Cyberstudy
PDF p.130 In progress

Device Attributes

Open PDF at p.130 17 flashcards

Summary

PDF p.130

Device attributes determine how a device can be placed within the network topology. Key attributes include whether a device is active or passive, its deployment method (inline or monitor), and its fail mode (fail-open or fail-closed). These attributes influence the device's role in enforcing security controls and maintaining network integrity.

In plain words

Supplementary — not from your PDF

Three attributes describe how a security device fits in. Active or passive: does it need hosts to be configured, or does it just watch? Inline or monitor: is it in the cable path, or does it receive a copy through a TAP or SPAN port? Fail-open or fail-closed: when it breaks, does traffic keep flowing (availability) or stop (security)?

Detailed explanation

PDF p.130
  • Active vs. Passive
    • Passive Security Control
      • Definition: Does not require client or agent configuration or host data transfer.
      • Example: Network traffic directed to a sensor and scanned by an analysis engine.
      • Characteristics: No addressable interface, hosts unaware of its operation.
    • Active Security Control
      • Definition: Requires configuration with credentials and access permissions.
      • Example: Scanning or filtering controls.
      • Characteristics: Hosts must be explicitly configured to use the control, may involve installing agent software or configuring network settings.
  • Inline Devices and Monitor Methods
    • Inline Device
      • Definition: Becomes part of the cable path without changes in IP or routing topology.
      • Characteristics: Interfaces not configured with MAC or IP addresses.
      • Traffic Copying: Can copy network traffic to a monitor or sensor.
    • Monitor Methods
      • Test Access Point (TAP)
        • Definition: Inline device with ports for incoming/outgoing network cabling.
        • Function: Physically copies the signal to a monitor port.
        • Characteristics: Receives every frame, unaffected by load.
      • SPAN/Mirror Port
        • Definition: Sensor attached to a specially configured mirror port on a switch.
        • Function: Receives copies of frames addressed to nominated access ports.
        • Characteristics: Not completely reliable, frames with errors not mirrored, may drop frames under heavy load.
  • Fail-Open vs. Fail-Closed
    • Fail-Open
      • Definition: Network or host access is preserved during failure.
      • Priority: Availability over confidentiality and integrity.
      • Risk: Threat actor could engineer a failure state to defeat the control.
    • Fail-Closed
      • Definition: Access is blocked or system enters the most secure state during failure.
      • Priority: Confidentiality and integrity over availability.
      • Risk: System downtime.
    • Configuration: May or may not be possible to configure the fail mode.
      • Example: Inline security appliance with power failure will fail-closed unless there is an alternative network path.

Important terms

taken from the text above
Passive Security Control
Does not require client or agent configuration or host data transfer.
Active Security Control
Requires configuration with credentials and access permissions.
Inline Device
Becomes part of the cable path without changes in IP or routing topology.
Traffic Copying
Can copy network traffic to a monitor or sensor.
Test Access Point (TAP)
Inline device with ports for incoming/outgoing network cabling.
SPAN/Mirror Port
Sensor attached to a specially configured mirror port on a switch.
Fail-Open
Network or host access is preserved during failure.
Priority
Availability over confidentiality and integrity.
Fail-Closed
Access is blocked or system enters the most secure state during failure.
TAP Test Access Point

Examples & real-world scenarios

Supplementary — not from your PDF
  • A passive IDS sensor fed by a SPAN port.
  • A TAP physically copying every frame to a monitor port.
  • An inline firewall that fails closed during a power loss.

Scenario

A hospital must choose the fail mode for an inline appliance on a clinical network. Fail-closed protects data but could stop clinical systems; fail-open keeps them running but lets traffic through uninspected. Availability needs may favour fail-open here, with other compensating controls.

Common mistakes

Supplementary — not from your PDF
  • Thinking a SPAN port captures everything. Under load it can drop frames, and it doesn't mirror errored frames; a TAP captures everything.
  • Mixing up fail-open (keeps availability) and fail-closed (keeps confidentiality and integrity).

Practical skills

Supplementary — not from your PDF
  • Choose a TAP or SPAN port for a monitoring requirement.
  • Justify a fail mode for a given system.

What I should remember

Key Points PDF p.130
  • Active vs. Passive
    • Passive: No client configuration, no addressable interface.
    • Active: Requires configuration, explicit host setup.
  • Inline Devices and Monitor Methods
    • Inline Device: Part of cable path, no IP/MAC addresses.
    • Monitor Methods
      • TAP: Physical signal copy, unaffected by load.
      • SPAN/Mirror Port: Frame copies, not completely reliable.
  • Fail-Open vs. Fail-Closed
    • Fail-Open: Preserves access, prioritizes availability.
    • Fail-Closed: Blocks access, prioritizes security.
    • Configuration: Depends on device capabilities.