study questions - 2nd half of netmgmt/security class

-----------------------
snmpv3

1. what is the overall structure of an snmpv3 packet?

2. what crypto facilities does snmpv3 include?

3. give a rough overview of the ideas behind the user-based ACL
	mechanism

4. what is the basic crypto idea behind how snmpv3 can change
a set of authentication passwords simultaneously on a set of
network boxes?

-----------------------
attacks

1. explain or characterize how attacks gone over in class work
	e.g., winnuke, land

	1.1 how to defend if policy is accept all, deny a few

	1.2 how to defend if policy is deny all, accept a few

2. what is a buffer overflow attack ?
	how can it be defined against?

3. what can be done about virus attacks?
	3.1 what can apparently NOT be done about virus attacks?

4. what is the difference between a multi-user based attack
	and an attack over the network?

	which is harder to defend against?

5. why can open source be presumed to be a defence against attacks?

6. explain the rdrop or Xmas-day or "combined" attack that uses
	IP spoofing, and TCP sequence number hijacking.

-----------------------
cryptographic protocols

1. explain how a session-key protocol could work using DH

2. define 

	public key cryptography

	symmetric key cryptography

	hash/one-way functions

	what all can hash/one-way functions do?

3. explain how RSA would be used to send authenticated,
		encrypted email from Alice to Bob

4. how can you use a function like DES and create an authentication
	protocol in which a shared secret (password) is NOT sent
	as plaintext?

-----------------------
firewalls/acls

1. be able to explain what cisco acls on slides do ...

2. explain the difference between a packet based/ACL firewall,
	and a proxy-based firewall

3. argue which of the above is "more secure".  give a justification.

4. what is tripwire and how does it work?

5. what is ingress/egress filtering and what relationship
	does this have to smurf attacks?

6. how can a stateful inspection based firewall do a better job
	on allowing ftp-client access from inside an enterprise
	to outside - compared to a traditional ACL-based firewall?

-----------------------
link layer

1. what does "bump in the wire" mean?

2. what are the pros and cons of link-layer encryption?

-----------------------
ipsec

1. define AH/ESP/IKE/Oakley

2. what is a DH group?

3. what is PFS?

4. what is the difference between tunnel mode and transport mode

5. roughly explain what IKE does

6  what is a proposed plaintext attack and how might this apply to
	IPSEC?

-----------------------
ssh

1. ssh roughly gives you what functionality?

2. explain how the sshv1 protocol works

3. how does ssh make X secure?
	what part of X does it NOT make secure?  how do you fix that?

4. how does sshv2 hope to protect against the sshv1 man-in-the-middle
	attack flaw?

-----------------------
ssl

1. explain the basis ssl protocol
	server-side encryption
	client-side authentication

2. what is ssl normally used for?  why is it more general?

3. functions of certificates ?
	client/server/root
	how are these signed (who signed them)?

4. who was Monica and why wouldn't ssh/ssl/ipsec/PPTP or whatever
	not be terribly helpful in her case?