Chapter 7

Front 1

dedicated hardware device

Back 1

load balancer

Front 2

load balancers are grouped into two categories:

Back 2

Layer 4 load balancers

Layer 7 load balancers

Front 3

act upon data found in Network and Transport Layer protocols such as Internet Protocol (IP), Transmission Control Protocol (TCP), File Transport Protocol (FTP), and User Datagram Protocol (UDP)

Back 3

Layer 4 load balancers

Front 4

distribute requests based on data found in Application layer protocols such as HTTP

Back 4

Layer 7 load balancers

Front 5

these two layers can distribute work in different ways Layer 4 and Layer 7:

Back 5

based on a "round-robin" rotation to all devices equally

to devices that have the least number of connections

Front 6

also can use HTTP headers, cookies, or data within application message itself to make decision on distribution.

Back 6

Layer 7 load balancers

Front 7

person who authorized to act as substitute or agent on behalf of another human

Back 7

Proxy

Front 8

computer or application that intercepts and processes user requests:

Back 8

Proxy Server

Front 9

special proxy server that "knows" the application protocols that it supports (FTP proxy server implements the protocol FTP)

Back 9

application - aware proxy

Front 10

proxy server advantages

Back 10

- increased speed (requests served from the cache)

- reduced costs (cache reduces bandwith required )

- improved management - block specific Web pages or sites

-Stronger security

Front 11

Stronger security in proxies provide:

Back 11

intercept malware

hide client systems IP address from the open Internet

Front 12

reverse proxy

Back 12

does not serve clients but routes incoming requests to correct server

Front 13

reverse proxy's IP address is

Back 13

visible to outside users

Front 14

internal servers' IP address is

Back 14

hidden

Front 15

Network sercurity hardware is:

Back 15

- specifically designed security hardware devices

- greater protection than standard networking devices

- devices include network firewalls, spam filters, virtual private network concentrates, internet content filters,

Front 16

software firewall that runs as program on one client

Back 16

host based application software

Front 17

designed to protected an entire network

Back 17

hardware-based network firewall

Front 18

both essentially same: (network firewalls)

Back 18

to inspect packets and either accept or deny entry

Front 19

usually located outside network security perimeter as first line of defense

Back 19

hardware firewalls

Front 20

methods of firewall packet filtering

Back 20

stateless packet filtering

stateful packet filtering

Front 21

inspects incoming packet and permits or denies based on conditions set by administrator

Back 21

stateless packet filtering

Front 22

keeps records of state of connection and makes decisions based on connection and conditions

Back 22

stateful packet filtering

Front 23

Firewall actions:

Back 23

allow - let packet pass through and continue on its journey

drop- prevent packet from passing into network and send no response to sender

reject- prevent packet from passing into network but send a message to sender that the destination cannot be reached

ask- inquire what action to take

Front 24

uses set of individual instructions to control actions (firewall rules)

Back 24

rule-based firewall

Front 25

are static in nature and cannot do anything other what have been expressly configured do

Back 25

rule-based firewall

Front 26

more "intelligent" firewall operates at higher level (next- generation firewall or NGFW)

Back 26

application - aware firewall

Front 27

special type of application - aware that looks at applications using HTTP

Back 27

web application firewall

Front 28

identifies applications that send packets through firewall and then make decisions about application (vs. granular rule settings like destination port or protocol)

Back 28

application - aware firewall

Front 29

enterprise - wide spam filters block spam before it reaches the host

Back 29

spam filters

Front 30

email systems use two protocols:

Back 30

simple mail transfer protocol (SMTP)

Post Office Protocol (POP)

Front 31

handles outgoing mail

Back 31

simple mail transfer protocol (SMTP)

Front 32

handles incoming mail

Back 32

Post Office Protocol (POP)

Front 33

installed with SMTP server

Back 33

spam filters

Front 34

Spam filters installed on POP3 server

Back 34

- All spam must first pass through SMTP server and be delivered to user’s mailbox

- Can result in increased costs of storage, transmission, backup, deletion

Front 35

Uses unsecured network as if were secure

Back 35

Virtual private network (VPN) -

Front 36

two types of VPNs

Back 36

remote-access VPN

Site-to-site VPN

Front 37

–Multiplesites can connect to other sites over the Internet

Back 37

Site-to-site VPN

Front 38

- User to LAN connection

Back 38

Remote-access VPN

Front 39

All data transmitted between remote device and network is encrypted

Back 39

VPN Concentrators

Front 40

End of tunnel between VPN devices:

May be software on local computerMay be VPN concentrator (hardware device)May be integrated into another networking device

Back 40

Endpoints

Front 41

Hardware-based generally have better securitySoftware-based have more flexibility in managing network traffic

Back 41

VPNs can be software-based or hardware-based

Front 42

Monitor Internet traffic and block access to preselected Web sites and files

Back 42

Internet content filters

Front 43

Unapproved sites can be restricted based on:

Back 43

Uniform Resource Locator (URL filtering) Searching for and matching keywords such as sex or hate (content inspection) Looking for malware (malware inspection)

Front 44

Can block malicious content in real time

Back 44

Web security gateway

Front 45

- ActiveX objects

- Adware, spyware

- Peer to peer file sharing

- Script exploits

- TCP/IP malicious code attacks

Back 45

Examples of blocked web traffic:

