routing Protocols ?
Static manual routes placed on routers to direct traffic from A to B. If the router is down the network is down.
* If two paths are listed for a route there is no congestion control.
* only practical in small networks
* It does have low bandwidth requirements and built in security.
64
What are Dynamic Routing Protocols ?
Dynamic Routing Protocols discover routes to get to another location.
* Congestion Aware.
* link state aware
65
What is a distance-vector protocol ?
It makes routing decisions based on 2 factors distance (hops) and vector (egress router interface).
66
What is Convergence ?
The time it takes for all routers in a network to update their routing tables.
* During Convergence routing information is exchanged and networks slow down considerably.
67
What is RIP ?
* Routing Information Protocol.
| * It uses Distance - Vector routing protocol that uses hop counting as a routing metric with a hop limit of 15.
68
What is a Link State Protocol ?
* Demands that all routers maintain a complete map / routing table of the entire network.
* processor intensive to produce.
* calculates the most efficient way to data across a networkm calculating factors like: Speed, Delay, Load, relability and cost.
Convergence with link state protocols occurs much more quickly than with vector - distance Protocols.
69
What is a Path Vector Protocol ?
Is similar in concept to a distance vector protocol but without the scalability issues associated with limited hop counts. BGP is an example of this.
70
RIP Routing Loops
Routing loops are when packets get stuck bouncing between various hops. to prevent this RIP implements the following:
* Hop limit of 15.
* Split Horizon - prevents a router from advertising a route back out through the same interface.
* Route Poisoning - Sets the hop count on a bad route to 16.
* Holddown Timers - starts a timer when a router receives a router to a destination that is unreachable, untill the timer ends any router updates to that destination are dropped. this prevents flapping.
* RIP uses UDP port 520
* Slow Convergance
* Poor Security
71
What is OSPF ?
Open Shortest Path First:
* A link state routing protocol
* It is considered an Interior Gateway Protocol (IGP)
* Encapsulated as IP Datagrams, as oppose to TCP,UDP.
72
What is an Autonomous System (AS) ?
A group of contiguous IP address ranges under the control of a single internet entity.
73
What is an ASN ?
Autonomous System Number - individual autonomous systems are assigned a 16 ro 32 AS Number that uniquely identifies them on the Internet, these are assigned by IANA.
74
What is IANA ?
Internet Assigned Numbers Authourity.
| * Assigns 16 or 32 bit unique numbers to autonomous systems on the internet.
75
What is IS-IS ?
Intermediate Systems to Intermediate Systems - A link state routing protocol used to route datagrams through a packet switched network.
* It is an Interior Gateway Protocol (IGP)
* used in large service provider backbone networks.
76
What is BGP ?
Border Gateway Protocol - a Path vector routing protocol used between seperate authonomous systems (AS).
* Exterior Gateway Protocol (EGP).
* Core Protocol used by ISPs and on large enterprise networks.
77
eBGP ?
External Border Gateway Protocol - when BGP is used between autonomous systems (AS).
78
iBGP ?
Internal Border Gateway Protocol - When BGP runs within an Autonomous System (AS).
79
What are Routed Protocols ?
Network Layer Protocols that address packets with routing information.
* IP, IPX.
80
Internet Protocol (IP) ?
* Contains Addressing information that enables it to be routed.
* Connectionless, best effort, delivery of datagrams.
* Fragmentation and reassembly of datagrams.
* IPv4 used 32bit logical IP addresses divided into 4 x 8 bit octets.
81
The 5 IP Classes:
```
A - 1 top 126 (large, 16,777,214)
B - 128 to 191 (medium, 65,534)
C - 192 to 223 (small, 254)
MultiCast - 224 to 239
Experimental - 240 - 254
```
82
IP LoopBack
127.0.0.1 - 127.255.255.255 - loopback network used for testing and troubleshooting.
83
Class 'A' Private IP Range ?
10.0.0.0 - 10.255.255.255
84
Class 'B' Private IP Range ?
172.16.0.0 - 172.31.0.0
85
Class 'C' Private IP Range ?
192.168.0.0 - 192.168.255.255
86
IPv6
* 128bit logical IP Address Scheme
| * backward compatable with IPv4
87
What is IPX ?
Internetwork Packet Exchange.
* COnnectionless Protocol associated with Netware
* part of the IPX / SPX package Suite.
88
What is ICMP ?
