Do you have implemented IPv6 addresses in border devices? 2 points
By implementing IPv6 in border devices, organizations ensure they can fully participate in the evolving internet ecosystem. Neglecting to adopt IPv6 addresses increases the risk of network limitations and potential incompatibility with emerging technologies. Therefore, integrating IPv6 addresses into border devices is a fundamental step in ensuring long-term network sustainability and compatibility.
Do you use either Stateful DHCPv6 or manual IPv6 in your network? 2 points
Implementing either Stateful DHCPv6 or manual IPv6 addressing is crucial for effective IPv6 deployment. Stateful DHCPv6 offers centralized control, while manual addressing provides more granular control. Failing to adopt a clear addressing strategy can lead to connectivity issues and misconfigurations. Therefore, choosing the appropriate method is fundamental for a robust IPv6 deployment.
Do you use the Private VLAN such as Isolated and Community in your company? 2 points
Private VLAN is an incredible tool when it comes to enhancing the security of a network design within companies. Private VLAN (PVLAN), adds an extra layer of security by isolating communication between the devices in the same VLAN, allows resource segmentation (therefore a company can manage resources more efficiently and the network management is simplified), allows conservation of IP addresses, reduces broadcast traffic through isolation of devices which do not communicate with each other and lastly enhance efficiency in troubleshooting, as it narrows down the scope of potential problems.
Does the dynamic routing protocol use key authentication techniques, to avoid the Router Rogue in your organization? 2 points
Using key authentication for dynamic protocol routing is crucial in preventing rogue routers, as it ensures that only trusted routers can participate, therefore preventing unauthorized users from potentially joining the network, which can lead security breaches or disruptions in the network traffic.
Do you ever scan the network from the external site and verify the ports which you were not aware for their existence? 3 points
Performing external network scans to identify unexpected open ports is a critical security practice. This proactive approach helps uncover potential vulnerabilities or unauthorized services running on the network. Detecting such unexpected open ports allows for timely investigation and remediation, reducing the risk of unauthorized access or exploitation.
Do you use ssh tunnel for accessing the remote device? 3 points
Using an SSH tunnel for accessing remote devices is a recommended security practice. SSH tunnels encrypt the connection, providing a secure way to access resources on a remote network. This helps protect sensitive data from interception or unauthorized access. It is a crucial measure, particularly when accessing devices over untrusted networks like the internet.
Do you cloak the ssh port to be invisible for the rest of world, except you to prevent the brute force attack? 1 point
A security layer which aids in prevention and mitigation of brute force attacks in SSH port cloaking. By doing so, it is harder for attackers to locate and target the SSH device, therefore adding a layer of security through obscurity and reducing log noise and logging attempts from attackers and bots.
Do you use the DHCP snooping in your switch to avoid the DHCP spoofing and rogue? 3 points
Enabling DHCP snooping on switches is a crucial security measure to prevent DHCP spoofing and rogue DHCP servers in a network. DHCP snooping helps validate DHCP messages, ensuring that only legitimate DHCP servers are allowed to provide IP addresses. This prevents potential man-in-the-middle attacks and helps maintain network integrity and security.
Do you use the IP Source guard to prevent IP Spoofing? 2 points
Implementing IP Source Guard is a crucial security measure to prevent IP spoofing attacks. It restricts traffic to only allow packets with legitimate source IP addresses, preventing attackers from using forged or malicious IPs. This helps maintain network integrity and safeguards against various forms of network-based attacks.
Do you block immediately the service in which you have find a SYN-ACK reply, without SYN request from this service (By using the traffic analyzer tool, i.e Wireshark)? 3 points
Blocking a service upon detecting a SYN-ACK reply without a prior SYN request, using a traffic analyzer like Wireshark, is a prudent security response. This behavior can indicate a potential security threat, such as a SYN flood attack or misconfiguration. Taking immediate action to block such traffic helps mitigate the risk of exploitation and ensures the integrity of network services.
Do you block the ICMP echo request and reply toward your network to prevent DoS attack or camouflage the traffic under the ping request (Type 3 – Destination unreachable message, Type 8 – Echo, Type 14 – Timestamp Reply, Type 42 – Extended Echo Request, Type 43 – Extended Echo Reply)? 3 points
Blocking ICMP echo requests and replies, along with specific ICMP message types like destination unreachable, echo, timestamp reply, extended echo request, and extended echo reply, can be a part of a comprehensive security strategy. This measure helps prevent potential Denial-of-Service (DoS) attacks and can make it more challenging for attackers to camouflage their traffic using ICMP requests. It is important to carefully consider the implications of blocking these types of ICMP traffic to ensure it aligns with the specific security requirements and operational needs of the network.
Do you use tools which identify the TCP half connection toward your network (SYN – SYN/ACK – RST Flags)? 2 points
As an important security practice, using tools which identify TCP half-open connections allows for detection of malicious or abnormal network behavior (such as SYN Flood), freeing up resources for new connections and latency reduction. This practice enables a response for threat mitigation, faster troubleshooting, and network security maintenance.
Do you stop immediately the service in which you find the Network Analyzer program flags such as: FIN, URG, PUSH, NULL? 1 point
Flags such as FIN, URG, PUSH, NULL indicate potential suspicious or unauthorized activity, therefore it is important to stop a server as soon as these flags are detected. By taking immediate action, exploitation risks are minimized, and network integrity is maintained. However, it is important to note that a thorough investigation and analysis of the nature of the flagged activity needs to be done, before security measures are implemented.
Do you use the Port Security Features in Switches to avoid Flood Attack? 3 points
Using Port Security features in switches helps in avoiding Flood Attacks as they restric the number of MAC addresses allowed on a port, preventing attackers from flooding the switch with a large number of fake MAC addresses, consequently maintaining the network integrity and security.
Do you put the MAC Address in CAM of the switches in static or dynamic learning with sticky features in your company? 2 points
By managing MAC addresses in the CAM table of the switches, whether in static or dynamic learning, helps in maintaining and controlling network access and port security, preventing unauthorized devices from connecting and overall enhancing the network security by mitigating the risk of MAC spoofing.
Do you configure the switch with Dynamic ARP-Spoofing Inspection to avoid ARP Poisoning in your Cache? 2 points
A vital security measure is the configuration of a switch with Dynamic ARP-Spoofing Inspection in order to prevent ARP poisoning attacks. Dynamic ARP-Spoofing Inspection helps validate ARP requests and responses, ensuring that only legitimate ARP messages are accepted, this way preventing malicious actors manipulating the ARP cache to redirect network traffic.
Do you use the MAC-Access Control List to prevent MitM (Man in the Middle) in your company? 1 point
MAC-Access Control List (ACL) allow network administrators to specify which devices are permitted or denied access to the network based on their MAC address. By utilizing this measure, network administrators ensure that only trusted devices are allowed access to the network, therefore reducing the risk of unauthorized access or data interception by Man-In-The-Middle attacks.
Do you use policies such as: MAC-SEC-SPA for encryption of traffic trunk among switches, and MAC-SEC-MKA for encryption of traffic among host and switches in order to avoid internal sniffing? 1 point
Implementing policies like MAC-SEC-SPA for encrypting traffic between switches, and MAC-SEC-MKA for encrypting traffic between hosts and switches, is a critical security measure to safeguard against internal sniffing attacks. These protocols provide encryption at the MAC layer, ensuring that data traversing the network remains confidential and protected from eavesdropping or interception. By employing these measures, organizations can establish a secure communication environment, reducing the risk of unauthorized access or data compromise within the internal network.
Do you configure the switches with BPDU Guard, BPDU Filter and ROOT Guard in order to avoid the Rogue Switch? 2 points
BPDU Guard identifies and disables ports that receive unexpected BPDU frames, BPDU filter helps with filtering BPDU frames and ROOT Guard protects against unauthorized switches attempting to become the root bridge in a spanning tree network. Configuring switches with these features ensures that network integrity and security is hardened and maintained, while simultaneously minimizing risks created by rogue switches.
Do you avoid the presence of VLAN Default for maintaining traffic between hosts to prevent VLAN Hopping? 1 point
Avoiding the use of the default VLAN for maintaining traffic between hosts is a critical security practice to prevent VLAN hopping attacks. VLAN hopping exploits misconfigurations or vulnerabilities in network switches to gain unauthorized access to traffic on different VLANs. By not relying on the default VLAN, organizations can significantly reduce the risk of this type of attack, enhancing network security and integrity.
Do you specify each switch port as static and based on their rule and activities, i.e trunk or access, to avoid Switch Rogue? 3 points
Specifying each switch port as either static, trunk or access based on their rule and activities is a fundamental security practice in preventing rogue switches from compromising the network, as organizations can effectively control network access, preventing unauthorized devices from connecting to the network, therefore maintaining network integrity and security.
Do you use VLAN Native tag differ from the default one, to avoid Double Tagging? 1 point
Double Tagging or VLAN stacking attacks can be prevented by using a VLAN Native Tag that is different from the default one, as it involves specifying a VLAN ID for untagged frames. This practice helps companies protect themselves against vulnerabilities in which attackers may try to exploit multiple layers of VLAN tags to gain unauthorized access to network segments.
Do you use the NTP authentication protocol to synchronize the time among devices in a security way? 1 point
Using NTP authentication for time synchronization is crucial for network security. It ensures devices receive authenticated time updates, reducing the risk of malicious time attacks, meeting compliance requirements, and enhancing overall network security.
Do you disable the protocols which are able to identify devices in the network in an easy way, such as SSDP (Simple Service Discovery Protocol) 1 point
Simple Service Discovery Protocol (SSDP) is a network protocol which is used for discovery of network services, often for device discovery in Universal Plug and Play (UPnP) networks. By disabling SSDP companies ensure that potential information leakage or device enumeration is prevented, thus reducing the attack surface.
Do you disable the protocols which are able to identify devices in the network in an easy way, such as CDP (If you use Cisco devices)? 1 point
A recommended security practice is disabling Cisco Discovery Protocol (CDP), as it is used for device discovery in Cisco networks, therefore increasing the threat surface. A disabled CDP means that the exposure of device information is reduced and the amount of sensitive information that can be gathered from attackers is reduced as well.
Do you use the threshold traffic generation to the CPU Network Device to prevent the overheating of processors? 1 point
Using threshold-based traffic generation for network device CPUs is a recommended practice to prevent overheating. By setting CPU usage thresholds and generating traffic when they are reached, organizations can proactively manage overheating issues, ensuring device stability and reliability.
Do you use the threshold traffic generation to the CPU Servers to prevent the overheating of processors? 1 point
Implementing threshold-based traffic generation to monitor and manage CPU utilization on servers is a critical practice in preventing overheating of processors. By defining thresholds and generating traffic when these limits are exceeded, organizations can proactively address potential overheating issues. This proactive measure ensures the servers maintain stability and optimal performance, operating safely within designated temperature ranges.
Do you enable lockout feature for users who fails more than 3-times to login in network devices? 2 points
Enabling a lockout feature for users who fail to login more than three times on network devices is a prudent security measure. This practice helps protect against brute-force attacks by temporarily blocking access for users who repeatedly enter incorrect credentials. By implementing this feature, organizations can mitigate the risk of unauthorized access and enhance overall network security.
Do you use High Availability schema for Data Traffic lines, Switches, Routers and Firewalls? 4 points
The incorporation of a High Availability (HA) framework within network design is crucial to ensure seamless network operations. HA configurations provide redundancy and failover capabilities for data traffic lines, switches, routers, and firewalls, minimizing the risk of service disruption due to hardware or link failures. This approach not only reduces downtime but also guarantees continuous network services, making it an essential practice for organizations that rely on consistent network availability and dependability.
By implementing HA setups, organizations can effectively safeguard their network infrastructure against potential outages, offering a reliable and uninterrupted network experience to users. This resilience is particularly vital for businesses and institutions with stringent uptime requirements, as it ensures that critical operations can continue without interruption, even in the face of hardware failures or other network issues.
Do you use the IPS/IDS in your company to avoid the malicious traffic in your network? 4 points
Using Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) is crucial for a company's network security. These features both actively (IPS) and passively (IDS) monitor network traffic, block suspicious/malicious traffic (IPS), alert administrators to potential security incidents (IDS).
Do you use the Host IPS in your company to avoid the malicious traffic in application layer? 3 points
The risks of not using Host IPS in a company include increased vulnerability to application layer attacks, higher likelihood of data breaches, potential malware infections, compliance violations, reputational damage, productivity losses, and higher remediation costs.
Do you use the Multilayer Firewall (From L3 – L5) in your organization? 3 points
Using a Multilayer Firewall that operates at layers 3 to 5 (L3-L5) is a crucial security measure for comprehensive network protection. This approach combines traditional packet filtering (L3), stateful inspection (L4), and application-level filtering (L5) to provide a layered defense against several types of threats. It helps prevent unauthorized access, filter specific applications or protocols, and enhance overall network security.
Do you use the Parse View technique to limit the access of users in network devices, based on the segregation of duties chart and user roles in your organization? 2 points
Not employing the Parse View technique to limit user access based on roles and segregation of duties poses several risks. Without this practice, there is a higher likelihood of granting users’ excessive privileges, potentially leading to unauthorized configuration changes, mismanagement of critical settings, and increased vulnerability to insider threats. Additionally, it can result in non-compliance with security policies and regulatory requirements, leaving the network more susceptible to unauthorized access and potential security breaches. Overall, not implementing Parse View can weaken network security and jeopardize the integrity and confidentiality of sensitive information.
Have you disabled the unnecessary UPnP services especially for Internet facing devices/interfaces? 2 points
Not disabling unnecessary UPnP services, especially for internet-facing devices/interfaces, heightens the risks in several ways. It broadens potential entry points for attackers, increasing the overall risk of unauthorized access. Vulnerabilities introduced by UPnP could be exploited, potentially compromising device security. This may lead to unauthorized control or even malicious use of devices. Additionally, UPnP may inadvertently expose sensitive services, creating privacy and compliance concerns. Failing to disable unnecessary UPnP services exposes the network to a range of potential vulnerabilities and security breaches.
