Perimeter Security notes
Tags: security, studying, network, firewall
Published: 2020-03-08 23:45:53

## Firewalls

Section and protect
Three main types:
Hardware-based- a standalone device that's part of your network stack
Software-based- run as a piece of software on a host or server
Embedded- work as a single function out of many on a single device- like a firewall that comes with a home router


Packet filtering- Inspects packets, accepts or rejects based on rules
Inbound Port 80 and Port 443 commonly used
Two types- stateless and stateful packet filtering
Stateless Packet Filtering- accept or reject based on IP address and port requested
Stateful Packet Filtering- tracks requests *leaving the network* used to eliminate IP spoofing

NAT filtering- filters traffic based on port and TCP or UDP connection

Application layer gateway- applies security mechanisms to specific applications. Resource-intensive, but is powerful. 
Application layer gateway is a layer 7 firewall

Circuit-Level gateway works at session layer, ONLY inspects traffic during the establishment of the session over TCP or UDP

MAC filtering- filtering and preventing access based on MAC address

Access Control List: allow, explicit allow (example `allow TCP 10.0.0.2 any port 80`, explicit deny (example `deny TCP any any port 23`) implicit deny (`deny TCP any any port any`). 

Firewalls process traffic from first rule to last rule, when it meets a rule that matches, it stops the traffic

Layer 3- blocking IP addresses
Layer 4- blocking ports

WAF- web application firewall- installed on your server, inspects data being sent to and from. Useful to prevent XSS and SQL-injection attacks

Honeypots and honeynets
Use to attract and catch a would-be attacker

Honeypot: A single computer/file/group of files, or IP range that might be attractive to an attacker

Honeynets: A group of computers, servers, or an area of a network being used to attract

DLP systems- data loss prevention- analyze what's being sent out- also known as extrusion prevention systems (EPS) or Information Leak Protection (ILP)

Network based IDS- (NIDS) Attempts to detect, log, and alert on malicious network activities- like port scans and denial of service attacks- can be placed before or behind firewall. Can only detect, can't act, can only log

Network based IPS- (NIPS) Designed to inspect traffic AND, based on its configuration, attempts to remove, detain, redirect malicious traffic. NIPS can also perform functions as a protocol analyzer

Unified Threat Management- because one firewall is not enough! UTM is a single device that combines many other devicies and technologies into it- like firewall, NIDS/NIPS, content filter, anti-malware, DLP, VPN, often has a GUI instead of command line


## Cloud computing

Cloud computing is a way of offering on-demand services that extend the traditional capabilities of a computer or network

Cloud computing relies heavily on virtualization

Microsoft Azure uses Secure Enclaves

Secure Volumes though, are a method of keeping data at rest, secure from prying eyes

Four different cloud types: Public, Private, Hybrid, Community

Google Drive is a Public Cloud service

Private- used by companies for example, with their own environment, servers, and resource use- US Government. Private clouds are chosen when security is more important than cost

Hybrid- mixture, rules about what type of data is hosted where

Community cloud- resources shared

SaaS- ordered from least to most vendor-equipped

IaaS

PaaS

SECaaS- Security as a Service- anti-malware products. Upside- quick updates. Downside- highly reliant on an internet connection.


65,536 ports for a computer to use

35 are worth memorizing














Source:
CompTIA Security+ (SY0-501)
https://www.udemy.com/course/securityplus/