Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CWO > Traffic Analysis > Flashcards

Traffic Analysis Flashcards

1
Q

Network Analyst

A

Cyber operator whose main focus is infrastructure devices & netflow. Responsible for handling cyber incidents, network security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the benefits of a network analyst?

A

In depth knowledge of common network protocols, packet formats, & infrastructure security vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Network Baseline

A

Defines what is normal for enterprise netflow and ports, protocols & services used at a predetermined level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the benefits of a network baseline?

A
  • Allows for anomalous or abnormal condition detection through comparison (compares current baseline to original)
  • Allows for rapid deployment of new networks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Cyber Threat Intelligence (CTI)

A

Knowledge about adversaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the benefits of Cyber Threat Intelligence (CTI)?

A
  • Framework for indicators of compromise (IoC) for actionable hunting
  • Enables organizations to deploy measures to detect, mitigate, & possibly prevent attacks as they occur
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Network Artifacts

A

Piece of network traffic data that may be relevant to an investigated response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the benefits of network artifacts?

A
  • Helps with developing network and host signatures
  • Feeds CTI to triage incidents sooner
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are some things that could be network artifacts?

A

Logs (router, switch, firewall, DNS, web proxy, etc), files/directories (names, timestamps, sizes, hashes), registry keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Network Triage

A

A process for sorting network violations into groups based on need for or likely benefit from immediate attention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the benefit of network triage?

A

Helps the network analyst & the unit prioritize important systems to prevent mission failure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Sandbox

A

Highly controlled environment used to test unverified programs or malicious software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the benefits of sandboxes?

A

Safely examine suspicious files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Intrusion Detection System

A

Device or software application that passively monitors a network or systems for malicious activity or policy violations; “Man-on-the-Side”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the benefits of intrusion detection systems?

A
  • Easier to deploy because it doesn’t affect existing system or infrastructure
  • Detects network based attacks by checking packet headers
  • Retains evidence for network analysts when set up to log data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Intrusion Prevention System

A

Preemptive network security approach that uses techniques to detect and block possible intrusion attempts into a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the benefits of intrusion prevention systems?

A
  • Able to take defensive actions rather than just alerting on a possible attack
  • Retains evidence for network analysts when set up to log data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Security Info & Event Management (SIEM)

A

A group of technologies that together provide a bird’s eye view of the network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the benefits of SIEMs?

A
  • Aggregates relevant data from multiple data sources to identify deviations from the norm & and allow an analyst to take appropriate actions
  • Able to ingest data from virtually any product vendor
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?

A

An IDS passively monitors while an IPS actively tries to prevent possible intrusions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Full Packet Capture

A

File containing original packet data as seen at collection point (*.pcap, *.pcapng, *.cap, *.dmp)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the benefits of Full Packet Capture?

A
  • Holy grail of network data collection
  • Countless tools give the analyst many approaches to examine them
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the drawbacks of Full Packet Capture?

A
  • Files can grow extremely large
  • Legal constraints often limit availability of this data
  • Encrypted communications are increasingly used
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

NetFlow

A
  • Record containing a summary of network communication as seen at the collection point
  • Contains no content
  • Extremely helpful for quick network triage
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the benefits of NetFlow?

A
  • Requires less storage than full packet capture
  • Analysis processes are much faster
  • Generally fewer privacy concerns
  • Analysis processes apply equally to all protocols (encrypted/plain text, custom or standard)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the drawbacks of NetFlow?

A
  • Without content low level analysis & analysis may not be possible
  • Many collection platforms are unique and require training and/or license to use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Log Files

A
  • Most widely used source data for network & endpoint investigations
  • Contains application or platform centric items of use to characterize activities handled or observed by the log creator
28
Q

What are the benefits of log files?

A
  • Collected & retained for industry operation purposes, logs are widely available and processes often in place to analyze them
  • Raw log data can be aggregated for centralized analysis
29
Q

What are the drawbacks of log files?

A
  • Log data contains varying levels of detail in numerous formats
  • Often requires parsing & enrichment to add context or additional data to corroborate findings
  • If log data is not already aggregated finding it can involve significant time & effort before analysis can begin
30
Q

What is a port mirror?

A

It’s a software tap that duplicates packets sent to or from a designated switch port to another switch port (sometimes called a SPAN (Switch Port Analyzer) port)

31
Q

What are the benefits of port mirroring?

A
  • Activating a port mirror usually just requires a configuration change, usually avoiding downtime
  • Switches are everywhere so it maximizes flexibility of capture/observation platform placement
32
Q

What are some drawbacks of port mirroring?

A
  • Data loss is possible with high traffic networks
  • Bandwidth is limited by half duplex speed
33
Q

What are the benefits of collecting network traffic from a router?

A
  • Provides Netflow export functionality
  • Just requires a configuration change with limited downtime
  • Netflow is normally already collected so adding additional exporters is usually not hard
34
Q

What are some drawbacks of collecting from a router?

A

Generally does not provide the ability to perform full packet capture

35
Q

What layer 7 devices can perform data collection for network analysis?

A

Any platform with control of or purview over a network link can provide valuable logging data regarding the communications that pass through it

36
Q

What can layer 7 endpoints be configured to capture?

A

Generate full-packet capture data or export Netflow

37
Q

What are the benefits of collecting from a layer 7 device?

A

Many perspectives on the same incident may yield multiple useful data points about an incident

38
Q

What are the drawbacks of collecting from a layer 7 device?

A
  • Log data may include numerous formats & varying level of details in their content
  • May require labor intensive parsing & analysis to ID the useful details
  • Platforms that create the logs are often scattered
  • Requires sound log aggregation plan & platform
39
Q

Tap

A

Hardware device that provides duplicated packet data streams that can be sent to a capture or observation platform

40
Q

What is an aggregating tap?

A

It merges both directions of network traffic to a single stream of data on a single port

41
Q

What is a regenerating tap?

A

It provides the duplicated data streams to multiple physical ports

42
Q

What are the benefits of a network tap?

A
  • Hardware device designed specifically for network traffic capture, engineered for performance and reliability
  • Most taps will continue to pass monitored traffic even without power
43
Q

What are the drawbacks of a network tap?

A
  • Expensive
  • Downtime during installation
44
Q

Workflows

A
  • Most common and beneficial tasks can generally be placed in a workflow
  • Categories are not generally iterative
  • Dynamic process that adapts to adversaries actions (no single workflow can be used to address every scenario)
45
Q

Establish Baselines

A

A workflow with the goal of identifying normal patterns of behavior to help identify abnormal behavior
- Ideally the first step (can be made before, during or after)
- Determine cycles based on time and date
- Determine typical cycles of traffic (top talking hosts, ports/protocols, GET vs POST activity for http)

46
Q

Ingest & Distill

A

A workflow with the goal of preparing for analysis & deriving data that will more easily facilitate the rest of the analytic workflow
- Log source data according to local procedures
- If pcap files are available distill to other data sources types
- Considering splitting data into time-based chunks
- Load source data to large scale analytic platforms

47
Q

Reduce and Filter

A

A workflow with the goal of reducing large amounts of input data down to a smaller volume allowing analysis with a wider range of tools
- Reduce using known indicators and data points (IP addresses, ports/protocols, time frames, volume calculation, domain names, hostname, etc)
- For large scale analytic platforms, build filters to reduce visible data to traffic involving known indicators

48
Q

Analyze & Explore

A

A workflow with the goal of identifying traffic and artifacts that support investigative goals and hypothesis
- Look into reduced data set for suspicious traffic (may include evaluating traffic contents , context, anomalies, consistencies, anything that helps
- Use any baselines for identifying deviations

49
Q

Extract Indicators & Objects

A

A workflow with the goal of finding artifacts that help identify malicious activity, including field values, byte sequences, files or other objects
- As additional artifacts are ID’d, maintain on ongoing collection of these data points for further use during and after the investigation (includes direct observations or ancillary observations)
- Protect data according to local policies and share in accordance with operational security constraints

50
Q

Scope and Scale

A

A workflow with the goal of searching more broadly within source data for behavior that matches known indicators
- After IDing useful artifacts that define activity of interest, scale up the search using large scale analytic platforms & tools
- ID additional endpoints that exhibit the suspicious behavior, aiming to fully scope the incident within the environment
- Pass appropriate indicators to security operations for live ID of suspicious activity

51
Q

What are the network based processing workflows?

A
  • Establish baselines
  • Ingest & distill
  • Reduce & filter
  • Analyze & explore
  • Extract indicators & objects
  • Scope & scale
52
Q

Wireshark

A

Deep, protocol aware packet exploration & analysis tool (open source)

53
Q

TCPDump

A

Logs and/or parses network traffic (used to dump live network traffic to pcap files)

54
Q

How does TCPDump work?

A

It reduces data by reading from existing pcap files, applying a targeted filter, and writing the reduced data to a new pcap file

55
Q

Bro NSM

A

Creates log files as needed to document observed network traffic, uses “bro-cut” utility to extract specific fields from Bro logs

56
Q

Snort/Suricata

A

Capable of performing real time traffic analysis and packet logging on IP networks
- Performs protocol analysis, content searching and matching, and detects a variety of attacks and probes using signatures
- May be used as an Intrusion Detection System or an Intrusion Prevention System

57
Q

NetworkMiner

A

Protocol aware object extraction tool that writes files to disk
- Performs tedious object extraction
- May trigger host based defenses when files written to disk (use in isolated system)
- Network data fields can be exported to CSV

58
Q

How are TCP connections initialized?

A

A three way handshake (SYN, SYN/ACK, ACK)

59
Q

Port Scanning

A

Sending transmissions to end nodes, and analyzing the responses, in order to identify information about the communication system

60
Q

How difficult to detect is port scanning?

A

It’s easy. The technique is an expected voluminous activity on the internet. Active scanning typically generates benign traffic with no defense to execute (high volume makes it burdensome for defenders to chase so often ignored)

61
Q

What is the standard TTL for IP messages generated on a *nix system?

A

64

62
Q

What is the standard TTL for IP messages generated on a Windows system?

A

128

63
Q

What is the standard TTL for IP messages generated on a Solaris/AIX system?

A

254

64
Q

What is the standard TTL for IP messages generated on a network?

A

255

65
Q

User-Agent String

A

Part of network traffic that contains information about a browser’s identity, provided by client, may include platform token

66
Q

Platform Token

A

Describes the client operating system

67
Q

In Wireshark what types of data streams are you able to follow?

A

UDP, TCP, SSL, HTTP

CWO (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions