CISSP - Domain 4

67 flashcards · Computer Science · by Jaysen Lewis

Know the TCP Handshake:
Know the OSI Model and it's 7 layers
"All People Seem To Need Data Physically." -------------------------------------------------------------------
Know the TCP Model and it's 4 layers
"Applications Transport Internet to Network Interfaces" SImilar to the OSI model: top 3 layers from OSI = Application layer Network layer = Internet layer Data Link & Physical layers = Network Interface layer
What kind of tool can you use to alter DNS lookups and prevent users from accessing undesirable websites?
DNS-based content filtering tools
Attackers may attempt to insert false DNS records into intermediate DNS servers in an attempt to fool unsuspecting clients into accessing fake sites. What kind of attack is this?
DNS Poisoning
What does the DNSSEC protocol do?
Adds digital signatures to DNS allowing clients to verify that the DNS records they receive are authentic.
Know the common TCP Ports:
FTP – 20, 21 SSH – 22 Telnet - 23 SMTP – 25 DNS – 53 HTTP – 80 POP3 – 110 NTP – 123 NetBIOS - 137, 138, 139 IMAP - 143 LDAP - 389 HTTPS – 443 LDAP - 445 LDAPS - 636 MS SQL – 1433 Oracle – 1521 RDP – 3389
Know the differences between DNS, ARP & NAT
DNS - converts b/w IP addresses and domain names ARP - converts b/w MAC addresses and IP addresses NAT - converts b/w Public and Private IP addresses
ICMP provides Ping and Traceroute commands and is useful for troubleshooting connectivity issues. Know the basic workflow of ICMP comms.
Ping command example:
TCP is the most common multi-layer protocol but not the only one. What is another one designed specifically for use in a class of systems known as Supervisory Control And Data Acquisition Systems?
DNP3 - Distributed Network Protocol Provides network connectivity for SCADA systems
Know the quick facts about IP Addresses:
What device is best suited for separating networks into (typically 3) distinct security zones?
Firewall Usually have interfaces for 3 default networks: DMZ, Internet and Internal networks.
What network technology uses Light to transmit data wirelessly?
LiFi The key here is "wirelessly". Fiber-Optic is a wired connection and yes, uses light but it is instead transmitted over strands of *wired glass.
Know the difference between Extranet, Honeynet and Ad Hoc Network segments:
Ad Hoc networks present a security risk and may expose sensitive information or provide routes for attackers.
What is East-West traffic vs. North-South Traffic?
What networking device is typically used to carry VLANs?
Switches (2 step config.): Enable VLAN trunking Assign switchports to VLANs
What network function allows the monitoring of traffic on a single switchport?
Port Mirroring
Know the quick facts about SIEM Tool placement:
Proxy servers, SSL Accelerators, Load Balancers and Content Filters typically belong in which network segment?
DMZ
Know the quick facts about VPN Concentrators:
What is an SSL Accelerator?
SSL accelerators handle the tough cryptographic work of setting up a TLS connection on behalf of a web server, allowing the web server to focus on delivering web content.
Know the basics of SDNs
Software Defined Networking A network that is defined and configured as code or software, quickly change the network based on organizational requirements. PROS: Allows granular network config., Faster response to security incidents, can create quarantine zones CONS: increases network complexity, requires strong security/access controls Separates the control plane from the data plane and uses an SDN Controller. allows network administrators to treat the functionality and implementation details o…
What is a VXLAN
"Xtended" VLAN - A software-defined network that implements the data plane which is built upon the control plane provided using the underlying network infrastructure. The VXLAN protocol uses encapsulation to build an overlay network (Layer 2) that lies on top of network equipment (Layer 3). VXLAN gets its name from the concept that VXLAN allows you to eXtend the VLANs used at Layer 2 across a larger area.
What technology is commonly used to create software-defined networks over large distances?
SD-WAN "Super Duper WAN"
What is the difference between Bluesnarfing and Bluejacking attacks?
Bluesnarfing targets the data or information on Bluetooth-enabled devices. Bluejacking occurs when attackers send unsolicited messages via Bluetooth.
What is the difference between DNS Spoofing and DNS Poisoning?
DNS Spoofing occurs when an attacker sends false replies to a requesting system, beating valid replies from the actual DNS server DNS Poisoning occurs when an attacker changes the domain name to IP address mappings of a system to redirect traffic to alternate systems.
What is a UTM?
UTM = Unified Threat Management Performs the Basic functions of a Firewall & Router and Adds security features like VPN, IDS & IPS, Malware Inspection, Email & Spam filtering Perform URL filtering & content inspection to remove untrusted web content
What is the danger of Orphaned Firewall rules?
