NETWORK SECURITY EXAM 1

Network Security

consists of configurations and practices utilized to protect against & monitor unauthorized access/modifications of a network.

attack

any action that compromises the security of data on a system

threat

any action that could damage an asset

cybersecurity kill chain

attack surface

consists of the reachable & exploitable vulnerabilities on a system

firewall

acts as a gate between a network, allowing and denying network traffic based on its configurations

firewall goals…

• All traffic, in and out, must pass through the firewall

• Only authorized traffic (defined by firewall config) is allowed to pass

• The firewall itself is immune to penetration

stateful

filters traffic based on trusted networks/IP addresses

stateless

filters traffic based on fixed rules and doesn’t remember any packet information

DMZ (Demilitarized Zone)

an isolated network zone that acts as a buffer between internal network and the internet

IDS

Passive system used to identify anomalous traffic on a network

IPS

Active system used to control anomalous network traffic

signature-based

relies on a se of pre-configured list of rules for known traffic patterns

anomaly-based

utilizes a model of normal patterns on the network, and alerts anomalous patterns

NGFW

enhanced functions of a traditional firewall, while additionally have IPS capabilities

UTM

App identification

User identification

Content identification

DNSSec

authentication & integrity verification of DNS recordss

Blacklist vs Whitelist…

• Blacklist = (default; allow)

• Whitelist = (default; deny)

Single Bastion T

Double Bastion T

DNS zone

a specific portion of the DNS that is mananaged by an administrator or set of name servers; contains all DNS records for domains

DNS domain

a name that serves as an address for a site or service on the internet

Buffer overflow

a cyberattack where an attacker sends an abundance of data to overwhelm a system

Session hijacking

a cyberattack where an attack steals a legitimate user’s session ID to gain unauthroized access

DNS-cache poisoning

a cyberattack taht causes a DNS resolver to return an false IP address by corrupting data in resolver’s cache

packet filtering

port hopping

out-of-band vs inline…

network security monitoring (NSM)

Continuous Monitoring (CM)

Firewall Rules Order: