Q29105 TC Security + 9/5/04 2:46 PM Page 1

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
AUDITING 26. Routers forward packets between subnets
14. Auditing is the process of tracking user actions (Network layer, layer 3) using the following:
on the network. • RIP
15. System scanning involves probing service ports. • IGRP
• EIGRP
COMMUNICATION SECURITY • OSPF
• BGP
REMOTE ACCESS
• EGP
The Security+ Cram Sheet 16. Remote access includes these items:
• 802.11x wireless networking (Wi-Fi)
• IS-IS
27. Switches segment broadcast networks (Data Link
• Virtual Private Network (VPN) connections layer, layer 2).
• Dial-up using RADIUS, TACACS, or TACACS+ 28. Wireless devices provide broadcast-based
• SSL connections connectivity.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . • Packet-level authentication via IPSec in the 29. Modems allow connection through audio
• SYN flood—Repeated SYN requests without Network layer (layer 3) of the OSI model telephony.
GENERAL SECURITY CONCEPTS
ACK 17. VPN connections use PPTP or L2TP connectivity.
1. Access control includes MAC, DAC, and RBAC 30. RAS allows remote dial-up (Telecom/PBX) or
• Land—Exploits TCP/IP stacks using spoofed 18. SSH functions as a secure Telnet. VPN connections.
(Rule-Based Access Control or Role-Based
SYNs (where the same source address and
Access Control) 31. Useful network diagnostic tools include the
port appears in both source and destination SECURING CONNECTIVITY
2. Authentication involves determining the identity elements) following:
19. Email can be secured using the S/MIME or PGP
of the account attempting access to resources. • Teardrop—An attack using overlapping, frag- • Ping
protocols.
Here are some key points: mented UDP packets that can’t be reassembled • Tracert/traceroute
20. Email and Instant Messaging suffer from unde-
• Kerberos authentication is a ticket-based, sym- correctly • Nslookup
sired messages (spam) and hoaxes.
metric-key authentication system involving a • Bonk—An attack on port 53 using fragmented • Netstat
KDC. Kerberos v5 supports mutual authentica- UDP packets with bogus reassembly informa- 21. Web connectivity can be secured using HTTPS,
SSL, and TLS. • IPConfig/ifconfig
tion. tion • Telnet
• CHAP involves the exchange of hashed values • Boink—Bonk-like attack on multiple ports
for authentication. ONLINE VULNERABILITIES • SNMP
5. A back door allows access to a system without 32. Workstations, servers, and mobile devices (such
• Certificates are used within a PKI to provide an 22. Web vulnerabilities include the following:
normal security checks. as PDAs) require configuration to improve securi-
asymmetric-key solution. • Java and JavaScript
6. Spoofing is the process of making data look as if ty beyond the default.
• Username and password combinations are the it came from somewhere other than its origin. • ActiveX controls
most common form of authentication. • Cookies MEDIA
7. Man-in-the-middle attacks involve the intercep-
• Token-based authentication is a strong form • CGI vulnerabilities
tion of traffic between two systems using a third 33. The two main types of coaxial cable (coax) are
requiring possession of the token item. • SMTP relay vulnerabilities
system pretending to be the others. 10Base2 (Thinnet) and 10Base5 (Thicknet).
• Biometric authentication uses parts of the 23. Protocol vulnerabilities include the following:
human body (hand, finger, iris, and so on) for 8. Replay attacks involve the reposting of captured 34. Twisted pair cable is either unshielded (UTP) or
authentication. data. • TLS shielded (STP). Both come in two speeds: Cat3
9. TCP/IP hijacking involves taking control of a • LDAP (10Mbps) or Cat5 (100Mbps).
3. Nonessential services and protocols should be
disabled, which requires an understanding of the TCP/IP session. • FTP vulnerabilities, including anonymous 35. Fiber-optic cable (fiber) speeds range from
following: 10. Mathematical attacks involve cryptographic key access and unencrypted authentication 100Mbps to 2Gbps (with higher speeds in the
cracking. • Wireless vulnerabilities, including WEP key works).
