Ccna Security Chapter 11

Front 1

After a network is fully integrated and operational

Back 1

a Security Test and Evaluation (ST&E) is performed.

Front 2

Penetration testing

Back 2

Network penetration tests, or pen testing, simulate attacks from malicious sources.

Front 3

Network scanning

Back 3

Includes software that can ping computers, scan for listening TCP ports and display which types of resources are available on the network.

can also detect user names, groups and shared resources

Front 4

Vulnerability scanning

Back 4

Includes software that can detect potential weaknesses in the tested systems.

weaknesses can include misconfiguration, blank or default passwords, or potential targets for DoS attacks

Front 5

Password cracking

Back 5

Includes software that is used to test and detect weak passwords that should be changed.

Front 6

Log review

Back 6

System administrators should review security logs to identify potential security threats

Front 7

Integrity checkers

Back 7

An integrity checking system detects and reports on changes in the system

Front 8

Virus detection

Back 8

Virus detection software can be used to identify and remove computer viruses and other malware.

Front 9

Nmap/Zenmap

Back 9

Discovers computers and services on a computer network, thus creating a map of the network

Front 10

SuperScan

Back 10

Port scanning software designed to detect open TCP and UDP ports, determine what services are running on those ports, and to run queries, such as whois, ping, traceroute, and hostname lookups

Front 11

SIEM (Security Information Event Management)

Back 11

A technology used in enterprise organizations to provide real time reporting and long-term analysis of security events

Front 12

GFI LANguard

Back 12

Network and security scanner which detects vulnerabilities

Front 13

Tripwire

Back 13

Assesses and validates IT configurations against internal policies, compliance standards, and security best practices

Front 14

Nessus

Back 14

Vulnerability scanning software, focusing on remote access, misconfigurations, and DoS against the TCP/IP stack

Front 15

L0phtCrack

Back 15

Password auditing and recovery application

Front 16

Metasploit

Back 16

Provides information about vulnerabilities and aids in penetration testing and IDS signature development

Front 17

Nmap task

Classic TCP and UDP port scanning

Back 17

Searches for different services on one host.

Front 18

Nmap task

Classic TCP and UDP port sweeping

Back 18

Searches for the same service on multiple hosts.

Front 19

Nmap task

Stealth TCP and UDP port scans and sweeps

Back 19

Similar to classic scans and sweeps, but harder to detect by the target host or IPS.

Front 20

Nmap task

Remote operating system identification

Back 20

This is also known as OS fingerprinting.

Front 21

Advanced features of Nmap include

Back 21

protocol scanning, known as Layer 3 port scanning

Front 22

SuperScan

While Service Pack 2 for Windows XP increased the security aspect of this tool by removing certain features, some functionality can be restored by entering the __________________ command at the Windows command prompt.

Back 22

net stop Shared Access

Front 23

Security Information Event Management (SIEM)

Back 23

a technology used in enterprise organizations to provide real time reporting and long-term analysis of security events.

Front 24

SIEM

Forensic analysis

Back 24

The ability to search logs and event records from sources throughout the organization provides more complete information for forensic analysis.

Front 25

SIEM

Correlation

Back 25

Examines logs and events from disparate systems or applications, speeding detection of and reaction to security threats.

Front 26

SIEM

Aggregation

Back 26

Aggregation reduces the volume of event data by consolidating duplicate event records.

Front 27

SIEM

Retention

Back 27

Reporting presents the correlated and aggregated event data in real-time monitoring and long-term summaries.

Front 28

SIEM provides details on the source of suspicious activity, including:

Back 28

User Info

Device Info

Posture Info

Front 29

Security policy

Identification and authentication policies

Back 29

Specifies authorized persons that can have access to network resources and outlines verification procedures.

Front 30

Security policy

Password policies

Back 30

Ensures passwords meet minimum requirements and are changed regularly.

Front 31

Security policy

Acceptable use policies

Back 31

Identifies network resources and usages that are acceptable to the organization. It may also identify ramifications if this policy is violated.

Front 32

Security policy

Remote access policies

Back 32

Identifies how remote users can access a network and what is accessible via remote connectivity.

Front 33

Security policy

Network maintenance policies

Back 33

Specifies network device operating systems and end user application update procedures.

Front 34

Security policy

Incident handling policies

Back 34

Describes how security incidents are handled.

Front 35

One of the most common security policy components is an

Back 35

acceptable use policy (AUP).

Front 36

Security Policy Hierarchy

Governing policy

Back 36

High-level treatment of the security guidelines that are important to the entire company. Managers and technical staff are the intended audience.