Front 46

Device that can detect an attackas it occurs

Back 46

Intrusion detection system (IDS)

Front 47

- can use different methodologies for monitoring for attacks

- can be installed on either local hosts or networks

- an intrusion prevention system (IPS)

Back 47

Intrusion detection system (IDS)

Front 48

Compares current detected behavior with baseline

Back 48

Anomaly-based monitoring

Front 49

Looks for well-known attack signature patterns

Back 49

Signature-based monitoring

Front 50

Detects abnormal actions by processes or programs and alerts user who decides whether to allow or block activity

Back 50

Behavior-based monitoring

Front 51

Uses experience-based techniques

Back 51

Heuristic monitoring -

Front 52

Software-based application that runs on local host computer that can detect an attack as occurs

Back 52

Host-based intrusion detection system (HIDS)

Front 53

relies on agents installed directly on system being protected

Back 53

HIDS

Front 54

- System calls

- File system access

- System registry settings

- Host input/output

Back 54

Monitors

Front 55

- Cannot monitor network traffic that does not reach local system

- All log data is stored locally

- Resource-intensive and can slow system

Back 55

Disadvantages of HIDS:

Front 56

Watches for attacks on network. May use one or more of the evaluation techniques

Back 56

Network intrusion detection system (NIDS) -

Front 57

gather information and report back to central device

Back 57

NIDS sensors installed

Front 58

Monitors to detect malicious activities like IDS does but also attempts to prevent them by stopping attack

Back 58

Intrusion prevention system (IPS)

Front 59

Similar to active NIDS that monitors network traffic to immediately react to malicious attack

Back 59

Network intrusion prevention system (NIPS)

Front 60

Knows information like applications and operating systems so that can provide higher degree of accuracy

Back 60

Application-aware IPS

Front 61

Major differences between a NIDS and a NIPS is location:

Back 61

- NIDS has sensors that monitor traffic entering and leaving firewall, and reports back to central device for analysis

- NIPS would be located “in line” on firewall itself to allow NIPS to more quickly take action to block attack

Front 62

Security product that combines several security functions

Back 62

Unified Threat Management (UTM)

Front 63

- Because different types of network security hardware each provide a different defense, network may require multiple devices for comprehensive protection

- Makes cumbersome to manage multiple devices

Back 63

Unified Threat Management (UTM) Security Appliances

Front 64

- Antispam and antiphishing

- Antivirus and antispyware

- Bandwidth optimization

- Content filtering

- Encryption

- Firewall

- Instant messaging control

- Intrusion protection

- Web filtering

Back 64

UTM functions:

Front 65

Network technologies can also help to secure network

Back 65

Two technologies:Network address translation Network access control

Front 66

Allows private IP addresses to be used on public Internet

Back 66

Network address translation (NAT)

Front 67

Variation of NAT that outgoing packets given same IP address but different TCP port number

Back 67

Port address translation (PAT)

Front 68

Replaces private IP address withpublic address as leaves network and vice versa when returns

Back 68

Port address translation (PAT)

Front 69

Advantages of NAT:

Back 69

- Masks IP addresses of internal devices

- Allows multiple devices to share smaller number of public IP addresses

Front 70

Examines current state of system or network device before allowing network connection

Back 70

Network access control (NAC) -

Front 71

Device must meet set of criteriaIf not met, NAC allows connection to quarantine network until deficiencies corrected

Back 71

Network Access Control (NAC)

Front 72

- Demilitarized zones

- Subnetting

- Virtual LANs

- Remote access

Back 72

Elements of a secure network design

Front 73

Separate network located outside secure network perimeter

Back 73

Demilitarized zone (DMZ)

Front 74

- Untrusted outside users can access DMZ but not secure network

- Most secure approach is have two firewalls

Back 74

Demilitarized zone (DMZ)

Front 75

- IP address split anywhere within its 32 bits

Back 75

Subnetting or subnet addressing

Front 76

Split between the network and host portions on the boundaries between the bytes

Back 76

Classful addressing

Front 77

with network address and host address

Back 77

IP addresses are 32-bit (4-byte) addresses

Front 78

- Single network into multiple smaller subnets in order to isolate groups of hosts

- Allows network administrators to hide the internal network layout

Back 78

Subnets also can improve network security:

Front 79

Each network can contain several subnets,

Back 79

and each subnet connected through different routers can contain multiple hosts

Front 80

Segment network by separating devices into logical groups

Back 80

Virtual LAN (VLAN)

Front 81

allows scattered users to be logically grouped together even though physically attached to different switches

Back 81

VLAN

Front 82

can be isolated so sensitive data is transported only to members of the VLAN

Back 82

VLANs

Front 83

Working away from the office commonplace today:

Back 83

- Telecommuters

- Traveling sales representatives

- Traveling workers

Front 84

- Strong security for remote workers must be maintained

- Transmissions are routed through networks not managed by the organization

Back 84

Remote Workers

Front 85

Any combination of hardware and software that enables remote users to access local internal network

Back 85

Remote access

Front 86

provides remote users with same access and functionality as local users through VPN or dial-up connection

Back 86

Remote access

Front 87

support for remote connection and logon and then displays the same network interface as the normal network

Back 87

Service includes