CISSP- Telecommunications & Networking

Bots” and “botnets” are most insidious implementations of unauthorized,
remote control of compromised systems. Such machines are essentially
zombies controlled by ethereal entities from the dark places on the Internet. Page 749.

SEM/SEIM systems have to understand a wide variety of diff erent
applications and network element (routers/switches) logs and formats; consolidate
these logs into a single database and then correlate events looking for clues to
unauthorized behaviors that would be otherwise inconclusive if observed in a single
log fi le. Page 751.

Correct answer is d. See Figure 10.3, Page 740.

Although the modifi cation of messages will often happen at
the higher network layers, networks can be set up to provide robustness or resilience
against interception and change of a message (man-in-the-middle attack) or
replay attacks. Ways to accomplish this can be based on encryption or checksums
on messages, as well as on access control measures for clients that would prevent
an attacker from gaining the necessary access to send a modifi ed message into the
network. Page 745.

Layer 2, the data-link layer, describes data transfer between
machines, for instance, by an Ethernet. Page 735.

Intrusion detection systems (IDS) monitor activity and send
alerts when they detect suspicious traffi c. Th ere are two broad classifi cations of IDS:
host-based IDS, which monitor activity on servers and workstations, and networkbased
IDS, which monitor network activity. Page 750.

Th e security perimeter is the fi rst line of protection between
trusted and untrusted networks. In general, it includes a fi rewall and router that
helps fi lter traffi c. Security perimeters may also include proxies and devices, such
as an intrusion detection system (IDS), to warn of suspicious traffi c. Th e defensive
perimeter extends out from these fi rst protective devices, to include proactive
defense such as boundary routers which can provide early warning of upstream
attacks and threat activities. Page 765.

From a security perspective, fi ber optics’ immunity to electromagnetic
interference (EMI) and radio frequency interference (RFI) is important.
Because fi ber optics emit extremely small amounts of energy from the cable, data
cannot be as easily intercepted as information is transported through electric current
in wires. Page 762.

Wireless networks allow users to be mobile while remaining
connected to a LAN. Unfortunately, this allows unauthorized users greater access to the LAN as well. In fact, many wireless LANs can be accessed off of the organization’s
property by anyone with a wireless card in a laptop, which eff ectively
extends the LAN where there are no physical controls. Page 777.

Authentication has been proposed but attempts to introduce
stronger authentication into DNS have not found wider acceptance. Authentication
services have been delegated upward to higher protocol layers. Applications in need
of guaranteeing authenticity cannot rely on DNS to provide such but will have to
implement a solution themselves. Page 818.

IP Security (IPSec) is a suite of protocols for communicating
securely with IP by providing mechanisms for authenticating and encryption.
Standard IPSec authenticates only hosts with each other. Page 804.

Countermeasures to a denial-of-service attack include, but
are not limited to: multiple layers of fi rewalls, careful fi ltering on fi rewalls, routers
and switches, internal network access controls (NAC), redundant (diverse) network
connections, load balancing, reserved bandwidth (quality of service, which would
at least protect systems not directly targeted), and blocking traffi c from an attacker
on upstream router. Page 745.

Ideally to counter an attack, network security must also be proactive,
anticipate, and oppose the attack against their infrastructure by interdicting
and disrupting an attack preemptively or in self-defense. Th is requires intelligence
on the threat, active surveillance at the perimeter and beyond, and the ability to
intercede upstream or disable a threat agent’s tools. Page 742.

Although using blacklists as one indicator in spam fi ltering has
its merits, it is risky to use them as an exclusive indicator. Generally, they are run by
private organizations and individuals according to their own rules, they are able to
change their policies on a whim, they can vanish overnight for any reason, and they
can rarely be held accountable for the way they operate their lists. Page 827.

Correct answer is d. SSIDs are not for authentication. Page 778.