Week 4 Flashcards
Network hardening
The process of securing a network by reducing its potential vulnerabilities through configuration changes and taking specific steps
Implicit deny
A network security concept where anything not explicitly permitted or allowed should be denied
Analyzing logs
The practice of collecting logs from different network and sometimes client devices on your network, then performing an automated analysis on them
Correlation analysis
The process of taking log data from different systems and matching events across the systems
Splunk
A popular and powerful logs analysis system
Flood guards
Provide protection against DoS attacks
A good flood guard, especially if you are the sole IT person in your company, is Failed to Ban
DHCP snooping
A way to prevent Rouge DHCP Server Attacks. It’s a switch capability (not all switches have this feature) that monitors DHCP traffic, track IP assignments, and map them to hosts connected to switch ports
What does DAI do on enterprise switches?
It detects forged gratuitous ARP packets and drops them using the help of the DHCP table from the DHCP snooping feature ; it enforces great limiting of ARP packets per port to prevent ARP scanning
IPSG
Uses the snoop to dynamically create ACLs for each switchboard. This drops packets that don’t match the IP address for the port based on the DHCP snooping table
EAP-TLS
An authentication type supported by EAP that uses TLS to provide mutual authentication of both the client and the authenticating server
Host based firewall
Can protect mobile devices like laptops from being compromised in potentially malicious environments like airport Wi-Fi. They also protect other hosts from being compromised by a corrupt device on the network, which is something network firewalls may not be able to help defend against
Packet sniffing (packet capture)
The process of intercepting network packets in their entirety for analysis
Promiscuous mode
A type of computer networking operational mode in which all network data packets can be accessed and viewed by all network adapters operating in this mode
Port mirroring
Allows the switch to take all packets from a specified port, port range, or entire VLAN and mirror the packets to a specified switch port
Monitor mode
Allows us to scan across channels to see all wireless traffic being sent by APs and clients