Do you have exactly the same Re-Assembly time of fragmentation packets between IDS and Web Server (IIS or Apache)? 3 points
Not aligning re-assembly times between an IDS and a Web Server poses risks, including missed intrusions, false positives/negatives, incomplete analysis, and weakened security. Compliance concerns may arise, and the network becomes more vulnerable to attacks.
Do you install in router or firewall, IP Source Header investigation, such as i.e uRPF for verifying the source origination of packets? 2 points
Failing to implement IP Source Header validation, like uRPF in routers or firewalls, poses significant risks by exposing the network to IP spoofing attacks. This vulnerability can lead to unauthorized access, data breaches, and challenges in tracing the attack source, hindering incident response and potentially causing service disruptions.
Do you probe IP spoofing attack, based on TTL of packet receives which might understand if packets were originated from fake user, located at different subnet? 2 points
Not verifying TTL values as a defense against IP spoofing presents substantial risks. Without this safeguard, the network is vulnerable to malicious entities concealing their true origin. This susceptibility may lead to unauthorized access, data breaches, and potential network compromise. Furthermore, the absence of TTL-based checks complicates the differentiation between genuine and spoofed traffic, hindering incident response and potentially enabling undetected attacks. Ultimately, neglecting this security measure heightens the network's susceptibility to IP spoofing threats, raising the likelihood of severe security incidents.
Do you probe IP spoofing attack, based on ID of IP packets receives which might understand that packets were originated from one of your organization’s employees? 2 points
Neglecting to investigate IP spoofing attacks based on the ID of received IP packets introduces significant risks. Without this verification, the network becomes vulnerable to attackers impersonating legitimate employees, potentially gaining unauthorized access to sensitive resources. This can result in data breaches, unauthorized actions, and compromised security. Moreover, without the capability to distinguish between genuine and spoofed packets based on their ID, detecting and responding to potential attacks becomes challenging. The absence of this security measure increases the organization's susceptibility to IP spoofing, potentially leading to severe security incidents.
Do you probe for IP spoofing attack, by tricking the packets send and modify by you, with Window size =0? 2 points
Failure to check for IP spoofing attacks, like manipulating packets with a Window size of 0, poses significant risks. It exposes the network to potential unauthorized access, data breaches, and compromised security. It also hinders the ability to distinguish legitimate traffic from spoofed traffic, reducing incident response effectiveness and increasing vulnerability to IP spoofing attacks.
Do you export and import plaintext traffic from your open ports? 4 points
Engaging in the exchange of unencrypted plaintext traffic through open ports carries substantial risks. It leaves sensitive data vulnerable to potential eavesdropping and interception, which can result in unauthorized access, data breaches, and the potential compromise of valuable information. Additionally, the lack of encryption exposes the network to a range of cyber threats, including the possibility of man-in-the-middle attacks. To safeguard data in transit and maintain the confidentiality and integrity of information transmitted via open ports, it is imperative to implement robust encryption protocols.
Do you use AAA service in your premise, to authenticate/authorize and record the activity of users’ login to your system? 4 points
Failing to implement AAA (Authentication, Authorization, and Accounting) services in your premise poses considerable risks. Without AAA, there is a higher likelihood of unauthorized access to systems and sensitive data. This could lead to data breaches, compromised security, and potential legal or regulatory issues. Additionally, without proper recording of user activity, it becomes challenging to trace and investigate security incidents or policy violations. Implementing AAA services is crucial for ensuring robust access control, accountability, and compliance with security policies and regulations.
Do you prohibit the user authentication to your critical systems based only IP Addresses? 3 points
Prohibiting user authentication based solely on IP addresses for critical systems is vital because it lacks security, doesn't verify user identities, fails to accommodate dynamic IP addresses, remote access, and proxy servers, and is ineffective against insider threats. It also hinders failover and redundancy, restricts access for geographically diverse users, lacks multi-factor authentication, and can lead to non-compliance with regulatory requirements. Robust authentication methods like username/password, 2FA, biometrics, or smart cards offer better security and user verification for critical systems.
Do you filter packets on Firewall based on some suspicious IP such as, multicast addresses, loopback addresses, reserved addresses, or forbidden addresses? 3 points
Neglecting to employ packet filtering on a firewall for suspicious IP addresses, including multicast, loopback, reserved, or forbidden ones, poses significant risks. This omission exposes the network to potentially harmful traffic from these sources, creating the potential for unauthorized access, security breaches, and a compromised network integrity. Furthermore, failing to implement this security measure elevates the network's vulnerability to several types of cyber threats. Employing IP filtering based on suspicious addresses is essential for fortifying network security and defending against potential malicious activities.
