ch 6 Flashcards
Hardware or software device used to join two separate computer networks to enable communication between them
• Bridges
A device that connects network hosts intelligently.
• Switches
Forwards packets across different computer networks.
Operates at a Network Layer (layer3)
• Routers
acts upon data found in Network and transport layer protocols
• Layer 4 Load balancer
Distribute requests based on data found in application layer protocols.
• Layer 7 load balancer
a computer or an application program that intercepts user requests from the internal network and processes that request on behalf of the user.
Forward proxy
A special proxy server that “knows” the application protocols that it supports.
• Application/Multipurpose
Routs requests coming from an external network to correct internal server.
• Reverse Proxy
Does not require any configuration on the user’s computer.
• Transparent Proxy
Can be software or hardware based.
Both types inspect packets and either accept or deny entry.
• Firewalls
– Inspects incoming packet and permits or denies based on conditions set by administrator
• Stateless Packet Filtering
– (lets packets pass through)
Allow
– (prevent the packet from passing into the network and send no response to sender)
Drop
– (prevent the packet from passing into the network but send a message to the sender).
Reject
– Operates on a higher level by identifying applications that send packets through the firewall and make decisions about actions to take.
• Application-Aware Firewalls
– Special type of application aware firewall that looks deeply into packets that carry HTTP traffic. Can block specific sites of HTTP traffic
• Web application Firewall (WAF)
enables authorized users to use an unsecured public network as if it were a secure private network.
• (VPN) Virtual Private Network
a user to LAN connection
• Remote access VPN
Multiple sites can connect to other sites over the internet
• Site to Site
Allow the user to always stay connected.
• Always on VPNs
end of the tunnel between VPN devices, may be software on local computer or a VPN concentrator.
Endpoints
A dedicated hardware device that aggregates hundreds of thousands of VPN connections.
• VPN concentrator
some traffic is routed over the secure VPN, while other traffic directly accesses the internet.
• Split Tunneling
(SMTP)
Simple Mail Transfer Protocol
(POP/POP3)
Post Office Protocol
(IMAP)
Internet Message Access Protocol
is a more recent and advanced email system
• (IMAP) Internet Message Access Protocol
Monitors email for unwanted content.
• Mail Gateway
Can detect attack as it occurs
• (IDS) Intrusion detection system
– Compares current detected behavior with baseline
• Anomaly- based Monitoring
Looks for well-known attack signature patterns
• Signature based monitoring
Detects abnormal actions by processes or programs, alerts user who decides whether to allow or black activity.
• Behavior based monitoring
– Uses experience based techniques
• Heuristic Monitoring
A software- based application that can detect an attack as it occurs. Monitors, system calls and files, unauthorized registry modification, anomalous activity.
• (HIDS) Host intrusion detection system
watches for attack on the network, sensors installed on firewalls and routers, can sound alarm and log events.
• (NIDS) Network intrusion detection system-
aware IDS- a specialized IDS, uses “contextual knowledge” in real time, it can know the version of the OS or which application is running.
• Application
Monitors network traffic to immediately block a malicious attack, similar to NIDS.
• (IPS) Intrusion Prevention System
knows which application are running as well as the underlying OS.
• Application aware IPS
Consolidates real-time monitoring and management of security information.
• (SIEM) Security and Information Event Management
a dedicated cryptographic processor that provides protection for cryptographic keys
hardware security module
a separate device that decrypts SSL traffic
SSL decryptor
a seperate hardware card that insets into a web server that contains one or more co-processors to handle SSL/TLS processing
SSL/TLS accelerator
a device that converts media data from one format to another
Media gateway
integrated device that combines several security functions
Unified Threat Management (UTM)
monitors internet traffic and blocks access to preselected websites and files
internet content filter
Blocks malicious content in real time as it would appear without first knowing the URL at a dangerous site.
Web Security Gateway
a separate network located outside the secure network. (unsecure)
• (DMZ) Demilitarized Zones
Allows private IP addresses to be used on the public internet, replaces private IP addresses with public addresses. Masks IP addresses
• (NAT) Network address Translation
a private network that belongs to an organization that can only be accessed by internal users
intranet
a private network that can be accessed by authorized external customers, vendors, and partners
extranet
a separate open network that anyone can access without prior authorization
guest network
Isolates the network so that it is not accessible by outsiders.
• Physical Network Segregation
The absence of any type of connection between devices, (a secure network and a regular network
• Air gap
allow scattered users to be logically grouped together, even if attached to different switches.
• (VLAN) Virtual Lan
protocol is used for communicating between switches
special “tagged” (802.1Q)
Examines the current state of a system or network device before it can connect to the network
• (NAC) Network Access Control
disappears after reporting information to the NAC
NAC technology can be embedded within a Microsoft Windows Active Directory domain controller.
Dissolve NAC agent
NAC uses AD to scan the device
agent-less NAC)
system of security tools that is used to recognize and identify data that is critical to the organization.
• (DLP) data loss prevention
is used for Monitoring emails through mail gateway, blocking and copying files to a USB flash drive (USB Blocking).
• (DLP) data loss prevention
Defined as a security analysis of the transaction within its approved context.
Content inspection –
Three types of DLP sensors
DLP network sensors
DLP storage sensors
DLP agent sensors (host)
