Understanding Devices and Infrastructure (Ch. 3) Flashcards
A table or data file that specifies whether a user or group has access to a specific resource on a computer or network.
access control list (ACL)
The point at which access to a network is accomplished, typically via wireless technology.
access point (AP)
A response generated in real time.
active response
A notification that an unusual condition exists and should be investigated.
alarm
An indication that an unusual condition could exist and should be investigated.
alert
An appliance that performs multiple functions.
all-in-one appliance
The component or process that analyzes the data collected by the sensor.
analyzer
Variations from normal operations.
anomalies
An anomaly-detection intrusion detection system works by looking for deviations from a pattern of normal network traffic.
anomaly-detection IDS (AD-IDS)
A freestanding device that operates in a largely self-contained manner.
appliance
A device or software that recognizes application-specific commands and offers granular control over them.
application-level proxy
An IPSec header used to provide connectionless integrity and data origin authentication for IP datagrams and to provide protection against replays.
Authentication Header (AH)
A method of balancing loads and providing fault tolerance.
clustering
Gap controls that fill in the coverage between other types of vulnerability mitigation techniques
compensating controls
Any systems that identify, monitor, and protect data to prevent it from unauthorized use, modification, destruction, egress, or exfiltration from a location.
data loss prevention (DLP)
An IPSec header used to provide a mix of security services in IPv4 and IPv6. ESP can be used alone or in combination with the IP Authentication Header (AH).
Encapsulating Security Payload (ESP)
The process of enclosing data in a packet.
encapsulation
An event that should be flagged but isn’t.
false negative
A flagged event that isn’t really an event and has been falsely triggered.
false positive
A combination of hardware and software filters placed between trusted and untrusted networks intended to protect a network from attack by hackers who could gain access through public networks, including the Internet.
firewall
An intrusion detection system that is host based. An alternative is an intrusion detection system that is network based.
host-based IDS (HIDS)
A software or appliance stand-alone used to enhance security and commonly used with PKI systems.
HSM (hardware security module)
A condition that states that unless otherwise given, the permission will be denied.
implicit deny
A set of protocols that enable encryption, authentication, and integrity over IP.
Internet Protocol Security (IPSec)
Tools that identify attacks using defined rules or logic and are considered passive.
intrusion detection system (IDS)
Tools that respond to attacks using defined rules or logic and are considered active.
intrusion prevention system (IPS)
The management of all aspects of cryptographic keys in a cryptosystem, including key generation, exchange, storage, use, destruction and replacement.
key management
Dividing a load for greater efficiency of management among multiple devices.
load balancing
The set of standards defined by the network for clients attempting to access it.
network access control (NAC)
An intrusion prevention system that is network based.
network intrusion prevention system (NIPS)
attaches the system to a point in the network where it can monitor and report on all network traffic.
network-based IDS (NIDS)
A nonactive response, such as logging.
passive response
A type of system that prevents direct communication between a client and a host by acting as an intermediary.
proxy
A proxy server that also acts as a firewall, blocking network access from external networks.
proxy firewall
A type of server that makes a single Internet connection and services requests on behalf of many users.
proxy server
A protocol that secures messages by operating between the Application layer (HTTP) and the Transport layer.
Secure Sockets Layer (SSL)
provide real-time analysis of security alerts.
SIEM Security information and event management (SIEM)
A system that acts based on the digital signature it sees and offers no repudiation to increase the integrity of a message.
signature-based system
An access point’s broadcasting of the network name.
SSID broadcast
Inspections that occur at all levels of the network and provide additional security using a state table that tracks every communications channel.
stateful inspection
A network device that can replace a router or hub in a local network and get data from a source to a destination. Switching allows for higher speeds.
switch
