CHAPTER SUMMARY

Network security implementation relies on a thorough understanding of your organization, its goals, its risks, and the technologies employed within your IT infrastructure. Before you can properly deploy network security, you must first design it. Most network security designs include layers of defense, as well as sufficient capacity for growth.

Network security includes an evaluation of the protocols and methods your organization uses. If the current design is insufficient, replace it with a design that addresses productivity and security. You need to assess the addressing schemes in use—whether public or private, static or dynamic—in light of how each improves or detracts from security.

Other important components of network security design and deployment include controlling communication pathways; hardening systems; and selecting proper equipment, authentication, authorization, accounting, communication encryption, types of hosts, redundancy, and node security specifics.

This chapter also introduced the concept of risk assessment and management to aid in determining the proper number of firewalls and other security measures. While the terms are important, it is essential to understand how to convert risk into a quantifiable number and address it in a way that properly protects and defends the network.

KEY CONCEPTS AND TERMS

Annualized loss expectancy (ALE)

Annualized rate of occurrence (ARO)

Asset value (AV)

Attack surface

Auditing

Authentication, authorization, and accounting (AAA)

Bring Your Own Device (BYOD)

Brute-force password attack

Cost/benefit analysis

Dictionary password attacks

Dictionary password cracking

Exposure factor (EF)

File Transfer Protocol (FTP)

Hybrid attack

Identity and access management (IAM)

Intangible costs and value

Internet Assigned Numbers Authority (IANA)

Modeling

Multifactor authentication

Network News Transfer Protocol (NNTP)

Piloting

Post Office Protocol (POP)

Rainbow tables

Redundancy

Redundant array of inexpensive disks (RAID)

Regional Internet Registry (RIR)

Risk assessment

Risk management

Router access control lists

Router anti-spoofing

Security through obscurity

Simple Mail Transfer Protocol (SMTP)

Single loss expectancy (SLE)

Single point of failure

Sunk cost

Tangible

Telnet

Uninterruptable power supply (UPS)

Virtual local area network (VLAN)

Zone of risk

Zones of trust

CHAPTER 4 ASSESSMENT

  1. Which of the following should be done as part of router configuration?
    1. Copy and paste the configuration to all routers and firewalls
    2. Enable a warning banner for all attempted connections
    3. Require SNMP v 2 or earlier for consistency
    4. Drop all encrypted packets within the network perimeter
  2. Which of the following is not a type of attack against password use?
    1. Brute-force
    2. Dictionary
    3. Hybrid
    4. Recursive
  3. Which of the following is part of a defense-in-depth strategy?
    1. Avoid single points of failure
    2. Avoid having multiple redundancies
    3. Avoid removing the default account
    4. Avoid using devices from different manufacturers
  4. Which addressing class is 192.168.32.16?
    1. Class A
    2. Class B
    3. Class C
    4. Class D
  5. Which of the following is an example of redundancy?
    1. A firewall at each physical perimeter
    2. Using multifactor authentication
    3. Encrypting communication outside the network
    4. An uninterruptable power supply
  6. Which of the following best defines security through obscurity?
    1. Changing the names taped to all physical devices
    2. Changing the logical names of all devices
    3. Hiding the network in order to secure it
    4. Expanding the network to hide individual devices
  7. When considering multifactor authentication, which of the following is something you have?
    1. An iris scan
    2. An ID card
    3. A spoken phrase
    4. A password
  8. Which of the following is commonly referred to as access control?
    1. Accounting
    2. Auditing
    3. Authentication
    4. Authorization
  9. Which of the following is true of IPv4 versus IPv6?
    1. IPv4 is more expensive to implement that IPv6.
    2. IPv4 is more time-consuming when building packets.
    3. IPv4 is used less and therefore less is known about it.
    4. IPv4 is plaintext transmission by default.
  10. Which of the following best describes a dynamic password token?
    1. A device that shows a random password
    2. Radio-frequency identification (RFID) chip
    3. Identification (ID) badge
    4. Smart card
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.133.156.251