Untitled Quiz

Module 1: Security Technology: Access Control, Firewalls, and Protecting Remote Connections

• Access control is the method systems use to determine user admission to trusted areas, encompassing information systems, secure zones, and the physical location. It mandates permissions or privileges for subjects (users/systems) on objects (resources), specifying access, use, and location.

• Access controls in the 1960s-70s were primarily mandatory access controls (MACs) and discretionary access controls (DACs). MACs are nondiscretionary, lattice-based, while DACs allow peer-to-peer resource sharing.

• Discretionary access controls (DACs) give users control over resource access, allowing general or specific access, often for shared resources (e.g., a hard drive).

• Nondiscretionary access controls (NDACs) are centrally managed, examples include lattice-based access control (LBAC), enabling users to be assigned access matrices for specific areas. This is often implemented via access control lists (ACLs) and capabilities tables.

• Role-based access control (RBAC) ties access to roles, granting automatic access based on assigned position, while task-based access control (TBAC) links access to specific tasks, providing granular control for short-term assignments.

• Attribute-based access control (ABAC) is another approach, using subject attributes (e.g., job function, address, etc.) to regulate access to specific resources.

Access Control Mechanisms

• Identification: The process of labeling an entity with a unique identifier, mapping it to a single entity within the security domain. This may include various elements concatenated for uniqueness.

• Authentication: Verification of an unauthenticated entity's claimed identity, including something the entity knows (password), has (token), or is (biometric).

• Authorization: Matching an authenticated entity to a list of information assets and corresponding access levels using ACLs or access control matrices. This can be done by individually verifying each entity, grouping entities by membership, or by utilizing a central authorization system.

• Accountability: Ensuring all actions are attributed to an authenticated identity using system logs, database journals, and audits to trace particular resource use.

Firewalls

• Firewalls are hardware and/or software barriers that control data flow between untrusted and trusted networks, preventing unauthorized data transfer.

• Packet-filtering firewalls: Inspect data packet headers and apply rules to allow or drop them based on criteria like IP source and destination address, protocol, and ports.

• Stateful Packet Inspection (SPI) firewalls: Maintain a state table of active connections to expedite filtering of related traffic; they keep track of conversations.

• Application Layer Proxy Firewalls: Operate at a higher network level, examining data contents for application-specific criteria.

• Firewall architectures include single bastion hosts (a single device separating trusted and untrusted networks), screened host firewalls (combining a packet filtering router with another device like an application layer proxy), and screened subnet (DMZ) architectures (using a dedicated segment between networks via a separate router.

Remote Connections

• Virtual Private Networks (VPNs) establish secure data channels over public networks like the Internet, encrypting data in transit.

Intrusion Detection and Prevention Systems (IDPSs)

• IDPSs monitor and analyze network activity to detect intrusions or suspicious events.

• IDPS Terminology:

• Alarm clustering: Combining similar alarms for easier management

• Alarm filtering: Classifying alerts based on factors like attack signature or type.

• Alert or Alarm: Notification of an attack event

• Confidence value: The probability for an alert to indicate a genuine attack.

• Evasion: Attacker techniques to avoid detection

• False Positive: An alert from an IDPS without an actual attack

• False Negative: Failure of an IDPS to detect an actual attack

• Noise: Alerts not posing significant security risks

• Site Policy: Guidelines for IDPS configuration deployment

• True Attack Stimulus: The event causing an IDPS to alert.

• IDPS types:

• Network-based IDPS (NIDPS): Monitors a network segment for traffic anomalies

• Host-based IDPS (HIDPS): Monitors a host computer for suspicious activity

• Application IDPS: Monitors (one or more) host systems for known application-specific attacks

• IDPSs can be deployed via centralized, partially, or fully distributed architectures; each strategy has benefits and drawbacks.

Honeypots, Honeynets, and Padded Cell Systems

• Honeypots and honeynets are decoy systems designed to monitor or divert attackers, providing data about attempted intrusions.

• A padded cell is a security enhancement to a honeypot designed to prevent damage to the main network.

Trap-and-Trace Systems

• Trap-and-trace methods combine attractions (honeypots) with a tracing feature designed to track the malicious activity to its source. These can be used to identify sources for criminal prosecution but have legal implications to consider.

Scanning and Analysis Tools

• Vulnerability scanners (like Nessus, Nmap, and OpenVAS) identify exposed usernames, open network shares, configuration problems, and other vulnerabilities, while passive scanners observe network traffic without initiating traffic, primarily identifying known vulnerabilities on client machines or servers.

• Packet sniffers (such as Wireshark) capture and analyze network traffic to diagnose issues and detect malicious traffic, but misuse may reveal sensitive personal or business information.