Network Security: Authentication Methods

What you know, what you have, what you are, where you are

Encrypted data file that uses a Certificate Authority to guarantee the identity of the holder

Remote Authentication Dial-In User Service

Terminal Access Controller Access Control System Plus

Users should only be allowed to access resources that they are supposed to be able to access

Rights are placed on the users using group policy, Permissions are assigned to folders, structure groups, etc using ACLs

Access Control List

An authentication system used to verify the identity of networked users.

Key Distribution Center

Stored in KDC, hashed password + salt

Centralized, hierarchical information repository about objects in an IT system

Lightweight Directory Access Protocol

Moving an object from one location to another

Defines attribute types and structure of a directory

Any object that cannot contain other objects in the directory

Organizational unit

Distinguished Name

The International Organization for Standardization (ISO) standard for directory service.

The Windows directory service that enables administrators to create and manage users and groups, set network-wide user and computer policies, manage security, and organize network resources.

In Windows, a logical group of computers and users in which administration, resources, and security are distributed throughout the network, without centralized management or security.

A collection of objects that share the same database

A collection of well-connected subnets; the physical structure or topology of network

Changes made on one domain controller are applied to another domain controller

Instance of a class. Everything within AD is an object

A concept or framework that organizes and interprets information. Hold the classes for objects

A centralized configuration management
feature available for Active Directory on
Windows Server systems.

Group Policy Object

Remote Desktop Protocol

Single instance of Active Directory

A Windows server that has Active Directory installed and is responsible for allowing client computers access to domain resources.

Controls all updates and modifications to the schema.

Controls the addition and removal of domains in the forest.

The master time keeper and master for password changes in an Active Directory domain

Responsible for assigning IDs to objects

Maintains references to objects located in another domain (phantoms)

Security Groups have SIDs added to user tokens, can be used in ACLs
Distribution groups are organizational only, not for access control

A user profile stored on the same system where the user logs on.

A user profile that can be changed during a user's logon session, but the next time the user logs on, the changes aren't saved, and the profile reverts to its original state.

A user profile that is stored in a network location and is accessible from multiple computers. Roaming profiles move with users from computer to computer.

A setting that allows files to be redirected to a network drive for backup and makes them accessible from anywhere on the network.

A host name plus domain name that uniquely identifies a computer or location on a network.

A computer whose job is to know the name of every other computer on the network. Resolves FQDNs to IP addresses

Network Basic Input/Output System. Legacy but still a part of Windows

Server Message Block. NetBIOS names are used here

NETBEUI, IPX/SPX, TCP/IP

15 user defined characters, alphanumeric except for \/:*?";|+˽

Used by Active Directory. Local DNS server attempts to resolve itself and if unable, it makes a series of iterative queries to locate and query the authoritative name server for the target domain

computer's network name

Allows DNS clients to register their
hostnames in an assigned namespace such
as DHCP.

The process of emulating hardware so it can be made available to multiple logical systems

Virtualization layer is installed on top of existing operating system as an application

Virtualization layer is installed directly on the hardware

A method for a hypervisor to offer interfaces to a guest OS that the guest OS can use instead of the normal hardware interfaces.

Enables multiple applications an processes, whose aggregate memory requirement is greater than the available physical memory, to run a host without impacting each other. Uses the virtual memory manager (VPP) to do a paging process with swap space.

Involves managing the routing of I/O requests between
virtual devices and the shared physical hardware

a bare-metal hypervisor that is powerful enough to replace the host OS on a physical box, turning the physical machine into a system that does nothing but support VMs. Is often run from a USB

Network Interface Card

Network Attached Storage

Storage Area Network

A mechanism for setting policies that govern the network connected to it. A vSwitch can have multiple Port Groups.

Hard disk, floppy disks, CD, DVD, jump drives

Redundant Array of Independent Disks

Uses striping, but no redundancy; improves performance, but not reliability

Provides redundancy through disk mirroring, in which data from one disk is automatically copied to another disk as the information is written.

