Exam (elaborations)
HBSS - Host Based Security System: Q’s And A’s
- Course
- Institution
HBSS - Host Based Security System: Q’s And A’s
[Show more]
Content preview
HBSS - Host Based Security System: Q’s And A’sWhat is HBSS Right Ans - -host based security system on the individual
workstation or the host
-(COTS)
-monitor, detect, and counter against known cyber threats. -address known
traffic exploits
What is HBSS on Right Ans - Cyber Tasking Order (CTO) 07
12, US Cyber Command (USCYBERCOM) mandates that HBSS be installed on
every DoD system.
Why do we use HBSS Right Ans - allows us to centralize the administration
of security tools. With this centralized administration we can control and
monitor our different modules (VSE, HIPS, DLP, and any other module that is
installed on the host.
Who can you call for HBSS assistance Right Ans - DISA
HBSS Components Right Ans - -ePolicy Orchestrator Server
-the McAfee Agent
-the distributed repositories
-registered server
The ePO server Right Ans - -application server that manages the suit of
product
-contains the SQL database that stores logs, events, and policies
-contains the master repository which stores all products as well as software
that is deployable to the clients
The McAfee Agent Right Ans - installed on the clients and allows the ePO
server to enforce polices on the client machine
Distributed repositories Right Ans - servers contain software packages for
remote clients. These repositories are known as SADRs and are similar to that
of a WSUS
, Registered servers Right Ans - additional servers on your network that you
register with your ePO server to provide additional data such as LDAP, SNMP,
and other ePO servers.
How HBSS components work together Right Ans - Through the ePO's web
interface create the policies & tell each product how they will behave, then
stored on the local ePO server, agent on the client machine will pull the latest
policy from the ePO server, enforce the last policy as long as agent is running
Port 80 Right Ans - -Agent to Server communication (TCP
-Inbound TCP. The ePO server listens for requests from McAfee Agents
Port 443 Right Ans - -Agent to Server secure communication (TLS)
-Inbound TCP. The ePO server listens for TLS (SSL)-encrypted requests from
McAfee Agents
Port 591 Right Ans - -Agent Wakeup Call
-Outbound TCP. For when the ePO server or an Agent Handler sends a
Wakeup Call to a managed machine.
Port 8005 Right Ans - -Agent Handler Communication
-Inbound TCP. ePO Agent Handlers connect to this port during installation and
updates
Port 8007 Right Ans - -Console-to-application (HTTPS
-Inbound TCP. Port used to connect to the ePO web interface using HTTPS
Port 8443 Right Ans - -Rogue system detection sensor (HTTPS)
-Inbound TCP. The ePO server listens for Rogue System Detection events. Also
used by Agent Handlers to get information from the ePO (like LDAP servers).
Port 8082 Right Ans - -UDP Broadcast communication port
-Inbound UDP. Agents listen for UDP broadcasts from SuperAgents
it is possible to lose access to the database if these ports are not open on the
ePO server's host firewall Right Ans - -Always apply firewall rules to the
ePO server carefully.
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller Studyhall. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $10.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
81298 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now