Glossary

AAA

Authentication, authorization, and accounting.

accounting

Tracking and logging what a user does once he is authenticated.

ACE (access control entry)

The permit or deny statement within an access list. ACLs can contain one or more ACEs.

ACK

The final packet in TCP's three-way handshake used to establish a connection between peers.

ACL (access control list)

A list kept by routers to control access to or from the router for a number of services.

administrative access

Character mode access to a router's aux, CTY, TTY, or VTY ports.

atomic signature

Requires only one packet to be inspected to identify an alarm condition.

attack signature

Detects attacks attempted into the protected network, such as denial-of-service (DoS) attempts or the execution of illegal commands during an FTP session.

authentication

In security, the verification of the identity of a person or a process.

authentication methods

The various methods that can authenticate a user such as local methods, Terminal Access Controller Access Control System + (TACACS+), Remote Authentication Dial-In User Service (RADIUS), or token cards.

authentication proxy

A Cisco IOS Firewall feature that allows network administrators to apply specific security policies on a per-user basis.

authorization

Allowing or disallowing access to users for network services.

authorization types

What services require authorization. Some of the keywords can be network , exec , commands , and configuration .

certificate authority ( CA )

Entity that issues digital certificates ( especially X.509 certificates) and vouches for the binding between the data items in a certificate.

certificate revocation list ( CRL )

List that enumerates digital certificates which have been invalidated by their issuers prior to when they were scheduled to expire.

character mode

Access to a router's aux, CTY, TTY, or VTY ports.

See also [administrative access]

CIC (Cisco Integrated Client) Firewall

The stateful firewall built into the VPN Client.

ciphertext

Data that has been transformed by encryption and is no longer intelligible.

CiscoWorks 2000

A family of comprehensive network-management tools.

compound signatures

Signatures that detect complex patterns in packets.

confidentiality

Prevents the viewing of data while traffic is traveling between peers. Encryption is one method used to ensure data confidentiality.

connectionless

Data transfer without the existence of a virtual circuit.

connection-oriented

Data transfer that requires the establishment of a virtual circuit.

console access

Access to a router's console port using a terminal-emulation application such as HyperTerminal.

control channel

Session that is used to pass commands and error information between the client and the server.

crypto access list

Defines which IP traffic will be protected by cryptography and which traffic will not.

data channel

A means for delivering data from one point to another.

default signature action

The default action an intrusion detection system (IDS) takes when it detects a malicious packet. Both the IOS routers and PIX Firewalls have a default signature action of alarm.

denial-of-service ( DoS ) attack

An explicit attempt by attackers to prevent legitimate users of a service from using that service.

digital certificate

Certificate in the form of a digital data object. A digital signature value is also appended to the digital certificate.

digital signature

Value computed with a cryptographic algorithm and appended to a data object in such a way that any recipient of the data can use the signature to verify the data's origin and integrity.

distributed denial-of-service ( DDoS ) attack

Compromises multiple hosts and enslaves them to send vast amounts of traffic to a target host.

DMZ (demilitarized zone)

A computer or small subnetwork that sits between a trusted internal network and an untrusted external network.

dynamic crypto map

Policy template that you use when you do not fully know a remote peer's IP Security (IPSec) parameters.

Easy VPN Remote

Enhancement to the IOS that allows Cisco routers, PIX Firewalls, and VPN Hardware and Software Clients to act as remote VPN devices.

Easy VPN Server

Enhancement to the IOS that allows Cisco routers, PIX Firewalls, and VPN Concentrators to act as headend VPN devices.

embryonic

A connection attempted but not completed that has not yet seen data. When working with Cisco equipment, embryonic concerns TCP's three-way handshake.

encryption

Application of an algorithm to data so that the data is no longer intelligible.

established state

The completion of TCP's three-way handshake.

exploit

An attack against a vulnerability in an application, operating system, or device.

external threat

A threat posed to an organization by an individual who was not given explicit rights to access the organization's resources.

half- open session

For TCP, the state of the session that has not reached the established state. Therefore, the three-way handshake has not been completed. For UDP, "half-open" implies that CBAC has detected traffic from one direction only.

hashing

Reducing data of an arbitrary size into a fixed size. The data that is output into a fixed size is no longer intelligible.

