Section 1.1 Flashcards
A device that can filter incoming and outgoing traffic.
Firewall
Router
A device that connects multiple network segments into one.
Uses ACL (rules) to manage traffic between network segments.
A layer 3 device.
Switches
A device used to connect computers together and learns which device is attached to which port.
A layer 2 device, some can also operate on layer three.
Used to create VLANs.
Load Balancer
A system that distribute traffic between multiple servers that provide the same service.
Provides increased availability of server services.
What is a proxy server?
Proxy servers request services (ie HTTP, FTP, etc) on behalf of clients on a network.
They are capable of caching data to improve network performance by storing commonly requested data and supply it to clients when requested.
A proxy server is also capable of performing URL filtering, denying access to sites that are not authorized on the network.
Web security gateway
A type of UTM detects malicious software coming in as email attachments, as code embedded in websites, and spam.
VPN Concentrators
A server dedicated to VPN connections.
Deployed by large organizations.
Has strong encryption and authentication techniques, and can has support for a large number of clients.
Protocol Analyser
Used to gather packets that are passed on a network.
Gathered packets can be analysed to see packet header information and packet payload.
This can be used to either detect malicious activities over the network, or it can be used by an attacker to gather information about the network and any information passed as cleartext.
Use is called Packet Sniffing.
Span Filter
Performed by either the email server or a UTM solution.
This helps prevent sending large amounts of junk data, the servers storing garbage data, and help prevents emails malicious scripts coming through.
What is a Web Application Firewall (WAF)?
A firewall designed to protect web applications.
Normally hosted on the web server.
Not to be used in place of a network based firewall since it only protects the web application and not the rest of the network.
Is an example of an Application level fire wall.
What is the main difference between IPS and IDS
An IPS is always placed in-line with the traffic so that it can prevent the attack from reaching the network.
What is the difference between Active and Passive IDS
While both log and can notify personnel of alerts active systems will take actions to change the environment.
What is IDS?
What are the two types?
What methods can it use to detect attacks?
Intrusion Detection System
Host-based (installed on a single host)
Network-based (installed on a router or firewall)
Signature Based (a.k.a. Definition-based) Anomaly Based (a.k.a. Behaviour based or Heuristic based)
How does signature based detection work?
Detects attacks based on known attack patterns.
How does anomaly detection work?
Detects attacks by comparing activity against a baseline.
