Chapter 7: Delving into Network and Security Concepts Flashcards
prevents unauthorized access to the corporate network; we tend to use back-to-back configuration
Firewall
Internal Network
Local Area Network (LAN)
This is an application firewall that is build into desktop operating systems, such as Windows 10 operating system.
Host-Based Firewall
this is a hardware appliance that keeps the network safe. It is vital that only the ports required are open. The network based firewall is placed at the edge of the network to prevent unauthorized access.
Network-Based Firewall
: this looks deep at the application and its traffic to see whether it is allowed through
stateful firewall
could also be called packet-filtering firewall. It only looks at whether the packet is permitted and never looks in depth at the packet format
stateless firewall
is placed on a web server and its role is to protect web-based applications running on the webserver
Web Application Firewall (WAF)
is a multipurpose firewall: it does malware, content, and URL filtering. –all in one security appliance
Unified Threat Management Firewall (UTM)
this is a firewall that is application aware and can be used for both on premise and a cloud environment. It has cloud intelligence and the capabilities of an intrusion prevention system.
Next Generation Firewall (NGFW)
where a request from a private internal IP address is translated to an external IP public address, hiding the internal from the external attack.
Network Address Translation (NAT)
device that connects two different networks when setting up a host machine
-known as the default gateway.
-used by your company to give you access to other networks—for example the internet
Router
ensure applications have the amount of bandwidth they need to operate when there is limited network bandwidth.
Quality of Service (QOS)
when two or more switches are joined together they can create loops that create broadcast storms—Spanning Tree Protocols (STPs) prevent this by blocking, listening, or forwarding ports.
Loop Protection
frames that contain information about the STP
Bridge Protocol Data Units (BPDU)
set up on a port of a switch so that when the data arrives at that port, a splitter sends a copy to another device for later investigation.
-will inform NIDS Network Intrusion Detection System
Port mirror (port spanning)
link aggregation allows you to connect multiple switches so that they work as a single logical unit and prevent looping
Switch 1/Switch 2/Switch 3–>________
Aggregation Switches
when security teams are trying to find out the attack methods that hackers are using, they set up a website similar to the legitimate website with lower security. When the attack commences, the security team monitors the attack methods so that they can prevent future attacks.
Honeypot
Group of honeypots
Honeynet
is a decoy file that is probably called password.txt so that it attracts the attention of an attacker. An alert has been set up to alert the security team once that fie has been opened.
Honey File
where the cybersecurity team notices that an attacker is using tools such as IP or Port Scanner to gain information about your network. They then send false information back to the attacker.
Fake Telemetry
is a server that controls requests from clients seeking resources on the internet or an external network. Think of it as a go between that makes requests on behalf of the client ensure that anyone outside of your network does not know the details of the requesting host.
Proxy Server
3 main functions of a Proxy Server
-URL Filter: companies may not want their employees to go to certain websites so they block them (example: espn.com)
-Content filter: looks at the content on the requested web page. It will block the request depending on what filters are set up. If we block gambling then users that try and visit a poker or horse betting site are blocked.
-Web page caching: purpose is to reduce the bandwidth being used as well to make access to web pages faster as they are actually obtaining content from their LAN
The IT team sets up jobs to cache web pages; for example they cache espn.com at 3am local time to ensure it has the latest results
Active Caching
when new web pages are being requested the pages are fetched and submitted to the requesting a host and a copy is then placed in the cache. That way, the second time it is requested, it is retrieved from the cache
Passive caching