Internet Control Message Protocol. Layer 3.
* reports errors and other information back to the source.
* Common Terms: Destination Unreachable, Echo Request, Echo Reply, Redirect, Time Exceeded. PING
89
What is SKIP ?
Simple Key Management for Internet Protocols - A Network layer key management protocol used to share encryption keys.
* Bandwidth intensive (size of packet header information due to encrypted packets).
* No pre-required session is required.
90
Layer 3 Network Equipement ?
Router - hardware and software equipment (BGP,OSPF,RIP)
| Gateway - Hardware and software appliance that links disparate networks, this can include protocols (IPX <> IP)
91
What is Layer 4 ?
The Transport Layer - It provides end to end reliable data transport and and transmission control.
92
What is Flow Control ?
A transport layer function that manages data transmission between devices. Makes sure 1 device does not overload another.
93
What is Multiplexing ?
A transport layer function that enables data from multiple applications to be transmitted over a single physical link.
94
What is Virtual Circuit Management ?
A transport layer function that establishes, maintains and terminates virtual circuits.
95
What is Error Checking & Recovery ?
A transport layer function that detects for transmission eorrs and takes actions to resolve the errors.
96
What is TCP ?
Transmission Control Protocol (Layer 4):
* A full duplex connection orientated protcol.
* Connection established through a 3-way handshake
* Reliable - guarantees delivery by acknowledging packets and re-transmitting / requesting if there is an error.
* Slow - due to the overhead (3-way,error checking)
97
What is TCP-SYN
A PC attempting to communicate with another initiates the communication with a SYN (syncronise) Packet. Part 1 of the 3 way TCP Hand Shake.
98
What is TCP-SYN-ACK
The PC that has received a SYN packet responds to the original Request with a SYN-ACK (syncronise - acknowledgement) Part 2 of the 3 Way TCP HandShake.
99
What is TCP SYN-ACK-ACK
A response to a SYN-ACK packet, this is third part of the TCP 3 Way Hand shake.
100
What is UDP ?
User Datagram Protocol:
* Connectionless protocol, uses Best effort for delivery.
* no delivery guarantee
* no packet re-sequencing or error checking.
101
UDP Uses Cases
* suited for data that requires fast delivery that is not sensitive to packet loss or fragmentation.
* DNS
* SNMP
* video and audio streaming.
102
What is SPX ?
Sequenced Packet Exchange.
* Used to guarantee data delivery on Netware Networks.
* Similar to TCP
* reliable.
* provides for packet re-assembly.
103
What is SSL / TLS
Secure Socket Layer / Transport Layer Security.
| * provides session based encryption & authentication.
104
What is the Layer 5 ?
The Session Layer . This establishes co-ordinates and terminates communication sessions between networked systems.
105
Layer 5 Communication Sessions are divided into 3 phases:
1) Connection Establishment: Initial Contact between communicating systems is made and the end devices agree on communication parameters.
2) Data Transfer - data is exchanged between end devices.
3) Connection Release - After the data has been communicated end devices end the session.
106
What are the three operation modes of the communication session (OSI, Layer 5)?
* Simplex Mode - 1 way communication path, 1 transmits the other receives. Like a Radio.
* Half Duplex Mode - Both devices can transmit and receive but not at the same time. Like a 2 way radio.
* Full Duplex - Both devices can communicate at the same time (transmit and receive) simultaneously. Life a telephone.
107
What is NetBios ?
Network Basic Input / Output System.
* Layer 5
* microsoft protocol, designed for communication across a LAN.
* None routable.
108
What is a NFS ?
Network File System.
* Layer 5.
* designed to faciliate remote access to resources for users on a UNIX based system.
109
What is a RPC ?
Remote Procedure Call
* Layer 5 protocol
* This is a client | Server network redirection tool.
110
What is SSH ?
SecureShell. - An alternative to tellnet.
* Layer 5 Protocol.
* provides remote access on unix systems.
111
What is SIP ?
Session Initiation Protocol:
* Layer 5 Protocol
* used for managing and terminative real time communications (Video, Audio and Text)
112
What is Layer 6 ?
Presentation Layer: Provides coding and conversion functions for data being presented the Application Layer.
113
Common Layer 6 (Presentation) Tasks ?
* Data Representation
* Character Conversion
* Data Compression
* Data Encryption
114
What is ASCII ?
American Standard Code for Information Interchange.
* Layer 6
* Character encoding system
115
What is Layer 7 ?
Application Layer - responsible for identifying and establishing availability of communication partners, determining resource availability and syncronising communications.
116
What is FTP ?
File Transfer Protocol.
* Layer 7
* copy files from A to B
117
What is HTTP ?
HyperText Transfer Protocol.
* Language of the WWW
* Layer 7
118
What is HTTPs ?
HyperText Transfer Protocol Secure.
* Language of commerical applications on the WWW
* Layer 7
* HTTP + SSL / TLS
119
What is IMAP ?
Internet Message Access Protocol - Stores and forwards electronic emails.
* Layer 7
* User port 143
120
What is POP ?
Post Office Protocol version 3 (POP3)
* Layer 7
* An Email retrieval protocol
* uses port 110
* Insecure auth over plain text.
121
What is S/MIME ?
Secure Multi Purpose Internet Mail Extension
* layer 7
* allowed users to send email with a web browser.
122
What is SMTP ?
Simple Mail Transfer Protocol
* Layer 7
* used to send and receive email across the internet.
* Runs on Port 25.
123
What is the TCP / IP Model ?
A communication model based on TCP/IP that predates the OSI Model. 4 layers:
Application (App, Presentation,Session: OSI)
Transport (Transport : OSI)
Internet (Network: OSI)
Network (Link) Layer: (Data Link, Physical: OSI)
124
What is a FireWall ?
A hardware and Software appliance that controls traffic flow.
125
What is a Packet Filtering FireWall ?
* denies / permits traffic based on TCP, UDP, ICMP and IP headers of individual packets.
* Cheap
* Uses pre-defined access rules (ACLs)
* Fast, Efficient.
* Transparent.
* No protection from IP or DNS spoofing
* Doesn't strong user encryption
* limited logging
126
What is a Circuit Level Gateway ?
A FireWall that controls access by maintaining state information about established connections. When the session is created (layer 5) between 2 hosts packets flow freely between them.
* Speed (after a connection is made individual packets aren't analysed)
* support for many protocols
* easy maintenance
* dependence on trustworthy connections
* limited logging.
127
What is a Stateful inspection FireWall ?
* A circuit level gateway that captures network layer packets and then queues and analyses them.
128
What is an Application level Gateway ?
* operates at the Application (Layer 7) of the OSI model.
* Proxy Server
* Processes and inspects data packets for specific IP Applications.
* No data is directly sent between the two hosts, the proxy server accepts the packets, inspects the packets and sends on a copy.
* masks network internals and designs
* Can implement strong user authentication
* reduced network performance
* Must be tailored to specific applications.
129
What is a screening Router ?
* A Basic type of firewall architecture
* A router that is placed between a trusted and untrusted network that uses an ACL secruity policy.
* Device is transparent
* Simple and inexpensive
* has issues with certain types of traffic
* limited / no logging
* no user authentication
* Single point of failure
* Is not really a firewall (no choke point strategy)
130
What is a Dual homed Gateway ?
* A common FireWall Architecture
* Called a Bastion Host. (sacrifical lamb)
* Systems with 2x NICS that sits between 2 networks
* A hardened system that employs robust security mechanisms.
* Proxys connections between NICS
* Can have a fail safe option.
* internal network structure is masked.
* Inconvenient to Users
* can cause slower network performance (bottleneck)
131
What is a Screened-host Gateway ?
* A type of firewall architecture that employs both a bastion host as well as a screening router.
* The screening router makes the bastion the single point of ingress / egress between the two networks.
* provides distributed secruity between 2 devices
* transparent outbound
* restricted inbound
* bastion host could be bypassed by the screened router
Masking the internal network structure is difficult
* multiple single points of failure.
132
What is a Screened-Subnet ?
* A secure Firewall Architecture
* uses an exterrnal screening router
* dual homed host with a second screening router (DMZ)
* Transparent to end users
* Flexible
* provides defense in depth
* internal network structure can be masked.
* expensive, difficult to maintain and configure
* tough to troubleshoot.
133
IDS / IPS
Provides realtime monitoring and analysis of network traffic.
134
Active IDS
* This is an IPS, it can block suspected attacks.
* Must be placed inline
* single point of failure
* could be used to DoS a company
135
Passive IDS
* Or just a plain old IDS
* monitors and alerts.
* Not neccesarily inline.