Stripping with parity, at least 3 disks. If one fails, the parity disk will reconstruct the data. 66% of the drive is open, the rest is used by parity

Mirrored and striped, increased performance and fault tolerance

32-bit file allocation table

Often referred to as a "journaling" file system because it keeps track of transactions performed when working with files and directories.

The storage devices that transfer data to and from the system in chunks of many data bits by caching the information in RAM; they are represented by block device files.

An area of a hard disk created by dividing a large hard disk into several smaller virtual ones, such as when using two operating systems on a single computer.

Backup that copies all data from a system.

A type of partial backup that involves copying all changes made since the last full backup. Thus, each new differential backup file contains the cumulative effects of all activity since the last full backup.

A type of partial backup that involves copying only the data items that have changed since the last partial backup. This produces a set of incremental backup files, each containing the results of one day's transactions

The backup is done over the network from a central backup console

A logical subset of a larger network, used to determine relative location of an item in the directory

An IP-based storage networking standard for linking data storage facilities.

Used to move an FSMO role when both source and destination servers are available

Used to move an FSMO role when the source server is unavailable, once a role is seized the server should not be brought back online

A system that replicates the information of every object in a tree and forest so that objects can be found and accessed from any domain.

SAN is designed for datacenter-class applications
-Separates transaction-intensive traffic from other traffic on the network

NAS is used for more file server applications
-NAS traffic is somewhat shared with other traffic
-Mostly used for storage solutions, rather than real-time sensitive applications

Transmission Control Protocol - provides reliable, ordered, and error-checked delivery of a stream of packets on the internet. TCP is tightly linked with IP and usually seen as TCP/IP in writing.

Linking two or more identical printers with one printer setup or printer share.

LPD, installed on all printing devices, handles both printers and print jobs. LPR acts on the client, or sending machine, and is used to send the data from a host machine to the network's print resource so you end up with actual printed output.

designed for printer sharing, along with the Line Printer (LPR) program, allows print jobs to be spooled and sent to the network's printers using TCP/IP

Default network printing protocol. Doesn't require a queue setting, no port limits, no timeout, bi-directional

A printing system for Linux and other Unix-like systems. CUPS adds several features that had been missing from the earlier BSD LPD and LPRng printing systems.

A file format that describes a page's layout, contents, and position within the larger document in a manner the output device can understand.

-created by HP
-originally used to command early inkjet printers
-now an industry standard for most printer types

created bu Apple, licensed by Adobe. Provides the basis for PDF files. Treats everything as raster images

Provides services to the print driver, calls the proper print driver based on type of printer needed

a device driver that converts the print jobs generated by applications into an appropriate string of commands for a specific print device

Processes and sends print jobs to the print server

Handles scheduling received print jobs

Also responsible for locating the print driver and spooling high-level function calls

Determines which print provider to send print jobs to based on information provided with the print job

Provides job control and printer management capabilities

A component of the print spooler that controls access to and monitors the status of a specific print device.

A service implemented on Windows Servers that hides the complexity of the network from end users in that it makes files that are distributed across multiple servers appear as if they are in one place.

Unified view of distributed file shares

Server that contains the namespace root

A network share located on a server that is part of the
namespace

The process of pointing a client to a target

folder within namespace, virtual or a referral to an actual target

A subset of Visual Basic, used to introduce dynamic decision making into web pages.

is the Microsoft version of JavaScript, similar in functionality a subset of the full JavaScript language. JScript is built into Microsoft Internet Explorer; JavaScript is built into Mozilla Firefox. Because of the slight differences between JavaScript and JScript, programs written in JavaScript may not function properly within Internet Explorer, and programs written in JScript may not function properly within Mozilla Firefox.

A command-line interactive scripting environment that provides the commands needed for most management tasks in a Windows Server 2012/R2 environment.

Developed for a free OS called GNU. The GPL is slightly more restrictive that the BSD license because it requires derivative works to be licensed.

Key Management Service