Security+ Element K Chapter 5

Front 1

Define IPSec.

Back 1

Internet Protocol Security. A set of open standards that you can use to secure data as it travels across the network or the internet. IPSec uses an array of protocols and services to provide data authenticity and integrity, anti-replay protection, non-repudiation, and protection against eavesdropping and sniffing.

Front 2

What four protection mechanisms does IPSec offer?

Back 2

Provides data authenticity and integrity, protects against replay attacks by using sequence numbered transmissions, prevents repudiation by identifying/validating all comm. sources, protects against eavesdropping and sniffing.

Front 3

What algorithms does IPSec incorporate?

Back 3

Uses message digests, called HMACs (hash method authentication codes), by using either MD5 or SHA-1. Provides confidentiality by encrypting message data with DES or 3DES.

Front 4

Define the AH protocol.

Back 4

IPSet transport protocol. Authentication Header. Provides data integrity through the user of MD5 and SHA. AH takes an IP packet and uses either MD5 or SHA to hash the IP header and the data payload, then adds its own header to the packet. The AH header is inserted into the packet behind the original IP header but ahead of the TCP or UDP header and ESP header (if you are using AH and ESP together). Includes SPI (security parameters index), the sequence number of the packet, and the hash data. The computer on the other end receives the IP packet, calculates the hash value, and compares it to the data in the AH header to verify the integrity of the payload. If the values do not match, the packet is dropped.

Front 5

Define the ESP protocol.

Back 5

IPSec transport protocol. Encapsulating Security Payload. Provides data integrity, as well as data confidentiality, using either DES or 3DES. Like AH, ESP uses MD5 or SHA to hash an IP packet's header and payload, but it includes the hash in the ESP authentication data at the end of the packet instead of in the ESP header, which contains the packet's sequence number and the SPI. The ESP header is inserted behind the IP header and the AH header (if there is one) but before the IP payload. After the payload, you'll find ESP trailer, which contains mostly padding (required by the ESP packet format) and the ESP authentication data, where you will find the hash for verifying data integrity. ESP encrypts only the payload and not the headers in IPSec's transport mode.

Front 6

Define IKE.

Back 6

Internet Key Exchange. Used to create a master key, which in turn is used to generate bulk encryption keys. IPSec computers never exchange the master key. Instead, they agree on a prime number and a public key, which are used along with each computer's private key to create another set of numbers that are shared between the computers. The separate computers then use the Deffie-Hellman algorithm to calculate matching master keys. Because no other computers can access the original private keys used to create the master key, the master key is always secure.

Front 7

Define SA in regard to IPSec.

Back 7

Security Associations. The negotiated relationship between two computers using IPSec. Occurs in two phases.
Phase 1 (1 hour lifetime): Computers negotiate how communication will take place, and agree on authentication, encryption, and master key generation. The resulting phase 1 SA is bi-directional.
Phase 2: Produces two one-way SAs on each computer: one inbound and one outbound. The phase 2 SA is used for the actual transmission of data.
Each computer may have multiple phase 1 and phase 2 SAs with different partners.

Front 8

What are the three Windows-based IPSec policies?

Back 8

Secure Server: Highest level (require security) policy. Session fails if the client cannot negotiate security with the server.
Server: Middle level (request security) policy. Requests secure, but will accept open session.
Client: Lowest level (respond only) policy. Client negotiates security if the server requests it.

Front 9

What are the five rules that make up each IPSec policy.

Back 9

IP filters (protocol, port, source/destination computer the rules apply to.)
Filter action (how to respond to packets that match particular filters, can permit the comm or request or require security.)
Authentication method (enables the computers to establish a trust relationship. Methods include Kerberos, digital certificates, or preshared key configured as part of the rule.)
Tunnel setting (enables the computers to encapsulate data in a tunnel inside the transport network.)
Connection type (determines if the rule applies to local network connections, remote access connections, or both.)

Front 10

Define the 802.11 protocol.

Back 10

Wireless. 2 Mbps. 2.5 GHz.

Front 11

Define the 802.11a protocol.

Back 11

Wireless. 54 Mbps. 5 GHz. 60 ft. range.

Front 12

Define the 802.11b protocol.

