Firewall Overview and Techniques

Methods used by firewalls to control access and enforce security policies.

Firewall technique deciding which internet services can access the network (inbound/outbound).

Firewall technique deciding the direction of service requests allowed through the firewall.

Firewall technique controlling access to a service based on the user attempting to access it.

Firewall technique controlling how individual services are used.

Features of firewalls in protecting networks and supporting internet functions.

Weaknesses firewalls have in protecting against certain types of attacks or security loopholes.

Untrusted users attempting to gain access to a network bypassing a firewall.

A firewall that separates parts of an enterprise network, protecting it from internal threats.

A basic firewall examining packet details (source, destination, port, protocol) to control network access.

The address of the computer sending the network packet.

The address of the computer receiving the network packet.

A number associated with the application program on a computer sending a network packet.

A number associated with the application program on a computer receiving a network packet.

An attack where the attacker pretends to be a trusted device on the network.

Discarding packets with an inside source address if they arrive on an external interface.

Packet filtering firewalls don't prevent attacks exploiting application vulnerabilities.

Packet filtering firewalls are fast and simple to use.

The process of analyzing system events to identify possible security breaches.

A proactive approach to security that actively blocks potential threats.

Software or hardware that monitors a system for unauthorized access attempts and alerts administrators.

An IDS that monitors activity on a single computer, like a laptop or server.

An IDS that monitors traffic across a network, looking for suspicious activity.

Components of an IDS that collect data from various parts of a system.

Parts of an IDS that analyze sensor data to determine if an intrusion is happening.

A way for users to view IDS outputs and manage its behavior.

Combines various firewall techniques like stateful packet inspection (SPI) and circuit-level gateways for enhanced security.

A software-based firewall installed on a network host that controls incoming and outgoing traffic based on defined rules.

A network host with two network interfaces, one connected to the external network and the other to the internal network, both secured by separate firewalls.

A firewall integrated into a network router, providing basic packet filtering and security for the entire network.

A firewall setup that combines a bastion host (a hardened system) and a screening router for enhanced security.

A separate segment of a network that hosts servers exposed to the public internet, protected by two firewalls for security.

A firewall technique that analyzes the entire state of a communication session, not just individual packets, to identify and block suspicious activity.

A firewall that focuses on protecting specific applications, filtering traffic based on the application's protocol and behavior.

A server that acts as an intermediary between a client and a server, hiding the client's identity and providing additional security benefits.

A technique that translates private IP addresses on a network to public IP addresses used on the internet, allowing multiple internal devices to share a single public IP address.

A network segment that sits between an internal network and the external internet, acting as a buffer for public-facing services. It provides an extra layer of security by isolating sensitive systems from direct external access.

Two main approaches: signature-based and anomaly-based. Signature-based IDS searches for known attack patterns, matching them to a database of signatures. Anomaly-based IDS identifies unusual behavior compared to normal network traffic, even if the attack patterns are unknown.

Analyzing the flow of data packets within a network to identify patterns, anomalies, and suspicious behavior. It examines factors like source and destination IP addresses, ports, protocols, and packet size.

Examining the actual content of data packets to detect malicious code or suspicious data. This delves deeper, looking for specific keywords, patterns, and potential threats hidden within the data.

A security measure that attempts to prevent intrusions by blocking suspicious activity before it becomes malicious. It operates by analyzing user behavior and blocking activities that deviate from normal patterns.

A security approach that identifies potential intrusions by detecting deviations from normal network behavior. It relies on establishing baseline patterns of normal activity and flagging any significant departures.

A technique used in anomaly detection that sets limits for acceptable network activity. Any behavior that exceeds these limits triggers an alert, suggesting a potential security breach.

A method for detecting anomalies by analyzing system-wide resource utilization. It creates profiles of typical resource usage and identifies any significant deviations as potential threats.

A technique for anomaly detection that establishes profiles of typical user or group activities. Any behaviors that fall outside these profiles are considered suspicious.

A method that monitors the resource use of programs to detect malware attacks. It analyzes how programs utilize system resources and flags any abnormal resource consumption as potentially malicious.

A security system that monitors network traffic in real-time for malicious activities. It analyzes network packets for suspicious patterns or known attack signatures.

A type of intrusion detection technique that identifies known malicious patterns in network packets. These patterns are like unique fingerprints of known attacks.

A type of intrusion detection technique that monitors network traffic to see if it's attempting to access known vulnerable ports. These ports are often exploited by attackers to gain unauthorized access.

A type of intrusion detection technique that analyzes the headers of network packets for suspicious patterns. Attackers often try to manipulate packet headers to deceive security systems.

A popular, open-source intrusion detection system (IDS) available on various platforms. It can monitor network traffic for suspicious patterns and potential attacks.

A mode in Snort where it passively captures all network traffic on a system to analyze it. Useful for identifying potential security threats or observing encrypted traffic.

A mode in Snort where it records all captured network traffic into a file. Useful for analyzing patterns or searching for specific activities.

A mode in Snort where it actively analyzes network traffic for suspicious activity based on predefined rules. When a rule is triggered, Snort can issue alerts or take further actions.

A decoy system designed to attract and trap attackers. It's set up to appear as a valuable target, but it's actually a controlled environment where attacker actions are monitored and analyzed.

A structured process for handling and responding to security incidents. It involves detecting incidents, assessing their impact, coordinating response actions, and learning from the experience.