Topic 9B Flashcards
firewall
serves as the first line of defense in network security. It monitors and controls the incoming and outgoing network traffic based on predetermined rules, effectively creating a barrier between a trusted internal network and untrusted external networks.
Intrusion detection systems (IDS) and intrusion prevention systems (IPS)
An IDS monitors network traffic for signs of possible incidents and alerts systems administrators when such activities are detected.
An IPS, on the other hand, not only detects but also prevents identified threats by automatically taking action, such as blocking network traffic or terminating connections.
Web filters
prevent users from accessing potentially malicious websites, block the download of malicious files, and can even monitor and control access to restricted sites
access control list (ACL)
a list of permissions associated with a network device, such as a router or a switch, that controls traffic at a network interface level.
ACLs typically use packet information like source and destination IP addresses, port numbers, and the protocol to decide whether to permit or deny the traffic.
a firewall rule
dictates how firewalls should handle inbound or outbound network traffic for specific IP addresses, IP ranges, or network interfaces.
Firewalls typically provide both network and application-level control. They are designed to protect a network perimeter by preventing unauthorized access to or from a network.
What firewall rules take the most priority?
The rules in a firewall’s ACL are processed from top to bottom
The final default rule is typically to block any traffic that has not matched a rule (implicit deny). If the firewall does not have a default implicit deny rule, an explicit deny all rule can be added manually to the end of the ACL.
tuples
Each rule can specify whether to block or allow traffic based on several parameters
If you think of each rule being like a row in a database, the tuples are the columns.
For example, in the previous screenshot, the tuples include Protocol, Source (address), (Source) Port, Destination (address), (Destination) Port, and so on.
Some other basic principles include the following for firewalls:
Block incoming requests from internal or private IP addresses (that have obviously been spoofed).
Block incoming requests from protocols that should only function at a local network level, such as ICMP, DHCP, or routing protocol traffic.
Use penetration testing to confirm the configuration is secure. Log access attempts and monitor the logs for suspicious activity.
Take the usual steps to secure the hardware on which the firewall is running and use the management interface.
Host-based IDS/IPS (HIDS/HIPS)
are installed on individual systems or servers
they monitor and analyze system behavior and configurations for suspicious activities.
HIDS/HIPS are particularly effective at identifying insider threats, detecting changes in system files, and monitoring non-network events like local logins and system processes.
OSSEC is an
open-source HIDS solution that performs log analysis, integrity checking,
Windows registry monitoring, rootkit detection, real-time alerting, and active response. It is compatible with multiple platforms, including Linux, Windows, and MacOS.
Network-based IDS/IPS (NIDS/NIPS)
monitors network traffic. They look for patterns or signatures of known threats and unusual network packet behavior.
NIDS/NIPS are effective at identifying and responding to threats across multiple systems, like distributed denial-of-service (DDoS) attacks or network scanning activities.
Intrusion detection systems (IDS)
IDS systems are passive, inspecting network traffic, identifying potential threats based on predefined rules or unusual behavior, and sending alerts to administrators.
intrusion prevention systems (IPS)
are proactive security tools that detect potential threats and take action to prevent or mitigate them.
An IPS identifies a threat using methods similar to an IDS and can block traffic from the offending source, drop malicious packets, or reset connections to disrupt an attack.
there is a risk of false positives leading to blocking legitimate traffic.
what is Snort
one of the most well-known IDS tools.
It uses a rule-driven language, which combines the benefits of signature, protocol, and anomaly-based inspection methods, providing robust detection capabilities.
Open Source
what is Suricata
is a high-performance open source IDS/IPS/NSM engine. Suricata is designed to take full advantage of modern hardware and deliver higher performance and scalability than Snort.
Suricata can function as an IDS or an IPS, and is compatible with Snort rulesets, making it a highly flexible option for network security.
