07 - Firewalls and IDS

Question 1

List four techniques used by firewalls to control access and enforce a security policy.

Question 2

What is a DMZ network and what types of systems would you expect to find on such networks?

Question 3

What are the two main approaches to intrusion detection?

Question 4

Explain the difference between network traffic analysis, payload analysis, and endpoint behaviour analysis.

Question 5

A common management requirement is that “all external Web traffic must flow via the organization’s Web proxy.” However, that requirement is easier stated than implemented.

• Discuss the various problems and issues, possible solutions, and limitations supporting this requirement.
• In particular, consider issues such as identifying exactly what constitutes “Web traffic” and how it may be monitored, given the large range of ports and various protocols used by Web browsers and servers.

Question 6

Explain the role of firewalls as part of a computer and network security strategy.

Question 7

List the key characteristics of firewalls.

Question 8

Understand the relative merits of various choices for firewall location and configurations.

Question 9

Understand the basic principles of and requirements for intrusion detection.

Question 10

Discuss the key features of intrusion detection systems.

Question 11

Present an overview of the key elements of malware defence.