Do you take the pre-caution steps to prevent the DNS Zone transfer attack, such as location of the DNS transfer strictly in a specific IP which is controlled totally from your site and deployed over the very secure zone? 3 points
Failing to take precautionary steps to prevent DNS Zone transfer attacks, such as strictly controlling the location of DNS transfers to a specific IP within a secure zone, exposes the network to significant risks. Without these measures, the organization is vulnerable to unauthorized access and potential data breaches through DNS vulnerabilities. This could lead to compromised security and potential exposure of sensitive information. Implementing strict controls over DNS zone transfers is crucial for safeguarding network integrity and protecting against DNS-related attacks.
Do you block the port 135 TCP/UDP for RDP endpoint mapper? 2 points
Not implementing port blocking for 135 (TCP/UDP) associated with the RDP (Remote Desktop Protocol) endpoint mapper presents substantial risks. Keeping this port open may expose the system to various attacks, including attempts to exploit vulnerabilities related to RDP services. This exposure can lead to unauthorized access, potential security breaches, and compromised network integrity. By blocking port 135, the risks can be mitigated by limiting access and reducing the attack surface. This security measure is a vital step in defending against potential threats targeting RDP services.
Do you block port 137 UDP for NetBIOS Name Server? 2 points
Not implementing port blocking for UDP port 137, used by NetBIOS Name Server, entails significant risks. Keeping this port open can expose systems to potential attacks based on NetBIOS, including attempts to exploit vulnerabilities linked to NetBIOS services. This could result in unauthorized access, potential security breaches, and harm to network integrity. Blocking UDP port 137 is an essential security measure aimed at shrinking the attack surface and fortifying protection against potential threats that target NetBIOS services.
Do you block ports 139 TCP and 445 TCP/UDP for SMB over NetBIOS and SMB over TCP for Web and DNS Servers? 2 points
Failing to block ports 139 TCP and 445 TCP/UDP for SMB (Server Message Block) over NetBIOS and SMB over TCP for Web and DNS Servers poses significant risks. Leaving these ports open could potentially expose servers to various SMB-related attacks, including attempts to exploit vulnerabilities associated with SMB services. This can lead to unauthorized access, potential security breaches, and compromised server integrity. Blocking ports 139 and 445 helps mitigate these risks by limiting access and reducing the attack surface for SMB services on Web and DNS Servers. It is a crucial security measure to protect against potential threats targeting SMB protocols.
Do you block SNMPv1;2 for sending device logs toward the MIB Table by using the community string? 2 points
Neglecting to restrict SNMPv1 and SNMPv2 from transmitting device logs to the MIB (Management Information Base) Table via community strings creates substantial vulnerabilities. Allowing SNMPv1 and SNMPv2 with community strings opens the door to potential unauthorized access or tampering with device logs, which can result in unauthorized entry, security breaches, and harm to network integrity. By blocking these SNMP versions (Simple Network Management Protocol), we can mitigate these risks by controlling access to the MIB Table and safeguarding device logs. This stands as a critical security step to fortify against potential threats aimed at SNMP protocols.
Do you block port 389 TCP/UDP for LDAP management? 2 points
Failure to block TCP/UDP port 389 for LDAP management poses significant risks, including unauthorized access and security breaches. Blocking this port is crucial to limit access and enhance protection against potential threats targeting LDAP protocols.
If you are using LDAP for your accounts, do you prevent using of the same credentials as they use to access mails? 1 point
Using the same credentials for LDAP and mail accounts poses significant security risks, as a breach in one service could lead to unauthorized access to sensitive data in the other. Implementing separate credentials is crucial to prevent these risks and protect sensitive information.
Do you block port 3268 TCP/UDP for Global Catalog Service? 2 points
Failure to block port 3268 TCP/UDP for the Global Catalog Service poses significant security risks, potentially leading to unauthorized access and network breaches. Blocking this port is crucial to limit access and protect against potential threats targeting the service.
Do you block ports TCP/25&110 for SMTP and POP3 Mail? 2 points
Failing to block ports TCP/25 and TCP/110 for SMTP (Simple Mail Transfer Protocol) and POP3 (Post Office Protocol version 3) Mail poses significant risks. Leaving these ports open could potentially expose mail services to unauthorized access or exploitation. This may lead to unauthorized access, potential security breaches, and compromised email accounts. Blocking these ports helps mitigate these risks by limiting access and reducing the attack surface for mail services. It is a crucial security measure to protect against potential threats targeting SMTP and POP3 protocols.
Do you get the trigger on SNMP over the TCP/UDP 162? 1 point
Failing to implement triggers for SNMP (Simple Network Management Protocol) over port TCP/UDP 162 introduces significant risks. Without triggers, the network may not be able to promptly detect and respond to critical events or incidents. This could lead to delayed or inadequate responses to network issues, potentially resulting in service disruptions or security breaches. Implementing triggers for SNMP on port 162 is crucial for timely and effective monitoring and management of network devices.