136
Network IDS
Is an a network device / appliance with an NIC card configured in promiscious mode, can sniff all traffic.
137
Host IDS
Is a system with host applications or agents that are installed on hosts and alert the IDS when triggers occur.
138
Knowledge / Signature Based IDS
This type of IDS references a database of previous attack profiles.
* Low false positive rate
* alerts are more standardised.
* signature based must be continually maintained
* new attacks may have not been classified and thus not be detected.
139
Behaviour / anomaly / Based IDS
* this references a baseline or learned pattern
* deviations from the baseline or pattern trigger an alarm.
* less dependent on identifying specific OS vulns.
* dynamically adapt to new, unique, original attacks.
* High false positive rate
* cannot adapt to legitimate usage patterns.
140
Remote Access Sec. Method - Restricted Address
Access is granted or restricted based on the user's IP Address.
141
Remote Access Sec. Method - Caller ID
Access is granted or restricted based on the user's phone number.
142
Remote Access Sec. Method - CallBack
This requires a remote access user to authenticate to a RAS Server, the RAS then disconnects and calls the user back at a preconfigured phone number.
* Easily defeated with call forwarding.
143
What is RAS ?
Remote Access Service - they utilise PPP to encapsulate IP packets and establish a dial-in connection.
144
What is a VPN ?
VIrtual Private Network. - A secure tunnel over a public network such as the Internet.
145
VPN Connection Methods
Client to VPN Concentrator
Client to Client
Firewall to firewall
router to router
146
VPN PPTP Protocol ?
Point-to-Point Tunneling Protocol:
* Developed by Microsoft.
* tunnels the Point to Point Protocol through a public network.
* uses native PPP authentication & encryption services.
147
What is L2F ?
```
Layer 2 forwarding protocol:
* designed by Cisco
* similar to PPTP
* Data link layer (Layer 2)
permits tunneling of WAN Protcols (HDLC,SLIP)
```
148
What is L2TP ?
Layer 2 Tunneling Protocol
* combination of L2F and PPTP
* Transparent (requires no additional software)
* Robust Authentication (PPP,RADIUS,TACACS)
* Local addressing (assigned by VPN not ISP)
* Authorisation - managed server side
* Accounting - Both the ISP and USER perform AAA accounting
149
What is IPSEC ?
Internet Protocol Security.
* Layer 3 IETF open standard.
* Ensures confidentiality, integrity and authenticity
150
What is IPS SEC Transport Mode ?
Only data is encrypted.
151
What is IP SEC Tunnel Mode ?
The entire packet is encrypted.
152
What is AH ?
IP-SEC protocol - Authentication Header, provides integrity, authentication, and non-repudiation.
153
What is ESP ?
```
IP-SEC Protocol - Encapsulated Security Payload.
Provides confidentiality (encryption) and limited authentication.
```
154
What is a Security Association (SA) ?
A component of IPSEC.
* A 1 way connection between 2 communicating parties.
* Thus you need two SAs between 2 parties
* Each SA only supports ESP or AH.
155
What are the 3 (SA) parameters that identify them as IPSec sessions ?
* Security Parameter Index (SPI) - 32bit string used by receiving stations to differentiate between SAs.
* Destination IP Address - (Unicast address)
* Security Protocol ID - The Security Protocol ID must be either an AH or ESP association.
156
What is IKE ?
Internet key Exchange .
* Key Management in IP Sec.
* a combination of 3 other protocols: ISAKMP, SKEME and OKE protocol.
157
What is SSL ?
Secure Socket Layer - Layer 4 Transport Protocol.
* Low Cost , Easy to use.
* Transparent - no special software is required to use it.
* Provides granular access control.
* Not all applications are SSL aware.
158
4 types of wireless antenna:
* Omni-Directional: send and receive signals equally in all directions.
* Parabolic: Also known as dish antenna, extend wireless ranges.
* Sectorized: direct signals in a 60 to 120 degree pattern provides additional range and decreases interference.
* Yagi: Used for long distances in P2P or P2MP wireless apps.
159
What is Root Mode (AP, WLAN) ?
* default access point setup.
| * The AP is directly connected to the wired Network and bridges the two networks.
160
What is Repeater Mode (AP,WLAN) ?
* The access point provides an upstream link to another AP effectively extending the range.
161
What is Bridge Mode (AP,WLAN)?
* The Wireless Access Point functions as a bridge between two seperate wireless networks.
