Test Questions Flashcards
Uses a challenge message during authentication?
-CHAP - Challenge Handshake Authentication Protocol
Which hashing algorithms are NOT secure?
Which hashing algorithms are NOT secure?
- MD5 - collisions
- RIPEMD - collisions
Which hashing algorithms are NOT secure?
* list not complete
Which hashing algorithms are NOT secure?
- MD5 - collisions
- SHA-0, SHA-1
-RIPEMD-160 is secure, but other version maybe not good. SHA-2 is better
EV Certificate
EV Certificate
Extended Validation
-Additional checks have been made to validate site owner
tracerout
tracerout
- Maps each hop by incrementing TTL (Time To Live) for each request
- When TTL reaches 0, receiving router drops packet and sends ICMP TTL Exceeded message back to original station.
AAA Framework
-Four phases, and what they need
AAA Framework
- Identification - username - who you claim to be
- Authentication - password - prove you are who you say you are
- Authorization - based on identification and authentication, what do you have access to?
- Accounting - Resources use - login time, data send/received, logout time
Data Steward/Custodian
-What are this role’s responsibilities
Data Steward/Custodian Handles routine tasks to protect data -ensure data backed up -ensure backups properly labeled and stored -Data owners delegate task to custodian
Data Owner
-What are this role’s responsibilities
Data Owner
- A higher-level executive
- Identifying classification of data
- Ensure data labeled to match classification
- Ensure security controls implemented to protect data
ICS
ICS
Industrial Control System
-Dedicated network to manage and control manufacturing equipment, power generation equipment, etc
802.1X supports what types of authentication?
- 1X supports what types of authentication?
- Authentication server receives request for access via EAP
- RADIUS
- LDAP
- TACAS+
- Kerberos
Which authentication mechanism does 802.1x usually rely upon?
Which authentication mechanism does 802.1x usually rely upon?
- EAP - Extensible Authentication Protocol
- Request for access from supplicant on computer and authentication server (RADIUS, etc)
PKCS
PKCS
Public Key Cryptography Standard
-Asymmetric
-A digital signature algorithm
Data Wiping
- Another name?
- What does it do?
- Is media reusable?
Data Wiping
- aka clearing
- software tool to overwrite data on hard drive to destroy all electronic data.
- May be performed with a 1x, 7x, or 35x overwriting, with a higher number of times being more secure.
- Allows the hard drive to remain functional and reused.
Degaussing
- What does it do?
- Is media reusable?
Degaussing
- demagnetizing a hard drive to erase its stored data.
- cannot reuse a hard drive once it has been degaussed.
Data Purging
- What does it do?
- Is media reusable?
Data Purging
- aka sanitizing
- Removing sensitive data from a hard drive using the device’s own electronics or an outside source (like a degausser).
- Not reusable.
- Three methods: physical destruction, cryptographic erasure and data erasure
Behavior-Based Analysis
Behavior-Based Analysis
- Capture/analyze normal behavior and then alert when an anomaly occurs.
- Configuring a behavior-based analysis tool requires more effort to set up properly, but it requires less work and manual monitoring once it is running.
- Ex: could be used to detect unexpected output from an application being managed or monitored
ECC
ECC
Elliptic Curve Cryptography
-Asymmetric
FTK Imager
-Open source or proprietary?
FTK Imager
- Forensic imager
- proprietary
dd
dd
- Forensic imager
- open source
Autopsy
-Open source or proprietary?
Autopsy
- Forensic tool suite
- cross–platform
- open source
SAML
-Roles
SAML Roles
- XML
- Exchange authentication and authorization info between parties
- SAML is a solution for providing single sign-on (SSO) and federated identity management for web-based apps
- SP (Service Provider), RP (Relying Partner) - a web application that wants to authenticate and eventually authorize access to data.
- IdP (Identity Provider) - Provides authentication and authorization for service providers/relying parties (SPs/RPs). It may rely on itself, or another Identity Provider (IdP) (ex: the OP provides a front-end for LDAP, WS-Federation, OIDC or SAML).
SHA-1 Output Length
SHA-1 Output Length
-160 bit
SHA-2 Output Length
SHA-2 Output Length
256 bit
NTLM Output Length
NTLM Output Length
-128 bit
MD5 Output Length
MD5 Output Length
-128 bit
Phishing
Phishing
-Sending out a large volume of email to a broad set of recipients in the hopes of collecting the desired action or information.
Pharming
Pharming
- Fake website
- Domain spoofing in an attempt to gather the desired information from a victim.
MSSP
MSSP
Managed security service provider (MSSP)
-provides security as a service (SECaaS)
Anomaly-Based Detection
Anomaly-Based Detection
- aka heuristic detection
- aka behavioral
- Can detect unknown (zero-day) anomalies
- Can be used by IDS, IPS
- Detect attacks by comparing operations against baseline
Hoax
Hoax
-Message that tells of impending doom from virus or other threat
DHCP Sniffing
DHCP Sniffing
Dynamic Host Configuration Protocol
-A device connected to the network requests an IP address from the DHCP server using the DHCP protocol
-When DHCP servers are allocating IP addresses to the clients on the LAN, DHCP snooping can be configured on LAN switches to prevent malicious or malformed DHCP traffic, or rogue DHCP servers
XSS vs Remote Code Exploit
XSS vs Remote Code Exploit
- XSS targets server
- Remote Code Exploits target client (user input)
ASLR
ASLR
Address space layout randomization
-computer security technique involved in preventing exploitation of memory corruption vulnerabilities. In order to prevent an attacker from reliably jumping to, for example, a particular exploited function in memory, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries.
BPDU
BPDU
A bridge protocol data unit (BPDU) is a data message transmitted across a local area network to detect loops in network topologies
CSU
CSU
Channel Service Unit or CSU is a digital communication device that is used to connect a digital line to a digital device.
DNAT
DNAT
Destination network address translation is a technique for transparently changing the destination IP address of an end route packet and performing the inverse function for any replies. Any router situated between two endpoints can perform this transformation of the packet.
POODLE
POODLE
- Padding Oracle on Downgrade Legacy Encryption
- Downgrade attack - take advantage of falling back to SSL from TLS
- SSL Man in the Middle exploit - attacker inserts self into comms session and forces browser to use SSL 3.0
- SSL no longer maintained
- Disable SSL to prevent
Rootkits
- How do they hide?
- How can they be discovered?
Rootkits
- Hide their running processes with hooking
- Tools that inspect RAM can discover hidden hooked processes