HMAC (Hashed Message Authentication Code)

A mechanism for message authentication that can be used with any iterative cryptographic hash function, such as MD5 or SHA-1, in combination with a secret shared key.

identity certificate

The certificates that identify specific systems or hosts.

IDS (intrusion detection system)

Detects malicious packets traversing a network.

IKE (Internet Key Exchange)

Establishes a shared security policy and authenticates keys for services (such as IPSec) that require keys.

IKE dead peer detection ( DPD )

Allow the IPSec headend device to send DPD messages to the remote device.

IKE Phase 1

Sets up an authenticated secure connection that can be used for Phase 2 negotiations.

IKE Phase 2

Negotiates the IPSec security associations (SAs).

inbound

Packets that are entering a router's interface.

informational signature

Detects information-gathering activities.

initial contact

A message that tells the receiver to ignore and delete any old connection information that has been maintained for a newly connecting peer. An initial contact message is sent when a client or router is connecting to another Cisco gateway for the first time.

integrity

Ensures that data received by the destination device is identical to the data sent by the source device.

internal threat

A threat posed to an organization by an individual who was given explicit rights to access the organization's resources.

IP spoofing

Occurs when an attacker outside your network pretends to be a trusted user, either by using an IP address that is within the range of IP addresses for your network or by using an authorized external IP address that you trust.

IPSec (IP Security)

A framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers.

IPSec over TCP

The insertion of a TCP header into an IPSec packet so that IPSec communication can work properly when traversing a network using network address translation (NAT), port address translation (PAT), or a firewall.

IPSec over UDP

The insertion of a User Datagram Protocol (UDP) header into an IPSec packet so that IPSec communication can work properly when traversing a network using NAT or PAT.

IPSec with GRE (Generic Routing Encapsulation)

Tunneling protocol developed by Cisco that can encapsulate a wide variety of protocol packet types inside IP tunnels, creating a virtual point-to-point link between Cisco routers. When using IPSec with GRE, non-IP packets are encapsulated into IP packets and then protected by IPSec and sent across the IPSec tunnel.

KDC (key distribution center)

A trusted third party that performs secure verification of users and services. Kerberos is based on this concept.

legal SMTP commands

The RFC 821 section 4.5.1 commands that Context-Based Access Control (CBAC) is compliant with.

local authentication

Authentication using passwords or usernames and passwords configured on a router.

man-in-the-middle attack

Form of active wiretapping attack in which the attacker intercepts and selectively modifies communicated data to masquerade as one or more of the entities involved in a communication association.

mode configuration

The point at which the Easy VPN Remote requests configuration parameters from the Easy VPN Server, after IPSec extended authentication is finished.

NAS (network access server)

Cisco platform that interfaces between a packet network and a circuit network.

network access

Packet mode access through a router using Basic Rate Interface (BRI), Primary Rate Interface (PRI), async, or group -async ports.

origin authentication

Verifies that data originated from a specific source.

outbound

Packets that are leaving a router's interface.

packet mode

Packet mode access through a router using BRI, PRI, async, or group-async ports.

See also [network access]

packet sniffer

A program that can record all network packets that travel past a given network interface, on a given computer, on a network.

PAM (port-to-application mapping)

Allows you to customize TCP or UDP port numbers for network services or applications.

priv-level

Specifies the current privilege level for command authorization as a number from 0 to 15.

protected network

Usually the corporate LAN. Access to this network is usually given to authorized personnel only.

proxyacl

Entries that define user access privileges.

queue threshold

The maximum number of items, packets or messages, that can be held before being discarded.

RA certificate

A server that acts as a proxy for the CA so that CA functions can continue when the CA is offline.

See also [registration authority (RA)]

RADIUS (Remote Authentication Dial-In User Service)

Database used with AAA for remote access sessions and for tracking connection time.

RADIUS key

Used for encryption and authentication for all communication between the RADIUS client and the server.

registration authority ( RA )

Responsible for recording or verifying some or all of the information needed by a CA to issue certificates and CRLs and to perform other certificate-management functions.

Reverse Route Injection ( RRI )

Used by the VPN concentrator to automatically add static routes to the routing table and announce these routes to the concentrator's private network or border routers using Open Shortest Path First (OSPF) or Routing Information Protocol (RIP).

RFC 2196

A document that provides guidance to system and network administrators on how to address security issues within the Internet community.

root certificate

The self-signed public-key certificate at the top of a certification hierarchy.

SCEP (Simple Certificate Enrollment Protocol)

Provides a standard way to enroll network devices with a CA.

session information

Parameters related to a data conversation that might include source and destination addresses, port numbers, TCP sequencing information, and flags.

signature

Used with IDS devices to determine whether a packet is malicious.

signature reactions

What an IDS device can do in response to a packet matching a signature. The usual reactions are alarms, TCP resets, drops , and automatic blocking.

split tunneling

Allows a VPN client to continue using its existing Internet connection for non-VPN “related traffic.

state structure allocation

The maximum number of unassembled packets that the router will allocate memory for.

stateful

The creation of state table entries and the updating of those entries based on the traffic being inspected.

stateful inspection

Inspection system that is a sophisticated packet-filtering system and that operates at Layer 3 of the Open Systems Interconnect (OSI) model. Is is also a method of access control that analyzes packets in terms of traffic sessions.

state table

The logging of session information, including source and destination addresses, port numbers, TCP sequencing information, and flags, into a table.

strong password

At least eight characters that contains both uppercase and lowercase letters , numbers, and special characters.

structured threat

A hacker who knows applications and operating systems intimately, can write hacking programs, and knows potential vulnerabilities.

symmetrical ACLs

Crypto access lists used by IPSec peers that should be mirror images and that protect the same IP addresses, protocols, and applications.

SYN

The only flag set in a TCP packet that is attempting to initiate a connection.

SYN-ACK

A TCP packet sent in response to a connection request with both the SYN flag and the ACK flag set.

TACACS+ (Terminal Access Controller Access Control System +)

Proprietary Cisco enhancement to TACACS. Provides additional support for AAA.

TACACS+ key

Character string used by the TACACS+ protocol for authentication and encryption.

threat mitigation

Procedures used to lessen the impact of hacking attacks against a network.

three-way handshake

Process whereby two protocol entities synchronize during connection establishment.

token card

A card about the size of a credit card and programmed to a specific user. Each user has a unique PIN that can generate a password keyed strictly to the corresponding card.

transform sets

An acceptable combination of security protocols, algorithms, and other settings to apply to IPSec-protected traffic.

transform

The list of IPSec methods used for a data flow to provide data authentication, data confidentiality, and data compression.

transparent tunneling

Allows secure transmission between the VPN client and a secure gateway through a router serving as a firewall.

trusted third party

An SA trusted by communicating entities with respect to specific security-related activities.

trust exploitation

An attack where an individual takes advantage of a trust relationship within a network.

unassembled packets

Packets that have been fragmented and not made whole.

unstructured threat

A hacker who does not know applications and operating systems intimately and who can't write hacking programs. This type of hacker can download programs to launch attacks. Sometimes, these individuals are called script kiddies .

VTY access

Access to a router's VTY lines using, for example, Telnet or SSH.

vulnerability

A weakness in an application, operating system, or device. Hackers use exploits to take advantage of vulnerabilities.

XAUTH

Allows all Cisco IOS software AAA authentication methods to perform user authentication in a separate phase after the IKE authentication Phase 1 exchange.