Applying Network Security Features

Question 1

What is IAM?

Answer 1

A security process that provides identification, authentication, and authorization mechanisms for users, computers, and other entities to work with organizational assets like networks, operating systems, and applications. Also referred to as identity management (IdM), and access management.

Modern access control is typically implemented as an identity and access management (IAM) system.

Question 2

What are the 4 main processes IAM is comprised of?

Answer 2

Identification : Creating an account or ID that uniquely represents the user, device, or process on the network.

Authentication : Proving that a subject is who or what it claims to be when it attempts to access the resource. An authentication factor determines what sort of credential the subject can use.

Authorization: Determining what rights subjects should have on each resource, and enforcing those rights. An authorization model determines how these rights are granted.

Accounting - Tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted.

Question 3

What is a authentication factor and what are the categories for them?

Answer 3

An authentication factor is the type of data used to create a credential.
These are the following categories:
-Knowledge factor: Something you know (such as a password).

-Ownership factor: Something you have (such as a smart card).

-Human or biometric factor: Something you are (such as a fingerprint).

-Behavioral factor: Something you do (such as making a signature).

-Location factor: Somewhere you are, such as only being able to log into an account from a specific location, known as geofencing.

-Time factor: Somewhen you are (such as only being permitted to start a session during work hours or using an access token before it expires).

Question 4

How does Windows Authentication work?

Answer 4

Windows local sign-in—The Local Security Authority (LSA) compares the submitted credential to a hash stored in the Security Accounts Manager (SAM) database, which is part of the registry. This is also referred to as interactive logon.

Windows network sign-in—The LSA can pass the credentials for authentication to a network service. The preferred system for network authentication is based on Kerberos, but legacy network applications might use NT LAN Manager (NTLM) authentication.

Remote sign-in—If the user’s device is not connected to the local network, authentication can take place over some type of virtual private network (VPN) or web portal.

Question 5

How does Linux Authentication work?

Answer 5

Local user account names are stored in /etc/passwd.

When a user logs in to a local interactive shell, the password is checked against a hash stored in /etc/shadow.

Interactive login over a network is typically accomplished using SSH. With SSH the user can be authenticated using cryptographic keys instead of a password.

Question 6

What is PAM? (Pluggable Authentication Module.)

Answer 6

Pluggable Authentication Module.
A package for enabling different authentication providers, such as smart card login.
The PAM framework can also be used to implement authentication to network servers.

Question 7

What does SSO do?

Answer 7

Single Sign On.
Allows the user to authenticate once to a local device and be authorized to access compatible application servers without having to enter credentials again.

Ex. A user could log in to a Windows computer using a Microsoft account and be able to access OneDrive, Teams, Office 365 in Outlook, and other linked Microsoft and non-Microsoft web services, without having to sign in again.

Question 8

What are the 2 services that make up a KDC?

Answer 8

The Authentication Service: Responsible for authenticating user logon requests. Once users are authenticated the KDC server grants a Ticket Granting Ticket.

The Ticket Granting Service: When a client supplies a Ticket Granting Ticket to a Ticket Granting Service they are granted a service ticket to access resources within the domain.

Question 9

What is Kerberos?

Answer 9

A single sign-on authentication and authorization service that is based on a time-sensitive, ticket-granting system.
Provides SSO authentication to Active Directory, as well as compatibility with other, non-Windows operating systems.

Kerberos consists of three parts:
-Client (which requests services)
-Server (from which the service is requested)
-Key Distribution Center (KDC)—to vouch for their identity.

Question 10

How does asymmetric encryption work?

Answer 10

With asymmetric encryption, you generate a key pair. The private key in the pair remains a secret that only you know. The public key can be transmitted to other subjects. The private key cannot be derived from the public key.

The public key cannot be used to decrypt a message.

Question 11

What is PKI?

Answer 11

Public Key Infrastructure.
A framework of certificate authorities, digital certificates, software, services, and other cryptographic components deployed for the purpose of validating subject identities.
Aims to prove that the owners of public keys are who they say they are.

Question 12

What are self signed certificates and when are they useful?

Answer 12

A digital certificate that has been signed by the entity that issued it, rather than by a CA.
Can also be useful in development and test environments.
They are very difficult to validate and should not be used to protect critical hosts and applications.

Question 13

What is key management?

Answer 13

Operational considerations for the various stages in the lifecycle of an encryption key or key pair.

Question 14

What stages might a keys lifecycle involve?

Answer 14

Key Generation: Creates an asymmetric key pair or symmetric secret key of the required strength, using the chosen cipher.

Storage: Prevents unauthorized access to a private or secret key and protects against loss or damage.

Revocation: Prevents use of the key if it is compromised.