Do you implement a group policy security option called: Additional Restriction for anonymous connections? 3 points
Failing to implement a group policy security option called "Additional Restriction for anonymous connections" introduces notable risks. Without this policy, the network may be more susceptible to unauthorized access attempts through anonymous connections. This could lead to potential security breaches and compromised network integrity. Implementing this security option is crucial for strengthening access controls and preventing unauthorized access to sensitive resources.
Do you configure in employees` windows machine the restriction of the anonymous access through RestrictNullSessionAccess parameter from the Windows Registry? 2 points
Failing to configure the restriction of anonymous access through the RestrictNullSessionAccess parameter in employees' Windows machines introduces significant risks. Without this configuration, the network may be more vulnerable to unauthorized access attempts through null sessions. This could lead to potential security breaches and compromised system integrity. Implementing this security measure is crucial for strengthening access controls and preventing unauthorized access to sensitive resources on Windows machines.
Do you block the NULL Session share or pipe access in any host, externally or inside the company? 2 points
Failing to block NULL Session share or pipe access in any host, whether externally or within the company, poses significant security risks. Allowing NULL Sessions can potentially expose sensitive information and resources to unauthorized access or exploitation. This could lead to unauthorized access, potential security breaches, and compromised network integrity. Blocking NULL Session access is a crucial security measure to prevent such unauthorized entry points and protect against potential threats targeting Windows systems.
Do you disable the open relay feature in SMTP server? 2 points
Having open relay feature enabled poses security risks such as spam exploitation or malicious emails, which can lead to phishing attacks, social engineering, blacklisting, and compromised email services. Disabling this feature is an important practice in prevention of SMTP server abuse.
Do you restrict the number of accept connections from a source to your server to prevent the brute force attack? 2 points
Failing to restrict the number of accepted connections from an only source to your server poses significant security risks. Without this restriction, the server is more vulnerable to brute force attacks, where an attacker may attempt to gain unauthorized access through a high volume of login attempts. This could lead to potential unauthorized access, security breaches, and compromised server integrity. Restricting the number of connections from a source is a crucial security measure to thwart brute force attacks and protect against potential threats targeting server access.
Do you prevent storing sensitive information such as passwords in cleartext configuration in data transit devices, such as routers, switches configuration? 2 points
Storing passwords in plaintext is a reckless practice that places sensitive information at significant risk. When passwords are readily accessible without any encryption or protection, it becomes a straightforward task for unauthorized individuals to gain access to these credentials. This, in turn, can lead to dire consequences, including security breaches. Unauthorized users can exploit this vulnerability to infiltrate systems, applications, and networks, potentially stealing sensitive data, disrupting services, and causing significant financial and reputational damage. The compromised passwords may also provide attackers with a foothold to launch further attacks within the network. As a result, the overall integrity of the network is severely compromised, and it becomes susceptible to a wide range of security threats.
To enhance network security and protect against these risks, it is imperative to implement encryption and robust storage mechanisms for passwords. Encryption transforms passwords into unreadable, scrambled data that can only be deciphered with the proper encryption key. Secure storage mechanisms, such as salted and hashed passwords, provide an additional layer of protection. This means that even if a breach occurs, the stolen data remains incomprehensible and unusable by malicious actors. By employing these security measures, organizations can significantly increase the resilience of their networks, safeguard sensitive user information, and reduce the likelihood of unauthorized access or security incidents. Ultimately, this prudent approach to password management bolsters the overall security posture of the network, promoting a safer and more robust digital environment.
Do you use Host IDS which monitor your system and disable the installation keylogger? 2 points
Failing to use a Host Intrusion Detection System (IDS) that monitors the system, detects, and disables keyloggers introduces significant security risks. Without this protection, the system is more susceptible to keylogger attacks, which can capture sensitive information like passwords and personal data. This could lead to unauthorized access, data breaches, and compromised security. Implementing a Host IDS with keylogger detection is a crucial security measure to safeguard against this type of threat and maintain the integrity of the system.
Do you configure the TCP Intercept feature in routers of your company to protect TCP servers from a TCP SYN-Flooding attack? 3 points
Failing to configure the TCP Intercept feature in routers to protect TCP servers from SYN-Flooding attacks poses significant security risks. Without this protection, the servers are more vulnerable to SYN-flooding attacks, which can overwhelm the network and lead to service disruption or downtime. This could result in potential loss of productivity and revenue. Configuring TCP Intercept is a crucial security measure to mitigate the impact of such attacks and ensure the availability and reliability of TCP services.
