Net + Mod 9 Explaining Network Security Concepts

Question 1

Common Security Terminology

Mod 9.1 Security Concepts
Objective 4.1

Answer 1

CIA triad
- Confidentiality: means that certain information should only be known to certain people

• Integrity: means that the data is stored and transferred as intended and that any modification is authorized
• Availability: means that information is accessible to those authorized to view or modify it

DAD triad
- Disclosure
- Alteration
- Destruction

VTR (V+T=R)
- Vulnerability: weakness that could be accidentally triggered or intentionally exploited to cause a security breach

• Threat: The potential for someone or something to exploit a vulnerability and breach security
• Risk: likelihood and impact (or consequence) of a threat actor exercising a vulnerability

Question 2

Security Audits and Assessments

Mod 9.1 Security Concepts
Objective 4.1

Answer 2

Risk Management: process for identifying, assessing, and mitigating vulnerabilities and threats to the essential functions that a business must perform to serve its customers

Posture Assessment: overall status of risk management is referred to as risk posture, shows which risk response options can be identified and prioritized

Process Assessment:
- MEF: Mission essential function - Business or organizational activity that is too critical to be deferred for anything more than a few hours, if at all
- BIA: Business impact analysis - Systematic activity that identifies organizational risks and determines their effect on ongoing, mission critical operations

Question 3

Regulatory Compliance

Mod 9.1 Security Concepts
Objective 4.1

Answer 3

Regulatory Compliance: imposes externally determined requirements on companies in certain industries or when processing certain types of data

• PII
• GDPR: General Data Protection Regulation European
• Data Sovereignty: jurisdiction preventing or restricting processing and storage from taking place on systems that do not physically reside within that jurisdiction
• PCS DSS: Payment Card Industry Data Security Standard

Question 4

Encryption

Mod 9.1 Security Concepts
Objective 4.1

Answer 4

Symmetric: keys same on both sides
Asymmetric: public and private keys

encryption algorithm: converts a human-readable plaintext into a ciphertext

cryptographic hash algorithm: converts a variable length string into a fixed-length hash, cannot be converted back to a plaintext

Data at rest: data is in some sort of persistent storage media
Data in transit: data is transmitted over a network
Data in use: data is present in volatile memory (RAM/CPU)

Question 4

Attack Types

Mod 9.2 Network Threats and Attacks
Objective 4.2

Answer 4

Enumeration: An attack that aims to list resources on the network, host, or system as a whole to identify potential targets for further attack
- Footprinting: discover the topology and general configuration of the network and security systems, social engineering attacks, TCP/UDP application ports
- Fingerprinting: identify device and OS types and versions

Spoofing: Attack technique where the threat actor disguises his or her identity or impersonates another user or resource

DoS / DDoS: single/multiple physical, application, or network attack to manage resources

Question 5

Vulnerability and Exploit Types

Mod 9.1 Security Concepts
Objective 4.1

Answer 5

Exploit: specific code or method of using a vulnerability to gain control of a system or damage it in some way

Zero-day: vulnerability that is exploited before the developer knows about it or can release a patch

Vulnerability assessment: evaluation of a system’s security and ability to meet compliance requirements based on the configuration state of the system

Question 6

Deception Technologies

Mod 9.1 Security Concepts
Objective 4.1

Answer 6

Honeypot: A host (honeypot), network (honeynet), file (honeyfile), or credential/token (honeytoken) set up with the purpose of luring attackers away from assets of actual value and/or discovering attack strategies and weaknesses in the security configuration

Question 7

Threat Types and Assessment

Mod 9.2 Network Threats and Attacks
Objective 4.2

Answer 7

External: threat actor or agent is one that has no account or authorized access to the target system
Internal: insider threat, has been granted permissions on the system

Threat Research: counterintelligence gathering effort in which security companies and researchers attempt to discover the tactics, techniques, and procedures (TTPs) of threat actors

