Section 12: Perimeter Security Flashcards
Perimeter Security
Boundary that separates the LAN from the WAN and how to secure that
Firewalls
Screen traffic between two portions of a network
Three main types of firewalls
Hardware based, software based, and embedded (SOHO router, UTM)
Packet Filtering
Inspects each packet passing through the firewall and accepts or rejects it based on the rules
Stateless Packet Filtering
Filtering based on IP address
Stateful Packet Filtering
Tracks the request leaving the network (eliminates IP spoofing)
NAT Filtering
Filters traffic based upon the ports being utilized and type of connection (TCP or UDP)
Circuit Level Gateway
Operates at the session layer and only inspects the traffic during the establishment of the initial session for TCP or UDP
Explicit Allow
Allows because you’ve specifically created a rule for it
Explicit Deny
Traffic is denied because the rules says so
Implicit Deny
Traffic is denied the ability to enter or leave the network because there is no specific rules that allows it
Web Application Firewall
Firewall installed to protect your server by inspecting traffic being sent to a web application
Proxy Server
A device that acts as a middle man between a device and a remote server
What are the four kinds of Proxy Servers in use today?
IP proxy, caching proxy, content filter, web security gateway
IP Proxy
Used to secure a network by keeping devices behind it anonymous
Caching Proxy
Attempts to serve client requests by delivering content from itself without actually contacting the remote server
PAC files for security
Disable them!
Internet Content Filter
Used in organizations to prevent users from accessing prohibited websites
Web Security Gateway
A go-between device that scans for viruses, filters unwanted content like ads, and performs data loss prevention functions
Honeypots and honeynets
Used to attract and trap potential attackers
Honeypot
A single computer (or file, group of files, or IP range) that might be attractive to an attacker
Honeynet
A group of computers, servers, or networks used to attract an attacker
Data Loss Prevention
Systems designed to protect data by conducting content inspection of data being sent out of the network
NIDS
Network Intrusion Detection System - attempts to detect, log, and alert on malicious network activities
NIPS
Attempts to remove, detain, or redirect malicious traffic
UTM
Unified Threat Management - Single device that combines several security devices within it
