Section 4 - Security Applications and Devices Flashcards
Software application that protects a single computer from unwanted
Internet traffic
These are also known as “host-based firewalls”
Personal Firewalls
How do personal firewalls work?
These firewalls work by applying a set of rules and policies against traffic that’s attempting to come into or go out of our protected computer.
With each of the following operating systems, what is the software-based firewall that applies to them?
Windows
Mac OSX
Linux
- Windows Firewall (Windows)
▪ PF and IPFW (OS X)
▪ iptables (Linux)
Many ____ suites also contain software firewalls
anti-malware
What is an IDS?
Intrusion Detection System - Device or software application that monitors a system or network and analyzes the data passing through it in order to identify an incident or
attack
Intrusion Detection Systems come in two different varieties, which are?
HIDS - Host-based IDS: This usually takes the form as a piece of software that’s installed on your computer or on a server and it will protect it. Now, the host-based Intrusion Detection System will sit there and log everything that it thinks is suspicious.
NIDS - Network-based IDS: This is a piece of hardware that’s installed on your network. And all the traffic goes through that switch, and then it will get a copy of that sent down to the Network Intrusion Detection System. If it’s suspicious, it’ll log it and it’ll alert on it.
Now, how do we know what HIDS or NIDS systems will alert on? Well, they’re going to use one of three different methods. Name these methods.
Signature Based
Policy Based
Anomaly Based
What is a signature-based detection method?
A specific string of bytes triggers an alert
This works like any other signature-based product.This computer is going to continually search over and over for a known specific key. And any time it sees that combination of letters or bytes, it knows that it’s malicious. It’ll flag it and it will alert on it.
What is a Policy-based detection method?
Relies on specific declaration of the security policy (i.e., ‘No Telnet
Authorized’)
This is going to rely on a specific declaration of the security policy. For example, if your company has a policy that no one is allowed to use Telnet, any time this system sees somebody trying to connect on port 23, which is the port for Telnet, it’s going to flag it, log it, and alert on it.
What is an Anomaly-based detection method?
Analyzes the current traffic against an established baseline and
triggers an alert if outside the statistical average
Often, this is referred to as just anomaly-based detection or statistical-based detection. This is going to analyze all of the current traffic patterns against an established baseline, and anytime it sees something that goes outside the statistical norm, it’s going to alert on it. So, if I’ve been watching your network for a while and I know what normal looks like, and everybody always works from nine in the morning
until five in the afternoon, and now I start seeing somebody downloading large amounts of data around two o’clock in the morning, that’s outside our normal baseline and we would flag that and alert on that.
What are the four different types of alerts?
True Positive
False Positive
True Negative
False Negative
What is a true positive alert?
Malicious activity is identified as an attack
Now, a true positive means something bad happened and the system flagged it and alerted on it. That’s good because it means our system is tuned properly.
What is a false positive alert?
Legitimate activity is identified as an attack
When we get into something like false positives, this is where some legitimate activity
is being as identified as an attack. For example, if you log on the computer and you start up Microsoft Word, that’s authorized. But if the system thought that was malicious and flagged it and alerted on it, that’s considered a false positive.
What is a true negative alert?
Legitimate activity is identified as legitimate traffic
A true negative means something good or normal happened and the system didn’t flag it. Again, that’s good, because our system’s working like it should.
What is a false negative alert?
Malicious activity is identified as legitimate traffic
Now, next we have what’s called a false negative. This is when something bad happens but it’s identified as legitimate activity. In other words, it isn’t flagged and it wasn’t alerted on. Let’s say you downloaded a virus, and you ran the virus and something bad happened, but your Intrusion Detection System didn’t see it, didn’t flag on it, and didn’t alert on it. This is a false negative.
It’s really important to realize that IDSs can only…? They won’t be able to stop anything. If you want the activity to be stopped, then you need to invest in an ___.
alert and log on suspicious activity
IPS - Intrusion Prevention System
How is IPS different from IDS?
IPS work very similarly to an IDS except they have the ability to stop malicious activity from being executed.
A concern with pop-up ads is that a lot of times, they’re being done through ___ ___ networks. And these are based on a pay-per-click model.
ad distribution
***Malicious attackers can purchase pay-per-click advertisements through these networks, as well. And sometimes, they can embed either a link to their website or a link to malicious code.
What is an issue you may run into when using an Adblocker?
Some websites you want to go to may not serve up content if you’re blocking advertisements. A lot of websites are working under a free model and their advertiser-supported. So, if you’re blocking the ads, they’re not making any money giving you content. And so, a lot of them have coded it so they won’t deliver the content you’re looking for unless you turn off your ad blocker.
The following describes what?
Blocking of external files containing JavaScript, images, or web pages
from loading in a browser
Content Filters
The best defense against unscrupulous advertisers though, is to ensure…?
your browser and its extensions are updated regularly
The following describes what?
Monitors the data of a system while in use, in transit, or at rest
to detect attempts to steal the data
Data Loss Prevention (DLP)
DLP comes in two different types of solutions, which are?
Software or hardware
What are the four types of DLP systems?
Endpoint
Network
Storage
Cloud
Which DLP system is the following describing?
Software-based client that monitors the data in use on a computer
and can stop a file transfer or alert an admin of the occurrence
Endpoint DLP System
***An endpoint system is usually a piece of software that’s installed on a workstation or a laptop, and it’s going to monitor the data that’s in use on that computer. And if someone tries to do a file transfer, it’ll either stop that file transfer, or it’ll alert the admin of the occurrence based on certain rules and policies. Very much like an IDS or an IPS would, but focused on data. DLPs can be set to detection mode or prevention mode.
Which DLP system is the following describing?
Software or hardware-based solution that is installed on the
perimeter of the network to detect data in transit
Network DLP System
***The next one we have is a network DLP system. This is a piece of software or hardware that’s a solution placed at the perimeter of your network. It’s sole function in life is to check all of the data going into and out of your network, with a special focus on things going out of the network. They want to detect data in transit that shouldn’t be leaving the building.
Which DLP system is the following describing?
Software installed on servers in the datacenter to inspect the data
at rest
Storage DLP system
*** This is a software that’s installed on a server in the data center and inspects the data while its at rest on the server. This is usually because they’ve encrypted it or watermarked it, and we want to make sure that nobody’s accessing the data at times that they shouldn’t be. For example, if someone starts downloading large amounts of data at two in the morning, that’s probably against your policy and the DLP could catch it.
