Ccna Constructing A Secure Infrastructure Part Ii

Front 1

Cisco Security Elements for Endpoint

Back 1

Endpoint Protection
Cisco Network Admission Control (NAC)
Network Infection Contaiment

Front 2

Cisco Network
Admission
Control (NAC)

Back 2

To ensure that every endpoint complies with network security
policies before being granted access to the network

Front 3

Network infection containment

Back 3

The focus of containment is to automate key elements of the infection response process.

Front 4

Secure software has two main areas of focus:

Back 4

Security of operating systems
■ Security of applications that run on top of the operating system

Front 5

Trusted code

Back 5

This is the assurance that the operating system code is not
compromised. This assurance might be provided through a process
of integrity checking of all running code using keyed Hash-based
Message Authentication Code (HMAC) or digital signatures.

Front 6

Trusted path

Back 6

A trusted path is a facility that helps ensure that a user is using a
genuine system and not a Trojan horse.

Front 7

Privileged context of execution

Back 7

Provides a degree of identity authentication and certain privileges based on the identity.

Front 8

Process memory protection and isolation

Back 8

Provides separation from other users and their data.

Front 9

Access control to resources

Back 9

Ensures confidentiality and integrity of data.

Front 10

Techniques for Protecting Endpoints from Operating System Vulnerabilities

Back 10

Least-privilege concept
Isolation between processes
Reference monitor
Small, verifiable pieces of code

Front 11

Isolation between
processes

Back 11

Isolation between processes should be provided by the operating
system and may be either physical or virtua

Front 12

Reference monitor

Back 12

A central point for all
policy decisions is provided by the reference monitor, which
typically implements auditing functions to keep track of access as
well.

Front 13

These attacks against applications

Back 13

Direct
Indirect

Front 14

Attack against application: Direct

Back 14

An attacker “tricks” the application into performing a task using the
application’s privileges.

Front 15

Attack against application; Indirect

Back 15

An attacker compromises another subsystem and then, through this
compromised subsystem, attacks the application (this is called privilege escalation).

Front 16

Cisco NAC device provides four key features

Back 16

Securing Endpoints with Cisco Technologies 267 The Cisco NAC device provides four key features to help further secure the enterprise and endpoint systems
■Authentication and authorization
■Posture assessment (evaluating an incoming device against the network’s policies)
■Quarantining of noncompliant systems
■Remediation of noncompliant system

Front 17

General Categories of the Cisco NAC Product

Back 17

NAC framework
Cisco NAC
Appliance (Cisco
Clean Access)

Front 18

Architectural Components of the Cisco Security Agent

Back 18

Management
Center for Cisco
Security Agents
Cisco Security
Agent

Front 19

Cisco Security Agent Interceptors

Back 19

File System Interceptor
Network Interceptor
Configuration Interceptor
Execution Space Interceptor

Front 20

Cisco Security Agent provides security approaches:

Back 20

Distributed firewall
HIPS
Application sandbox
Network worm prevention
File integrity monitor

Front 21

SAN Transport Technologies

Back 21

Fibre Channel
iSCSI
FCIP

Front 22

Providing a comprehensive SAN security solution involves four key aspects:

Back 22

Centralized authentication, authorization, and logging of all changes via secure rolesbased management
Centralized authentication of devices connected to the network, ensuring that only
authorized devices may be connected
Secure transmission and receipt of data through traffic isolation and access controls,
which ensure protection from activities of other devices in the network
Full encryption of all data leaving the storage network for business continuance,
remote vaulting, and backup

Front 23

Classes of SAN Attacks

Back 23

Snooping
Spoofing
DoS

Front 24

A Logical Unit Number (LUN)

Back 24

In this authorization process,
a LUN is made available to some hosts and unavailable to other hosts. Generally, this
technique of LUN masking is implemented at the host bus adapter (HBA) level.