162
What is ad-hoc (WLAN) ?
A WLAN architecture that has no Access Points. Device communicate directly with each other in a peer to peer network.
163
What is an SSID ?
32 Character name that identifies a wireless network.
164
What is WEP ?
Wired Equivalent Privacy (WEP). Gen 1 wireless security protocol.
* RC4 stream cipher
* CRC-32 checksum for integrity
* uses a 40 or 104 bit key with a 24-bit initialisation vector (IV) to form a 64 or 128 bit key.
165
WEP Authentication Methods ?
Open System Authentication - no wireless client required.
| Shared Key Authentication - uses a 4 way handshake to auth and associate the wireless client with the access point.
166
Increasing WEP Security
You can tunnel IPSec and SSH over WEP to increase Security.
167
WPA
WiFi Protected Access (WPA/WPA2)
* WPA uses the Temporal Key Integrity Protocol (TKIP) to address some encryption issues. TKEP = secret root key + initialisation vector.
* Support for EAP Extensions (EAP-TLS, EAP-TTLS, Protected EAP).
168
WPA 2
Wifi Protected |Access (WPA2)
WPA 1 + security enhancements
* WPA2 uses AES-based algorithm counter mode /w Cipher block chaining message authenitication Code.
169
Email Security - SMTP
* Open Relay be default (bad)
170
Email Security - RBL
* A realtime blackhole list
| * A frequently updated list of IP addresses with open relay.
171
Email Security -Phishing
Victims are lured to an online site and asked to validate personal data. (Mostly banking type sites)
172
What is SPIM ?
Spam Over Instant Messaging
173
What is SPIT ?
Spam Over Internet Telephony
174
Web Security - 2 Primary Protocols
* HTTP - Hypertext Transport Protocol
| * HTML - Hypertext Markup Language
175
Web Security - Script Injection
An attempt to inject scripting language commands into a web form.
* This is an attempt to fool the web server into sending the contents of the back-end databases to the hacker.
176
Web Security -Buffer Overflow
* An attempt to send machine language instructions as part of a query to a web server in an attempt to get the server to run the commands.
177
Web Security -Denial of Service (DoS)
Sending huge numbers of queries to a web server in an attempt to clog inputs and make it unavailable.
178
Facsimile Security
* Use Cover pages
* Place fax machines in secure areas.
* Using secure phone lines.
* Encrypting fax data.
179
PBX, POTS VoIP abuse
* Audit call logs
| * publish and enforce corporate telephone use policies.
180
Caller ID Fraud
* Use a calling card
* Use a caller id service
* blocking caller id
* reconfigure your telephoen switch
* VoIP
181
What is Blue Jacking ?
sending anonymous unsolicted messages to bluetooth enabled devices.
182
What is Blue Snarfing?
stealing personal data from a bluetooth enabled device.
183
What is a Fraggle Attack ?
a UDP echo (port 7) flood attack
184
What is an ICMP Flood ?
A large number of ICMP (echo requests) are sent to the target network in an attempt to consume resources (bandwidth)
185
What is Session Hijacking / Spoofing ?
IP Spoofing involves altering a TCP packet so that it appears to be coming from a known good / trusted source.
186
What is a smurf Attack ?
A large number of ICMP (echo requests) are sent to the target network in an attempt to consume resources (bandwidth).
However in this attack the packets are sent to the broadcast address of the target network from a spoofed ip address on the target network.
* To counter you could drop ICMP at the router.
187
What is a syn flood ?
* TCP packets with a spoofed source address request a connection (syn bit set) to the target network.
* target network responds with a syn-ack packet, but the spoofed source never responds.
* broken three way packets over whealm the system and it crashes.
188
CounterMeasures for a Syn Flood ?
* Enable tcp intercept on the router
* Enable committed access rate (CAR) which would rate limit the bandwidth.
* Checkpoint has a syn defender function
* reduce the time out period on networked systems
* change the default max. number of half open TCP connections.
189
What is a TearDrop Attack ?
A tear drop attack occurs when a change has been made to the length and fragmentation offset fields of sequential IP packets, which causes the target system to to become confused and crashed.
190
What is a UDP Flood ?
* In a UDP Flood large numbers of UDP packets are sent to the target network to consume available bandwdith and shut the network down due to congestion.
* A counter for this would be to drop unneccessary UDP packets at the router.