Expiration and Renewal: Gives the certificate that validates the key a “shelf-life” to increase security. Every certificate expires after a certain period. Certificates can be renewed with the same key pair or with a new key pair.

Question 15

What is decentralized key management?

Answer 15

That keys are generated and managed directly on the computer or user account that will use the certificate.

Question 16

What is centralized key management?

Answer 16

The practice of managing, storing, and controlling cryptographic keys within a single, unified system rather than distributing them across multiple applications or locations.

Ex. A dedicated server or appliance is used to generate and store keys. When a device or app needs to perform a cryptographic operation, it uses the Key Management Interoperability Protocol (KMIP) to communicate with the server.

Question 17

What is Federation?

Answer 17

The notion that a network needs to be accessible to more than just a well-defined group of employees.
In business, a company might need to make parts of its network open to partners, suppliers, and customers.
Federation means that the company trusts accounts created and managed by a different network.

ex. If Google and Facebook establish a federated network for the purpose of authentication and authorization, then the user can log on to Facebook using their Google credentials or vice versa.

Question 18

How is Federated identity management done?

Answer 18

1.A service provider (SP) establishes a trust relationship with an identity provider (IdP).

2. The principal attempts to access a service provider.
3. The service provider redirects the principal to the IdP.
4. The principal authenticates with the identity provider.
5. If authentication is successful, the principal obtains a claim, in the form of some sort of token or document signed by the IdP.

6.The principal presents the claim to the service provider. The SP can validate that the IdP has signed the claim because of its trust relationship with the IdP.

Question 19

What is SAML?

Answer 19

Security Assertion Markup Language.
An XML-based data format used to exchange authentication information between a client and a service.

SAML assertions (claims) are written in eXtensible Markup Language (XML).
Communications are established using HTTP/HTTPS and the Simple Object Access Protocol (SOAP).
The secure tokens are signed using the XML signature specification.
The use of a digital signature allows the relying party to trust the identity provider.

Question 20

What is the AAA architecture and what are its components?

Answer 20

authentication, authorization, and accounting.
AAA uses the following components:
-Supplicant: The device requesting access i.e a user’s PC or laptop.

-Network access server (NAS) or network access point (NAP): Edge network appliances, such as switches, access points, and VPN gateways. These are also referred to as AAA clients or authenticators.

-AAA server: The authentication server, positioned within the local network. This server either holds a database of accounts and credentials or has access to a directory server that can authenticate requests and issue SSO authorizations. There are two main types of AAA server: RADIUS and TACACS+.

NOTE: Remote Access typically uses AAA architecture.

Question 21

What is RADIUS?

Answer 21

Remote Authentication Dial-In User Service.
An AAA protocol used to manage remote and wireless authentication infrastructures.
Very widely used for client device access over VPNs.
Typically uses UDP ports 1812 and 1813.
Each RADIUS client must be configured with the IP address of the RADIUS server plus the same shared secret.

Question 22

What is TACAS+?

Answer 22

Terminal Access Controller Access Control System.
An AAA protocol developed by Cisco that is often used to authenticate to administrator accounts for network appliance management.
A similar protocol to RADIUS but designed to be more flexible and reliable because it separates the AAA functions while RADIUS does not.
It is also supported on many of the other third-party and open source RADIUS server implementations.
Often used in authenticating administrative access to routers and switches.
Uses TCP over port 49, and the reliable delivery offered by TCP makes it easier to detect when a server is down.

Question 23

What is a key pair in public key cryptography?

Answer 23

A set of two keys, one public and one private, used together.

Question 24

Which factor determines the type of credential a subject can use for authentication?

Answer 24

Authentication Factor.

Question 25

What is Role-based access control (RBAC)?

Answer 25

An access control model where resources are protected by ACLs that are managed by administrators and that provide user permissions based on job functions. An organization defines its authorizations in terms of the tasks that an employee or service must be able to perform. Each set of permissions is a role. Under this system, the right to modify the permissions assigned to each role is reserved to a system owner. Principals gain rights implicitly (through being assigned to a role) rather than explicitly (being assigned the right directly).

Question 26

What is Discretionary access control (DAC)

Answer 26

An access control model where each resource is protected by an access control list (ACL) managed by the resource's owner (or owners). In a DAC model, every resource has an owner. The owner has full control over the resource, and they can modify its access control list (ACL) to grant rights to others.

Question 27

What is Privileged access management (PAM)?

Answer 27

Refers to policies, procedures, and technical controls to prevent the malicious abuse of privileged accounts by internal threat actors and to mitigate risks from weak configuration control over authorizations. These controls identify and document privileged accounts, giving visibility into their use and managing the credentials used to access them.

Question 28

What are general principals of Privileged access management (PAM)?

Answer 28

Least privilege: Means that a user is granted sufficient rights to perform their job and no more. Least privilege should be ensured by closely analyzing business workflows to assess what privileges are required and by performing regular account audits. Separation of Duties: A means of establishing checks and balances against the possibility that critical systems or procedures can be compromised by insider threats. Duties and responsibilities should be divided among individuals to prevent ethical conflicts or abuse of powers.

Question 29

What is authorization creep?

Answer 29

Refers to a situation where a user acquires more and more rights, either directly or by being added to security groups and roles.

Question 30

What is the main directory standard?

Answer 30

X.500 series of standards.

Question 31

What is LDAP?

Answer 31

Lightweight Directory Access Protocol. A protocol used to access network directory databases, which store information about authorized users and their privileges, as well as other organizational information. Specifically designed for querying and updating directory services, allowing for the management of user identities, groups, and access permissions in a networked environment. LDAP is widely supported in current directory products, most notably in Windows Active Directory. Insecure LDAP messaging uses TCP and UDP port 389 by default.

Question 32

What are unique identifiers in X.500 called?

Answer 32

Each object has a unique identifier called a distinguished name. A distinguished name is made up of attribute value pairs, separated by commas.

Question 33

What are some ways authentication (referred to as binding to the server) can be implemented?

Answer 33

Simple bind:The client must supply its distinguished name (DN) and password, but these are passed as plaintext. Simple Authentication and Security Layer (SASL):This framework allows a client and server to negotiate authentication and encryption parameters to make a connection over TCP port 389 secure. The client and server negotiate the use of a supported authentication mechanism, such as Kerberos. The STARTTLS command can be used to require certificate-based encryption (sealing) and message integrity (signing). LDAP Secure (LDAPS)—The server is installed with a digital certificate, which it uses to set up a secure Transport Layer Security (TLS) session to authenticate the server and protect the user's LDAP credentials and data. LDAPS uses port 636.

Question 34

What is defense in depth?

Answer 34

A security strategy that positions the layers of diverse security control categories and functions as opposed to relying on perimeter controls. So that all access attempts are authenticated, authorized, and audited.

Question 35

What is a NAC?

Answer 35

Network Access Control. A system for authenticating endpoints before they can fully connect to the network. This is principally designed to mitigate risks from rogue devices and services.

Question 36

Why should you disable unused switch ports?

Answer 36

Access to the physical switch ports and switch hardware should be restricted to authorized staff, using a secure server/equipment room and/or lockable hardware cabinets. To prevent the attachment of unauthorized devices, a switch port can be disabled using the management software or isolated to a VLAN with no route to the network (a sinkhole VLAN). On a Cisco switch, these configuration settings will generally be applied using some version of a switchport command or subcommand.

Question 37

What is MAC filtering?

Answer 37

Applying an access control list to a switch or access point so that only clients with approved MAC addresses can connect to it. Means defining which MAC addresses are permitted to connect to a particular port. This can be done by creating a static lock list of valid MAC addresses or by specifying a limit to the number of permitted addresses. NOTE: The dynamic method is often referred to as sticky MACs. Addresses are dropped from the table if they go unused for a specified amount of time.

Question 38

What happens if a host attempts to connect with a MAC address that violates policy?

Answer 38

The switch port enters a violation state: -Protect mode means the port drops frames from the invalid source address but keeps the interface open otherwise. Protect mode can only be used with sticky MACs. -Restrict mode drops frames and logs and alerts violations but also keeps the interface open. -Shutdown mode disables the port and sends alerts. The port must be manually re-enabled using the no shutdown command. This is the default mode.

Question 39

What is Extensible Authentication Protocol (EAP)?

Answer 39

Provides a framework for deploying multiple types of authentication protocols and technologies when an endpoint device needs to be authenticated before it can join the network. This pre-authentication requirement arises in a number of scenarios: -When the user is accessing a wireless network and needs to authenticate with the network directory server. -When a device is connecting to a network via a switch and network policies require the user to be authenticated before the device is allowed to communicate. -When the user is connecting to the network over a public network via a virtual private network (VPN). EAP allows many different authentication methods.

Question 40

What is IEEE 802.1X Port-Based Network Access Control (NAC)?

Answer 40

A standard for encapsulating EAP communications over a LAN (EAPoL) or WLAN (EAPoW) to implement port-based authentication. Provides the means of using an EAP(Extensible Authentication Protocol) method when a device connects to an Ethernet switch port, wireless access point, or VPN gateway. Uses AAA (Authentication, Authorization, and Accounting) architecture

Question 41

What is a health policy?

