Network Defense Ch 1 – Flashcards
Unlock all answers in this set
Unlock answersquestion
Threats to Network Security: Status
answer
Some attackers attempt to take over computer systems just for the thrill of it. They like to count the number of systems they have accessed as notches on their belt
question
Threats to Network Security: Revenge
answer
Disgruntled current or former employees might want to retaliate against an organization for policies or actions they consider wrong. They can sometimes gain entry through an undocumented account (back door) in the system.
question
Threats to Network Security: Financial Gain
answer
Other attackers have financial profit as their goal. Attackers who break into a network can gain access to financial accounts. They can steal individual or corpo-rate credit card numbers and make unauthorized purchases. Just as often, attackers defraud people out of money with scams carried out via e-mail or other mean
question
Threats to Network Security: Industrial Espionage
answer
Proprietary information is often valuable enough that it can be sold to competing companies or other parties.
question
Hacker
answer
Anyone who attempts to gain access to unauthorized resources on a network, usually by finding a way to circumvent passwords, firewalls. or other protective measures.
question
Hacker Goals: "Old School"
answer
hackers consider themselves seekers of knowledge; they operate on the theory that knowledge is power, regardless of how they come by that knowledge. They are not out to destroy or harm; they want to discover how things work and open any sources of knowledge they can find. They believe the Internet was intended to be an open environment, and that anything online can and should be available to anyone.
question
Hacker Goals: Crackers
answer
hackers who are less ethical and pursue destructive aims, such as the proliferation of viruses and worms, much like vandals
question
Hacker Goals: Young and Board
answer
hackers who are highly adept with computers try to gain control of as many systems as possible for the thrill of it. They enjoy disrupting systems and keeping them from working, and they tend to boast about their exploits online.
question
Hacker Goals: Criminals & Industrial Spies
answer
hackers who might be interested in selling information to the top bidder or using it to influence potential victims. Some companies would certainly be interested in getting the plans for a new product from their competitors.
question
Hacker Goals: Script Kiddies
answer
Hackers who are relatively unskilled programmers who spread viruses and other malicious scripts to exploit weaknesses in computer systems. Script kiddies lack the ability to create viruses or Trojan programs on their own, but they can usually find these programs online.
question
Hacker Goals: Packet Monkeys
answer
hackers who are primarily interested in blocking Web site activities through a distributed denial of service (DDoS) attack. In a DDoS attack, many computers are hijacked and used to flood the target with so many false requests that the server cannot process them all, and normal traffic is blocked. might also want to deface Web sites by leaving messages that their friends can read
question
Hacker Goals: Hacktivists
answer
hackers who are computer attackers with political goals. Frequently they use denial of service attacks to shut down Web sites of organizations with whom they disagree. Ex. Anonymous, has successfully shut down sites of the U.S. Federal Trade Commission to express its opposition to proposed laws that combat digital piracy. Anonymous has also shut down sites that belong to the State of Alabama in protest of immigration laws. After discovering that the Central Intelligence Agency (CIA) was investigating the group, Anonymous shut down some of the CIA's sites as well.
question
Threats to Network Security: Disgruntled Employees
answer
usually unhappy over perceived injustices and want to exact revenge by stealing information. With the economic downturn, more current or former employees are stealing information for financial reasons. Often they give confidential information to new employers. When an employee is terminated, security measures should be taken immediately to ensure that the employee can no longer access the company network and telecommunications systems
question
Logic Bomb
answer
malware designed to start at a specific time in the future or when a specified condition exists. At Fannie Mae, the Federal National Mortgage Association, a former engineer planted a logic bomb that could have shut the company down and cost millions by destroying all 4000 of the company's servers. Fortunately, the attack did not succeed. The former employee was sentenced to three years in jail.
question
Ansir Khan
answer
a former bank employee in Sheffield, England, attempted to steal $1.9 million after successfully stealing more than $1.1 million from the bank in April 2005 and May 2006. He extracted customer data and shared it with accomplices. He was sentenced to three years in jail.
