Flashcard Machine - create, study and share online flash cards

What are the three key goals for network security?

(Describe and give broad example)

Confidentiality - keeping data private against eavesdroppin; eg. encryption

Integrity - keeping data from being altered; eg. hash/checksum verification to prevent MitM attacks

Availability - keeping data/hosts/services available for intended purposes; eg. rate limiting to stop excessive flows against DoS attacks

Trying to gain info about network such as IP addresses, device types, software revisions

use cryptographic protocols (eg. IPsec, SSL, SSH) to protect data in transit

use switches instead of hubs to reduce ports/LAN segments that data is sent to

password attacks

trust exploitation (elevating existing privileges to root/admin level)

man-in-the-middle

Denial of Service

Identify the acronyms of the following Cisco "Self-Defending Network" solutions:

IPS

ASA

NAC

MARS

monitors traffic for attacks matching signature

automatically modify firewall and ACLs

firewall

supports antivirus, IPsec, VPN

also can integrate IPS and NAC

Detects the presence of potential Distributed Denial of Service attacks

Blocks malicious traffic in real-time while not affecting the flow of legitmate/critical traffic

Works in conjunction with DDoS Guard

Uses behavior analysis to maintain profile for normal traffic

Detect deviations outside of defined DDoS Guard signatures

Software installed on endpoint systems

Defends against targeted attacks, spyware, rootkits, day-zero attacks

Contains built-in IPS, malicious mobile code protection, OS patch assurance, audit logs

Allows admins to authenticate, authorize, evaluate, and remediate users on network

Can quarantine and prevent noncompliant end hosts from accessing network

Security monitoring for security devices and host applications

Supports event aggregation, device discovery, compliance reporting, notifications

Assists in analysis/response of threats on network

use SSH instead of telnet

updated IOS

configure ACLs

use difficult & encrypted passwords

  disable uneeded services

1. classifying for QoS

2. filtering routing updates

3. defining interesting traffic for dial-on-demand

4. identify address ranges for NAT

What are the ACL number ranges for:

IP Standard ACL

IP Extended ACL

IP Standard Expanded Range ACL

IP Extended Expanded Range ACL

more meaningful to read

supports both standard and extended ACLs

allow removal of individual lines

What are the syntax for port operators and ICMP operators in Extended ACL config?

What is the syntax for applying an ACL on:

interface

telnet/ssh

What are the three advanced options/keywords that can be configured on an ACL line?

What are their functions and what kind of ACLs support them?

standard - close to the destination of filtered traffic

extended - close to the source of filtered traffic

Private side of the network

Usually the source of addresses being translated

Public side of the network

Address space to which inside/private hosts are being translated to

located on the "inside"

addresses assigned to inside/private hosts, which are the ones being translated

located on the "outside"

addresses to which the inside local address get translated to

usually IPs registered with the ISP

located on the outside

registered IPs assigned to web servers, mail servers, or any host reachable on the public network itself

addresses of the outside global hosts as they appear on the inside network

may or may not have been translated, depending on configuration

conserves the registered IP address space

security by hiding originating IP & preventing inside access

Application incompatibilities with the nature of changing the source IP of traffic

introduces additional latency to transmission

one-on-one mapping of inside local to inside global IP

gives hosts such as mail/web servers on the private network access to the public internet & vice-versa

What are the characteristics of Dynamic NAT?

enables an inside host to get to an outside address when/as needed

still doesn't conserve IP

inside source: access list

outside IP range: NAT pool

Port Address Translation

aka extended NAT entry

uses source ports of hosts to distinguish translated flows, possibly to a single outside address

What are the commands to verify (show) NAT configuration/stats?

What is the command to clear dynamic NAT entries?

show ip nat translations

show ip nat statistics

 - snapshot of how many translations performed, overview of config, amount of pool used

clear ip nat translation *