2.3.2 Securing Networks Quiz

Explanation: Continuous video surveillance is a security measure found both inside and outside a data center facility. A gate provides outside perimeter security. Security traps, biometrics access, and exit sensors provide inside perimeter security.

Explanation: Hyperjacking occurs when an attacker hijacks a virtual machine (VM) hypervisor and then uses that VM to launch an attack on other data center devices.

Explanation: Internal threats can be intentional or accidental and cause greater damage than external threats because the internal user has direct access to the internal corporate network and corporate data.

Explanation: Data, such as research and development data, sales data, financial data, human resource and legal data, employee data, contractor data, and customer data, is likely to be the most valuable asset for an organization.

Explanation: Cloud storage is popular and has many benefits. However data stored there could be compromised due to weak security settings.

Explanation: The company had a flat network with no subnets. The threat actor was able to access and destroy all kinds of corporate data due to a thermostat that was on the network, but was not scanned as part of the security procedures.

Explanation: A distinguishing factor of campus area networks (CANs) are that they have interconnected LANs.

Explanation: WANs span a wide area and commonly have connections from a main site to remote sites including a branch office, regional site, SOHO sites, and mobile workers. WANs typically connect over a public internet connection. Each site commonly has a firewall and VPNs used by remote workers between sites.

Explanation: VPNs are commonly used between corporate sites and between mobile or remote workers that connect to and use resources on the corporate network.

Explanation: Mobile Device Management (MDM) is used to secure, monitor, and manage both corporate-owned and employee-owned devices such as smartphones, tablets, laptops, and desktops.

Explanation: Definitions for the different types of threat actors are:

• Hacktivists - a term that refers to grey hat hackers who rally and protest against different political and social ideas. Hacktivists publicly protest against organizations or governments by posting articles, videos, leaking sensitive information, and performing distributed denial of service (DDoS) attacks.
• Cybercriminals - a term for black hat hackers who are either self-employed or working for large cybercrime organizations. Each year, cyber criminals are responsible for stealing billions of dollars from consumers and businesses.
• State-Sponsored hackers - threat actors who steal government secrets, gather intelligence, and sabotage networks of foreign governments, terrorist groups, and corporations. Most countries in the world participate to some degree in state-sponsored hacking.
• Vulnerability brokers - typically grey hat hackers who attempt to discover exploits and report them to vendors, sometimes for prizes or rewards.

Explanation: Indicators of attack (IOA) focus more on the motivation behind an attack and the potential means by which threat actors have, or will, compromise vulnerabilities to gain access to assets. IOAs are concerned with the strategies that are used by attackers. For this reason, rather than informing response to a single threat, IOAs can help generate a proactive security approach. Indicators of compromise (IOC) can be features that identify malware files, IP addresses of servers that are used in attacks, filenames, and characteristic changes made to end system software, among others. IOCs help cybersecurity personnel identify what has happened in an attack and develop defenses against the attack. The US Cybersecurity Infrastructure and Security Agency (CISA) is leading efforts to automate the sharing of cybersecurity information with public and private organizations at no cost. CISA uses a system called Automated Indicator Sharing (AIS). AIS enables the sharing of attack indicators between the US government and the private sector as soon as threats are verified.

Explanation: Internal threats have the potential to cause greater damage than external threats because internal users have direct access to the building and its infrastructure devices. Employees may also have knowledge of the corporate network, its resources, and its confidential data.

Explanation: Common network security terms include:

• Threat - A potential danger to an asset such as data or the network itself.
• Vulnerability - A weakness in a system or its design that could be exploited by a threat.
• Exploit - The mechanism that is used to leverage a vulnerability to compromise an asset.
• Risk - The likelihood that a particular threat will exploit a particular vulnerability of an asset and result in an undesirable consequence.

Explanation: Common network security terms include:

• Attack surface - The total sum of the vulnerabilities in each system that are accessible to an attacker.
• Vulnerability - A weakness in a system or its design that could be exploited by a threat.
• Exploit - The mechanism that is used to leverage a vulnerability to compromise an asset.
• Risk - The likelihood that a particular threat will exploit a particular vulnerability of an asset and result in an undesirable consequence.

Explanation: There are four common ways to manage risk:

• Risk transfer - Some or all the risk is transferred to a willing third party such as a cloud service provider or an insurance company.
• Risk reduction - This reduces exposure to risk or reduces the impact of risk by taking action to decrease the risk. This strategy requires careful evaluation of the costs of loss, the mitigation strategy, and the benefits gained from the operation or activity that is at risk.
• Risk avoidance - This means avoiding any exposure to the risk by eliminating the activity or device that presents the risk. By eliminating an activity to avoid risk, any benefits that are possible from the activity are also lost.
• Risk acceptance - This is when the cost of risk management options outweighs the cost of the risk itself. The risk is accepted, and no action is taken.

Explanation: Network security relates directly to an organization's business continuity. Many tools are available to help network administrators adapt, develop, and implement threat mitigation techniques. The Cisco Product Security Incident Response Team (PSIRT) is responsible for investigating and mitigating potential vulnerabilities in Cisco products. The Cisco Talos Intelligence Group website provides comprehensive security and threat intelligence to defend customers and protect their assets. US Cybersecurity Infrastructure and Security Agency (CISA) and the National Cyber Security Alliance (NCSA) are US government organizations to promote cybersecurity.

Explanation: An attack vector is a path by which a threat actor can gain access to a server, host, or network. Attack vectors originate from inside or outside the corporate network.