question
Luis Robert Altamirano,
answer
a former employee of United Way in Miami, accessed the United Way computer system a year after he left the organization. He deleted files and disabled the voicemail system. pled guilty and was sentenced to 18 months in jail and fined $50,000 for computer fraud
question
Adeniyi Adeyemi
answer
a contract employee of Bank of New York Mellon, stole the per- sonal information of dozens of bank employees, mainly in the IT department. He used the information to open dummy financial accounts and receive funds stolen from the accounts of charities and nonprofit organizations.
question
Threats to Network Security: Terrorists
answer
group might want to attack computer systems for several reasons: to make a political statement or accomplish a political goal, such as the release of a jailed comrade; cause damage to critical systems; or disrupt the target's financial stability. Attacking the World Trade Center certainly accomplished the latter goal, given the nature and location of the structures. -might also want simply to cause panic - The overall psychological effect could be just as detrimental as the infrastructure damage and even the loss of life
question
Threats to Network Security: Government Operations
answer
a number of countries see computer operations as more than simply a spying technique; computer networks are a potential battleground
question
Threats to Network Security: Viruses
answer
-is executable code that can replicate itself from one place to another sur-reptitiously and perform actions that range from benign to harmful. -are spread by several methods, including running executable code, sharing disks or memory sticks, opening e-mail attachments, and viewing infected or malicious Web pages. -can attach to other executables or replace them in order to spread or execute. -require user intervention to run -can mutate or be altered to defeat antivirus software
question
Threats to Network Security: Worms
answer
creates files that copy themselves repeatedly and consume disk space. -do not require user intervention to be launched; they are self-propagating. -can install back doors -can destroy data on a hard disk -can mutate or be altered to defeat antivirus software
question
Threats to Network Security: Trojan Programs
answer
a harmful computer program, but one that appears to be something usefulâa deception like the Trojan horse described in Greek legends. The difference between a virus and a Trojan program lies in how the malicious code is used. Viruses replicate and can potentially cause damage when they run on a user's computer. -can also create a back door, which opens the system to additional attacks. -often hidden or obscure nature of a back door makes the attacker's activities difficult to detect.
question
Stuxnet
answer
-worm was designed to attack Windows systems used in industrial and military settings. The goal was to infect the control systems of automated industrial processes. Security experts who analyzed -concluded that it was probably the work of a government operation because of the complexity of the program and the amount of time and resources required to create and propagate it. -Prevalent in Iran, though U.S./Israel responsible for creation and intended target=Iran's nuclear industry
question
Malicious Code: MyDoom
answer
-worm infected millions of computers in only a few days, costing $38.5 billion in cleanup, lost productivity, and other losses - was believed to have been the fastest-spreading worm ever created - primarily transmitted via e-mail, with subject lines such as "Error," "Mail Delivery System," or "Mail Transaction Failed." If the user opens the attachment, the worm resends itself to e-mail addresses in the user's address book and local files
question
Malicious Code: Conficker
answer
-program attacked all Windows operating systems from Windows 2000 through Windows 7. An estimated 9 to 15 million computers were infected. In 2009, Microsoft offered a $250,000 reward for the identification of authors. -was designed to create botnets: networks of tens of thousands of infected computers that belong to unsuspecting victims and can be controlled from a central station -the program was designed not to infect systems with a Ukrainian keyboard, it is thought that the worm was developed in Eastern Europe.
question
Back doors
answer
-a way of gaining unauthorized access to a computer or other resource, such as an unused port or terminal service, that makes it possible for attackers to gain control over the computer.
question
Port
answer
-is an area in random access memory (RAM) that is assigned a number (the port address) and is reserved for a program that runs in the background to listen for requests for the service it offers.
question
Macro Viruses
answer
a type of script that automates repetitive tasks in Microsoft Word or similar applications. When you run a macro, a series of actions are carried out automatically. Macros are a useful way to make some tasks perform more efficiently. Unfortunately, macro viruses perform the same functions as macros, but they tend to be harmful - remain a threat today, but the good news is that the user must perform some action for the virus to be activated; therefore, educating users not to open the attach- ments is essential. Most modern operating systems and office suites do not automatically run macros, so the threat from is reduced.
question
Social Engineering: The People Factor
answer
-The vulnerability in this case is well-meaning but gullible employees who attackers fool into giving out passwords or other access codes. To protect itself against personnel who do not observe accepted security practices or who willfully abuse them, an organization needs a strong and consistently enforced security policy and a rigorous training program.
