Firewall Overview and Techniques

<p>Serving as a high-speed data processor (A)</p> Signup and view all the answers

<p>Which user is attempting to access a service (A)</p> Signup and view all the answers

<p>It determines the direction of service requests allowed through the firewall. (C)</p> Signup and view all the answers

<p>Potentially vulnerable services entering or leaving the network (D)</p> Signup and view all the answers

<p>It serves as the location for implementing the VPN. (A)</p> Signup and view all the answers

<p>To gather and analyze information for signs of intrusions (B)</p> Signup and view all the answers

<p>Host-based IDS (A)</p> Signup and view all the answers

<p>IPS takes action to prevent attacks while IDS only logs activities (C)</p> Signup and view all the answers

<p>Firewalls (D)</p> Signup and view all the answers

<p>To determine if an intrusion has occurred based on collected data (A)</p> Signup and view all the answers

<p>It can generate false positives and potentially block legitimate traffic (B)</p> Signup and view all the answers

<p>It analyzes network traffic and application protocols for suspicious activity (A)</p> Signup and view all the answers

<p>They collect data from various parts of a system to identify potential intrusions (B)</p> Signup and view all the answers

<p>They cannot prevent attacks that exploit application-specific vulnerabilities. (D)</p> Signup and view all the answers

<p>Application type (A)</p> Signup and view all the answers

<p>Security breaches that arise from human error. (A)</p> Signup and view all the answers

<p>They are often transparent to users. (D)</p> Signup and view all the answers

<p>SMTP (B)</p> Signup and view all the answers

<p>Transmitting packets from outside with a source IP that appears to be an internal host. (A)</p> Signup and view all the answers

<p>Advanced user authentication schemes. (D)</p> Signup and view all the answers

<p>Discard packets with an inside source address on an external interface. (B)</p> Signup and view all the answers

<p>They analyze individual packets at a basic level. (C)</p> Signup and view all the answers

<p>Acts as the first line of defense in a network (D)</p> Signup and view all the answers

<p>Screened network firewall (A)</p> Signup and view all the answers

<p>To translate internal IP addresses to public addresses (C)</p> Signup and view all the answers

<p>To provide logging information and protect against spoofing (D)</p> Signup and view all the answers

<p>They are typically software-based and easy to configure. (B)</p> Signup and view all the answers

<p>They detect violations of security policy that affect confidentiality, integrity, or availability. (D)</p> Signup and view all the answers

<p>They combine multiple firewall implementations like SPI and circuit level gateways. (A)</p> Signup and view all the answers

<p>To block both inbound and outbound packets (B)</p> Signup and view all the answers

<p>They often include a dedicated network administration personnel. (C)</p> Signup and view all the answers

<p>Logs should be reviewed periodically for anomalies and performance statistics utilized. (B)</p> Signup and view all the answers

<p>To monitor and analyze network packets for suspicious activity. (A)</p> Signup and view all the answers

<p>It may block legitimate traffic due to false positives. (B)</p> Signup and view all the answers

<p>Normal usage profiles (C)</p> Signup and view all the answers

<p>Signature-based detection (A)</p> Signup and view all the answers

<p>To serve as bait for attackers to analyze their methods. (C)</p> Signup and view all the answers

<p>Header condition signatures (A)</p> Signup and view all the answers

<p>Difficulty in maintaining updated profiles due to changing behaviors. (B)</p> Signup and view all the answers

<p>The act of identifying and correcting discrepancies in data formats. (D)</p> Signup and view all the answers

<p>Sniffer mode (D)</p> Signup and view all the answers

<p>Sandboxing (B)</p> Signup and view all the answers

<p>The typical resource usage across the system. (B)</p> Signup and view all the answers

<p>Malicious payload patterns (C)</p> Signup and view all the answers

<p>To identify relationships and patterns across different data entries. (D)</p> Signup and view all the answers

<p>Threshold monitoring (C)</p> Signup and view all the answers

<p>To isolate internal systems from external threats (A)</p> Signup and view all the answers

<p>Signature-based and anomaly-based detection (A)</p> Signup and view all the answers

<p>Identifying what constitutes Web traffic (D)</p> Signup and view all the answers

<p>Monitoring network traffic to identify suspicious behavior (A)</p> Signup and view all the answers

<p>Monitoring and filtering of incoming and outgoing traffic (B)</p> Signup and view all the answers

Methods used by firewalls to control access and enforce security policies.

Firewall technique deciding which internet services can access the network (inbound/outbound).

Firewall technique deciding the direction of service requests allowed through the firewall.

Firewall technique controlling access to a service based on the user attempting to access it.

Firewall technique controlling how individual services are used.

Features of firewalls in protecting networks and supporting internet functions.

Weaknesses firewalls have in protecting against certain types of attacks or security loopholes.

Untrusted users attempting to gain access to a network bypassing a firewall.

