Firewall Concepts and Management Quiz

To establish a connection on behalf of the user and decrypt packets for inspection

NGFWs can decrypt SSL packets to inspect them

To allow malicious traffic to flow disguised as DNS traffic

To explicitly allow or deny a process or port access to networks

Minimize external access and your attack vector

NGFWs can verify the integrity of the protocol and prevent such disguises

NGFWs can inspect SSL packets deeply, while Stateful firewalls cannot

To ensure encrypted connections between server and client

To act as a middleman between the user and the internet, decrypting and inspecting packets

To protect a computer from unauthorized access

IPsec

It is a stateful host firewall

Deep Packet Inspection

IPsec

To require authentication from communicating devices

A firewall controls network traffic to protect from unauthorized access, while antivirus software scans and removes viruses

To track the state of active network connections and determine which network traffic to allow

Deep Packet Inspection (DPI)

To either allow or block network traffic

Monitoring the state and context of connections

Through pseudo-states

Offering stateful packet inspection (SPI)

Inspecting packets for validity and specific criteria

Viewing local processes and ports

Through pseudo-states

Pattern or signature matching

It is handled through pseudo-states

Inspecting packets using various methodologies such as SSL decryption

Context refers to network-related metadata components of the TCP/IP protocol

False

True

True

False

True

False

False

False

True

False

True

True

False

False

True

True

False

True

True

True

True

True

True

True

True

True

True

True

True

False

SSL decryption on NGFWs acts as a middleman between the user and the internet, establishing a connection on behalf of the user, decrypting packets to inspect them, and then re-encrypting the package before sending it to the user. This ensures that packets are only decrypted on the firewall and not anywhere else, enhancing network security.

Key tips for basic server hardening include controlling server access via RBAC, minimizing external access and attack vectors, keeping servers up-to-date with vetted patches, and maintaining a baseline inventory of hardware, software, and configurations.

Inbound and Outbound rules in a firewall explicitly allow or deny a process or port access to networks. They can filter based on program, port, predefined services, or custom parameters, allowing for specific control over network traffic.

TCP over DNS allows malicious traffic to flow disguised as DNS (port 53), and firewalls may allow this traffic because they do not examine the 'innards' of the packet. This poses a significant security risk as it can bypass traditional firewall protections.

The primary function of DPI in NGFWs is to inspect and manage network traffic at the packet level, allowing for intelligent traffic filtering and enhancing security.

NGFWs can inspect SSL packets deeply to verify signatures or other mechanisms, while Stateful firewalls are unable to perform deep SSL packet inspection, limiting their ability to ensure the integrity of SSL connections.

Decentralized services involve moving away from having all services hosted on a single server, reducing the impact of a single point of failure and enhancing security. This is a key aspect of server hardening as it improves resilience and mitigates security risks.

Windows Defender Firewall with Advanced Security provides advanced capabilities for network protection, allowing for the management of inbound and outbound rules, connection security rules, and monitoring to control network traffic and enhance security.

SSL is the backbone of security on the internet, used by most websites to ensure encrypted connections and data transmissions between servers and clients. Its widespread usage contributes significantly to internet security.

SSL decryption on NGFWs is extremely resource-intensive due to the process of establishing connections, decrypting packets, and re-encrypting them. This can impact the performance of the firewall and requires significant computational resources.

Basic functions of a firewall include dealing with network-based access, explicitly blocking or allowing access for traffic (IP), and being 'intelligent' (DPI, Stateful, etc).

Windows Defender Firewall with Advanced Security is a stateful host firewall that helps secure the device by allowing the creation of rules to determine permitted network traffic. It also supports Internet Protocol security (IPsec), which can require authentication from communicating devices and encrypt certain network traffic.

Early iterations of firewalls were very basic, where traffic was either allowed to enter or leave, or it was not.

Windows Server ships with Windows Defender Firewall with Advanced Security and supports Internet Protocol security (IPsec) to require authentication and encryption for network traffic.

IPsec is used to require authentication from any device attempting to communicate with the device and to encrypt certain network traffic to prevent it from being read by malicious users.

A firewall deals with network-based access by explicitly blocking or allowing traffic, while antivirus software focuses on detecting and removing malicious software from a computer system.

DPI allows firewalls to inspect and manage network traffic at the packet level, discerning specific criteria and enhancing security.

The primary function of Inbound and Outbound rules in a firewall is to explicitly allow or deny process or port access to networks.

A tip for basic server hardening is to avoid manual configuration and to implement security measures such as firewalls and IPsec.

The purpose of SSL decryption technology on NGFWs is to ensure that packets are decrypted only on the firewall and not anywhere else, enhancing security and privacy.

NGFWs offer stateful packet inspection (SPI) and deep packet inspection (DPI), while Stateful firewalls only offer stateful packet inspection at Layer 3 and 4.

Stateful firewalls handle stateless protocols like UDP through pseudo-states.

Context in stateful firewalls refers to network-related metadata components of the TCP/IP protocol.

DPI techniques used in NGFWs include pattern or signature matching and protocol discernment.

DPI can inspect packets for validity and ensure they meet specific criteria for passage.

Stateful firewalls monitor the state and context of connections and adjust accordingly (allow or deny).

The 'Netstat' command is used to view local processes and ports, providing a practical example for understanding firewalls.

UDP, a stateless protocol, is handled by stateful firewalls through pseudo-states.

The primary role of SSL decryption technology on NGFWs is to ensure that packets are inspected using various methodologies such as SSL decryption.

NGFWs offer enhanced security through deep packet inspection (DPI), while Stateful firewalls only offer stateful packet inspection.