question
Melissa macro virus
answer
-caused Microsoft to shut down the company's entire e-mail service. -spread rapidly and arrived as an attachment with the subject line "Important message from [name of someone]." The body text read, "Here is that document you asked for...don't show anyone else." If the recipient opened the attachment, the macro virus infected the computer and carried out a series of commands. -was a fast-spreading virus, infecting more than 100,000 computers in the first few days.
question
Common Attacks and Defenses: Denial of Service Attack
answer
The traffic into and out of a network is blocked when servers are flooded with malformed packets (bits of digital information) that contain false IP addresses, other harmful data, or other fake communications. -Defense: Keep your server OS up to date; log instances of frequent connection attempts against one service.
question
Common Attacks and Defenses: SYN Flood
answer
A network is overloaded with packets that have the SYN flag set. Servers are overloaded with requests for connections and are unable to respond to legitimate requests (a denial of service attack) -Defense: Keep your firewall and OS up to date so that these attacks are blocked by means of software patches and updates, and review your log files of access attempts to see whether intrusion attempts have been mad
question
Common Attacks and Defenses: Virus
answer
Network computers are infected by viruses -Defense: Install antivirus software and keep virus definitions up to date. Keep applications and operating systems patched
question
Common Attacks and Defenses: Trojan Program
answer
A user installs a malicious Trojan program that can create a "back door" an attacker can exploit. -Defense: Install antivirus software and keep virus definitions up to date. Keep applications and operating systems patched.
question
Common Attacks and Defenses: Social Engineering
answer
An employee is misled into giving out passwords or other sensitive information. -Defense: Educate employees about your security policy, which is a set of goals and procedures for making an organization's network secure.
question
Common Attacks and Defenses: Malicious Port Scanning
answer
An attacker looks for open ports to infiltrate a network. -Defense: Install and configure a firewall, which is hardware and/or software designed to filter out unwanted network traffic and protect authorized traffic.
question
Common Attacks and Defenses: Internet Control Message (ICMP) message abuse
answer
A network is flooded with a stream of ICMP echo requests to a target computer. -Defense: Set up packet filtering
question
Common Attacks and Defenses: Man-in-the-middle attack
answer
An attacker operates between two computers in a network and impersonates one computer to intercept communications. -Defense: Use VPN encryption
question
Common Attacks and Defenses: Finding vulnerable hosts on the internal network to attack
answer
An attacker who gains access to one computer on a network can get IP addresses, host names, and passwords, which are then used to find other hosts to attack. -Defense: use proxy servers
question
Common Attacks and Defenses: New files being placed on the system
answer
A virus or other program causes new files to proliferate on infected computers, using up system resources. -Defense: Install system-auditing software
question
Common Attacks and Defenses: Remote Procedure Calls (RPC) attacks
answer
The operating systems crash because they are unable to handle arbitrary data sent to an RPC port. -Defense: Set up an IDPS (intrusion detection and prevention system)
question
Common Attacks and Defenses: Application vulnerability exploits
answer
Unpatched or vulnerable client-side applications that can be invoked and then misused by browsers are targeted, often by trusted Web sites converted into malicious servers. -Defense: Keep applications patched. Maintain software inventories so vulnerable software is accounted for and defended. Ensure secure configurations of all software and use perimeter defenses to help identify and prevent attacks.
question
Common Attacks and Defenses: Web application attacks
answer
Brute force password guessing is used to gain a valid username/password pair. Popular targets of this attack are Microsoft SQL, SSH servers, and FTP. Cross-site scripting, SQL injection, and PHP File Include attacks are the most popular methods for compromising Web sites. -Defense: Perimeter defenses should be used to ensure that layered defenses identify and prevent attacks aimed at Web servers. Log files can help determine if your Web server has been compromised. Ensure that all applications and operating systems are patched regularly.
question
Internet Security Concerns
answer
a port number combined with a computer's IP address constitutes a network connection called a socket. Attackers commonly use software to try to identify sockets that respond to connection requests. The sockets that respond can be targeted to see whether they have been left open or have security vulnerabilities that can be exploited. Hypertext Transport Protocol (HTTP) Web services use port 80. HTTP is among the most commonly exploited services.