Front 25

The two main zoning methods

Back 25

hard zoning and soft zoning

Front 26

soft zoning shows

Back 26

soft zoning shows a device only an
allowed subset of devices. So, with soft zoning in place, when a server looks at the fabric’s
content, it sees only the devices it is allowed to see.

Front 27

hard zoning

Back 27

hard zoning truly restricts communication across a fabric by
using access control lists (ACL) that are applied by the switch port ASIC to every Fibre
Channel frame that is switched.

Front 28

Fibre Channel networks use

Back 28

use 64-bit addresses known as World Wide Names (WWN) to
uniquely identify each element in a Fibre Channel network.

Front 29

two primary port authentication protocols when working with
VSANs:

Back 29

Diffie-Hellman Challenge Handshake Authentication Protocol (DHCHAP)
Challenge Handshake Authentication Protocol (CHAP)

Front 30

DHCHAP

Back 30

Before any
authentication may be performed, DHCHAP negotiates hash algorithms and DiffieHellman (DH) groups. In addition, it supports Message Digest 5 (MD5) and Secure Hash
Algorithm 1 (SHA-1)-based authentication.

Front 31

FCAP Advantages

Back 31

strong authentication and management data integrity using certificates (PKI Infrastructure)

Front 32

FCPAP

Back 32

This is based in password and does not require PKI Infrastructure

Front 33

FC-SP

Back 33

Fibre Channel Security Protocol

Front 34

The Need for VoIP

Back 34

Reduced recurring expenses
Adaptability
Advanced functionality

Front 35

Advanced functionality for VoIP

Back 35

Call Routing: using diferents networks (OSPF, EIGRP)
Messaging
Call center solutions
Security
Customer facing solutions

Front 36

Gatekeeper

Back 36

Gatekeepers can be thought of as the traffic cops of the WAN. For
example, because bandwidth on a WAN typically is somewhat
limited, a gatekeeper can monitor the available bandwidth. Then,
when there is not enough bandwidth to support another voice call, the
gatekeeper can deny future call attempts.

Front 37

Multipoint
Control Unit
(MCU)

Back 37

MCUs are useful for conference calling

Front 38

VoIP Protocols

Back 38

H.323, MGCP, H.248, SIP, and
SCCP

Front 39

H.323

Back 39

H.323 is
considered a peer-to-peer protocol, because some H.323 devices can
make their own call-routing decisions, as opposed to relying on an
external database. it is a
suite of protocols

Front 40

SIP

Back 40

Session Initiation Protocol (SIP), like H.323, is considered a peer-to-peer
protocol

Front 41

RTP

Back 41

Real-time Transport Protocol (RTP) carries the voice payload.

Front 42

Common VoIP Attack Targets

Back 42

Accessing VoIP resources without appropriate credentials
Gleaning information from unsecured VoIP network resources
Launching a denial-of-service
(DoS) attack
Capturing telephone conversations

Front 43

SPIT

Back 43

spam over IP telephony

Front 44

vishing

Back 44

maliciously collecting such information over the phone

Front 45

message tampering

Back 45

the attacker could change the SIP addresses in
the messages. This type of attack is known as message tampering.

Front 46

Examples of Attacks Targeting Voice Networks

Back 46

SPIT
Vishing
Toll fraud
SIP attacks

Front 47

auxiliary VLAN

Back 47

Separate the voice from the data

Front 48

Methods of Mitigating Attacks Targeting Voice Networks

Back 48

Using auxiliary VLANs
Using Firewalls
Using IPsec-protected VPNs
Disabling web access
Disabling unneeded services

Front 49

Firewalls consist of a pair of mechanisms

Back 49

One mechanism blocks traffic.
The second mechanism permits traffic.

