detection focuses on characterizing the past behavior of individual users or related groups of users and then detecting significant deviations.

A backdoor is any mechanism that bypasses a normal security check.

_________ can result in pop-up ads or redirection of a browser to a commercial site

detection focuses on characterizing the past behavior of individual users or related groups of users and then detecting significant deviations.

Unauthorized intrusion into a computer system or network is not one of the most serious threats to computer security

Statistical approaches attempt to define proper behavior and rule-based approaches attempt to define normal or expected behavior.

A _________ is an individual who is not authorized to use the computer and who penetrates a system's access controls to exploit a legitimate user's account.

is software that collects information from a computer and transmits it to another system

A ________ lies dormant until a predefined condition is met; the program then triggers an unauthorized act

IP security is a capability that can be added to either current version of the Internet Protocol by means of additional headers.

Typically housed in the user's computer, a _________ is referred to as a client e-mail program or a local network e-mail server

The _________ payload allows peers to identify packet flows for processing by IPsec services.

The __________ mechanism assures that a received packet was in fact transmitted by the party identified as the source in the packet header and assures that the packet has not been altered in transit.

Video content will be identified as _________ type.

The _________ accepts the message submitted by a Message User Agent and enforces the policies of the hosting domain and the requirements of Internet standards.

The ________ MIME field is a text description of the object with the body which is useful when the object is not readable as in the case of audio data

Transport mode provides protection to the entire IP packet

S/MIME cryptographic algorithms use __________ to specify requirement level.

Authentication applied to all of the packet except for the IP header is _________ .

In using cloud infrastructures, the client necessarily cedes control to the CP on a number of issues that may affect security

The ____________ knows the passwords of all users and stores these in a centralized database and also shares a unique secret key with each server

Cloud computing gives you the ability to expand and reduce resources according to only to Cloud provider availability.

Public-key encryption is also referred to as conventional encryption, secret-key, or single-key encryption.

saves the complexity of software installation, maintenance, upgrades, and patches.

Verifying that users are who they say they are and that each input arriving at the system came from a trusted source

The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity

_________ provides secure, remote logon and other secure client/server facilities.

The strength of a hash function against brute-force attacks depends solely on the length of the hash code produced by the algorithm

If both sender and receiver use the same key the system is referred to as _________ encryption.

known as public-key cryptography, is a process that uses a pair of related keys -- one public key and one private key

The World Wide Web is fundamentally a client/server application running over the Internet and UDP/IP intranets.

Public key cryptography is __________ .

The purpose of a ___________ is to produce a "fingerprint" of a file, message, or other block of data

The key used in conventional encryption is typically referred to as a _________ key

_________ is the original message or data that is fed into the algorithm as input.

__________ is a centralized, automated approach to provide enterprise-wide access to resources by employees and other authorized individuals, with a focus on defining an identity for each user, associating attributes with the identity, and enforcing a means by which a user can verify identity.

The protection of data from unauthorized disclosure is _________ .

Patient information stored in a database – inaccurate information could result in serious harm or death to a patient and expose the hospital to massive liability

The more critical a component or service, the higher the level of_______________required

The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity is _________ .

A __________ takes place when one entity pretends to be a different entity

____Involves the passive capture of a data unit and its subsequent retransmission to produce an unauthorized effect

______Some portion of a legitimate message is altered, or messages are delayed or reordered to produce an unauthorized effect

_______Prevents or inhibits the normal use or management of communications facilities

A _________ is a person, organization, or entity responsible for making a service available to interested parties.

_____An independent entity that can assure that the CP conforms to a set of standards

_____A networking facility that provides connectivity and transport of cloud services between cloud consumers and CPs

_____• Useful when cloud services are too complex for a cloud consumer to easily manage • Three areas of support can be offered by a cloud broker: • Service intermediation • Value-added services such as identity management, performance reporting, and enhanced security • Service aggregation • The broker combines multiple cloud services to meet consumer needs not specifically addressed by a single CP, or to optimize performance or minimize cost • Service arbitrage • A broker has the flexibility to choose services from multiple agencies

Wireless networks, and the wireless devices that use them, introduce a host of security problems over and above those found in wired networks.

____________ is an umbrella term for managing access to a network

________Authenticates users logging into the network and determines what data they can access and actions they can perform

what are the Common NAC enforcement methods

What are the approaches to message authentication?

attacks include impersonating another user, altering messages in transit between client and server, and altering information on a Web site

What type of passive attacks?

Active Attacks

(a)  

(b)  

(c)   ​ ​ (d)  

X.800 Service Categories

With a __________ infrastructure, the cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.

