Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
security infrastruct
| Question | Answer |
|---|---|
| Port | Logical communication endpoint that exists on a computer or server |
| inbound port | Logical communication opening on a server that is listening for a connection from a client |
| outbound port | Logical communication opening created on a client in order to call out to a server that is listening for a connection |
| Port number range | 0-65,535 |
| well-known ports | Ports 0 to 1023 are considered well-known and are assigned by the Internet Assigned Numbers Authority (IANA) |
| HTTPS | port 443 |
| Telnet | port 23 |
| registered ports | ports 1024 to 49,151 are considered registered and are usually assigned to proprietary protocols |
| SQL | port 1433 |
| RDP | 3389 |
| Dynamic and private ports | port 49,152 to 65,535 can be used by any application without being registered with IANA |
| Protocol | Rules governing device communication and data exchange |
| File Transfer Protocol (FTP) | port 21 (TCP) file transfer from host to host |
| SSH, SCP, SFTP | Port 22 (TCP) provides secure remote terminal access and file transfer capabilities, secure copy functions, and secure file transfers |
| Telnet | Port 23 (TCP) Provides insecure remote control of another machine using a text-based environment |
| Simple Mail Transfer Protocol (SMTP) | Port 25 (TCP) provides the ability to send emails over the network |
| Domain Name System (DNS) | Port 53 (TCP and UDP) Translates domain names into IP addresses |
| Trivial File Transfer Protocol (TFTP) | Port 69 (UDP) used as a lightweight file transfer method for sending configuration files or network booting of an operating system |
| Hypertext Transfer Protocol (HTTP) | Port 80 (TCP) used for insecure web browsing |
| Kerberos | Port 88 (UDP) network authentication protocol |
| Post Office Protocol Version Three (POP3) | PORT 110 (TCP) responsible for retrieving email from a server |
| Network News Transfer Protocol (NNTP) | Port 119 (TCP) Used for accessing newsgroups |
| Remote Procedure Call (RPC) | Port 135 (TCP and UDP) Facilities communication between different system processes |
| NetBIOS | Ports 137, 138, and 139 (TCP and UDP) networking protocol suite |
| Internet Message Access Protocol (IMAP) | Port 143 (TCP) allows access to email messages on a server |
| Simple network management protocol (SNMP) | port 161 (UDP) manages network devices |
| SNMP Trap | Port 162 (UDP) responsible for sending SNMP trap messages |
| Lightweight directory access protocol (LDAP) | Facilitates directory services |
| HTTP Secure (HTTPS) | Port 443 (TCP) provide secure web communication |
| Server Message Block (SMB) | Port 445 (TCP) used for file and printer sharing over a network |
| SMTP Secure (SMTPS) | Port 465 and 587 (TCP) provides secure SMTP communication |
| Syslog | Port 514 (UDP) using for sending log messages |
| LDAP secure (LDAPS) | Port 636 (TCP) LDAP communication over SSL/TLS |
| Internet Message Access Protocol over SSL/TLS (IMAPS) | port 993 (TCP) used for secure email retrieval |
| Post Office Protocol version 3 over SSL/TLS (POP3S) | port 995 (TCP) used for secure email retrieval |
| Microsoft SQL | Port 1433 (TCP) used to facilitate communication with Microsoft SQL Server |
| RADUIS TCP | Ports 1645 and 1646 (TCP) used for remote authentication, authorization, and accounting |
| RADIUS UDP | ports 1812 and 1813 (UDP) used for authentication and accounting as defined by the Internet Engineering Task Force (IETF) |
| Remote Desktop Protocol (RDP) | ports 3389 (TCP) enables remote desktop access |
| syslog TLS | ports 6514 (TCP) used in a secure syslog that uses SSL/TLS to encrypt the IP packets using a certificate before sending them across the IP network to the syslog collector |
| firewalls | Can be hardware appliances or specialized software installed in a device to control network traffic |
| Screened subnet (Dual-homed Host) | Act as a security barrier between external untrusted networks, and internal trusted networks, using a protected host with security measures like a packet-filtering firewall |
| Packet filtering firewall | Checks packet headers for traffic allowance based on IP addresses port numbers |
| Stateful firewall | Monitors all inbound and outbound network connections and requests |
| Proxy firewall | Act as an intermediary between internal and external connections, making connections on behalf of other endpoints |
| Circuit level | Like a SOCKS firewall, operates at the layer 5 of the OSI model |
| Application level | Conducts various proxy functions for each type of application at the layer 7 of the OSI model |
| Kernel proxy firewall (fifth generation firewall) | Has minimal impact on network performance while thoroughly inspecting packets across all layers |
| Next generation firewall (NGFW) | Aims to address the limitations of traditional firewalls by being more aware of applications and their behaviors. Merges standard firewall functions with advanced threat detection and application awareness |
| Unified threat management firewall (UTM) | Provides the ability to conduct multiple security functions in a single appliance. Combine security platform that integrates firewall, antivirus, intrusion detection, and contents filtering |
| Web application firewall (WAF) | Focuses on the inspection of the HTTP traffic and applies rule sets to prevent common web-based attacks |
| Inline configuration | Device sits between the network firewall and the web servers |
| Out of band configuration | Device receives a mirrored copy of Web server traffic |
| Layer 4 firewall | Filters based on port numbers and protocols, without inspecting packet content |
| layer 7 firewall | Inspects and controls traffic based on data content and application characteristics |
| Access control list (ACL) | A rule set that is placed on firewall routers and other network infrastructure devices that permit or allow traffic through a particular interface |
| IDS | logs and alerts, detects |
| IPS | logs, alerts, takes action, detects and reacts |
| Network intrusion detection systems (NIDS) | Responsible for detecting unauthorized network access or attacks |
| Network IDS (NIDS) | Monitors the traffic coming in and out of a network |
| Host based IDS (HIDS) | Looks at suspicious network traffic going to or from a single server or endpoint |
| Wireless IDS (WIDS) | Detect attempts to cause a denial of service on a wireless network |
| Signature based IDS | Analyzes traffic based on defined signatures and can only recognize attacks based on previously identified attacks in its database |
| Pattern matching | Specific pattern of steps. NIDS, WIDS |