Orphaned rules occur when a system or service is decommissioned, but the old firewall rules that were related to that system are never removed from the firewall. Let's say a decommissioned server maybe reused in the future, if the IP address matches up with the IP address present in the orphaned firewall rule, this essentially reactivates the orphaned rule and unintentionally allows external access to an internal system. Firewall administrators should regularly conduct firewall rule base review…
What is a Shadowed Firewall Rule?
A fw rule that will never actually be executed because of it's placement in the rule base/ hierachy.
What are the different types of filtering you can perform on a Router and how is that different from a Firewall?
Router FIltering Types: Standard ACLs filtering based on Source IP Very basic and limited. Extended ACLs Filtering based on more advanced criteria, source & destination IPs, ports and protocols Routers allow you to configure quality of service (QoS) controls that provide guaranteed bandwidth to high priority applications. For example, you might prioritize video conferencing traffic over routine file transfers. Firewalls are more advanced than Routers, more specific and efficient & can be based…
What are 4 security configs you can implement to protect Switches (limit VLAN hopping)?
1) VLAN Pruning (minimize VLAN exposure) 2) VLAN Trunk Negotiation 3) Port Security (MAC Filtering, Dynamic Port Security) 4) DHCP Snooping (Blocks malicious DHCP traffic)
What can you do to prevent DoS attacks and maintain network availability?
1) Flood Guard Technology Prevents SYN Floods, MAC Floods 2) Port Security (on switches) Prevents MAC flooding attacks 3) Spanning Tree Protocol (STP) Prevents Broadcast storms, Routing loops 4) BDPU spoofing attacks Protect against spanning tree attacks
What is SNMP and what version of SNMP should be used on networks?
Simple Network Management protocol (SNMP) provides network administrators with a means to centrally configure and monitor network devices. Takes out a lot of manual mgmt for large networks. SNMP has 3 components: Managed Devices (network devices you want to manage) SNMP Agent (runs on "managed devices") Network Management System (central control system for SNMP) GetRequest - Network mgmt System wants to retrieve info from a managed device SetRequest - Used for pushing commands to managed device…
What can you use to help get to a machine that's isolated in something like a DMZ when you legitimately need access to it?
Jumpbox (jump server, jump host)
What is a Darknet?
A Darknet is a deception technique where a segment of unused network address space (that should have no network activity) is used to monitor for illicit activity.
Explain the difference between Honeyfiles, Honeypots & Honeynets:
Honeyfiles are files that are specifically created to resemble sensitive data, but they instead contain garbage data or intentional misinformation - used to lure attackers. Honeypots are trap systems placed on a network with the purpose of intentionally attracting/fooling attackers and are carefully monitored. They immediately alert administrators and may trigger an immediate security response. Honeynets are large scale deployments of multiple honeypots on the same network. Honeynets contain Ho…
What is a DNS Sinkhole?
DNS sinkholes are basically self-inflicted DNS poisoning attacks, except in this case, security professionals are waging the attack against their own users to prevent those users from carrying out botnet instructions. Useful for limiting the ability of botnets to reach sensitive servers.
When it comes to storage networks, what is a NAS vs. a SAN?
NAS - Network Attached Storage Simple, self-contained storage (Commonly use CIFS and NFS) File servers SAN - Storage Area Networks Complex, Massive Storage systems Require dedicated networks, (via Fiber Channel) Very large storage requirements Raw storage to devices
What control can administrators use when encryption is not feasible for a VoIP network?
Separate Voice VLAN
What is VoIP?
Voice over IP Carries voice comms over data networks (instead of telephone lines) Converts voice from analogue to digital Transmits using Internet Protocol Should be encrypted (prevents eavesdropping but lowers quality) Should be on segmented networks (Voice VLANs)
Describe TLS:
Transport Layer Security Encrypts & protects transactions to prevent sniffing while data is in transit (along with VPN and IPsec) most effective control against session hijacking ephemeral session key is used to encrypt the actual content of communications between a web server and client Uses digital certificates to facilitate secure comms over public networks TLS depends upon combos of encryption and hash functions (Cipher Suites) *** It is not a cryptographic algorithm itself. You do not "enc…
What is SSL?
Insecure predecessor to TLS Similar handshake, but less secure. Many people tend to use the term "SSL" generically when they mean TLS.
What is IPsec?
Internet Protocol Security (IPsec) A set of protocols designed to add security capabilities to TCP/IP Operates at Network Layer (3) of OSI Enables multiple and simultaneous tunnels Encrypt and authenticate Build into IPv6 Network-to-network use Creates a private, encrypted network via a public network Encryption for confidentiality and integrity Uses 2 protocols to protect info.: 1) ESP - Encapsulated Security Payload Provides Confidentiallity & Integrity protection for packet payloads 2) AH -…
What are the secure & insecure file-transfer protocols?
