Chapter 6 Part 1 of 2 - Security Fundamentals AIT MOS 25B

The defense against a MAC flooding attack is a Flood Guard (port security).

Rule-Based systems cannot do anything other than what they have been configured to do.

A Forward Proxy is a computer or application that takes internal user requests and processes them on behalf of the user.

Load Balancers optimize bandwidth of network computers.

Anomaly-based monitoring compares current detected behavior with baseline

A Remote-Access VPN is desribed as a User-to-LAN connection

Two basic types of Intrusion Detection Systems are HIDS and NIDS

 Signature-based monitoring looks for well-known attack signature patterns

Virtual Private Network Endpoints are the end of the tunnel between VPN devices.

 Virtual private network enables authorized users to use unsecured public network as if it were a secure private network

A Switch can learn which device is connected to each of its ports.

Being "in line" on the firewall this allows the IPS can more quickly take action to block an attack.

 Rule-based firewalls use a set of individual instructions to control actions.

Types of Virtual Private Networks (VPNs) include:

Specifically designed security hardware devices provide greater protection than standard networking devices.

Behavior-based monitoring alerts user who then decides whether to allow or block activity

An Inline IDS is connected directly to the network and monitors the flow of data as it occurs.

A VPN can route some traffic securely and and other traffic directly over the internet using Split Tunneling.

NIDS cannot sound an alarm and log events.

Application-aware IDS knows the version of the Operating System

Rule-based Firewall systems are static in nature.

Firewall Rules are stored together in one or more text file(s) that are read when the firewall starts.

A proxy is an intermediary application or appliance that acts as a middle-man between clients and servers.

An Always-on VPNs allow the user to remain connected

Each rule in a Rule-Based Firewall have separate sequential instructions telling the firewall what action to take.

Load Balancers allocate requests among multiple devices.

It's important for switches to be properly configured to provide a high degree of security.

HIDS is a software-based application installed on each system that can detect an attack as it occurs and monitors which:

Standard network devices can be classified by the Open Systems Interconnection (OSI) layer at which they function.

Different scheduling protocols used in load balancers:

What does the Intrusion Detection System (IDS) HIDS stand for

For inbound emails, a mail gateway can search for various types of malware, spam, and phishing attacks.

Standard network devices include (but are not limited to) switches, routers, load balancers, and proxies .

Switches examine the MAC address of frames that it receives and associates its port with the MAC address of the device.

What are two different TCP/IP email systems:

Switches that support port security can be configured to limit the number of MAC addresses that can be learned on ports.

Heuristic monitoring uses experience-based techniques and an algorithm for threat detection.

A MAC Flood is when an attack agent overflows the switch with frames where each contains a different MAC address.

Each layer of the OSI Model has different networking task.

Application/multipurpose proxy is a special proxy server that “knows” the application protocols that it supports.

An Intrusion Detection System (IDS) can detect an attack as it occurs

The Mail Gateway monitors emails for unwanted content and prevents these messages from being delivered.

Load Balancers help evenly distribute work across a network.

A VPN concentrator is a dedicated hardware device that aggregates hundreds or thousands of VPN connections.

Using a Full Tunnel a VPN can protect all traffic sent to the VPN concentrator.

Routers can be used to limit traffic entering the network from unapproved networks.

Each layer of the OSI Model cooperates with adjacent layers

Application-Aware Firewalls make decisions about actions to take based application packets sent through the firewall.

 A Site-to-Site VPN is when multiple sites can connect to other sites over the Internet

What does the Intrusion Detection System (IDS) NIDS stands for

Application-aware IPS knows the version of the OS or which application is running.

The firewall action REJECT prevents the packet from passing into the network and DOES NOT SEND a response to sender.

Layer 4 load balancers act upon data found in Network and Transport layer protocols.

NIDS are firewall & router sensors that detect attacks on the network, gather INFO, & send reports to central device.

What are some common types of proxies:

A passive IDS is connected to a port on a switch, which receives a copy of network traffic.

In Network Intrusion Detection and Prevention, what are some monitoring methodologies:

Routers can be set to filter out specific types of network traffic by using an Access Control List (ACL).

Reverse proxy routes requests coming from an external network to the correct internal server.

There are several types of proxies used in computer networking

What does IPS stand for?

A Switch is a device that connects network hosts intelligently.

Firewalls can be software-based or hardware-based.

Applications can be identified by application-based firewalls through:

Intrusion Detection Systems can be managed:

Hardware firewalls tend to be more expensive than software based firewalls and more difficult to configure and manage.

The firewall action ALLOW lets packets pass through.

For outbound email, a mail gateway can detect and block the transmission of sensitive data.

Switches forward frames intended for a specific device (unicast) instead of sending it out all ports (broadcast).

In-band means through the network itself by using network protocols and tools.

Software firewalls running on a device provide protection to that device only.

Transparent proxy does not require any configuration on the user’s computer.

A routers internal ACL often configured with explicit permit and deny statements.

Behavior-based monitoring detects abnormal actions by processes or programs (adaptive & proactive rather than reactive)

Application-Aware Firewalls operate at a higher level by identifying applications that send packets through the firewall

Load balancing is achieved through or hardware device (load balancer).

The firewall action DROP prevents the packet from passing into the network but IT DOES send a message to the sender.

Layer 7 load balancers distribute requests based on data found in Application layer protocols.

Rule-Based Firewall systems rules contain information such as:

Some disadvantages of HIDS include:

Modern Operating Systems include a software firewall, usually called a hostbased firewall

Load Balancers reduce probability of overloading a single server.

Load balancers are grouped into two categories:

What are the advantages of using a proxy server?

Software and Hardware based firewalls inspect packets and either accept or deny entry.

Out-of-band means using an independent and dedicated channel to reach the device.

The OSI model breaks networking steps into seven layers

Application-aware IDS is a special IDS that uses "contextual knowledge" in real time.

Switches proper configurations include: loop prevention and providing a flood guard.

Routers forward packets across different computer networks.

Virtual Private Network Endpoints can be software on local computer or a VPN concentrator.

Application-aware IDS knows which application is running as well as what vulnerabilities are present in the system.

Like NIDS, IPS monitors network traffic to immediately block malicious attacks, due to being "in line" on the firewall.

Switches store addresses in a MAC address table.

Routers operate on Network Layer (Layer 3).

Improperly configured standard network devices can introduce vulnerabilities.

Security functions of network devices can provide a degree of network security.

With a VPN all data transmitted between the remote device and the network is encrypted.