Info Security Ch 6

Front 1

physical design process

Back 1

technologies supporting the information security blueprint, identifies complete technical solutions, designs physical security measures, and prepares project plans for the implementation phase

Front 2

firewall

Back 2

prevents specific types of information from moving between the outside world/untrusted network and the inside world/trusted network; may be a separate computer system, a software service running on an existing router or server, or a separate network containing a number of supporting devices

Front 3

small office/home office (SOHO)

Back 3

connect the user's local network or a specific computer system to the internet/networking device

Front 4

best practices for firewalls

Back 4

- all traffic from the trusted network is allowed out

- the firewall device is never directly accessible form the public network for configuration or management purposes

- simple mail transport protocol data is allowed to enter through the firewall but routed to a filter

- all internet control message protocol data should be denied

- telnet access to all internal servers from the public networks should be blocked

- when web services are offered outside the firewall, HTTP traffic should be blocked from internal networks

- all data that is not verifiably authentic should be denied

Front 5

content filters

Back 5

a software filter that allows administrators to restrict access to content from within a network

Front 6

war dialer

Back 6

an automatic phone-dialing program that dials every number in a configured range and checks to see if a person, answering machine, or modem

Front 7

kerberos

Back 7

an authentication system that can provide secure 3rd-party authentication; uses symmetric key encryption to validate a user to various network resources; keeps a database of private keys/encrypted passwords

Front 8

VPN

Back 8

a private and secure network connection between systems that uses the data communication capability of an unsecured and public network

Front 9

encapsulation

Back 9

the native protocol of the client is embedded within the frames of a protocol that can be routed over the public network and be usable by the server network environment

Front 10

encryption

Back 10

keeps the data contents private while in transit over public network, but is still usable by the client and server computers and/or the local networks

Front 11

authentication

Back 11

the remote computer and the remote user are allowed to perform specific actions, predicated on accurate and reliable identification of the remote system and/or user

Front 12

tunnel mode

Back 12

established 2 perimeter tunnel servers that encrypt all traffic on an unsecured network; the entire client packet is encrypted and added as the data portion of a packet addressed from 1 tunneling server to another, then the receiving server decrypts it and sends it to the final address; reveals nothing about the true destination system

Front 13

proxy server

Back 13

a server that is configured to look like a Web server and performs action on behalf of that server to protect it from hacking

Front 14

packet filtering

Back 14

examines the header information of data packets that come into a network

Front 15

application gateway/application firewall

Back 15

frequently installed on a dedicated computer, separate from the filtering router, although it is commonly used in conjunction with a filtering router

Front 16

circuit gateway

Back 16

operates at the transport layer and prevent direct connections between one network and another

Front 17

MAC layer

Back 17

designed to operate at the media access control layer of the OSI network model; can consider the specific host computer's identity in its filtering decisions

Front 18

hybrid processing mode

Back 18

combines the elements of other types of firewalls, such as packet filtering and proxy services or circuit gateways

Front 19

packet filtering routers

Back 19

rejects packets that the organization does not want to allow into the network

Front 20

screened host firewalls

Back 20

combine the packet-filtering router with a separate, dedicated firewall, allowing the router to prescreen packets to minimize network traffic and load internal proxy

Front 21

dual-homed host firewalls

Back 21

the bastion host contains 2 NICs , which makes all traffic physically go through the firewall to move between internal and external networks

Front 22

screened subnet firewalls (with DMZ)

Back 22

the dominant architecture used today; DMZ can be a dedicated port on the firewall device linking a single bastion host provided by the screened subnet firewalls

Front 23

trusted VPN

Back 23

uses leased circuits form a service provider and conducts packet switching over these leased circuits

Front 24

secure VPN

Back 24

uses security protocols and encrypts traffic transmitted across unsecured public networks like the Internet

Front 25

hybrid VPN

Back 25

combines trusted and secure VPNs, providing encrypted transmissions over some or all of a trusted VPN network