Security+ Element K Chapter 3

Front 1

Define a NULL Session.

Back 1

Allow an anonymous connection and query to the default, hidden Windows share IPC$, even if Guest access is disabled on the computer. Null sessions are a feature provided by NetBIOS service over TCP/IP. The attacker can determine password policy, other available shares, and user names on the machine. Can be disabled by disabling NetBIOS over TCP/IP, using a firewall, or by using third-party software.

Front 2

Define a security baseline.

Back 2

A collection of security and configuration settings that are to be applied to a particular system in the enterprise. The baseline security configuration is a benchmark tagainst which you can compare other systems in your network. Baselines differ depending on the target system.

Front 3

Name two security analyzers for Unix-based systems.

Back 3

Nessus and Nmap.

Front 4

Name two security analyzers for Microsoft-based systems.

Back 4

Microsoft Baseline Security Analyzer (MBSA) and Security Configuration Wizard (SCW).

Front 5

List the four types of software updates.

Back 5

Patch
Hotfix
Rollup
Service Pack

Front 6

Define a patch.

Back 6

Small units of supplemental code meant to address either a security problem or a functionality flaw in a software package or operating system.

Front 7

Define a hotfix.

Back 7

A patch that is often issued on an emergency basis to address a specific security flaw.

Front 8

Define a rollup.

Back 8

A collection of previously issued patches and hotfixes, usually meant to be applied to one component of a system, such as the web browser or a particular service.

Front 9

Define a service pack.

Back 9

A large compilation of system updates that can include functionality enchancements, new features, and typically all patches, updates, and hotfixes issued up to the point of the release of the service pack.

Front 10

What are the three phases of patch management.

Back 10

Evaluate
Test
Implement

Front 11

On Unix-based machines, what can be used for logging?

Back 11

Use syslog to enable logging for areas of concern such as the kernal, user activity, and system daemon activity. The auditd daemon provides robust auditing functions for Linux. Store logs in a safe location and back them up regularly.

Front 12

On Windows-based machines, what tool is used for logging?

Back 12

The Event Viewer tool can be customized to include audit events. These events include: Account logon events, account management, directory service access, logon events, object access, policy change, privilege use, process tracking, and system events.

Front 13

Define a service, NLM, and a Daemon.

Back 13

All three are programs that run in the background of a system without needing an actively logged in user. Services: Windows. NLM: Novel (NetWare Loadable Module). Daemon: Unix.

Front 14

Define a security template.

Back 14

A predefined set of security configuration parameters that you can apply to a system to enforce security baseline rules. Security templates give you a way to standardize security settings, based on a computer role and the level of security you require, and to apply those settings consistently to multiple computers. Assist in automating security settings.

Front 15

On Sun Solaris systems, what is used to automate the security policies?

Back 15

ASET (Automated Security Enhancement Tool). Has a low, medium, and high setting. Runs through system and checks system files, system config files, file permissions, users and groups, environment variables, EEPROM security, and firewall settings.

Front 16

Define virtualization technology.

Back 16

Seperates computing software from the hardware it runs on via an additional software layer. This enables a great deal of additional flexibility and increases hardware utilization by running multiple OSs on a single computer, each thinking it is the only system present.

Front 17

What are some steps that can be used to harden an OS?

Back 17

Install OS patches, Use strong passwords, install application patches, implement hardware and software manufacturers' security recommendations, use antivirus, anti-spyware, and anti-adware software, disable unnecessary services, disable or delete guest accounts or other unnecessary accounts and rename default accounts, restrict access permissions to users, display security banners to users, implement audit and logging policies, physically secure critical systems, plan backups, test functionality of system after hardening, use scanning and auditing tools to detect vulnerabilities, document changes.

Front 18

Define a directory service.

Back 18

A network service that stores information about all the objects in a particular network, including users, groups, servers, clients, printers, and network services. The directory also provides user access to directory objects and network resources. Centralizes security and controls access to individual network resources.

Front 19

Define a directory schema.

Back 19

The structure of the directory is controlled by a schema that defines rules for how objects are created and what their characteristics can be. Most are extensible, so they can be modified to support the specific needs of an organization.