Answer 41

A health policy means that the client must submit an attestation report. This secure report proves that the client is running an authorized OS and has up-to-date patches and security scanner configurations.

Question 42

What is port mirrioring?

Answer 42

Port mirroring copies all packets sent to one or more source ports to a mirror (or destination) port. The mirror port would be used by management or monitoring software, such as a packet sniffer, network analyzer, or intrusion detection system (IDS) sensor. Captures ingress, egress or both. NOTE: Port mirroring demands a lot of processing and can lead to the switch hardware becoming overloaded and consequently crashing.

Question 43

What is port mirroring called on a Cisco Switch?

Answer 43

A switched port analyzer (SPAN).

Question 44

Name some port security features.

Answer 44

DAI (dynamic ARP inspection) : Prevents a host attached to an untrusted port from flooding the segment with gratuitous ARP replies. Good against ARP Spoofing and Poisoning. DHCP snooping: Causes the switch to inspect DHCP traffic arriving on access ports to ensure that a host is not trying to spoof its MAC address. Allows only DHCP offers from ports configured as trusted. Good against Rouge DHCP servers. Neighbor Discovery (ND) Inspection and Router Advertisement (RA) Guard. Performs similar functions to DAI and DHCP snooping but for IPv6 networks. When configuring VLANs, ensure that the default VLAN uses a different ID than any other user accessible VLAN. This mitigates against double tagging attacks. Ensure that ports allowed to be used as trunks are predetermined in the switch configuration and that access ports are not allowed to auto-configure as trunk ports. Mitigates against VLAN hopping attacks. Set up Bridge Protocol Data Units Guard, or BPDU Guard, to allow an interface to put itself into blocking state when it receives a BPDU packet meant to change the root bridge switch. Good for mitigating attacks on spanning tree and root bridge selection.

Question 45

What are ACE's

Answer 45

Access control entries. These are one line of text that contain rules or instructions for various conditions.

Question 46

What are ACLs?

Answer 46

Access control Lists. These are the security rules for what traffic is permitted and what should be blocked. Applies basic Network or Transport layer filtering.

Question 47

What is the design of a firewalls ACL guided by?

Answer 47

The principal of least access. Only allow the minimum amount of traffic required for the operation of network services that should be permitted on the network segment and no more. The rules in a firewall's ACL are processed from top to bottom.

Question 48

What is the difference between implicit deny and explicit deny?

Answer 48

implicit deny: The basic principle of security stating that unless something has explicitly been granted access, it should be denied access. explicit deny: Firewall ACL rule configured manually to block any traffic not matched by previous rules.

Question 49

What is the difference between stateless vs Stateful firewalls?

Answer 49

Stateful firewalls monitor active connections and understand packet context for high security, while stateless firewalls examine packets individually based solely on static rules. Stateful is better for protecting complex networks, while stateless is faster, ideal for simple packet filtering. Stateful firewalls maintain a session table, unlike stateless.

Question 50

What is a proxy server and what does it do?

Answer 50

A server that mediates the communications between a client and another server. It forwards requests and responses on behalf of its clients. Rather than inspecting traffic as it passes through, the proxy deconstructs each packet, performs analysis, and then rebuilds the packet and forwards it on, providing it conforms to the rules. Can also perform address translation to convert between private and public addressing schemes.

Question 51

What is a forward Proxy?

Answer 51

A forwarding proxy server provides for protocol-specific outbound traffic. Acts on behalf of the client to enhance privacy and control access.

Question 52

What is a reverse proxy?

Answer 52

A reverse proxy server provides for protocol-specific inbound traffic. Acts on behalf of the server to optimize performance and security.

Question 53

What is the difference between transparent and non transparent proxy?

Answer 53

Transparent: A transparent (or "forced" or "intercepting") proxy intercepts client traffic without the client having to be reconfigured. Non Transparent: Means that the client must be configured with the proxy server address and port number to use it. The port on which the proxy server accepts client connections is often configured as port 8080.

Question 54

What is content filtering?

Answer 54

Security measure performed on email and Internet traffic to identify and block suspicious, malicious, and/or inappropriate content in accordance with an organization's policies. Capable of applying Application layer filters based on HTTP data.

Question 55

What are some of the criteria that a content filtering proxy or firewall can restrict access on?

Answer 55

Uniform Resource Locator (URL) filtering: Can scan URLs, use simple domain filtering, or use regular expression pattern matching to black or allow access. Content and reputation-based filtering: his filtering leverages continually updated databases that score websites based on their observed behavior and history. So sites known for malware would automatically be blocked. Can also sort websites into categories allowing for filtering that way.

Question 56

What is the most specific attribute in a distinguished name called?

Answer 56

Relative Distinguished Name (RDN)