| Stateful- matching | Known system baseline. HIDS. |
| Anomaly-based/behavioral-based IDS | Analyzes traffic and compares it to a normal baseline of traffic to determine whether a threat is occurring |
| Intrusion prevention systems (IPS) | Scans traffic to look for malicious activity and takes action to stop it |
| Network appliance | Dedicated hardware device with pre-installed software that is designed to provide specific networking services |
| Load balancer | Crucial component in any high-availability network or system that is designed to distribute network or application traffic across multiple servers |
| Proxy server | Intermediary between a client and a server to provide various functions like content cashing, request filtering, and login management |
| Network sensor | Designed to monitor, detect and analyze traffic and data flow across a network in order to identify any unusual activities, potential security, breaches or performance issues |
| Jump server/box | Dedicated gateway used by system administrators to securely access devices located in different security zones within the network |
| Port security | Common security feature found on network switches that allows administrators to restrict which devices can connect to a specific port based on the network interface cards MAC address |
| Content addressable memory (CAM) table | Used to store information about the MAC addresses that are available on any given port of the switch |
| Persistent (sticky) MAC learning | Feature in network port security where the switch automatically learns and associates MAC addresses with specific interfaces |
| 802.1X protocol | Standardize framework that is used for port based authentication for both wired and wireless networks |
| RADIUS | cross platform |
| TACACS+ | cisco-proprietary protocol |
| EAP-MD5 | Variant that utilizes simple Passwords and the challenge handshake authentication process to provide remote access authentication |
| EAP – TLS | Form of EAP that uses Public key infrastructure with a digital certificate being installed on both the client and the server as the method of authentication |
| EAP – TTLS | Variant that requires a digital certificate on the server, but not on the client |
| EAP – fast | Variant that uses a protected access credential, instead of a certificate, to establish mutual authentication between devices |
| PEAP | Variant that supports mutual authentication by using server certificates in the Microsoft active directory databases for it to authenticate a password from the client |
| LEAP | Variant of EAP the only works on Cisco based devices |
| Port security | Common security feature found on network switches that allows administrators to restrict which devices can connect to a specific port based on the network interface cards MAC address |
| Virtual private network (VPN) | Extends a private network over a public one, enabling users to securely send and receive data |
| Site to site VPN | Establishes secure, tunnels over the public Internet for interconnecting remote sites |
| Client to site VPN | Connects individual devices directly to the organizations headquarters, enabling remote users to access the network |
| Full tunnel | Maximize security by encrypting all traffic to the headquarters while integrating clients with the network |
| Split tunnel | Divides traffic and network requests and then route them to the appropriate network. Offers better performance. |
| Clientless VPN | Secures remote access through browser-based VPN tunnels without needing client software or hardware configuration |
| Transport layer security (TLS) | A protocol that provides cryptographic security for secure connections and is used for secure web browsing and data transfer |
| Transmission control protocol (TCP) | Used by TLS to establish secure connections between a client and a server, but it may slow down the connection |
| Datagram transport layer security (DTLS) | A UDP-based version of TLS protocol that offers the same security level as TLS while maintaining faster operations |
| Internet protocol security (IPSec) | A protocol suite for secure communication through authentication and data encryption in IP networks |
| Transport mode | Employs the original IP header, ideal for client to site VPNs, and is advantageous when dealing with MTU constraints |
| Tunneling mode | Employed for site-to-site VPNs and adds an extra header that can increase packet size and exceed the MTU |
| Authentication header (AH) | Offers connectionless data integrity and data origin authentication for IP datagrams using cryptographic hash as identification information |
| Encapsulating security payload (ESP) | Employed for providing authentication, integrity, replay protection, and data confidentiality by encrypting the packets payload |
| Software-defined wide area network (SD-WAN) | Virtualized approach to managing and optimizing wide area network connections to efficiently route traffic between remote sides, data centers, and cloud environments |
| Secure Access service edge (SASE) | Used to consolidate numerous networking and security functions into a single cloud native service to ensure that secure and access for end users can be achieved |
| Security zone | Distinct segment within a network, often created by logically isolating the segment using a firewall or other security device |
| Screen subnet | Host public facing services such as web servers, email servers and DNS servers and safeguards against security breaches by preventing attackers from gaining direct access to the sensitive core internal network |
| Attack surface of a network | Refers to all the points where an unauthorized user can try to enter data to or extract data from an environment |
| Connectivity | Refers to how different components of a network communicate with each other and with other external networks |
| Control | A protective measure put in place to reduce potential risk in safeguard and organizations assets |
| Least privilege | Users or systems are granted only the necessary access rights to perform their duties reducing the attack surface |
| Defense in depth | Emphasize the use of multiple layers of security to mitigate threats even if one control fails |
| Risk based approach | Prioritizing controls based on potential risk and vulnerabilities specific to the infrastructure to make efficient use of resources |
| Lifecycle management | Regulatory reviewing, updating, and retiring controls to adapt to evolving threat landscapes |
| Open design principle | Ensuring transparency and accountability through rigorous testing and scrutiny of infrastructure and controls |
Created by:
user-2044395