Firewall and NIDS Placement Quiz

Questions and Answers

The incoming packets are suspicious

Header signature

To establish the level of threat for a given enterprise network

It is an attempt to start and stop a connection at the same time Signup and view all the answers

To monitor traffic between the Internet and the DMZ Signup and view all the answers

To detect and alert on suspicious traffic Signup and view all the answers

Anomaly-based detection Signup and view all the answers

It monitors for penetration attempts that target internal services Signup and view all the answers

It helps to identify the attack source Signup and view all the answers

To identify potential security threats Signup and view all the answers

Study Notes

NIDS sensors can be placed behind internal firewalls to monitor major backbone networks, LANs, and specific network segments for more targeted attacks.
Four types of locations for NIDS sensors:
- Outside the main enterprise firewall: monitors threat levels and helps win management support for security efforts.
- In the network demilitarized zone (DMZ), inside the main firewall but outside internal firewalls: monitors penetration attempts on open services.
- Behind internal firewalls: monitors major backbone networks and LANs.
- Behind internal firewalls: monitors LANs that support user workstations and servers specific to single departments.

A firewall is a barrier between two computers or computer systems.
Firewalls filter incoming packets based on parameters like packet size, source IP address, protocol, and destination port.
Linux and Windows (from XP onwards) have built-in firewalls.
Windows 7 expanded firewall functionality to handle inbound and outbound traffic filtering.
Windows 8 and 10 did not change firewall functionality significantly.
Individual computer firewalls should be turned on and configured in addition to perimeter firewalls.
Dedicated firewalls are necessary between a network and the outside world in an organizational setting.

Network-based IDS monitors network traffic on a specific segment as a data source.
NIDS captures all network traffic by placing the network interface card in promiscuous mode.
Three primary types of signatures:
- String signatures: look for specific text strings indicating possible attacks (e.g., UNIX “cat “+ +” >/.rhosts”).
- Port signatures: watch for connection attempts to frequently attacked ports (e.g., Telnet TCP port 23, FTP TCP port 21/20).
- Header signatures: detect dangerous or illogical packet header combinations (e.g., WinNuke, TCP packet with both SYN and FIN flags set).