Question 8

Threat Types and Assessment

Mod 9.2 Network Threats and Attacks
Objective 4.2

Answer 8

Behavioral threat research: Narrative commentary describing examples of attacks and TTPs gathered through primary research sources

Reputational threat intelligence: Lists of IP addresses and domains associated with malicious behavior, plus signatures of known file-based malware

Threat data: Computer data that can correlate events observed on a customer’s own networks and logs with known TTP and threat actor indicators

Question 9

Distributed DoS Attacks and Botnets

Mod 9.2 Network Threats and Attacks
Objective 4.2

Answer 9

reflection DoS (DRDoS): amplification attack, victim’s IP address and attempts to open connections with multiple servers

Botnets: group of compromised hosts that can be used to launch DDoS and DRDoS attacks

command and control (C2 or C&C): network established between the handlers and the bots

Question 10

MAC Flooding Attack / VLAN Hopping Attacks

Mod 9.3 Spoofing Attacks
Objective 4.2

Answer 10

MAC Flooding: A variation of an ARP poisoning attack where a switch’s cache table is inundated with frames from random source MAC addresses

VLAN Hopping Attacks: send traffic to a VLAN other than the one the host system is in

Question 10

Malware Attacks

Mod 9.2 Network Threats and Attacks
Objective 4.2

Answer 10

Malware: Software that serves a malicious purpose, typically installed without the user’s consent (or knowledge)

• Viruses and worms: spread without any authorization from the user by being concealed within the executable code of another process, files/process running system memory
• Trojan: concealed within an installer package for software
• Potentially unwanted programs (PUPs)/Potentially unwanted applications (PUAs): Software installed alongside a package selected by the user or perhaps bundled with a new computer system

Shellcode: lightweight block of malicious code that exploits a software vulnerability to gain initial access to a victim system

advanced persistent threat (APT): attacker’s ability to obtain, maintain, and diversify access to network systems using exploits and malware

Question 11

On-Path Attacks

Mod 9.3 Spoofing Attacks
Objective 4.2

Answer 11

On-Path: attack is a specific type of spoofing attack where a threat actor compromises the connection between two hosts and transparently intercepts and relays all communications between them

MAC/IP Spoofing

ARP Spoof/ Poisoning: broadcasting unsolicited ARP reply packets w/source address that spoofs a legitimate host or router interface

Question 12

Rogue Devices and Services / Rogue DHCP

Mod 9.4 Rogue System Attacks
Objective 4.2

Answer 12

Rogue: device or service on your network isn’t under the administrative control of the network staff

Rogue DHCP
- deployed accidentally (forgetting to disable a DHCP server in an access point or router, for instance)

-rogue server to change the default gateway and/or DNS resolver addresses for the subnet and route communications via their machine On-path attack

Question 12

DNS Attacks

Mod 9.4 Rogue System Attacks
Objective 4.2

Answer 12

DNS poisoning: injects false resource records into a client or server cache to redirect a domain name to an IP address of the attacker’s choosing

DNS-Based On-Path Attacks: ARP poisoning to respond to DNS queries from the victim with spoofed replies

DNS Client Cache Poisoning: attacker is able to place a false name IP address mapping in the HOSTS file and effectively poison the DNS cache, they will be able to redirect traffic

DNS Server Cache Poisoning: corrupt the records held by the DNS server itself

Question 13

Social Engineering Attacks

Mod 9.5 Social Engineering
Objective 4.2

Answer 13

Phishing
Shoulder Surfing Attack
Tailgating and Piggybacking Attacks
Dumpster diving: organization’s (or individual’s) garbage to try to find useful documents/USB files

Question 14

Password Attacks

Mod 9.5 Social Engineering
Objective 4.2

Answer 14

Passwords or password hashes can be captured by obtaining a password file or by sniffing the network

Stored in: Secure Hash Algorithm (SHA), Message Digest v5 (MD5) = fixed-length string from a variable-length string

Plaintext string
Dictionary: software matches the hash to those produced by ordinary words found in a dictionary (personal info)
Brute Force: software tries to match the hash against one of every possible combination it could be