Do you use Honeypot to trap the attacker in a rogue vulnerable system? 3 points
Not utilizing a Honeypot, which is designed to trick attackers into engaging with a simulated vulnerable system, exposes the network to significant security risks. In the absence of this deception mechanism, there is no effective means to attract and identify potential attackers. This lack of visibility into potential threats makes it challenging to promptly detect and respond to security incidents, increasing the likelihood of delayed or inadequate responses. Consequently, network integrity may be compromised as attackers go undetected. Implementing a Honeypot serves as a vital security measure because it proactively allows organizations to monitor and collect information about potential attackers, bolstering the network's overall security stance by providing early threat detection and valuable threat intelligence.
In summary, a Honeypot acts as a strategic asset in the cybersecurity toolkit, not only for identifying attackers but also for gathering insights into their tactics and objectives. By employing this technology, organizations can better defend against cyber threats and minimize the potential damage and risks associated with security incidents.
Do you communicate with branches (if any) by using security tunnel such as: IPSec, SSL or L2TP? 5 points
Failing to communicate with branches (if any) using a secure tunnel, such as IPSec, TLS, or L2TP, introduces significant security risks. Without this encrypted communication channel, sensitive data transmitted between branches could be susceptible to interception or tampering by unauthorized parties. This could lead to potential data breaches, compromised confidentiality, and integrity of information. Implementing a secure tunnel is a crucial security measure to protect the confidentiality and integrity of communication between branches and maintain the overall security of the network.
Do you ever implement the technique of cognitive radios in the physical layer to handle jamming and scrambling attacks? 2 points
Failing to implement cognitive radios in the physical layer to handle jamming and scrambling attacks poses significant risks. Without this advanced technology, the network may be more vulnerable to deliberate interference and signal manipulation. This could lead to service disruptions, compromised communication, and potential security breaches. Implementing cognitive radios is a sophisticated security measure that can enhance the network's resilience against jamming and scrambling attacks, ensuring more robust and reliable communication.
Do you have any policy rule in Firewall or IDS which not allow TTL with small value such as i.e 1? 1 point
Failing to have a policy rule in the Firewall or IDS that restricts TTL (Time To Live) values to prevent small values, like 1, introduces significant security risks. Allowing extremely low TTL values could potentially indicate unusual or suspicious network behavior, which may be indicative of an attack or misconfiguration. Failing to enforce this rule could lead to delayed or inadequate responses to potential security incidents, potentially resulting in compromised network integrity. Implementing a policy to disallow incredibly low TTL values is a crucial security measure to strengthen network defenses and protect against potential threats.
Do you have a rule called traffic normalizer in IDS which simulate the packet received as if the real IIS or Apache web server in order to avoid the Invalid RST or SYN packets? 2 points
Failing to have a rule called traffic normalizer in an IDS (Intrusion Detection System) that simulates received packets to appear as if from a real IIS or Apache web server poses notable security risks. Without this rule, the network may be more susceptible to attacks that exploit vulnerabilities in the handling of RST or SYN packets. This could lead to potential service disruptions, compromised web server integrity, and potential security breaches. Implementing a traffic normalizer rule is a crucial security measure to mitigate the risk of such attacks and protect the web server from exploitation.
Do you have a rule in IDS which understand the Urgency Flag in TCP header to avoid the IDS bypass problem? 1 point
Failing to have a rule in the IDS (Intrusion Detection System) that understands the Urgency Flag in the TCP header to mitigate the IDS bypass problem poses significant security risks. Without this rule, attackers could potentially exploit the Urgency Flag to bypass detection, making it harder to identify and respond to threats. This could lead to undetected malicious activities, potential security breaches, and compromised network integrity. Implementing a rule that effectively interprets the Urgency Flag is a crucial security measure to enhance the effectiveness of the IDS and bolster network security.
Do you have a rule in Firewall / NIDS which block the ICMP TTL expired packets at the external interface level and change the TTL field to a large value? 2 points
Failing to have a rule in the Firewall/NIDS that blocks ICMP TTL expired packets at the external interface level and modifies the TTL field to a large value introduces significant security risks. Without this rule, the network may be more susceptible to potential reconnaissance attempts or information leakage through TTL-based techniques. This could lead to unauthorized access, potential security breaches, and compromised network integrity. Implementing a rule to handle ICMP TTL expired packets is a crucial security measure to strengthen network defenses and protect against potential threats.
Do you regularly check the ACLs in your firewall? 2 points
Failing to regularly check the Access Control Lists (ACLs) in your firewall poses notable security risks. Outdated or misconfigured ACLs can lead to unauthorized access, potential security breaches, and compromised network integrity. Regularly reviewing and updating ACLs is a crucial security measure to ensure that they accurately reflect the current network requirements and effectively protect against potential threats.
Do you create the unique user ID to run the firewall service rather than running the services using the Administrator or root IDs? 2 points
Failing to create a unique user ID to run the firewall service, rather than using Administrator or root IDs, introduces significant security risks. Running critical services with highly privileged accounts like Administrator or root increases the potential impact of a successful attack. If an attacker gains control over the firewall service, they may have broader access to the system, potentially leading to unauthorized access, security breaches, and compromised network integrity. Creating a dedicated, limited-privilege user ID for the firewall service is a crucial security measure to restrict potential damage in case of a successful attack.
