STUDYSEC+ {Part2}
Tags: Computer Science, Networking, Study, Security, Internet

INTRODUCTION TO NETWORK DEVICES [PART 2]

Introducing the layered Security Concept.

Network devices.

Introducing the Layered Security Concept

Modern networks are composed with multiple layers of devices and applications, which lead to security issues:

Each layer or device can contain its own security methods. This means that if a breach occurs in one area of the network, the rest of the network will remain secure. It is the best practice to use a layered approach when implementing network security.

Many security devices are trigered by a specific action occurring (network packet crosses an interface):

Some devices are capable of application awareness and this feature allows security devices to make better decisions based on which applications are allowed to operate on the network and which application is not allowed to cross through it. This layer is allowed to cross through it. Some devices for application-aware include firewalls, proxy servers, and network intrusion detection/prevention systems.

Network Devices

Virtual Private Network (VPN)

VPN will facilitate multiple secure VPN connections to a network. The type of VPN will determine what tunnelling and encryption the VPN concentrator will implement. Most concentrator can function at multiple layer of the OSI model (Layer 2,3 and 7). Outside of internet transaction which use SSL VPN connection (Layer 7) and concentrator will function on layer 3 of OSI model that provide IPsec encryption though a secure tunnel.

Network Intrusion Detection System (NIDS)

Is a passive system designed to identify when a network breach or attack against the network occur:

usually designed to inform a network administrator when a breach occurs. The file will send through log files, SMS, and/or email notification.

NIDS cannot be prevent or stop a breach or attack against on its own. It receive copy of all traffic and evaluates it against a set of standards:

Signature Based:

Evaluated network traffic for known malware or attack signatures.

Anomaly Based:

Evaluate network traffic for suspicious changes.

Policy-Based:

Evaluate network traffic against a specific declared security policy

heuristic Based:

Evaluate network traffic against past network behavior (look for expected pattern changes)

May be deployed at the host level:

Host-based Intrusion Detection System (HIDS)

Network-based Intrusion Prevention System (NIPS)

NIPS is an active system designed stop a breach or attack from succeeding in damaging the network:

Perform an action or set of actions to stop the malicious activity. Will inform the network administrator through the use of log files, SMS, and email notification.

All traffic will go though the NIPS to either enter or leave the segment:

All traffic is evaluated against a set of standards.

Placement of NIPS is on between a router (with a firewall) and the destination network segment. NIPS will be active on response of situation:

Block the offending IP address. Close the vulnerable interface. Terminate the network session. Redirect the attack. Perform additional actions.

UNIFIED Threat Management (UTM) Security Appliance

All possible all in one security solution:

Contains firewall features. Contains IDS features. Contains antivirus and antimalware features. Contains anti-spam features. Can perform content and URL (Web) filtering. Can also perform additional functions.

In a form of a network appliance.

Specially designed piece of hardware with an integrated software package-creating a closed system.

Pros:

Provide multiple security features in a central location. Simplifies management of security. Eases updating security.

Cons: