Security Final Exam Spring [[KEEP_s+]] - Recently Updated Verified

Security Final Exam Spring [[KEEP_s+]] - Recently Updated Verified IDS - answer - Intrusion Detection System NIDS - answer - Network-based intrusion detection system. IDS used to monitor a network. It can detect network-based attacks, such as smurf attacks. A NIDS cannot monitor encrypted traffic, and cannot monitor traffic on individual hosts. NIPS - answer - Network Intrusion Prevention System SIEM - answer - Security Information and Event Management - Acronym which refers to a technology that allows for real-time analysis of security alerts generated by network hardware and applications Radius - answer - Remote Authentication Dial-In User Service IPSec - answer - Internet Protocol Security. Used to encrypt traffic on the wire and can operate in both tunnel mode and transport mode. It uses tunnel mode for VPN traffic. IPsec is built into IPv6, but can also work with IPv4 and it includes both AH and ESP. AH provides authentication and integrity, and ESP provides confidentiality, integrity, and authentication. IPsec uses port 500 for IKE with VPN connections. ADC - answer - Application Delivery Controller - To mitigate the impact of SSL processing on the load balancer, SSL acceleration/ TLS acceleration is used. Load balancers are combined with SSL accelerators. This type of device is commonly referred to as an application delivery controller (ADC). SPAN - answer - Switched Port Analyzer (Mirror Port) - access traffic moving through a SPAN-supporting network switch. Configuration is done by mirroring traffic from selected ports or VLANs to the SPAN port. TAP - answer - Test Access Points - A tap is designed to copy the information in a network connection, thereby eliminating it as a point of failure in the network. A tap also can provide copies to multiple tools for data analysis. By design, taps provide traffic visibility without impacting monitored traffic. SDN - answer - Software Defined Network Software - is a method by which organizations can manage network services through a decoupled underlying infrastructure, allowing quick adjustments to changing business requirements. DMZ - answer - A demilitarized zone (DMZ) is a small network between the internal network and the Internet that provides a layer of security and privacy. Extranet - answer - An extranet is a subnet or segmented zone of the public portion of the company's IT infrastructure that grants resource access by partners and resellers that have proper authorization and authentication. Intranet - answer - intranet is a subnet portion or segmented zone of the internal network that uses web-based technologies. Sensor - answer - A sensor collects information about your network and can really be anything from a network tap to a firewall log. Sensors are found in both NIDS and NIPS and have real-time network awareness. Virus - answer - A virus is a program or piece of code that runs on your computer, often without your knowledge and certainly without your consent. Worm - answer - a software program capable of reproducing itself that can spread from one computer to the next over a network Trojan Horse - answer - Trojan horses are programs disguised as useful applications. Trojans do not replicate themselves as viruses do, but they can be just as destructive. Code hidden inside the application can attack your system directly or allow the code originator to compromise the system. Spyware - answer - spyware is software that communicates information from a user's system to another party without notifying the user. Root kit - answer - A rootkit is a piece of software that can be installed and hidden on a computer mainly to compromise the system and gain escalated privileges, such as administrative rights. A rootkit is usually installed on a computer when it first obtains user-level access. The rootkit then enables the attacker to gain root or privileged access to the computer, which can compromise other machines on the network as well. Botnet - answer - A