Front 50

basic firewall services

Back 50

Static packet filtering
Circuit-level firewalls
Proxy server
Application server

Front 51

Initial Firewall Technologies

Back 51

Static packet-filtering firewall
Circuit-level firewall
Application layer firewall
Dynamic packetfiltering firewall

Front 52

Static packet-filtering firewall

Back 52

This first-generation firewall technology is a Layer 3
device that analyzes network traffic. IP packets are
examined to see if they match one of a set of rules defining
which data flows are allowed.

Front 53

Circuit-level firewall

Back 53

This second-generation firewall technology validates the
fact that a packet is either a connection request or a data
packet belonging to a connection, or virtual circuit,
between two peer transport layers.

Front 54

Application layer firewall

Back 54

Data in all network packets
is examined at the application layer and maintains
complete connection state and sequencing information.

Front 55

Dynamic packet filtering firewall

Back 55

This fourth-generation firewall technology, sometimes
called stateful firewalls, keeps track of the actual
communication process through the use of a state table.
These firewalls operate at Layers 3, 4, and 5.

Front 56

transparent firewall

Back 56

A transparent firewall is a Layer 2 firewall and
behaves like a “stealth firewall.” In other words, it is not seen as a router hop to connected
devices.
However, each interface resides on a separate VLAN.

Front 57

The characteristics of transparent firewall mode are as follows:

Back 57

■ Transparent firewall mode supports two interfaces, usually an inside interface and an
outside interface.
■ Transparent firewall mode can run in single as well as multiple context mode.
■ Packets are bridged by the security appliance from one VLAN to the other instead of
being routed.
■ MAC lookups are performed rather than routing table lookups.

Front 58

Application Layer Firewalls

Back 58

Application layer firewalls,
sometimes called proxy firewalls or application gateways, allow the greatest level of control
and work across all seven layers of the OSI model,
These firewalls
filter traffic at Layers 3, 4, 5, and 7 of the OSI model.

Front 59

Benefits to install application firewall layer

Back 59

By locating the firewall at the application
layer, you gain greater control over traffic compared to packet-filtering, stateful, or
application inspection firewalls.

Front 60

Advantages of Application Layer Firewalls

Back 60

Authenticate individuals, not devices
It’s more difficult to spoof and implement DoS attacks
Can monitor and filter application data
Can provide detailed logging

Front 61

Authenticate individuals,
not devices

Back 61

Typically, connection requests can be authenticated
before traffic is allowed to pass to an internal or external
resource.

Front 62

It’s more difficult to spoof
and implement DoS
attacks

Back 62

prevent most
spoofing attacks, and DoS attacks are limited to the
application firewall itself. Application firewalls can
detect DoS attacks, thereby reducing the burden on your
internal resources.

Front 63

Can monitor and filter
application data

Back 63

Application layer firewalls also allow you
to control what commands or functions you allow an
individual to perform based on the authentication and
authorization information.

Front 64

Can provide detailed
logging

Back 64

Detailed logs may be generated, and you can monitor the
actual data that the individual is sending across a
connection.

Front 65

Two solutions can address the significant consumption of disk space in application firewalls

Back 65

Use a Context Transfer Protocol (CXTP)
Have the application layer firewall monitor only key applications

Front 66

using a CXTP

Back 66

By using a CXTP, you can perform authentication and authorization exclusively, rather than
adding the overhead of monitoring data on the connection.

Front 67

Static packet-filtering firewalls

Back 67

control traffic flow based on ports

Front 68

Stateful Packet-Filtering Firewalls

Back 68

stateful inspection can track each
connection traversing all interfaces of the firewall and confirm that they are valid.
These firewalls operate at Layers 3, 4, and 5 of the OSI model.

Front 69

Disadvantages of Stateful Filtering

Back 69

Remember, packets must make their way to the outside network. In doing so,
internal IP addresses might be exposed to potential hackers.

Front 70

Uses of Stateful Packet-Filtering Firewalls

Back 70

A primary means of defense
An intelligent first line of defense
Improve routing performance
Defend against spoofing and DoS attacks

Front 71

Limitations of Stateful Packet-Filtering Firewalls

Back 71

No prevention of application layer attacks Not all protols are stateful
Applications that open multiple connections
User authentication is not supported

Front 72

Application Inspection Firewalls

Back 72

Application inspection firewalls, sometimes called deep inspection firewalls, are used to
provide for the security of applications and services
Application inspection firewalls are
essentially stateful firewalls with intrusion detection system capabilities.

Front 73

application inspection firewalls

Back 73

Are aware of the Layer 5 state of a connection.
■ Check the conformity of application commands on Layer 5.
■ Can check and affect Layer 7 (such as Java applet or peer-to-peer filtering).
■ Prevent more kinds of attacks than stateful firewalls.

Front 74

Inspection Firewall Behavior

Back 74

Transport layer
Session layer
Application layer

Front 75

Application inspection firewalls also offer a number of advantages:

Back 75

Application inspection firewalls are aware of the state of Layer 4 and Layer 5
connections. For example, they know that a Layer 5 SMTP mail-from command
always follows a HELO command.
■ Application inspection firewalls check the conformity of application commands on
Layer 5.
■ Application inspection firewalls can check and affect Layer 7, as previously discussed.
■ Application inspection firewalls can prevent more kinds of attacks than stateful
firewalls.

Front 76

Uses of an Application Inspection Firewall

Back 76

Secondary means of defense
To provide more stringent
controls over security than stateful filtering provides

Front 77

Best Practices When Developing a Firewall Policy

Back 77

Trust no one
Deny physical access to firewall devices
Allow only necessary protocoles
Use logs and alerts
Segement security zones
Do no use a firewall as a server
Never use a firewall as a worstation for a user
Set connection limits
Restrict accesss to firewall technology
Use firewall as part of a comprehensive security solution
Maintain your installation

Front 78

packets that are allowed

Back 78

permited packets

Front 79

packets that are not allowed

Back 79

denied packets

Front 80

Cisco access lists:

Back 80

Standard
Extended

Front 81

Standard ACLs

Back 81

Standard ACLs allow you to permit or deny traffic from only specific IP addresses

Front 82

Extended ACL

Back 82

With extended ACLs you can filter IP packets based on a number of attributes. TCP or UDP ports, and optional
protocol type information if you require finer granularity of control.

Front 83

IP standard ACL

Back 83

1 to 99
1300 to 1999

Front 84

IP extended ACL

Back 84

100-199
2000-2699

Front 85

Turbo ACLs

Back 85

Turbo ACLs
use the packet header to access these tables in a small, fixed number of lookups, independent of the existing number of ACL entries.

Front 86

The Turbo ACL feature has a number of benefits:

Back 86

For ACLs with more than three entries, the CPU load is lower when matching the
packet to the predetermined packet matching.
The Turbo ACL feature leads to much reduced latency because the time it takes to
match the packet is fixed.

Front 87

support Turbo ACLs,

Back 87

access-list compiled

show access-list compiled

Front 88

Guidelines for Developing ACLs

Back 88

Create ACLs based on your
security policy
Write out your ACLs
Set up a development system
Test your ACLs

Front 89

Where to apply the ACLs

Back 89

For the ACL to take effect, you must first apply packet-filtering ACLs to a router interface.
These ACLs are applied based on the direction of the data flow.

Front 90

The ACL may be applied to

Back 90

Inbound (in): Applies to packets received on the router interface.
Outbound (out): Applies to packets transmitted outbound on the router interface.

Front 91

To apply an ACL to a router’s interface

Back 91

ip access-group

Front 92

Caveats to Consider When Creating ACLs

Back 92

Implicit deny all
Standard ACL limitation
Standard evaluation order
Order of specific statements
Directional filtering
Modify numbered ACLs
Special packets
Extended ACL placement
Standard ACL placement

Front 93

Extended AC placement

Back 93

Using extended ACLs on routers too far from the source that you
need to filter might adversely affect packets flowing to other routers and interfaces. It is best to place extended ACLs

Front 94

Standard ACL placement

Back 94

Placing standard ACLs too close to the source can adversely affect
packets destined for other destinations, because these filter packets
are based on the source address. It is best to place standard ACLs as
close to the destination as possible.

Front 95

You should filter traffic with ACLs to block services that hackers use to gather information

Back 95

Disable unused services, ports, or protocols
Limit access to services, ports, or protocols:

Front 96

Blocked Services with ACL

Back 96

pmux 1 TCP and UDP
Echo 7 TCP and UDP
Discard 9 TCP and UDP
Systat 11 TCP
Daytime 13 TCP and UDP
Netstat 15 TCP
Chargen 19 TCP and UDP
Time 37 TCP and UDP
Whois 43 TCP
BOOTP 67 UDP
TFTP-DC OK 69 UDP
SUPDUP 93 TCP
SunRPC 111 TCP and UDP
loc-srv 135 TCP and UDP
NetBIOS Name Service (NBNS) 137 TCP and UDP
NetBIOS Datagram Service (NetBIOS-DGN) 138 TCP and UDP
NetBIOS Session Service (NetBIOS-SSN) 139 TCP and UDP
X-Display Manager Client Protocol (XDMCP) 177 UDP
NetBIOS 445 TCP
Rexec 512 TCP
Line printer remote (LPR) 515 TCP
Talk 517 UDP
Ntalk 518 UDP
UNIX-to-UNIX Copy Program (UUCP) 540 TCP
Internet Relay Chat (IRC) 667 TCP
Microsoft UPnP SSDP 1900, 5000 TCP and UDP
Network File System (NFS) 2049 UDP
X Window System 6000 to 6063 TCP
NetBus 12345, 12346 TCP
Back Orifice 31337 TCP and UDP

Front 97

Services to Deny with ACL

Back 97

Finger 79 TCP
SNMP 161 TCP and UDP
SNMP trap 162 TCP and UDP
rlogin 513 UDP
Who 513 UDP
Remote Shell Protocol (rsh), Remote Copy
Protocol (rcp), rdist, rdump 514 TCP
Syslog 514 UDP
new-who 550 TCP and UDP

Front 98

Access to router services can be controlled in two ways:

Back 98

Disable the service:
Restrict access to the service using ACLs

Front 99

Preventing IP Spoofing with ACLs

Back 99

To mitigate IP address spoofing, do not allow any IP packets containing the source address
of any internal hosts or networks inbound to a private network.

Front 100

The Cisco IOS classic firewall can provide network protection on multiple levels

Back 100

■ Traffic filtering
■ Traffic inspection
■ Alerts and audit trails
■ Intrusion prevention

Front 101

Traffic Filtering

Back 101

The Cisco IOS classic firewall can intelligently filter TCP and UDP packets based on
application layer protocol session information

Front 102

Traffic Inspection

Back 102

One of the key responsibilities of the Cisco IOS classic firewall is to inspect traffic as it
travels through the firewall to discover and manage state information for the various TCP
and UDP sessions.

Front 103

The Role of Alerts and Audit Trails

Back 103

Real-time alerts and audit trails generated by the Cisco IOS classic firewall provide a means
for you to gain insight into what is happening on your firewall

Front 104

Classic Firewall Process

Back 104

The Cisco IOS classic firewall provides Stateful Packet Inspection (SPI) to inspect traffic and create temporary openings at firewall interfaces

Front 105

SPI

Back 105

Stateful Packet Inspection (SPI)

Front 106

CBAC

Back 106

Context-Based Access
Control (CBAC)

Front 107

SPI works by inspecting the packet after it passes the inbound ACL

Back 107

ip inspect in
ip inspect ou

Front 108

The network generally has two main policies:

Back 108

Private zone connectivity to the Internet
■ Internet zone connectivity to the private zone

Front 109

Two steps are involved when grouping interfaces into zones:

Back 109

Creating a zone so that interfaces can be attached to it
■ Configuring an interface to be a member of a given zone

Front 110

To define the zone pair

Back 110

To define the zone pair, you need to use the zone-pair security command

Front 111

To attach a firewall policy map to the target zone pair,

Back 111

To attach a firewall policy map to the target zone pair, you use the service-policy type
inspect command.