Front 37

Security Policy Hierarchy

Technical policy

Back 37

Used by security staff members as they carry out security responsibilities for the system.

Front 38

Security Policy Hierarchy

End user policy

Back 38

Covers all security topics that are important to end users. End users can include employees, customers, and any other individual user of the network.

Front 39

governing policy includes several areas:

Back 39

Statement of the issue that the policy addresses

How the policy applies in the environment

Roles and responsibilities of those affected by the policy

Actions, activities, and processes that are allowed (and not allowed)

Consequences of noncompliance

Front 40

Technical Policies

General policies

Back 40

Includes the AUP, account access request policy, acquisition assessment policy, audit policy, information sensitivity policy, risk assessment policy, and the global web server policy.

Front 41

Technical Policies

Telephony policy

Back 41

Defines the policy for using the corporate phone and FAX lines.

Front 42

Technical Policies

Email and communications policy

Back 42

Includes generic email policy and automatically forwarded email policy.

Front 43

Technical Policies

Remote access policy

Back 43

Includes a VPN policy and may include a dial-in access policy if still supported by the organization.

Front 44

Technical Policies

Network policy

Back 44

Includes an extranet policy, minimum requirements for network access policy, network access standards, router and switch security policy, and server security policy.

Front 45

Technical Policies

Application policy

Back 45

Includes an acceptable encryption policy, application service provider (ASP) policy, database credentials coding policy, inter-process communications policy, a project security policy, and a source code protection policy.

Front 46

End User Policies

Identity policy

Back 46

Defines rules and practices for protecting the organization’s network from unauthorized access. These practices help reduce the potential for identity information getting into the wrong hands.

Front 47

End User Policies

Password policy

Back 47

Passwords are an important aspect of computer security. A password policy defines the rules that all users must follow when creating and securing their passwords.

Front 48

End User Policies

Antivirus policy

Back 48

This policy defines standards for protecting an organization’s network from any threat related to viruses, worms, or Trojan horses.

Front 49

Standards documents

Back 49

include the technologies that are required for specific uses, hardware and software versioning requirements, program requirements, and any other organizational criteria that must be followed.

Front 50

security policy documents

Back 50

include the standards, guidelines, and procedures documents.

Front 51

Guideline Documents

Back 51

define how standards are developed and to guarantee adherence to general security policies.

Front 52

Procedure Documents

Back 52

include implementation details that usually contain step-by-step instructions and graphics.

Front 53

security policy creation to ensure that the policy is

Back 53

comprehensive,

cohesive,

legally binding.

Front 54

Chief Executive Officer (CEO)

Back 54

Ultimately responsible for the success of an organization. All executive positions report to the CEO.

Front 55

Chief Technology Officer (CTO)

Back 55

Identifies and evaluates new technologies. Directs any new technology development. Responsible for maintaining and improving existing systems. Provides leadership regarding all technology-related issues that support operations. The CTO is responsible for technology infrastructure.

Front 56

Chief Information Officer (CIO)

Back 56

Responsible for all IT and computer systems that support enterprise goals. Directs successful deployment of new technologies and work processes. In small to medium-sized organizations, this role is often combined with the CTO. The CIO provides leadership when processes and practices supporting the flow of information are developed.

Front 57

Chief Security Officer (CSO)

Back 57

Develops, implements, and manages the organization’s security strategy and programs. Provides leadership for the development of any processes associated with the business operation, including safeguarding intellectual property. The CSO must limit exposure to liability in all areas of financial, physical, and personal risk.

Front 58

Chief Information Security Officer (CISO)

Back 58

The CISO has a specific focus on IT security. The CISO is responsible for developing and implementing the security policy. The CISO may be the primary author of the security policy or provide leadership to other authors. In any case, the CISO is responsible and accountable for the security policy content.

Front 59

security awareness program

Back 59

reflects the business needs of an organization tempered by known risks.

informs users of their IT security responsibilities and explains the rules of behavior for using the IT systems and data within a company.

Front 60

security awareness program usually has two major components

Back 60

Awareness campaigns

Training and education

Front 61

several methods of increasing security awareness:

Back 61

Lectures, videos

Posters, newsletter articles, and bulletins

Awards for good security practices

Reminders, such as login banners, mouse pads, coffee cups, and notepads

Front 62

The life cycle of a security training course includes several steps:

Back 62

Step 1. Identify course scope, goals, and objectives

Step 2. Identify and educate training staff

Step 3. Identify target audiences

Step 4. Motivate management and employees

Step 5. Administer the courses

Step 6. Maintain the courses

Step 7. Evaluate the course effectiveness