Front 20

Define LDAP.

Back 20

Lightweight Directory Access Protocol. A standard protocol that is used on TCP/IP networks to access an LDAP-compliant directory service or directory database. Has a schema that defines the tasks you can and cannot perform while accessing a directory database, the form your directory query must take, and how the directory server will respond. LDAP's schema is extensible, which means you can make changes or add on to it.

Front 21

What documents can be reference for LDAP specifications?

Back 21

Specification: RFC 4510-4519.
Best practices: RFC 4520/4521.
LDAPv2: RFC 1777.

Front 22

List some common directory services.

Back 22

Novell eDirectory, Microsoft Active Directory, Sun Java Systems Directory Server, OpenDS, OpenLDAP, open Directory.

Front 23

Define Group Policy.

Back 23

A centralized configuration management feature available for Active Directory on Windows Server systems. Used to control certain desktop workstation features within an enterprise, such as specifying that all workstations display the company logo as their wallpaper, or that the default browser should have preloaded settings. It is also used to control security features, such as limiting the desktop icons that get displayed, granting permission to access certain servers but not other, or total desktop lockdown.

Front 24

How do you backup Active Directory?

Back 24

Using the Windows Backup utility, back up the computer's System State Data. This saves the following information: REgistry, COM_ Class Registration database, boot and system files, certificate services database, thte SYSVOL folder, and the IIS Metabase. Volume Snap Shots (VSS) can also be used to back up Active Directory.

Front 25

What are the three methods to restoring Active Directory?

Back 25

Primary Restore: Full restore of all domain controllers.
Nonauthoritative Restore: Restore a single DC.
Authoritative Restore: Forces all DCs to update their information from a single DC. Used when bad data has been pushed to hundreds of machines. Updates the USNs (update sequence number) on all other DCs.

Front 26

Define HDCP.

Back 26

An internet standard protocol that provides for automatic assignment of IP addresses and other TCP/IP configuration information. DHCP implementation is included with most network OSs. Should be protected from external systems requesting DHCP information and connecting to your network.

Front 27

Define the DHCP vulnerability: MAC address spoofing.

Back 27

An attacker leases an IP address by pretending to be a hardware device that is part of the corporate network. As a result, the attacker can communicate with the other computers on that network.

Front 28

Define the DHCP vulnerability: Scope modification.

Back 28

An attacker gains access to a DHCP server and modifies the scope, causing incorrect IP address leases and disruption communications on the network.

Front 29

Define the DHCP vulnerability: Rogue DHCP servers.

Back 29

Anyone with administrative access to a server can install the DHCP service, create a scope with false addresses, and begin handling them out to DHCP clients, thus preventing the clients from communicating on the network.

Front 30

Define the DHCP vulnerability: DHCP for remote clients.

Back 30

A remote access server that uses DHCP to assign remote clients' IP addresses can provide attackers with IP addresses and other network configuration information if they can connect to the remote access server.

Front 31

Where is the DHCP database stored?

Back 31

\system32\dhcp\backup. Frequency of backups is located at \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters\BackupInterval. You can perform a manual backup within the DHCP console by selecting the server and choosing Action->Backup.

Front 32

How do you restore a DHCP server?

Back 32

Stop and restart the service. When you do so it will automatically restore any databases from backup. Manually: Action->Restore.

Front 33

What are some file and print sharing vulnerabilities?

Back 33

Default administrative shares (can't browse but can be accessed directly), insecure file systems (FAT, should use NTFS), lack of redundancy, man-in-the-middle vulnerabilities (SMB protocol is particularly susceptible), weak default file security, physical disk security, and physical printer security (printed docs can be stolen).

Front 34

Define the SMB protocol.

Back 34

Server Message Block protocol. Runs on top of network transport protocols, such as TCP/IP, and is used to access shared network resources, such as files and printers. Used in older windows systems. Known as Samba for Solaris, Mac OS X, and other Unix and Linux systems.

Front 35

Define the CIFS protocol.

Back 35

Common Internet File System. Used in Windows 2000 and later to access shared network resources. Replaced SMB. Novell uses CIFS NLM.