390-2

Purpose

Interpreting the signatures of normal and abnormal network traffic can help prevent network intrusions. In this assessment, you will examine the characteristics of a network intrusion.

Assessment Instructions

Part 1: Concepts From Module Reading

Answer and provide a brief explanation (3050 words) and include at minimum of 1 scholarly source cited in APA format for each of the following five questions.

1. A ____________________ is a generic type of scan in which an attacker attempts to locate ports opened by a Trojan by scanning ports 065,535.
2. True or False: An attacker might choose to limit the speed at which they attack a network in order to avoid detection.
3. __________, which are TCP packets with no flags set, can be sent by an attacker to attempt to crash a server.
4. The ____________________ is used to set the largest sized packet that can be transmitted on a network. Larger packets than this number will be fragmented.
5. IP address
6. Maximum Transmission Unit (MTU)
7. IP protocol number
8. What type of attack might the Nemesis tool be used for?
9. Packet injection
10. Path obfuscation
11. CGI script exploitation

Part 2: Signatures and Actions

1. Signatures fall into one of the following two categories: Atomic signatures and stateful signatures. Describe each and include at minimum of 1 scholarly source cited in APA format. (100200 words each)
2. There are three types of signature triggers. Describe each and include at minimum of 1 scholarly source cited in APA format. (100200 words each)

Part 3: Network Traffic Signatures

1. Distinguish normal traffic signatures from abnormal traffic signatures. Include at minimum of 1 scholarly source cited in APA format (Minimum 300 words total)

Part 4: Detection and Prevention Capabilities

1. You want to deploy a wireless intrusion detection system. What tool would you use and why? (Minimum 300 words total) Include at minimum of 1 scholarly source cited in APA format
2. Most intrusion detection and prevention systems support multiple detection capabilities. Distinguish each of the following: Thresholds, blacklists, whitelists, and alert settings. (Minimum 300 words total) Include at minimum of 1 scholarly source cited in APA format