Chapter 6 Key Terms

Access Control list: A set of rules to permit or restrict data from flowing into or out of a network.

A configuration in which all load balancers are always active.

A configuration in which the primary load balancer distributes the network traffic to the most suitable server while the secondary load balancer operates in a “listening mode.”

A scheduling protocol that distributes the load based on which devices can handle the load more efficiently.

A network access control (NAC) agent that is not installed on an endpoint device but is embedded within a Microsoft Windows Active Directory domain controller.

The absence of any type of connection between devices.

A VPN that allows the user to always stay connected instead of connecting and disconnecting from it.

A monitoring technique used by an intrusion detection system (IDS) that creates a baseline of normal activities and compares actions against the baseline. Whenever there is a significant deviation from this baseline, an alarm is raised.

A defense used to protect against IP spoofing that imitates another computer’s IP address.

A special proxy server that “knows” the application protocols that it supports.

A firewall that functions at the OSI Application layer (Layer 7).

A monitoring technique used by an intrusion detection system (IDS) that uses the normal processes and actions as the standard and compares actions against it.

A hardware device or software that is used to join two separate computer networks to enable communication between them.

Data loss prevention: A system of security tools that is used to recognize and identify data that is critical to the organization and ensure that it is protected.

Demilitarized zone: A separate network that rests outside the secure network perimeter: untrusted outside users can access the DMZ but cannot enter the secure network.

A network access control (NAC) agent that disappears after reporting information to the NAC device.

A private network that can also be accessed by authorized external customers, vendors, and partners.

The failure to raise an alarm when there is abnormal behavior.

Alarm that is raised when there is no actual abnormal behavior.

Hardware or software that is designed to limit the spread of malware.

A defense against a MAC flooding attack. See also port security.

A computer or an application program that intercepts user requests from the internal secure network and then processes those requests on behalf of the users.

A VPN technology in which all traffic is sent to the VPN concentrator and is protected.

A separate open network that anyone can access without prior authorization.

gave no definition?

A monitoring technique used by an intrusion detection system (IDS) that uses an algorithm to determine if a threat exists.

Reports sent by network access control (NAC) “agents” installed on devices to gather information and report back to the NAC device.

A software firewall that runs as a program on the local computer to block or filter traffic coming into and out of the computer.

Host-based intrusion detection system: A software-based application that runs on a local host computer that can detect an attack as it occurs.

A technology that monitors a local system to immediately react to block a malicious attack.

internet mail access protocol: A more recent and advanced electronic email system for incoming mail.

The principle of being always blocked by default.

An intrusion detection system (IDS) implemented through the network itself by using network protocols and tools.

An intrusion detection system (IDS) that is directly connected to the network and monitors the flow of data as it occurs.

A private network that belongs to an organization that can only be accessed by approved internal users.

a device that detects an attack as it occurs

A dedicated network device that can direct requests to different servers based on a variety of factors.

A means to mitigate broadcast storms using the IEEE 802.1d standard spanning-tree algorithm (STA).

A system that monitors emails for unwanted content and prevents these messages from being delivered.

A device that converts media data from one format to another.

Network access controls: A technique that examines the current state of a system or network device before it can connect to the network.

Network address translation:A technique that allows private IP addresses to be used on the public Internet.

A technology that watches for attacks on the network and reports back to a central device.

A technology that monitors network traffic to immediately react to block a malicious attack.

A firewall that functions at the OSI Network layer (Layer 3).

An intrusion detection system (IDS) that uses an independent and dedicated channel to reach the device.

An intrusion detection system (IDS) that is connected to a port on a switch in which data is fed to it.

A network access control (NAC) agent that resides on end devices until uninstalled.

Isolating the network so that it is not accessible by outsiders.

A flood guard technology that restricts the number of incoming MAC addresses for a port.

Post office protocol: An earlier mail system responsible for incoming mail.

A user-to-LAN VPN connection used by remote users.

A proxy that routes requests coming from an external network to the correct internal server.

A scheduling protocol rotation that applies to all devices equally.

A device that can forward packets across computer networks.

Security and information event management: A product that consolidates real-time monitoring and management of security information with analysis and reporting of security events.

A SIEM feature that combines data from multiple data sources (network security devices, servers, software applications, etc.) to build a comprehensive picture of attacks.

A SIEM feature that can inform security personnel of critical issues that need immediate attention.

A SIEM feature that searches the data acquired through SIEM aggregation to look for common characteristics, such as multiple attacks coming from a specific source.

A SIEM feature that can help filter the multiple alerts into a single alarm.

A SIEM feature that records events to be retained for future analysis and to show that the enterprise has complied with regulations.

A SIEM feature that can show the order of the events.

A monitoring technique used by an intrusion detection system (IDS) that examines network traffic to look for well-known patterns and compares the activities against a predefined signature.

An earlier email system that handles outgoing mail.

A VPN connection in which multiple sites can connect to other sites over the Internet.

A VPN technology in which only some traffic is sent to the VPN concentrator and is protected while other traffic directly accesses the Internet.

A separate device that decrypts SSL traffic.

A separate hardware card that inserts into a web server that contains one or more co-processors to handle SSL/TLS processing.

A firewall that keeps a record of the state of a connection between an internal computer and an external device and then makes decisions based on the connection as well as the conditions.

A firewall that looks at the incoming packet and permits or denies it based on the conditions that have been set by the administrator.

A device that connects network segments and forwards only frames intended for that specific device or frames sent to all devices.

A proxy that does not require any configuration on the user’s computer.

unified threat managements: An integrated device that combines several security functions.

A data loss prevention (DLP) technique for blocking the copying of files to a USB flash drive.

Virtual IP: An IP address and a specific port number that can be used to reference different physical servers.

Virtual Lan: A technology that allows scattered users to be logically grouped together even though they may be attached to different switches.

virtual private network: A technology that enables use of an unsecured public network as if it were a secure private network.

A technology that enables use of an unsecured public network as if it were a secure private network.

A firewall that filters by examining the applications using HTTP.