Back 12

Wireless. 11 Mbps. 2.4 GHz. 1000 ft. open, 200-400 ft. closed area. Called Wi-Fi. Backwards compatible with 802.11 but not 802.11a.

Front 13

Define the 802.11e protocol.

Back 13

Wireless. Draft wireless standard for home and business. Adds Quality of Service (QoS) features and multimedia support to 802.11a and 802.11b.

Front 14

Define the 802.11g protocol.

Back 14

Wireless. 54 Mbps. 2.4 GHz. Compatible with b.

Front 15

Define the 802.11m protocol.

Back 15

In-progress initiative to support the editorial maintenance, improvements, and corrections of the 802.11 specifications.

Front 16

Define the 802.11n protocol.

Back 16

Wireless. Dual-band. 2.4/5 GHz. Higher throughput and range. Compatible with g, a, and b.

Front 17

Define the WAP protocol.

Back 17

Designed to transmit data such as web pages, email, and newsgroup postings to and from wireless devices such as cell phones, PDAs, and handheld computers over very long distances, and display the data on small screens in a web-like interface.

Front 18

Define WEP.

Back 18

Wireless security protocol. Wired Equivalent Privacy. 64/128/256-bit encryption using the Rivest Cipher 4 (RC4) algorithm for wireless comm. that uses A and B protocols. Not very secure due to data capture cracking methods (as little as 10 MB of data is needed to crack it).

Front 19

Define WTLS.

Back 19

Wireless security protocol. Wireless Transport Layer Security. Security layer of WAP that uses public-key cryptography for mutual authentication and data encryption. If set up incorrectly, leaves devices vulnerable to email forgery and sniffing.

Front 20

Define 802.1x.

Back 20

Wireless security protocol. Port-based authentication mechanism for wireless comm. using the A and B protocols. Uses Extensible Authentication Protocol (EAP) to provide user authentication against a directory service.

Front 21

Define WPA.

Back 21

Wireless security protocol. Wi-Fi Protected Access. Addresses some of the shortcomings of the WEP protocol. Provides for dynamic reassignment of keys to prevent the key-attack vulnerabilities of WEP.

Front 22

Define 802.11i.

Back 22

Wireless security protocol. Complete wireless standard that adds AES block cipher security to 802.11. Supersedes both WEP and WPA and relies on the 802.1x as the authentication mechanism. 802.11i is sometimes referred to as WPA2. Temporal key integrity protocol (TKIP) is a security protocol created by the IEEE 802.11i task group to replace WEP. TKIP is combined with the existing WEP encryption to provide a 128-bit encryption key that fixes the key length issues of WEP.

Front 23

Define data emanation.

Back 23

The process of wireless networks sending out unintended signals. Attackers will try to get reception from wireless networks under the radar. This allows them plenty of time to access and read data transmitted on the wireless network area. Similar to data emanation, SSID broadcasts are advertised signals from the WAP that allow users to connect to a wireless network.

Front 24

Define blue jacking.

Back 24

Method used by attackers to send out unwanted Bluetooth signals enabled on PDAs, mobile phones, and laptops to other Bluetooth-enabled devices. These types of signals sent out can lead to many different types of threats. Transmissions can include trojans and other viruses.

Front 25

Define bluesnarfing.

Back 25

Process in which attackers gain access to unauthorized information on a wireless device using a Bluetooth connection. Unlike blue jacking, access to wireless devices such as PDAs, mobile phones, and laptops by bluesnarfing can lead to exploitation of private information including email, contact information, calendar entries, images, videos, and any data stored on the device.

Front 26

Define WEP and WPA cracking.

Back 26

Method used to crack encryption keys used in WEP and WPA installations to gain access to private wireless networks.

Front 27

Define VoIP.

Back 27

Voice over Data implementation in which voice signals are transmitted over IP networks. The phone can be an IP telephone unit or a VoIP interface at a Private Branch Exchange (PBX), which enables the phone system to access the IP network at a single point.

Front 28

Define PBX.

Back 28

Private Branch Exchange. A private telephone network used inside a company or organization. The PBX includes a number of outside lines for communicating with the Public Switched Telephone Network (PSTN).

Front 29

Define CTI.

