Network Segmentation and Security

Network Security

• A properly laid out network can prevent some attacks, mitigate others, and fail in a graceful way when necessary.
• Network segmentation can reduce the impact of attacks by dividing a network into smaller subnets, controlling traffic flow between them, and blocking traffic when necessary.

Choke Points

• Choke points are points in the network where traffic is funneled through to inspect, filter, and control traffic.
• Examples of choke points include routers, firewalls, proxies, and application proxies.

Firewalls

• A firewall is a mechanism for controlling traffic that flows into and out of a network.
• Firewalls can allow or disallow traffic based on protocol, allowing Web and e-mail traffic to pass while blocking everything else.

Personal Firewall

• A personal firewall is a lightweight software that controls network traffic to and from a computer, permitting or denying communications based on a security policy.
• Personal firewalls typically work as an application-layer firewall and only protect the computer on which they are installed.

DMZs

• A DMZ (demilitarized zone) is a combination of a network design feature and a protective device, such as a firewall.
• DMZs are used to protect devices that need to be exposed to external networks, such as mail servers, proxy servers, and Web servers.

Network Intrusion Detection Systems

• IDSes monitor networks, hosts, or applications for unauthorized activity.
• There are three types of IDSes: Host-based intrusion detection systems (HIDSes), Application protocol-based intrusion detection systems (APIDSes), and Network-based intrusion detection systems (NIDSes).

IDS Detection Methods

• IDSes are classified into two main categories: signature-based detection and anomaly-based detection.
• Signature-based detection works by comparing incoming traffic to a database of known attack signatures.
• Anomaly-based detection works by taking a baseline of normal traffic and measuring the present state of traffic against it to detect patterns that are not present in normal traffic.

Secure Protocols

• Secure protocols can protect data by using secure equivalents of insecure protocols.
• Examples of secure protocols include Secure Shell (SSH) instead of Telnet, and Secure File Transfer Protocol (SFTP) instead of FTP.

Network Security Tools

• Network security tools can improve network security and are often the same as those used by attackers.
• Examples of security tools include Kismet, coWPAtty, and Aircrack-NG for wireless, Nmap for port scanning, HPing3 for firewall tools, and Tcpdump, WinDump, and OptiView for packet sniffers.

Honeypot

• Honeypots are a controversial tool that can detect, monitor, and sometimes tamper with the activities of an attacker.
• Honeypots are configured to deliberately display vulnerabilities or materials that would make the system attractive to an attacker.