Do you configure a remote syslog server and apply strict measures to protect it from the malicious users? 2 points
Failing to configure a remote syslog server and implement strict security measures to protect it from malicious users introduces significant risks. Without proper safeguards, the syslog server could be vulnerable to unauthorized access, potential data tampering, or even denial-of-service attacks. This could lead to compromised logging integrity, hindering the ability to detect and respond to security incidents effectively. Configuring a remote syslog server with robust security measures is a crucial step in maintaining accurate and reliable logs for network monitoring and security analysis.
Do you monitor regularly the user access to firewall and control who can modify the firewall configuration? 3 points
Neglecting regular monitoring of user access to the firewall and not controlling who can modify its configuration entails significant security risks. Without proper oversight, the likelihood of unauthorized alterations to firewall rules increases, potentially resulting in security vulnerabilities or misconfigurations. This could compromise network integrity, lead to unauthorized access, or trigger security incidents. Consistently monitoring user access and enforcing stringent controls over firewall configuration changes is an essential security measure to uphold the effectiveness and integrity of network defenses.
Do you notify the security policy administrator on firewall changes and document them? 3 points
Failing to notify the security policy administrator about firewall changes and properly documenting them poses notable security risks. Without this process, there may be a lack of accountability and transparency in managing firewall configurations. This could lead to potential security oversights, misconfigurations, or unauthorized changes that may compromise network integrity. Notifying the security policy administrator and maintaining thorough documentation of firewall changes is a crucial security measure to ensure that configurations align with security policies and to facilitate effective incident response and audit trails.
Do you take the regular backups of the firewall configuration and ruleset files? 3 points
Failing to take regular backups of the firewall configuration and ruleset files introduces significant security risks. In the event of a system failure, configuration error, or security incident, the absence of backups can lead to extended downtime, potential data loss, or compromised network security. Regularly backing up firewall configurations is a crucial security measure to ensure system resilience, enable swift recovery, and maintain the overall integrity of network defenses.
Do you schedule regular firewall security audits? 3 points
Failing to schedule regular firewall security audits poses notable security risks. Without routine assessments, potential vulnerabilities or misconfigurations may go undetected, leaving the network more susceptible to security breaches or unauthorized access. Regular security audits are a crucial measure to proactively identify and address any weaknesses in the firewall's configuration or ruleset, thereby enhancing network security and maintaining its integrity.
If you use a Cisco, Juniper, Mikrotik, Fortinet or D-Link router, do you block a Dial Backup line or Dial on Demand Routing (DDR) technique installed on your premise to avoid War dialing risk for un-authorized access? 4 points
Neglecting to block Dial Backup lines or Dial on Demand Routing (DDR) techniques can introduce significant security vulnerabilities to a network. These methods involve the use of modems and phone lines for connecting to the network, which can be exploited by malicious actors through a practice known as war dialing. In a war dialing attack, attackers systematically scan phone lines for modems that are inadvertently left exposed or inadequately secured. If they discover an active modem, they can gain unauthorized access to the network, potentially leading to security breaches, data theft, or other malicious activities. Failing to block these dialing techniques can, therefore, expose the network to such risks, compromising its integrity and granting unauthorized individuals access to sensitive systems and data.
Implementing the blocking of Dial Backup lines or DDR techniques is a crucial security measure to mitigate the threat of war dialing and enhance network security. By preventing unauthorized access through these methods, organizations can significantly reduce the risk of security breaches and safeguard their network infrastructure. This proactive approach helps protect against potential threats, maintain data confidentiality, and ensure that the network remains secure from external intruders seeking to exploit vulnerable modems or phone lines.
Do you disable the Broadcast Ping request in router to prevent the smurf attack? 3 points
Failing to disable Broadcast Ping requests in a router introduces significant security risks. Allowing Broadcast Ping requests can potentially enable smurf attacks, where an attacker floods a network with ICMP Echo Request packets, amplifying the volume of traffic and causing network disruption. This could lead to potential service disruptions, compromised network availability, and potential security breaches. Disabling Broadcast Ping requests is a crucial security measure to mitigate the risk of smurf attacks and safeguard network integrity.
Do you install features such as Throttling in your router, to prevent DoS/DDoS attack to servers inside or outside of the company? 2 points
Installing features like Throttling is a crucial security measure to mitigate the impact of DoS/DDoS attacks and protect the integrity of network services as failing to do so poses significant security risks. During a DoS/DDoS attack, throttling helps in conserving resources, improves responsiveness, provides a temporary time for mitigation and most importantly, limits the collateral damage by slowing down the rate of incoming malicious traffic.