question
Email and Communications: Firewalls
answer
a firewall's primary job is to keep viruses from infecting the system and to prevent Trojan programs from being installed and creating back door openings. Personal firewall programs, such as Comodo Internet Security, come with an antivirus program that alerts users to an e-mail attachment or a file containing a known virus.
question
Scripting
answer
âexecutable code attached to e-mail messages or downloaded files that infiltrates a system -It can be difficult for a firewall or intrusion-detection system (IDS) to block all such files; specialty firewalls and other programs should be integrated with existing security systems to keep scripts from infecting a network. -A specialty e-mail firewall can monitor and control certain types of content that pass into and out of a network. These firewalls can be configured to filter out pornographic content, junk e-mail, and malicious code.
question
M86 MailMarshal Secure Email Gateway by M86 Security
answer
scans the content of each e-mail message before it reaches the recipient
question
Email Filtering Programs
answer
-introduce privacy issues that need to be balanced against an organization's need for protectionâa trade-off that applies to almost all aspects of network security, not just e-mail messages.
question
Problems with Redundant Program Functions
answer
-not always compatible with security software -poor connection -communications blocked
question
Always-On Connectivity
answer
easier to locate and attack because their IP addresses remain the same as long as they are connected to the Internetâwhich might be days at a time if computers are left on overnight or over a weekend - static IP addresses that never change and that enable them to run easily found Web ser- vers or other services. Static IP addresses, however, make it easier for attackers to locate a computer and scan it for open ports. -effectively extend the boundaries of your corporate network, and you should secure them as you would any part of your network perimeter.
question
Always-On Connectivity: Problems
answer
-Remote users include employees who are on the road, contractors who work at home, and business partners. As the Internet grew in popularity, more home computers started using modems. These connections were usually made through temporary dial-up connections that used protocols such as Point-to-Point Protocol (PPP). Today, however, it is increasingly likely that remote users connect to a network through an always-on DSL or cable modem connection, which means they might be connected to a network for hours at a time. -network security policy should specify that remote users have their computers equipped with firewall and antivirus protection software. - if attackers can break into a remote user's computer while the user is connected to your network through a virtual private network (VPN) or other connection, your network becomes vulnerable as well
question
Goals of Network Security: Providing Secure Connectivity
answer
secure connectivity with trusted users and net- works
question
Goals of Network Security: Secure Remote Access
answer
-provide secure remote access for contractors and employees who are traveling. -VPN, with its combination of encryption and authentication, is often provided by the industry standard, IP security (IPsec), and is a simple and cost-effective solution
question
Goals of Network Security: Ensuring Privacy
answer
-educate all employees about security dangers and to explain security policies. -employees likely to detect security breaches and to cause security breaches accidentally through their own behavior. They can also be mindful of their coworkers' activities and be alert to suspicious actions that could indicate a security problem. -protect organizations that maintain databases of personal and financial information that need to maintain privacy -ensure information is protected according to US laws
question
Goals of Network Security: Providing Non-repudiation
answer
-which is the capability to prevent a participant in an electronic transaction from denying that it per- formed an action. -simply means ensuring that the sender cannot deny sending a message and the recipient cannot deny receiving it. -is an important aspect of establishing trusted communication between organizations that do business across a network rather than face to face.
question
Goals of Network Security: 1. Confidentiality, 2. Integrity, and 3. Availability
answer
-three primary goals of information security 1. is the prevention of intentional or unintentional disclosure of communications between a sender and recipient. 2. ensures the accuracy and consistency of information during all processing (creation, storage, and trans- mission). 3. is the assurance that authorized users can access resources in a reliable and timely manner.
question
Using a Layered Defense Strategy: Defense in Depth (DiD)
answer
-a group of methods that work in a coordinated fashion to provide protection against a variety of threats. -When beginning with an unprotected system, the first layer of defense added is always the most effective. -more layers are stacked on the first, potential attackers must successfully breach each layer to gain access to the next one. However, adding layers also adds increasing complexity for system administrators. Security enhancements must be balanced against the cost to maintain and monitor defenses.
question
DiD Layer: Physical Security
answer
-measures taken to protect a computer or other network device from theft, fire, or environmental disaster - installing computer locks that attach a computer device to a piece of furniture in your office, and keeping critical servers in a room protected by a lock and/or burglar alarm.
question
DiD Layer: Authentication and Password Security
answer
- a password security policy, which requires your employees to select good passwords, keep them secure, and change them regularly. -Using multiple passwords, including screen-saver passwords and passwords for protecting critical applications, is also a good idea to guard against unauthorized employees gaining control of unattended computers. -complex passwords and their safekeeping can be enforced through technical means, passwords can become a serious vulnerability. - Authenticate: verifying the identity of a user, service, or computerâuses one of three methods: verifying something the user knows, something the user possesses, or something the user is.
question
DiD Layer: Operating System Security
answer
-installing operating system (OS) patches that have been issued to address security flaws. -keep up with patches, hot fixes, and service packs and to test and install them when they become available. - stopping any unneeded services and disabling guest user accounts helps make an OS more secure.
question
DiD Layer: Antivirus Protection: Virus Scanning
answer
-process of examining files or e-mail messages for filenames, file extensions such as .exe (for executable code) or .zip (for zipped files), and other indications that viruses are present. Many viruses have suspicious file extensions, but some seem innocuous.
question
DiD Layer: Packet Filtering
answer
-block or allow the transmission of packets of information based on port, IP address, protocol, or other criteria -can be performed by different types of systems -evaluates information in the packet header and compares it to the established rules. If the information corresponds to one of the "allow" rules, the packet is allowed to pass; if the information matches one of the "deny" rules, the packet is dropped.
question
DiD Layer: Firewalls
answer
-The foundation for installing and configuring a firewall is your organization's overall security policy. -create a packet-filtering rule base for your firewall that reflects your overall approach to network security. -should enforce the overall policy established by the network administrator - Enforcement is handled primarily through setting up packet-filtering rules; a rule base contains a set of these rules. - The order of rules in the rule base is important to how the firewall processes traffic.
question
DiD Layer: Demilitarized Zone (DMZ)
answer
-A subnet and is a network that sits outside the internal net- work but is connected to the firewall -makes services like HTTP (Web server) and FTP (File Transfer Protocol) publicly available, yet protects the internal LAN. - might also contain a DNS server that resolves fully qualified domain names to IP addresses. -subnet attached to the firewall and contained in the DMZ is sometimes called a service network or perimeter network. A
question
DiD Layer: Intrusions Detection and Prevention System (IDPS)
answer
-recognizing the signs of a possible attack and sending a notification to an administrator that an attack is under way. Some traffic can trigger a response that attempts to actively combat the threat. -not precise because there is no known method for preventing all possible intrusions. -The signs of possible attacks are commonly called signaturesâcombinations of IP addresses, port numbers, and the frequency of access attempts.
question
DiD Layer: Virtual Private Networks (VPNs)
answer
-public telecommunications infrastructure, such as the Internet, to provide secure access to corporate assets for remote users. - use authentication to verify users' identities and encrypt and encapsulate traffic to protect it in transit.
question
DiD Layer: Network auditing
answer
-is the process of recording which computers are accessing a network and what resources are being accessed, and then recording the information in a log file.
question
DiD Layer: Log files Analysis
answer
-Compiling, reviewing, and analyzing log files are among the most tedious and time-consuming tasks associated with network security. Network administrators read and analyze log files to see who is accessing their networks from the Internet. All connection attempts that are rejected should be recorded in the hope of identifying possible intruders or pinpointing vulnerable points in the system. -When you first install intrusion detection or firewalls on your network, you will probably be asked to prepare reports that describe how the network is being used and what kinds of filtering activities the device is performing. It is a good idea to sort logs by time of day and per hour. (Sorting log files produces material that is more organized and easier to review than the log files produced by the server, firewall, or other device.) -Be sure to check logs to learn the peak traffic times on your network, and try to identify the services that consume the largest part of your available bandwidth. If your firewall or IDPS can display log file entries graphically, you should consider showing the graphs to management as needed. Graphs illustrate trends more effectively than lists of raw data
question
DiD Layer: Configuring Log files
answer
-the log files compiled by a firewall or IDPS give you different options. You can view active data (data compiled by the firewall as traffic moves through the gateway in real time) or data that the device has recently recorded. You can also view the information in the following ways: -System eventsâThese events usually track the operations of the firewall or IDPS, making a log entry whenever it starts or shuts down. -Security eventsâThese events are records of any alerts the firewall or IDPS has issued. -TrafficâThis is a record of the traffic that passes through the firewall. -PacketsâSome programs enable you to view information about packets that pass through them.
