112-51: Network Defense Essentials

The combination of authentication mechanisms that is implemented in the above scenario is biometric and password authentication. Biometric authentication is a type of authentication that uses an inherent factor, such as a retina scan, to verify the identity of the user. Password authentication is a type of authentication that uses a knowledge factor, such as a six-digit code, to verify the identity of the user. By combining biometric and password authentication, Finch has implemented a two-factor authentication (2FA) system that requires the user to provide two different types of authentication factors to gain access to the office. 2FA is a more secure way of authentication than using a single factor, as it reduces the risk of unauthorized access due to stolen or compromised credentials. Biometric and password authentication is a common 2FA method that is used in many applications, such as banking, e-commerce, or health care123.

Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-28 to 3-29

What is Biometric Authentication?, Norton, July 29, 2020

What is Two-Factor Authentication (2FA)?, Authy, 2020

The correct sequence of steps involved in establishing a network connection using the shared key authentication process is 4 -> 1 -> 3 -> 5 -> 2. This is based on the following description of the shared key authentication process from the Network Defense Essentials courseware:

The station sends an authentication frame to the AP, indicating that it wants to use shared key authentication.

The AP responds with an authentication frame containing a challenge text, which is a random string of bits.

The station encrypts the challenge text using its configured WEP key, which is derived from the shared secret key (password) that is also known by the AP. The station sends the encrypted text back to the AP in another authentication frame.

The AP decrypts the encrypted text using its configured WEP key and compares it with the original challenge text. If they match, the AP sends a positive authentication response to the station. If they do not match, the AP sends a negative authentication response to the station.

The station connects to the network if the authentication is successful.

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-18 to 3-19

Shared Key Authentication - Techopedia, Techopedia, June 15, 2017

Biometric authentication is a type of authentication that uses the physical or behavioral characteristics of a person to verify their identity. Biometric authentication is more secure and convenient than other methods such as passwords or tokens, as biometric traits are unique, hard to forge, and easy to use. Some examples of biometric authentication techniques are retina scanner, DNA, and voice recognition. Retina scanner uses a low-intensity light beam to scan the pattern of blood vessels at the back of the eye, which is unique for each individual. DNA uses the genetic code of a person to match their identity, which is the most accurate and reliable biometric technique. Voice recognition uses the sound and pitch of a person's voice to verify their identity, which is influenced by factors such as anatomy, physiology, and psychology. These techniques fall under biometric authentication, as they use the physical or behavioral traits of a person to authenticate them.

Reference:

Biometric Authentication - Week 2: Identification, Authentication, and Authorization

Biometric Authentication: What You Need To Know

Biometric Authentication Techniques

Explore

The correct order of wireless encryption modes in terms of security from high to low is 2 -> 1 -> 4 -> 3. This is based on the following comparison of the wireless encryption modes:

WPA3: WPA3 is the latest and most secure wireless encryption mode, introduced in 2018 as a successor to WPA2. WPA3 uses the AES encryption protocol and provides several security enhancements, such as stronger password protection, individualized encryption, forward secrecy, and protection against brute-force and dictionary attacks. WPA3 also supports two modes: WPA3-Personal and WPA3-Enterprise, which offer different levels of security for home and business networks. WPA3-Personal uses Simultaneous Authentication of Equals (SAE) to replace the Pre-Shared Key (PSK) method and provide more robust password-based authentication. WPA3-Enterprise uses 192-bit cryptographic strength to provide additional protection for sensitive data and networks123.

WPA2 Enterprise with RADIUS: WPA2 Enterprise with RADIUS is a wireless encryption mode that combines the security features of WPA2 Enterprise and the authentication features of RADIUS. WPA2 Enterprise is a mode of WPA2 that uses the AES encryption protocol and provides stronger security than WPA2 Personal, which uses the PSK method. WPA2 Enterprise uses the 802.1X standard to implement Extensible Authentication Protocol (EAP) methods, such as EAP-TLS, EAP-TTLS, or PEAP, to authenticate users and devices before granting access to the network. RADIUS is a protocol that allows a central server to manage authentication, authorization, and accounting for network access. RADIUS can integrate with WPA2 Enterprise to provide centralized and scalable authentication for large and complex networks, such as corporate or campus networks .

WPA2 Enterprise: WPA2 Enterprise is a wireless encryption mode that uses the AES encryption protocol and provides stronger security than WPA2 Personal, which uses the PSK method. WPA2 Enterprise uses the 802.1X standard to implement Extensible Authentication Protocol (EAP) methods, such as EAP-TLS, EAP-TTLS, or PEAP, to authenticate users and devices before granting access to the network. WPA2 Enterprise is suitable for business or public networks that require individual and secure authentication for each user or device .

WPA2 PSK: WPA2 PSK is a wireless encryption mode that uses the AES encryption protocol and provides better security than WEP or WPA, which use the TKIP encryption protocol. WPA2 PSK uses the Pre-Shared Key (PSK) method, which means that all users and devices share the same password or passphrase to join the network. WPA2 PSK is easy to set up and use, but it has some security drawbacks, such as being vulnerable to brute-force and dictionary attacks, or having the password compromised by a rogue user or device. WPA2 PSK is suitable for home or small networks that do not require individual authentication or advanced security features .

Wi-Fi Security: Should You Use WPA2-AES, WPA2-TKIP, or Both? - How-To Geek, How-To Geek, March 12, 2023

WiFi Security: WEP, WPA, WPA2, WPA3 And Their Differences - NetSpot, NetSpot, February 8, 2024

What is WPA3? And some gotchas to watch out for in this Wi-Fi security upgrade - CSO Online, CSO Online, November 18, 2020

[Types of Wireless Security Encryption - GeeksforGeeks], GeeksforGeeks, 2020

[Wireless Security Protocols: WEP, WPA, and WPA2 - Lifewire], Lifewire, February 17, 2021

[WPA vs. WPA2 vs. WPA3: Wi-Fi Security Explained - MakeUseOf], MakeUseOf, January 13, 2021

The IDS component that analyzes the traffic and reports if any suspicious activity is detected is the network sensor. A network sensor is a device or software application that is deployed at a strategic point or points within the network to monitor and capture the network traffic to and from all devices on the network. A network sensor can operate in one of two modes: promiscuous or inline. In promiscuous mode, the network sensor passively listens to the network traffic and copies the packets for analysis. In inline mode, the network sensor actively intercepts and filters the network traffic and can block or modify the packets based on predefined rules. A network sensor analyzes the network traffic using various detection methods, such as signature-based, anomaly-based, or reputation-based, and compares the traffic patterns with a database of attack signatures or a model of normal behavior. If the network sensor detects any suspicious or malicious activity, such as a reconnaissance scan, an unauthorized access attempt, or a denial-of-service attack, it generates an alert and reports it to the IDS manager or the operator. A network sensor can also integrate with a response system to take appropriate actions, such as logging, notifying, or blocking, in response to the detected activity123.

Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-33 to 3-34

Intrusion Detection System (IDS) - GeeksforGeeks, GeeksforGeeks, 2020

Intrusion detection system - Wikipedia, Wikipedia, March 16, 2021

Onsite data backup is the backup mechanism that is performed within the organization using external devices such as hard disks and requires human interaction to perform the backup operations, thus, making it susceptible to theft or natural disasters. Onsite data backup means storing the backup data on a local storage device, such as an external hard drive, a USB flash drive, a CD/DVD, or a tape drive, that is physically located in the same premises as the original data source. Onsite data backup has some advantages, such as fast backup and restore speed, easy access, and low cost. However, it also has some disadvantages, such as requiring manual intervention, occupying physical space, and being vulnerable to damage, loss, or theft. If a disaster, such as a fire, flood, earthquake, or power outage, occurs in the organization, both the original data and the backup data may be destroyed or inaccessible. Therefore, onsite data backup is not a reliable or secure way to protect the data from unforeseen events.

Reference:

Should I Use an External Hard Drive for Backup in 2024?, Cloudwards, February 8, 2024

How to Back Up a Computer to an External Hard Drive, Lifewire, April 1, 2022

Best Way to Backup Multiple Computers to One External Drive, AOMEI, December 29, 2020

Denial-of-service (DoS) is the category of suspicious traffic signature that George identified in the above scenario. DoS signatures are designed to detect attempts to disrupt or degrade the availability or performance of a system or network by overwhelming it with excessive or malformed traffic. SYN flood and ping of death are examples of DoS attacks that exploit the TCP/IP protocol to consume the resources or crash the target server. A SYN flood attack sends a large number of TCP SYN packets to the target server, without completing the three-way handshake, thus creating a backlog of half-open connections that exhaust the server's memory or bandwidth. A ping of death attack sends a malformed ICMP echo request packet that exceeds the maximum size allowed by the IP protocol, thus causing the target server to crash or reboot. DoS attacks can cause serious damage to the organization's reputation, productivity, and revenue, and should be detected and mitigated as soon as possible123.

Reference:

Network Defense Essentials Courseware, EC-Council, 2020, pp. 3-33 to 3-34

What is a denial-of-service attack?, Cloudflare, 2020

Denial-of-service attack - Wikipedia, Wikipedia, March 16, 2021

AES (Advanced Encryption Standard) is an iterated block cipher that works by repeating the defined steps multiple times and has a 128-bit block size, having key sizes of 128, 192, and 256 bits. AES is a symmetric-key algorithm that encrypts and decrypts data using the same secret key. AES operates on a 4x4 matrix of bytes called the state, which undergoes 10, 12, or 14 rounds of transformation depending on the key size. Each round consists of four steps: sub-bytes, shift-rows, mix-columns, and add-round-key. AES is widely used for securing data in various applications and platforms, such as web browsers, VPNs, wireless networks, and smart grids. AES is the algorithm that matches the description given in the question.

Reference:

AES - Week 4: Cryptography Techniques

Advanced Encryption Standard (AES) - NIST

AES Encryption and Decryption Online Tool - Code Beautify