Please enable JavaScript.
Coggle requires JavaScript to display documents.
CompTIA Security+ Chapter 4 (Wireless Attacks (Dissociation Attacks, WiFi…
CompTIA Security+ Chapter 4
Intrusion Detection / Prevention systems (IDSs & IPSs)
Host-based IDS (HIDS)
Passes through host's NIC
Malware detection
Network-based IDS (NIDS)
Plaintext or non-encrypted traffic only
Sensors / collectors
Tap / port mirror (all traffic to single port)
Detection Methods
Signature-based IDSs
Heuristic / Behavioural Detection
False Positive vs False Negative
Inline
/ in-band vs
Passive
/ out-of-band
Securing Network
SSL/TLS Accelerators
SSL Decrypter
often used with NIPS
Software defined network (SDN)
Open Shortest Path First (OSPF) and Border Gateway Protocol (BGP)
Honeypot / Honeynet
IEEE 802.1x Security
Wireless Basics
Access Points (AP)
Not all APs are wireless routers
Fat vs Thin AP
Band Selection and Channel Width
Service Set ID (SSID)
MAC Filtering
Antenna
Types, placement, power, signal strength
Network Architecture Zones
Wireless
Guest
Ad hoc
Wireless Cryptographic Protocols
Wi-Fi Protected Access (WPA) & WPA2
Temporal Key Integrity Protocol (TKIP) vs Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP).
CCMP is based on Advanced Encryption Standard (AES)
Pre-shared key (PSK) vs Enterprise
Authentication Protocols
Extensible Authentication Protocol (EAP) Pairwise Master Key (PMK).
EAP-Flexible -
certs optional
Protected EAP (PEAP) -
cert on server
; TLS for EAP conversations only
EAP-Tunneled TLS (EAP-TTLS) -
cert on server
; -extension of PEAP
EAP-TLS -most secure
-certs on BOTH client and server
RADIUS Federation
Captive Portals -log in for free internet hotspots
Wireless Attacks
Dissociation Attacks
WiFi Protected Setup (WPS) attacks
Rogue AP
Jamming
Init vector (IV) attack
Near field communication (NFC) attack
Bluetooth
bluejacking - unsolicted messages
bluesnarfing - unauthorized access
bluebugging - full access + backdoor
Replay Attacks
Radio-frequency identification (RFID)
Eavesdropping, replay, DoS
Misconfigured AP
Using depreciated WPA
enabling WPS
Virtual Private Network (VPN)
IPsec Tunneling
Tunnel mode & Transport mode
Provides: Authentication Header (AH) & Encapsulating Security Payload (ESP)
Protocol Port 51 & 50
Internet Key Exchange (IKE) Port 500
TLS Tunneling
Secure Socket Tunneling Protocol (SSTP) uses TLS
Port 443
Split tunnel vs Full Tunnel
Site-to-site VPN
Always-on VPN
Network Access Control (NAC)
Grant access based on 'Health'
Remediation Network (quarantine)
Permanent vs Dissolvable Agents
Identity and Access Services
Password Authentication Protocol (PAP)
Challenge Handshake Authentication Protocol (CHAP)
MS-CHAP
MS-CHAPv2
Remote Authentication Dial-In User Service (RADIUS)
Terminal Access Controller Access-Control System Plus (TACACS+)
Diameter
RADIUS, TACACS+, and Diameter are considered AAA protocols because they provide all three services.