ISC2 CISSP (Certified Information Systems Security Professional)

An IEEE standard for port-based network access control that provides an authentication mechanism to devices wishing to attach to a LAN port or to establish a wireless connection.

• Requires authentication before network access is granted.
• Often integrates with RADIUS servers.
• Can dynamically assign VLANs or apply policies post-authentication.

In Software-Defined Networking (SDN), the control plane is the centralized component that holds the network's intelligence, makes routing decisions, and communicates these decisions to the data plane devices. It decouples network control from forwarding functions.

• Centralizes network intelligence and decision-making.
• Communicates with the data plane via southbound APIs (e.g., OpenFlow).
• Enables network programmability and automation.

A hardware-based network security device that enforces one-way data flow between two networks. It prevents any data from flowing in the reverse direction, providing absolute assurance against data exfiltration or external network intrusion.

• Physically enforces unidirectional data transfer.
• Offers the highest level of network segregation security.
• Commonly used in critical infrastructure (OT/ICS) and classified networks.

A Virtual Private Network (VPN) implementation that uses the IPsec protocol suite to provide secure, encrypted, and authenticated communication over an untrusted network like the internet.

• Operates at the network layer (Layer 3).
• Provides confidentiality, integrity, and authentication.
• Can be configured as site-to-site or remote access VPNs.

An attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

• Requires the attacker to intercept and control the communication path.
• Can be facilitated by ARP spoofing, DNS spoofing, or compromised network devices.
• Compromises confidentiality and integrity.

The latest standard for securing Wi-Fi networks using a pre-shared key, offering enhanced security features over WPA2-Personal. It uses Simultaneous Authentication of Equals (SAE) to provide stronger protection against offline dictionary attacks and introduce forward secrecy.

• Uses Simultaneous Authentication of Equals (SAE) for robust key exchange.
• Protects against offline dictionary attacks.
• Provides forward secrecy, ensuring past session data remains secure.

The centralized management and control component of an SD-WAN, responsible for policy enforcement, global network visibility, and intelligent routing decisions.

• Acts as the 'brain' of the SD-WAN.
• Monitors network health and application performance.
• Pushes policies and routing decisions to edge devices.

A routing technique in telecommunications networks that directs data from one network node to the next based on short path labels rather than long network addresses.

• Reduces latency by avoiding complex IP header lookups.
• Enables traffic engineering and quality of service (QoS).
• Often used in core networks of service providers and large enterprises.

An Intrusion Prevention System deployment where all network traffic passes directly through the IPS, allowing it to actively block or prevent detected threats.

• Acts as a gatekeeper, sits 'in-line' with network traffic.
• Can actively drop malicious packets or reset connections.
• Introduces latency and can be a single point of failure.

The latest generation of Wi-Fi Protected Access security, offering enhanced cryptographic strength, improved authentication, and better resilience against common wireless attacks.

• Uses Simultaneous Authentication of Equals (SAE) for stronger key establishment.
• Provides Management Frame Protection (MFP) for integrity of management frames.
• Offers WPA3-Personal for home, WPA3-Enterprise for corporate.

A DDoS attack in which the attacker sends a large number of ICMP echo requests to an IP broadcast address using a spoofed source IP address that belongs to the victim.

• Relies on ICMP and IP broadcast addresses.
• Amplifies traffic, causing a denial of service to the victim.
• Mitigated by disabling IP directed broadcasts on routers.

The assurance that information is accurate and complete, and has not been subjected to unauthorized modification or destruction.

• Achieved through hashing, digital signatures, access controls.
• Compromised by data tampering, unauthorized changes, or replay attacks.
• Ensures trustworthiness and reliability of data.

A network attack that overwhelms a switch's Content Addressable Memory (CAM) table by sending a large number of frames with different source MAC addresses. This forces the switch to broadcast all incoming traffic to all ports, effectively turning it into a hub.

• Targets Layer 2 switches.
• Overwhelms the switch's CAM table.
• Causes the switch to enter fail-open mode, broadcasting all traffic.

A network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

• Can be hardware, software, or cloud-based.
• Operates at various layers of the OSI model.
• Essential for network segmentation and perimeter defense.

The latest and most secure Wi-Fi Protected Access standard designed for enterprise environments, providing enhanced authentication and encryption.

• Uses 802.1X for authentication, typically with RADIUS/EAP.
• Supports 192-bit cryptographic strength for CNSA compliance.
• Offers stronger protection against dictionary attacks and improved key management.

A suite of protocols used to secure IP communications by providing authentication, integrity, and confidentiality services.

• Operates at the network layer (Layer 3) of the OSI model.
• Commonly used for Virtual Private Networks (VPNs).
• Includes Authentication Header (AH) and Encapsulating Security Payload (ESP) protocols.

A cryptographic protocol designed to provide communication security over a computer network, widely used for encrypting web traffic and other application-layer data.

• Operates at the transport layer of the OSI model.
• Provides confidentiality, integrity, and authentication.
• Successor to SSL (Secure Sockets Layer).

A logical grouping of network devices that allows for segmentation of a local area network (LAN) into multiple broadcast domains, even if devices are on the same physical switch.

• Operates at Layer 2 of the OSI model.
• Enhances security by isolating traffic.
• Improves network performance by reducing broadcast traffic.

A security device that monitors network or system activities for malicious activity or policy violations and produces reports or alerts.

• Monitors traffic for signatures or anomalies.
• Primarily a detection and alerting tool.
• Does not actively block traffic (unlike IPS).

A switch feature that restricts input to an interface by limiting and identifying MAC addresses of stations allowed to access the port.

• Prevents MAC address spoofing and MAC flooding attacks.
• Allows static configuration of MAC addresses or dynamic learning up to a limit.
• Can be configured to shut down the port, restrict traffic, or protect against violations.

A network virtualization technology that encapsulates Layer 2 Ethernet frames in Layer 3 IP packets, creating a logical Layer 2 network over an existing Layer 3 infrastructure. It enables scalable multi-tenancy and larger virtual network segments in cloud data centers.

• Extends Layer 2 networks over Layer 3 (referred to as an overlay network).
• Uses a 24-bit VXLAN Network Identifier (VNI) for up to 16 million logical networks.
• Solves the scalability limitations of traditional VLANs (4096 IDs).

A communication protocol that provides security for datagram-based applications by allowing them to communicate in a way that prevents eavesdropping, tampering, or message forgery. It is based on TLS but adapted for unreliable transport protocols like UDP.

• Provides security similar to TLS but over UDP.
• Designed for applications sensitive to latency and packet loss (e.g., VoIP, gaming, IoT).
• Handles packet reordering and loss inherent in UDP.

A deployment method for an IPS where the device is placed directly in the network's traffic path. This allows the IPS to actively inspect all passing traffic and take immediate action, such as blocking or dropping malicious packets, before they reach their intended target.

• Acts as a gatekeeper, inspecting all traffic.
• Enables real-time prevention and active blocking of threats.
• Can introduce a single point of failure if not properly designed with bypass mechanisms.

An architectural approach that decouples the network control and forwarding functions, enabling network control to become directly programmable and the underlying infrastructure to be abstracted from applications and network services.

• Separates control plane from data plane.
• Centralized network management and orchestration.
• Enables network programmability and automation.