ITE 476 Exam 1

Information Assurance

The protection of information, regardless of location, as it pertains to confidentiality, integrity, availability, authentication and non-repudiation

Confidentiality

The property that information is not made available or disclosed to unauthorized individuals, entities, or processes.

Integrity

The assurance that the data is trustworthy and accurate. Maintaining and assuring the accuracy and completeness of data over its entire life-cycle.

Availability

A guarantee of reliable access to information by authorized users.

Asset

Anything within an environment that should be protected.

Threat

A person or thing that is likely to lead to interruption, meddling, or destruction of an asset.

Transitive Liability

You can be responsible for something your server does even if you did not configure it to do it.

Threat Agent

A person/thing that is likely to lead to interruption, meddling, or destruction of an asset.

Authentication

The act of verifying a claim of identity. Asserting/identifying that this is who I am by providing credentials.

Identification

Assertion of who someone is or what something is.

Authorization

The permissions/rights you have been granted based on least privilege.

Non-repudiiation

A state of affairs where the purported maker of a statement will not able to successfully challenge the validity of the statement.

Limiting

Limiting access and vulnerability footprint (only give necessary access, no more).

Layering

Providing layered access, such as more than 1 piece of security.

Obscurity

The act of not making anything obvious, or making it look like something it is not.

Diversity

Reducing mass attacks that rely on predictable behavior by not using identical software.

Hardware

The collection of physical parts of a computer system to be protected.

Software

The programs needed to accomplish the input, processing, output, storage, and control of activities in information systems.

Communications

The act of conveying intended meanings from one entity or group to another through the use of mutually understood signs and semiotic rules.

Products (Physical Security)

Physical security products, such as protective barriers, locks, UPS, and appliances.

People (Personal Security)

Personal security, such as training.

Procedures (Organizational Security)

A document that defines how to implement one or several activities of a process. Defines the sequence of steps.

Simplicity

Systems that are balanced between security and ease of use.

Vulnerability

A weakness in an asset or the absence/weakness of a safeguard/countermeasure that could allow an attacker to compromise CIA of an asset.

Risk

The possibility that something could happen to damage, destroy, or disclose data or other resources.

Stateful Inspection Firewall

A firewall that tracks the operating state and characteristics of network connections traversing the firewall. It drops all packets which are not associated with an existing connection that is recorded in its state table, preventing unsolicited connections with the protected machine. It does not allow unsolicited SYN-ACK from the 3-way handshake.

Network

Packet filtering happens on the _______ layer of the TCP/IP stack.

Transport

Stateful packet inspection is performed in the _______ layer of the TCP/IP stack.

Integrity

Ensuring that data cannot be modified in an unauthorized or undetected manner is a measure of ________.

Accuracy

_______ is measured as the closeness of a measured value to a known value.

Precision

_______ is measured as closeness of multiple measurements to each other.

Layering

________ is one of the fundamental security principles that uses more than one security measure to gain access to an asset.

Obscurity

_______ is one of the fundamental security principles that uses a modification to make something look like something it is not.

Unsolicited SYN/ACK

Stateful inspection firewalls are designed to prevent ________ _________.

Flags

State is determined by inspecting the _________ section of the TCP segment header.

business secrets

email

confidential information

patented processes

Give an example of an asset that needs protection.

Input Chain

used to control behavior for incoming connections. For example, if a user attempts to SSH into your PC/server, iptables will attempt to match the IP address and port to a rule in the input chain.

Forward Chain

used for incoming connections that aren't being delivered to the firewall itself but are forwarded through the firewall to another machine. In this case, the firewall is acting as a router between networks. For example, if a user attempts to SSH to a computer that is on the other side of the firewall, the packets are checked against the rules of the Forward chain and either allowed to go forward or dropped.

Output Chain

is used for outgoing connections. For example, if you try to ping a computer, iptables will check its output chain to see what the rules are regarding this ping before making a decision to allow or deny the connection attempt.

ip tables -L

List rules

iptables -L --line-numbers

List rules with rule numbers

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT DROP

Set default policies

iptables -F

Flush all rules

iptables-save > filename

Save rules

iptables-restore < filename

Restore rules

iptables -I

Insert rule top of list

iptables -A

Append rule to bottom of list

iptables -D [chain] [line-number]

Delete rule

iptables -R

Replace rule

ACCEPT

Allows the packet to successfully move on to its destination or another chain.

DROP

Drops the packet without responding to the requester. The system that sent the packet is not notified of the failure.

REJECT

Sends an error packet back to the remote system and drops the packet.

QUEUE

The packet is queued for handling by a user-space application.

RETURN

Stops checking the packet against rules in the current chain.

LOG

Logs all packets that match this rule.

NEW, N

Indicates a freshly initiated connection through which data has not yet passed back and forth.

ESTABLISHED, E

Indicates an existing connection that is in the process of transferring data.

RELATED

Indicates a connection that is used to facilitate another connection.

INVALID

Indicates connections that has problems in processing packets.