Back 29

Computer Telephony Integration. Allows telephone, email, fax, web, and computer actions to be integrated to work together. There are two forms of CTI used:
First-party call control is direct connection between the phone device and the computer. This allows the computer to directly control the phone.
Third-party call control requires a dedicated telephony server to handle all call requests. The call is made by a user computer sent to the telephony server. The server carries out the phone service and transmits commands made from the user's computer.

Front 30

Define wardialer.

Back 30

Tools used to dial every available phone number in an organization to find which numbers can be used to access unsecured modems, fax machines, and voicemail systems. This information can then be used to launch another attack. Wardialers include ToneLoc and PhoneSweep.

Front 31

Define tunneling.

Back 31

Data-transport technique in which a data packet from one protocol is transferred across a network inside the frame or packet of another protocol. This enables data from one network type to travel through another network type. The tunnel can provide additional security by hiding passenger data from the carrier network.

Front 32

Define CHAP.

Back 32

Challenge Handshake Authentication Protocol. User name/password authentication scheme that uses hashed values and is popular for logging in to remote servers.
1. Client logs on to the network.
2. Authenticating server sends a challenge message containing a random value.
3. Client encrypts the value with the client password and sends the encrypted value to the authenticating server.
4. Authenticating server encrypts the same value with the client password stored in its database.
5. If the two encrypted values match, the user is authenticated.

Front 33

Define PAP.

Back 33

Password Authentication Protocol. Authentication method that sends client IDs and passwords as cleartext. It is generally used when a remote client is connecting to a non-Windows PPP server that does not support a stronger password encryption such as CHAP. When the server receives a client ID and password pair, it compares them to is local list of credentials. If a match is found, the server accepts the credentials and allows the remote client to access resources. If no match is found, the connection is terminated.

Front 34

Define VPN.

Back 34

Virtual Private Network. Private network configured by tunneling through a public network. VPNs provide secure connections between endpoints, such as routers, clients, or servers, by using tunneling to encapsulate and encrypt data. Special VPN protocols are required to provide the VPN tunneling, security, and data encryption services.

Front 35

Define the PPTP VPN protocol.

Back 35

Point-to-Point Tunneling Protocol. Microsoft VPN protocol that provides tunneling and data encryption. It is the most widely supported VPN method among older Windows clients. PPTP encapsulates any type of network protocol and transports it over IP networks. It uses proprietary Microsoft Point-to-Point Encryption (MPPE) for data encryption.

Front 36

Define the L2TP VPN protocol.

Back 36

Internet standard protocol for tunneling across a variety of network protocols. L2TP tunnels appear as IP packets, so L2TP employs IPSec Transport Mode for authenticity, integrity, and confidentiality.

Front 37

Define the SSTP VPN protocol.

Back 37

Secure Socket Tunneling Protocol. Allows for PPP traffic to pass through an SSL channel.

Front 38

Define RADIUS.

Back 38

Remote Authentication Dial-In User Service. VPN security protocol that provides centralized remote-access authentication, authorization, and auditing services. When a network contains several remote access servers, you can configure one of the servers to be a RADIUS server, and all of the other servers as RADIUS clients. The clients will pass all authentication requests to the server for verification. User configuration, remote access policies, and usage logging can be centralized on the server. In this configuration, the remote access server is generically known as the Network Access Server (NAS).

Front 39

Define TACACS and TACACS+.

Back 39

Terminal Access Controller Access Control Systems. VPN security protocol that provides centralized authentication and authorization services for remote users. TACACS+ also supports multifactor authentication. + is considered more secure and more scalable that RADIUS, and utilizes TCP rather than UDP. Supports multiple protocols. Defined in RFC 1492.

Front 40

Define Diameter.

Back 40

VPN security protocol that improves upon RADIUS by strengthening some of its weaknesses. Diameter is backward-compatible with RADIUS. Defined in RFC 3588.

Front 41

Define NPS.

Back 41

Network Policy Server, Windows Server 2008's implementation of RADIUS. Replaced IAS. Provides centralized authentication services to all RRAS servers. Allows user logging and provides a single point for configuring RRAS servers.

Front 42

What are some PPTP flaws.

Back 42

Microsoft's implementation of PPTP is susceptible to a number of attacks, including a dictionary attack against its LAN Manager password authentication mechanism.

Front 43

List three remote access port numbers.

Back 43

500 / ISAKMP service / UDP
1701 / L2TP service / UDP
1723 / PPTP service / TCP