2.6 Network Security Technologies

Question 1

Firewall

Answer 1

A hardware and/or software platform that controls the flow of traffic between a trusted and untrusted network.

Question 2

Packet filtering firewalls

Answer 2

• Port-based firewalls
• Operate up to L4. Inspect packet headers, source and destination IP, protocol, and port number.
• Match with firewall rules that designate whether the packet should be allowed, blocked, or dropped.
• Inspect and handle each packet individually, with no info about context or session.

Question 3

Stateful packet inspection (SPI) firewalls

Answer 3

• Dynamic packet filtering firewalls
• Operate up to L4 and maintain state info about the different communication sessions.
• Inspect individual packet headers during session establishment only, to determine if the session should be allowed, blocked, or dropped based on the firewall rules.
• Once a permitted connection is established, the firewall created and deletes rules for individual connection (tunnel) that allows traffic to flow between the two hosts w/o further inspection.
• Very fast, but port-based and is highly dependent on the trustworthiness of the two hosts.

Question 4

Application firewalls

Answer 4

• Application-layer gateways, proxy-based, or reverse-proxy.
• Operate up to L7 and control access to specific application and services
• Proxy network traffic rather than permit direct communication between hosts.
• Inspect Application layer traffic and thus can identify and block threats using hiding techniques.

Question 5

Intrusion detection and prevention systems

Answer 5

IDS and IPS provide real-time monitoring of network traffic and perform deep-packet inspection (both header and payload) and analysis of network activity and data.

Question 6

Difference between IDS and IPS

Answer 6

IDS is considered to be a passive system, whereas IPS is an active system that also blocks or drops suspicious, pattern-matching activity.

Question 7

Disadvantages of Intrusion Prevention System

Answer 7

• Must be placed inline along a network boundary and is thus directly susceptible to attack itself.
• May be used to deploy a DoS attack by flooding the IPS.

Question 8

Knowledged-based IDS/IPS systems

Answer 8

Uses a database of known vulnerabilities and attack profiles to identify intrusion attempts. Lower false-alarm rates but must be continuously updated with new attack signatures.

Question 9

Behavior-based (or statistical anomaly-based) IDS/IPS systems

Answer 9

-Uses a baseline of normal network activity to identify unusual patterns or levels of network activity. More effective in detecting previously unknown vulnerabilities and attacks.