A firewall that separates parts of an enterprise network, protecting it from internal threats.

A basic firewall examining packet details (source, destination, port, protocol) to control network access.

The address of the computer sending the network packet.

The address of the computer receiving the network packet.

A number associated with the application program on a computer sending a network packet.

A number associated with the application program on a computer receiving a network packet.

An attack where the attacker pretends to be a trusted device on the network.

Discarding packets with an inside source address if they arrive on an external interface.

Packet filtering firewalls don't prevent attacks exploiting application vulnerabilities.

Packet filtering firewalls are fast and simple to use.

The process of analyzing system events to identify possible security breaches.

A proactive approach to security that actively blocks potential threats.

Software or hardware that monitors a system for unauthorized access attempts and alerts administrators.

An IDS that monitors activity on a single computer, like a laptop or server.

An IDS that monitors traffic across a network, looking for suspicious activity.

Components of an IDS that collect data from various parts of a system.

Parts of an IDS that analyze sensor data to determine if an intrusion is happening.

A way for users to view IDS outputs and manage its behavior.

Combines various firewall techniques like stateful packet inspection (SPI) and circuit-level gateways for enhanced security.

A software-based firewall installed on a network host that controls incoming and outgoing traffic based on defined rules.

A network host with two network interfaces, one connected to the external network and the other to the internal network, both secured by separate firewalls.

A firewall integrated into a network router, providing basic packet filtering and security for the entire network.

A firewall setup that combines a bastion host (a hardened system) and a screening router for enhanced security.

A separate segment of a network that hosts servers exposed to the public internet, protected by two firewalls for security.

A firewall technique that analyzes the entire state of a communication session, not just individual packets, to identify and block suspicious activity.

A firewall that focuses on protecting specific applications, filtering traffic based on the application's protocol and behavior.

A server that acts as an intermediary between a client and a server, hiding the client's identity and providing additional security benefits.

A technique that translates private IP addresses on a network to public IP addresses used on the internet, allowing multiple internal devices to share a single public IP address.

A network segment that sits between an internal network and the external internet, acting as a buffer for public-facing services. It provides an extra layer of security by isolating sensitive systems from direct external access.

Two main approaches: signature-based and anomaly-based. Signature-based IDS searches for known attack patterns, matching them to a database of signatures. Anomaly-based IDS identifies unusual behavior compared to normal network traffic, even if the attack patterns are unknown.

Analyzing the flow of data packets within a network to identify patterns, anomalies, and suspicious behavior. It examines factors like source and destination IP addresses, ports, protocols, and packet size.

Examining the actual content of data packets to detect malicious code or suspicious data. This delves deeper, looking for specific keywords, patterns, and potential threats hidden within the data.

A security measure that attempts to prevent intrusions by blocking suspicious activity before it becomes malicious. It operates by analyzing user behavior and blocking activities that deviate from normal patterns.

A security approach that identifies potential intrusions by detecting deviations from normal network behavior. It relies on establishing baseline patterns of normal activity and flagging any significant departures.

A technique used in anomaly detection that sets limits for acceptable network activity. Any behavior that exceeds these limits triggers an alert, suggesting a potential security breach.

A method for detecting anomalies by analyzing system-wide resource utilization. It creates profiles of typical resource usage and identifies any significant deviations as potential threats.

A technique for anomaly detection that establishes profiles of typical user or group activities. Any behaviors that fall outside these profiles are considered suspicious.

A method that monitors the resource use of programs to detect malware attacks. It analyzes how programs utilize system resources and flags any abnormal resource consumption as potentially malicious.

A security system that monitors network traffic in real-time for malicious activities. It analyzes network packets for suspicious patterns or known attack signatures.

A type of intrusion detection technique that identifies known malicious patterns in network packets. These patterns are like unique fingerprints of known attacks.

A type of intrusion detection technique that monitors network traffic to see if it's attempting to access known vulnerable ports. These ports are often exploited by attackers to gain unauthorized access.

A type of intrusion detection technique that analyzes the headers of network packets for suspicious patterns. Attackers often try to manipulate packet headers to deceive security systems.

A popular, open-source intrusion detection system (IDS) available on various platforms. It can monitor network traffic for suspicious patterns and potential attacks.

A mode in Snort where it passively captures all network traffic on a system to analyze it. Useful for identifying potential security threats or observing encrypted traffic.

A mode in Snort where it records all captured network traffic into a file. Useful for analyzing patterns or searching for specific activities.

A mode in Snort where it actively analyzes network traffic for suspicious activity based on predefined rules. When a rule is triggered, Snort can issue alerts or take further actions.

A decoy system designed to attract and trap attackers. It's set up to appear as a valuable target, but it's actually a controlled environment where attacker actions are monitored and analyzed.

A structured process for handling and responding to security incidents. It involves detecting incidents, assessing their impact, coordinating response actions, and learning from the experience.