• The role of each server, along with its current
11. Password-guessing, brute-force, and dictionary analysis 36. Removable media includes tape, recordable
configuration
attacks involve repeated guessing of logons and 24. A site survey is necessary before deploying a compact discs (CD-R), hard drives, diskettes,
• Required or critical services, protocols, and
passwords. WLAN. flashcards, and smartcards.
applications
• Configuration changes that should be made to 12. Forms of malicious code include the following: 37. Backups may be full, incremental, differential, or
INFRASTRUCTURE SECURITY copy.
existing servers • Viruses—Infect systems and spread copies of
themselves BASIC NETWORK SECURITY DEVICES SECURITY TOPOLOGIES
ATTACKS
• Trojan horses—Disguise malicious code within 25. Firewalls separate external and internal networks
4. Denial of service (DoS) and distributed denial of 38. Security zones support the management of a
apparently useful applications and include the following types:
service (DDoS) attacks involve the disruption of bastion host and screened host or screened
normal network services and include the follow- • Logic bombs—Trigger on a particular • Packet-filtering firewalls (Network layer, subnet gateways.
ing types: condition layer 3)
39. Networks may be divided into intranets,
• Worms—Self-replicating forms of other types • Proxy-service firewalls, including circuit-level
• Smurf—An attack based on the ICMP echo extranets, DMZs, and the Internet.
of malicious code (Session layer, layer 5) and application-level
reply 40. A VLAN allows for computers on the same
• Java and ActiveX controls—Automatically (Application layer, layer 7) gateways
• Fraggle—Smurf-like attack based on UDP physical segment to be on different logical
execute when sent via email • Stateful-inspection firewalls (Application layer,
packets segments.
13. Social engineering involves manipulating human layer 7)
• Ping flood—Blocks service through repeated 41. Network Address Translation (NAT) devices
psychology to gain access to something of value.
pings translate traffic between public and private
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . address
. . . .schemes.
. . . . . . . . . . . . . . . . . . .
 Q29105 TC Security + 9/5/04 2:46 PM Page 2

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
42. Tunneling is the process of transmitting data PUBLIC KEY INFRASTRUCTURE (PKI) • Renewal—If needed, a new key pair can be SECURITY POLICIES AND PROCEDURES
encapsulated within a second protocol to prevent 55. PKI relies on asymmetric-key cryptography using generated and the certificate renewed. 68. Security policies define guidelines and specifica-
direct eavesdropping using a packet sniffer. certificates issued by an authentication Certificate • Recovery—Recovery is possible if a certifying tions for general types of security considerations.
Authority (CA) such as VeriSign. key is compromised but the holder is still valid Procedures are step-by-step items defined within
INTRUSION DETECTION and trusted. each policy that specify the responsible agents,
56. Certificates are digitally signed blocks of data
43. An IDS monitors packet data using behavior- • Archiving—The certificates and their uses are actions to be taken, and methods for proper
that may be used within a PKI setting. Some
based or knowledge-based methods, operating in stored. reporting. Procedures must be followed. Policies
things to remember about certificates include
network-based or host-based configurations. 61. Key management may be either centralized or include risk assessment, security, acceptable use,
the following:
44. Honeypots and honeynets are used to study the decentralized. and compliance. Focus details may include due
• Certificate policies specify the uses for a cer- care, privacy, separation of duties, need to know,
actions of hackers and to distract them from 62. An escrow agent maintains a copy of the private
tificate as well as additional technical data. password management, retention, disposal and
more valuable data. key signed by the CA.
• A Certificate Practice Statement (CPS) is a destruction, incident response, and Human
45. Incident handling may include detection, deflec- legal document that details the purpose of 63. Multiple key pairs will require multiple certifi- Resources policies.
tion, or countermeasures. conveying information using a certificate. cates.