The core of ___________ is the implementation of intrusion detection systems and intrusion prevention systems at entry points to the cloud and on servers in the cloud

s Defined as "a model for enabling ubiquitous, convenient, on demandnetwork access to a shared pool of configurable computing resources that can be rapidlyprovisioned and released with minimal management effort or service providerinteraction

MAC spoofing occurs when an attacker is able to eavesdrop on network traffic and identify the MAC address of a computer with network privileges.

Sensors and robots, are not vulnerable to physical attacks

The actual method of key generation depends on the details of the authentication protocol used.

The layer of the IEEE 802 reference model that includes such functions as encoding/decoding of signals and bit transmission/reception is the _________

In a(n) __________ situation, a wireless device is configured to appear to be a legitimate access point, enabling the operator to steal passwords from legitimate users and then penetrate a wired network through a legitimate wireless access point.

nd links, such as personal network Bluetooth devices, barcode readers, and handheld PDAs, pose a security risk in terms of both eavesdropping and spoofing

A signature is created by taking the hash of a message and encrypting it with the sender's

The SSL Internet standard version is called _________

What are the uses of bots?

what are intruders ?

________An individual who is not authorized to use the computer and who penetrates a system’s access controls to exploit a legitimate user’s account

________A legitimate user who accesses data, programs, or resources for which such access is not authorized, or who is authorized for such access but misuses his or her privileges

________An individual who seizes supervisory control of the system and uses this control to evade auditing and access controls or to suppress audit collection

________Can be motivated by revenge or simply a feeling of entitlement

________Traditionally, those who hack into computers do so for the thrill of it or for status

________Objective of the intruder is to gain access to a system or to increase the range of privileges accessible on a system • Most initial attacks use system or software vulnerabilities that allow a user to e

________Objective of the intruder is to gain access to a system or to increase the range of privileges accessible on a system • Most initial attacks use system or software vulnerabilities that allow a user to e

________Ways to protect a password file:

________The system stores only the value of a function based on the user’s password

________Access to the password file is limited to one or a very few accounts

________involves the collection of data relating to the behavior of legitimate users over a period of time • Then statistical tests are applied to observed behavior to determine whether that behavior is not legitimate user behavior

________This approach involves defining thresholds, independent of user, for the frequency of occurrence of various events

profile based of the activity of each user is developed and used to detect changes in the behavior of individual accounts

Rule-based detection • Involves an attempt to define a set of rules or attack patterns that can be used to decide that a given behavior is that of an intruder • Often referred to as signature detection

Firewall limitations Cannot protect against attacks that bypass the firewall

Firewall limitations A laptop, PDA, or portable storage device may be used and infected outside the corporate network, and then attached and used internally

Firewall limitations May not protect fully against internal threats, such as a disgruntled employee or an employee who unwittingly cooperates with an external attacker

Firewall limitations Cannot guard against wireless communications between local systems on different sides of the internal firewall

firewalls Weaknesses

firewalls Strengths

Attacks

A suitabled countermeasures for __________ is to discard packets with an inside source address if the packet arrives on an external interface

A suitabled countermeasures for __________ is to discard all packets that use this option

A suitabled countermeasures for __________ is to enforce a rule that the first fragment of a packet must contain a predefined minimum amount of the transport header

__________The intruder transmits packets from the outside with a source IP address field containing an address of an internal host

__________The source station specifies the route that a packet should take as it crosses the internet, in the hopes that this will bypass security measures that do not analyze the source routing information

__________The intruder uses the IP fragmentation option to create extremely small fragments and force the TCP header information into a separate packet fragment

__________Also called an application proxy • Acts as a relay of application-level traffic • If the gateway does not implement the proxy code for a specific application, the service is not supported and cannot be forwarded across the firewall • The gateway can be configured to support only specific features of an application that the network administrator considers acceptable while denying all other features • Tend to be more secure than packet filters • Disadvantage: • The additional processing overhead on each connection

__________A system identified by the firewall administrator as a critical strong point in the network’s security

__________A software module used to secure an individual host • Is available in many operating systems or can be provided as an add-on package • Filters and restricts the flow of packets • Common location is a server • Advantages: • Filtering rules can be tailored to the host environment • Protection is provided independent of topology • Used in conjunction with stand-alone

Personal Firewall Controls the traffic between a personal computer or workstation on one side and the Internet or enterprise network on the other side

Host-resident firewall this category includes personal firewall software and firewall software on servers • Can be used alone or as part of an in-depth firewall deployment

Screening router • single router between internal and external networks with stateless or full packet filtering • This arrangement is typical for small office/home office (SOHO) applications

Single bastion inline • A single firewall device between an internal and external router • This is the typical firewall appliance configuration for small-to-medium sized organizations

Single bastion T • Similar to single bastion inline but has a third network interface on bastion to a DMZ where externally visible servers are placed

double bastion inline • DMZ is sandwiched between bastion firewalls

double bastion T • DMZ is on a separate network interface on the bastion firewall

distributed firewall configuration • Used by some large businesses and government organizations