Perimeter Security Flashcards
Perimeter Security
Security devices focused on the boundary between the LAN and the WAN in your organization’s network
Perimeter security relies on several different devices
Firewalls: Packet Filtering
Inspects each packet passing through the firewall and accepts or rejects it based on the rules
Stateless Packet Filtering
Stateful packet filtering tracks the requests leaving the network
Firewalls: NAT Filtering
Filters traffic based upon the ports being utilized and type of connection
(TCP or UDP)
Firewalls: Application-Layer Gateway
Conducts an in-depth inspection based upon the application being used
Firewalls: Circuit-Level Gateway
Operates at the session layer and only inspects the traffic during the establishment of the initial session over TCP or UDP
Firewalls: Explicit Allow
Traffic is allowed to enter or leave the network because there is an ACL rule that specifically allows it
Example: allow TCP 10.0.0.2 any port 80
Firewalls: Explicit Deny
Traffic is denied the ability to enter or leave the network because there is an ACL rule that specifically denies it
Example: deny TCP any any port 23
Firewalls: Implicit Deny
Traffic is denied the ability to enter or leave the network because there is no specific rule that allows it
Example: deny TCP any any port any
^ Usually at the end of an ACL
WAF
Web-Application Firewall:
Firewall installed to protect your server by inspecting traffic being sent to a web application
A WAF can prevent a XSS or SQL injection
Proxy Server
A device that acts as a middle man between a device and a remote server
IP Proxy
IP Proxy is used to secure a network by keeping its machines anonymous during web browsing
Caching Proxy
Attempts to serve client requests by delivering content from itself without actually contacting the remote server
Disable Proxy Auto-Configuration (PAC) files for security
Web Security Gateway
A go-between device that scans for viruses, filters unwanted content, and performs data loss prevention functions
Honeypot/Honeynet
Honeypots and honeynets are used to attract and trap potential attackers
Honeypot
A single computer (or file, group of files, or IP range) that might be attractive to an attacker
Honeynet
A group of computers, servers, or networks used to attract an attacker
Honeypots are normally used in security research
UTM
Unified Threat Management:
Combination of network security devices and technologies to provide more defense in depth within a single device
UTM may include a firewall, NIDS/NIPS, content filter, anti-malware, DLP, and VPN
UTM is also known as a Next Generation Firewall (NGFW)
