1. MSSP
Answer: Managed Security Service Provider
2. Vendors...
Answer: Vendors sell SIEM software, as appliances or as managed services;these products are
also used to log security data and generate reports for com
...
1. MSSP
Answer: Managed Security Service Provider
2. Vendors...
Answer: Vendors sell SIEM software, as appliances or as managed services;these products are
also used to log security data and generate reports for compliance purposes.
3. Explain what a SIEM is and how they can be used?
Answer: Stands for Security Information and Event Management.All a SIEM doesis aggregate
data from multiplesources, such as applications and network hardware, and compiles the data
into meaningful information. Depending on the software, they can also detect potential or
ongoing threats and block access.
4. DLP
Answer: Data Loss Prevention
Is a strategy for making sure that end users do not send sensitive or critical information
outside the corporate network. The term is also used to describe software productsthat help a
network administrator control what data end users can transfer.
5. What's the TCP Handshake
Answer: The three-way handshake is a cornerstone of theTCP suite:SYN, SYN/ACK, ACK.
SYN isthe outgoing connection requestfrom clientto server, requesting to open up a
connection. SYN/ACK is the acknowledgement of the server back to the client, saying that
yes I hear you, let's open a connection.ACK is the final connection, and allows the two to
speak.
6. How can the TCP handshake be exploited?
Answer: The problem is that this can be used as a very basic type of Denial of Service
Attack.The client opens up the SYN connection, the server responds with the SYN/ACK, but
then the client sendsanother SYN. The server treats this as a new connection request and
keeps the previous connection open.Asthisisrepeated over and over many times very quickly,
the server quickly becomes saturated with a huge number of connection requests,eventually
overloading its ability to connect to legitimate users.
7. Difference between TCP and UDP
Answer: TCP (Transmission Control Protocol) is connection oriented, whereas UDP (User
Datagram Protocol) is connection-less. This means that TCP tracks all data sent, requiring
acknowledgment for each octet(generally).While UDP does not
[Show More]