Network Security 12 Flashcards
NAT implementations can be implemented as
Software on systems or as hardware in a dedicated device such as cable modems, DSL routers
What is NAT
Network Address Translation
A form of Internet security they conceals internal addressing schemes from external networks such as the Internet.
Packets sent to the Internet from internal hosts all appear as if they came from a single IP address.
Prevents external hosts from identifying and connecting directly to internal systems
What’s the difference between static and dynamic NAT
Static NAT an unregistered address is mapped to a single specific registered address
Dynamic NAT a single unregistered address is mapped to the first registered address In an address pool
What is PAT
Port Address Translation
A subset of NAT functionality the maps either one or more unregistered addresses to a single registered address using multiple ports. Also known as overloading.
What is SNAT
Secure NAT where two or more routers work together to perform NAT
Describe the NAT process as it translates external and internal addresses based on port numbers
Client requests and external service
The NAT converts the source address to its own external address and adds a reference port number
The service returns data to the NAT devices external address using the port number
NAT uses the port number to identify the correct internal source address
NAT readdresses the packet it the internal system and delivers the data.
Describe IP filtering
Determines which packets will be allowed to pass and which will be dropped by screening the packet based in certain criteria set by an admin.
Operates at layer 2 of the TCP/IP and performed by a screening router.
What is MAC filtering
Provides a simple method of securing a wireless network. By configuring a WAPS to filter MAC addresses you can control which wireless clients can access your network.
What is a firewall
A software program or hardware device that protects a system or network from unauthorized data by blocking unsolicited traffic
Permits specifically permitted traffic based on a defined set of rules.
Universally deployed between private networks and the Internet.
Can also be between two separate private networks to control data flow
List the three sets of firewall rules to block or allow content
Inbound rules. Define the action to be performed by the firewall in the data that enters the system from another system
Outbound rules. Define the action to be performed by the firewall on the data that flows out of the system
Connection security rules. Define the type of authentication that is needed to allow communication between the systems.
How do you secure ports
Disable unnecessary services.
Close ports that open by default or have limited functionality
Applying security patches
Hiding responses from ports that indicate their status and allow access to pre configured connections only
List the four common types of firewalls
Packet filters
Stateful inspection firewall
Proxy firewall
Hybrid firewall
Describe packet filter firewall
The simplest implementation of a firewall
Work at the network layer of the OSI model
Each packet being passed along the network is compared to a set of default criteria. The is either passed or dropped.
Usually part of a router
Describe stateful inspection firewall
Work at the session layer of the OSI model
Monitors the condition or state of the connection.
Monitors the TCP connection establishment to determine if a request is legit.
also known as circuit level gateways
Describe proxy firewall
Work at the application layer of the OSI model
Require incoming and outgoing packets to have a proxy to access service. Allows ability to filter application specific commands.can be used it lof user activity and logons.
Also known as application level gateways
Describe hybrid firewall
Combines the functions of a packet filter, stateful inspection firewall, and a proxy firewall
They operate on the Network, session, and application layers simultaneously
What is the difference between a network based and host based firewalls
Network based is a dedicated hardware/software combo that protects all the computers on s network behind the firewall
Host based aka personal firewall is a software that is installed directly on a host and filters incoming and outgoing packets to and from that host
What is a stateless firewall
A firewall that manages and maintains the connection state of s session through the filter to ensure that only authorized pallets are permitted in sequence.
Filters a legitimate packet for various connections and allow only the packers matching a recognized connection state to pass, dropping the others.
Describe what a stateful inspection is
the process of packet filtering by analyzing each packet to ensure the contents match the expected service it is communicating with.
Resource intensive. And very expensive
List the four common firewall features
Scanning services. Scan incoming and outgoing packets and some action based on the contents of those packets.
Content filtering. Block restricted content accomplished by URL filtering or inspection of each file or packet.
Signature identification. Indicators compared against a list of known signature of common threats
Zones. Used to create a virtual or physical network topology that creates separate zones with differing security levels.
