5.2 Network Security Flashcards
Computer networks enable __________ ________ and are essential for many daily activities and devices. Network threats can come from attackers, __________, or ________.
resource sharing;
misconfigurations; outages
How can networks be protected? (two ways)
secure design (e.g. segmentation, choke points, redundancies) and implementing devices like firewalls and intrusion detection systems.
Network segmentation divides networks into _________, allowing traffic control between segments and localizing issues.
subnets;
It can boost performance and prevent unauthorized access to sensitive areas.
Network segmentation
Choke points are what? ( 3 things) _____________ in network design can help mitigate issues from failures or attacks.
Locations where network traffic can be inspected, filtered and controlled.
Redundancies
_____________ control traffic flow in and out of networks, typically placed at trust boundary points. They examine _______ ________ to allow or disallow traffic based on various factors.
Firewalls;
network packets
________ ________ _________s look at individual packet contents to allow/disallow based on source/destination addresses, port numbers, and protocols. This method can be vulnerable to _________________.
Packet filtering firewalls;
attacks spanning multiple packets.
What mechanism tracks traffic at a more granular level, monitoring connections over time. They can prevent some intentionally disruptive attack traffic.
Stateful packet inspection firewalls
Deep packet inspection firewalls can analyze ________________________, providing more intelligence but also raising____________________.
the actual content of network traffic;
privacy concerns.
Proxy servers are _________ _________ ________ that provide security and performance features. They can act as _________ _________and allow traffic logging.
APPLICATION-specific firewalls; choke points
________________________uses multiple firewall layers to separate devices from the rest of the network, allowing controlled public access while protecting internal systems.
A demilitarized zone (DMZ)
Intrusion detection systems (IDS) ______________, hosts or applications for unauthorized activity.
monitor networks;
What are the two types of Intrusion detection systems?
They can use signature-based or anomaly-based detection methods.
How does Signature-based IDS work?
compare traffic to known attack signatures. Good except when there is a new attacker whose name is not recognized.
How does anomaly-based IDS work?
Looks for deviations from normal traffic patterns. Can produce a large amount of false positives because during normal activity due to unusual amount of traffic.
Network IDS placement requires careful consideration to avoid ____________. Putting them behind other _____ devices can help ___________________________.
overload; filtering; reduce obviously unwanted traffic.