Front 112

Creating Cisco IOS zone-based policy firewall policies involves three main
constructs:

Back 112

Class map
■ Policy map
■ Parameter map

Front 113

A class map

Back 113

A class map is a way to identify a set of packets based on its contents using “match” conditions.
To create a class map, you use the class-map command

Front 114

Actions are associated with traffic classified by class maps using policy maps

Back 114

inspect, drop, and pass

Front 115

policy-map

Back 115

The policy-map
command is used to specify the name of the policy map to be created, added to, or modified.

Front 116

parameter-map

Back 116

Parameter maps are used to specify parameters to be applied to classified traffic.

Front 117

Types of Parameter Maps

Back 117

Inspect parameter map
URL filter parameter map
Protocol-specific parameter map

Front 118

The match-any or match-all

Back 118

If match-any is specified, traffic must meet only one of the match
criteria in the class map. In contrast, if match-all is specified, traffic must match all the
class map criteria to belong to that particular class.

Front 119

show ip port-map

Back 119

show all known services

Front 120

show zone security

Back 120

You can display zone descriptions along with the interfaces contained in a specified zone
using the show zone security [zone-name] command.

Front 121

show zone-pair security [source source-zonename] [destination destination-zone-name

Back 121

If you would like to display the source zone and the destination zone

Front 122

To display a specified policy ma

Back 122

show policy-map type inspect [policymap-name [class class-map-name]] command.

Front 123

Detection Methods IDS and IPS

Back 123

Signature-based detection
Policy-based detection
Anomaly-based detection
Honey pot detection

Front 124

Policy-Based Detection

Back 124

With a policy-based approach, the IDS/IPS
device needs a very specific declaration of the security policy.

Front 125

Anomaly-Based Detection

Back 125

Statistical anomaly detection
Nonstatistical anomaly detection

Front 126

Statistical anomaly detection

Back 126

This approach watches network traffic patterns over a
period of time and dynamically builds a baseline

Front 127

Nonstatistical anomaly detection

Back 127

This approach allows an administrator to define
what traffic patterns are supposed to look like

Front 128

All sensors contain at least two interfaces for IDS and IPS:

Back 128

Command and control interface
Monitoring interface(s)

Front 129

Sensor Operating Modes

Back 129

Promiscuous mode
Inline mode

Front 130

Promiscuous mode

Back 130

When running in promiscuous
mode, a sensor receives a copy of selected network traffic.
Because a sensor running in promiscuous mode is not inline with the traffic, IDS operation is supported, but not IPS
operation.

Front 131

Inline mode

Back 131

Inline mode operation requires a least two monitoring interfaces
(either virtual or physical), because the sensor resides inline with the traffic.

Therefore, a sensor running in inline mode supports
IPS operation and can drop malicious traffic before the traffic reaches its intended target.

Front 132

ollowing are examples of potential attacker exploits at these OSI layers:

Back 132

Application layer
Transport layer
Network layer

Front 133

Responses to a Signature Alarm:

Back 133

Create a log entry
Drop the offending packet
Reset the TCP connection
Block the attacker’s IP address
Block traffic associated with the offending connection

Front 134

Tabs in the Edit Global Settings Window

Back 134

Syslog and SDEE
Global Engine

Front 135

Syslog and SDEE

Back 135

With this tab, an administrator can cause the IPS feature to send alarm, event, and error information using syslog services

Front 136

Global Engine

Back 136

Enable Engine Fail Closed
Use Built-In Signatures (as backup
Enable deny action on IPS interface