question
DiD Layer: Routing and access control methods
answer
-routers are positioned on a network's perimeter, they can be equipped with their own firewall software to perform packet filtering and other functions. -Access Points: âVulnerable servicesâThe attacker might be able to exploit known vulnerabilities in an application. âE-mail gatewaysâThe attacker might be able to attach a virus payload to an e-mail message. If a recipient clicks the attachment to open it, the program runs and the virus installs itself on the user's system. âPorous bordersâComputers on the network might be listening (that is, waiting for connections) on a port that has no functional use. If an attacker discovers a port that the computer has left open and that is not being used, the open port can give the attacker access to that computer's content -Access Control encompasses everything from complex permission configurations on domain controllers to locked doors.
question
Access Control Method: Mandatory Access Control (MAC)
answer
-This is an uncompromising method for controlling how information can be accessed. -all access capabilities are defined in advance. System administrators establish what information users can and cannot share.
question
Access Control Method: Discretionary Access Control (DAC)
answer
With this method, network users are given more flexibility in accessing information. This method allows users to share information with other users; however, the risk of unauthorized disclosure is higher than with the MAC method.
question
Access Control Method: Role-Based Access Control (RBAC)
answer
âThis method establishes organizational roles to control access to information. -RBAC method limits access by job function or job responsibility. An employee could have one or more roles that allow access to specific information.
question
Basic Authentication
answer
involves using something the user knows, such as a username/ password pair
question
Challenge/Response Authentication
answer
-the authenticating device generates a random code or number (the challenge) and sends it to the user who wants to be authenticated. The user resubmits the number or code and adds a secret PIN or password (the response), or uses a possession such as a smart card to swipe through a card reader.
question
Biometric Authentication
answer
-physical information that identifies a person, such as retinal scans, voice prints, and fingerprints
question
DiD Layer: Antivirus Protection: Signature Files
answer
-which contain a pattern of known viruses. -primary reason for keeping your antivirus software updated; antivirus software vendors frequently create updates and make them available for customers to download -When antivirus software recognizes the presence of viruses, it deletes them from the file system or places them in a storage area called a quarantine where they cannot replicate them- selves or do harm to other files
question
Packet Filtering: Routers
answer
-These devices are probably the most common packet filters. -process packets according to an access control list (ACL) the administrator defines
question
Packet Filtering: Operating Systems
answer
-Some systems, such as Windows and Linux, have built-in utilities for packet filtering on the TCP/IP stack of the server software. Linux has a kernel-level packet filter called Iptables; Windows Server 2008 and Windows 7 have a feature called Windows Filtering Platform.
question
Packet Filtering: Software Firewalls
answer
-Most enterprise-level programs, such as Check Point Firewall Software Blade, perform packet filtering. Personal firewalls such as ZoneAlarm per- form basic stateless packet filtering based on simple rules. You use ZoneAlarm in the hands-on projects at the end of this chapte
question
Firewalls: Permissive Policy
answer
-Calls for a firewall and associated security components to allow all traffic through the network gateway by default and then to block services on a case- by-case basis.
question
Firewalls: Restrictive Policy
answer
-Calls for a firewall and associated network security components to deny all traffic by default. The first rule denies all traffic on any service and using any port. To allow a specific type of traffic, a new rule must be placed ahead of the "deny all" rule.
question
Upper Management Support: Key Purposes
answer
Money, Time, Implementation, Support from beginning to end, Keep Everything Up To Date âThe project will cost money, and you need to have funding for the project approved beforehand. âThe project will require IT staff time, and managers, supervisors, and employees from all departments must participate to paint a clear picture of priorities and carry out the security plan. âThe process of implementing security systems might require down time for the network, which translates into lost productivity and inconvenience for everyone. âMost importantly for the long-term success of security efforts, executives and management need to support the project from start to finish. If they do not, development, testing, implementation, and maintenance are nearly impossible to complete. The necessary resources and enforcement will not be available. Besides, if management does not seem to care and does not support the initiative, why would anyone else?