69. Privilege management may be user based, group
46. A security baseline is a measure of normal net- • Certificates can be revoked before their expira-
OPERATIONAL/ORGANIZATIONAL SECURITY based, or role based, reflecting a MAC, DAC, or
work activity against which behavior-based IDSs tion date. RBAC configuration.
measure network traffic to detect anomalies. 57. Certificate Authorities may be grouped into PHYSICAL SECURITY 70. Risk identification includes asset identification,
47. Hardening is the process of securing a host, net- several trust models, including the following:
64. Access control includes considerations of direct risk assessment, threat identification and
work, or application to resist attacks. Some key • Single CA—Uses a single CA access, network access, facilities, and the envi- classification, and identification of vulnerabilities.
services that should be considered during hard-
• Hierarchical CA—Uses a root CA and subordi- ronment supporting a system. 71. Education is required to ensure that users are
ening are Web, email, FTP, DNS, NNTP, DHCP,
nate CAs aware of required and recommended security
file, print, and data repository servers. 65. Social engineering involves extracting useful
• Bridge CA—Uses a bridge CA and principal information from an authorized user, whereas guidelines.
BASICS OF CRYPTOGRAPHY CAs reverse social engineering involves convincing an 72. All aspects of security must be documented,
58. The IETF Working Group on X.509 standards for authorized user of the attacker’s authorization or including security policies, architecture documen-
ALGORITHMS PKI is PKIX. expertise so that the user will ask for assistance. tation, as well as retention and disposal proce-
48. A hashing algorithm uses a mathematical formula 59. IPSec consists of AH, ESP, IPComp, and IKE. 66. A disaster recovery plan (DRP) details considera- dures for each form of documentation.
to verify data integrity. Examples include the SHA tions for backup and restoration, including secure 73. Computer forensic analysis includes the need to
and the Message Digest Series algorithms (MD2, KEY MANAGEMENT AND CERTIFICATE recovery methods. Some of the items within the establish a clear chain of custody, properly
MD4, and MD5). LIFECYCLE DRP are impact and risk assessments and serv- collect the evidence, correctly perform the
49. Symmetric-key algorithms depend on a shared 60. Key management and the certificate lifecycle sup- ice-level agreements (SLAs) with suppliers and investigation, document all actions and findings,
single key for encryption and decryption. port PKI solutions through the process of creat- vendors. preserve all evidence and documentation, and
Examples include DES, 3DES, AES, Blowfish, ing, using, and then destroying public keys and 67. A business continuity plan details the procedures prepare to provide expert testimony or consulta-
IDEA, and the Rivest ciphers (RC2, RC4, RC5, the digital certificates they are associated with. to follow in order to reestablish proper connectiv- tion if required.
and RC6). The lifecycle includes the following parts: ity as well as the facilities needed to restore data
50. Asymmetric-key algorithms use a public key for • Key generation—A public key pair is created in the event of a catastrophic loss. Items of con-
encryption and a private key for decryption. and held by the CA. sideration include network connectivity, facilities,
Examples include the RSA, Diffie-Hellman, El clustering, and fault tolerance.
• Identity submission—The requesting entity
Gamal, and Elliptic Curve Cryptography stan- submits its identity to the CA.
dards.
• Registration—The CA registers the request and
verifies the submission identity.
CONCEPTS OF USING CRYPTOGRAPHY
• Certification—The CA creates a certificate
51. Cryptographic encryption improves
signed by its own digital certificate.
confidentiality.
• Distribution—The CA publishes the generated
52. Error checking within encryption/decryption certificate.
schemes ensures data integrity. Digital signatures
• Usage—The receiving entity is authorized to
are used to sign data so that the recipient can
use the certificate only for its intended use.
verify the data’s origin.
• Revocation and expiration—The certificate will
53. Cryptographic routines can perform user authen- expire or may be revoked earlier if needed.
tication and provide for nonrepudiation of data
origin.
54. Cryptographic methods may be used for access
control.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .