Chapter 7
Honeynet
A monitored network or network segment that contains multiple honeypot systems.
Clipping Level
A predefined assessment level that triggers a predetermined response when surpassed.
Passive vulnerability scanner
A scanner that listens in on a network and identifies vulnerable versions of both server and client software.
Packet Sniffer
A software program or hardware appliance that can intercept, copy, and interpret network traffic.
intrusion detection system
A system capable of automatically detecting an intrusion into an organization's networks or host systems and notifying a designated authority.
fully distributed IDPS control strategy
An IDPS implementation approach in which all control functions are applied at the physical location of each IDPS component.
centralized IDPS control strategy
An IDPS implementation approach in which all control functions are implemented and managed in a central location.
Honeypot
An application that entices people who are illegally perusing the internal areas of a network by providing simulated rich content while the software notifies the administrator of the intrusion.
Pen register
An application that records information about outbound communications
Active vulnerability Scanner
An application that scans networks to identify exposed usernames and groups, open network shares, configuration problems, and other vulnerabilities in servers.
zero day vulnerability
An unknown or undisclosed vulnerability in an information asset or its protection systems that may be exploited and result in loss
Attack surface
The functions and features that a system exposes to unauthenticated users.
intrusion detection and prevention system
The general term for a system that can both detect and modify its configuration and environment to prevent intrusions.
Footprinting
The organized research and investigation of Internet addresses owned or controlled by a target organization.
Protocol stack verification
The process of examining and verifying network traffic for invalid data packets
Fingerprinting
The systematic survey of a targeted organization's Internet addresses collected during the footprinting phase to identify the network services offered by the hosts in that range.
Mirror port
a specially configured connection on a network device that can view all the traffic that moves through the device.