FTP (File Transfer Protocol) - Insecure. Unencrypted. TFTP (Trivial File Transfer Protocol) - Insecure SFTP (Secure FTP) - Secure. Over SSH FTPS (FTP Secure) - Secure. Add TLS to FTP comms. SCP (Secure Copy) - Secure command-line file transfer over SSH
Be familiar with the different WiFi standards and their bandwidths:
Be familiar with the different Wireless Encryption technologies:
NOTE: WPA2 Enterprise mode uses RADIUS authentication for users rather than a preshared key.
Know the 3 different methods of Wireless Authentication
1) Pre-Shared Keys: i.e. WiFi password, either 64-char hexadecimal string or 8-13 character password Burdensome when updating keys -all devices need to be updated. No idea who-is-who. 2) Enterprise Authentication: Uses EAP (extensible authentication protocol) PEAP, EAP-TLS, EAP-TTLS & EAP-FAST (Cisco) are secure, other variants like LEAP & EAP-MD5 are now insecure. 3) Captive Portals Directed to a login portal when connecting to a network (Airports, Hotels etc.) Accept terms of service, get cre…
WHat tool can you use to search for rogue networks and test wireless network security?
WiFi Analyzer (like Aircrack-NG)
In what mobile device deployment strategy do users choose devices from a list of company-provided options?
CYOD (Choose Your Own Device)
What term is used to describe loading apps onto a device without going through the official app store?
Sideloading (More of a problem on Android)
What can you use to loackdown mobile device configurations and enforce your org's security policies?
MDM (Mobile Device Mgmt)
What is Jailbreaking/ Rooting a mobile device and how can you secure against it?
Deliberately by-passing the built-in security controls of a mobile device by loading up a custom-built firmware. Update Firmware (Over-The-Air Updates)
What are the 4 important types of Malware?
1) Viruses Spread by Human action 2) Worms Spread by themselves (think maggots) 3) Trojan Horses Malicious payload within seemingly legit software. 4) Spyware Gathers information w/o the user knowing it Example: Keystroke loggers, traffic monitoring, userpass scanning.
What tools can you use to protect from Malware?
Antivirus typically protects from all 4 types of Malware. Application Control - Whitelisting, Blacklisting apps. Signature Detection looks for known patterns of malware activity Behavior Detection (Heuristic) learns what normal activity is, and then reports deviations Endpoint Detection and Response (EDR) Agent-based, installed on endpoints, more advanced, real-time detection. Can also trigger automated responses. Can also perform "Sandboxing", installs malware in a sandbox, runs it and monitor…
What does Host Software Baselining do?
Host software baselining uses a standard list or "baseline" of the software that you expect to see on systems in your environment, and then reports deviations from that baseline
What is the difference between Network Firewalls and Host Firewalls?
Exam Tip: Granting secure network access requires BOTH
What are NGFWs?
Next-gen Firewalls. Add advanced security features, such as contextual information about users & applications.
Whats the difference between IDS and IPS?
IDS "detects" IPS "prevents" Notes for the exam: IDS & IPS are not typically OS-based and require 3rd party solutions. Always send your host FW, IDS & IPS logs to SIEM & Log repos.
What is File Integrity Monitoring (FIM)?
They watch the file system of an endpoint or server for any unexpected changes (integrity violations) via Hashes, and then report those changes to an administrator for further investigation. *** FIM Tuning is critical ***
What is the difference between Host-based & Network-Based DLP (Data Loss Prevention)?
What DLP technique tags sensitive content and then watches for those tags in data leaving the organization?
Watermarking
What type of malware prevention is most effective against known viruses?
Signature Detection
As the administrator of the perimeter firewall, Nick notices a rule that permits traffic to port 80 on a server at address 10.23.56.45. What is the MOST likely reason he would have to be suspicious of this rule?
The address space (10.0.0.0/8) is private & therefor NOT routable on the Internet.
As the firewall administrator, Nick notices a rule that permits traffic to port 80 on the server at address 47.23.56.255. What is the MOST likely reason he would have to be suspicious of this rule?
This address is used to send a broadcast to all servers on the subnet. An IPv4 address with "255" as the last octet broadcasts the traffic to all servers on the subnet and any server (web or otherwise) would never be assigned this address.
Protocol analyzers like Wireshark and tcpdump are built on what?
The libpcap library.
What can help you to filter out DDoS attacks?
CDNs - Content Distribution Networks.
Know the VPN protocol specs for PPTP, L2F, L2TP and IPSEC:
L2TP can use IPsec to provide encryption of traffic, ensuring confidentiality of the traffic carried via an L2TP VPN. PPTP sends the initial packets of a session in plaintext, potentially including usernames and hashed passwords. PPTP does support EAP and was designed to encapsulate PPP packets. All VPNs are point to point, and multipoint issues are not a VPN problem