10 Questions
Match the following security measures with their primary function:
Firewalls = Blocking unauthorized access to the network IDS = Verifying compliance with firewall rules and router access control lists Routers = Preventing downloads of executable files DMZs = Identifying vulnerabilities in perimeter protection devices
Match the following security tools with their primary advantage:
IDS = Detecting external hackers and internal network-based attacks Firewalls = Providing centralized management for correlation of distributed attacks Routers = Enforcing security policies for unauthorized Internet access Switches = Scalability to provide protection for the entire network
Match the following security concerns with their primary limitation:
IDS = Generating false positives and negatives Firewalls = Requiring complex incident response process Routers = Unable to monitor traffic at higher network traffic rates Switches = Requiring full-time monitoring and highly skilled staff
Match the following security measures with their primary application:
IDS = Computer forensics and incident handling efforts Firewalls = Enforcing security policies for file sharing programs Routers = Verifying compliance with router access control lists DMZs = Identifying vulnerabilities in perimeter protection devices
Match the following security benefits with their primary consequence:
Defense in depth = Providing an additional layer of protection Centralized management = Correlating distributed attacks Quantifying attacks = Giving administrators the ability to analyze data Scalability = Protecting the entire network
Match the following security limitations with their primary impact:
Expensive = Higher costs for network security Generates false positives and negatives = Difficulty in incident response Reacts to attacks rather than preventing them = Inadequate protection against attacks Requires complex incident response process = Increased response time
Match the following security tools with their primary application:
IDS = Verifying compliance with firewall rules and router access control lists Firewalls = Blocking unauthorized access to the network Routers = Identifying vulnerabilities in perimeter protection devices Switches = Enforcing security policies for Instant Messenger use
Match the following security measures with their primary limitation:
IDS = Cannot monitor traffic at higher network traffic rates Firewalls = Requiring full-time monitoring and highly skilled staff Routers = Generating false positives and negatives Switches = Unable to deal with encrypted network traffic
Match the following security benefits with their primary consequence:
Scales easily = Protecting the entire network Provides defense in depth = Adding an additional layer of protection Offers centralized management = Correlating distributed attacks Gives administrators the ability to quantify attacks = Analyzing data
Match the following security concerns with their primary impact:
Cannot deal with encrypted network traffic = Inadequate protection against encrypted attacks Requiring full-time monitoring and highly skilled staff = Difficulty in incident response Generating false positives and negatives = Inadequate attack detection Reacts to attacks rather than preventing them = Inadequate protection against attacks
Study Notes
Zero-Day Exploits
- A zero-day attack is a computer attack that tries to exploit software vulnerabilities.
- Zero-hour describes the moment when the exploit is discovered.
Protecting Against Zero-Day Attacks
- Anti-virus software and firewall features are not enough to stop zero-day attacks.
- Manually analyzing log files is a time-consuming task that provides a limited view of the attacks being launched.
Intrusion Detection Systems (IDS)
- IDS are tools, methods, and resources to help identify, assess, and report unauthorized or unapproved network activity.
- IDS can detect and deal with insider attacks, as well as external attacks.
- IDS are useful in detecting violations of corporate security policy and other internal threats.
Functions of IDS
- Collect information from various system and network sources.
- Analyze collected data to detect activity that may constitute an attack or intrusion on the system.
- Allow system managers to more easily handle the monitoring, audit, and assessment of their systems and networks.
Types of IDS
- Host-Based IDS: installed on a single system or host, collects information about activity on the system.
- Network-Based IDS: collects information from the network itself, operates on a "wiretapping concept".
Host-Based IDS
- Installed on servers, focused on analyzing specific operating systems and applications, resource utilization, and system activity.
- Logs activities to a secure database and checks for malicious events.
Network-Based IDS
- Collects information from network traffic stream, inspects packet contents and headers for attacks or irregular behavior.
How IDS Works
- IDS sensor deployed in IDS mode receives copies of all packets to analyze for malicious traffic.
- IDS sensor matches malicious traffic to a signature.
Signature Trigger
- Signature-based (misuse) intrusion detection: detects patterns typical of a network intrusion.
- Profile-based (anomaly) intrusion detection: detects activity that deviates from "normal" activity.
Pattern Matching
- Looks for a fixed sequence of bytes within a single packet.
- Often associated with a particular service and source or destination port.
Stateful Pattern Matching
- Searches for unique sequences that might be distributed across several packets within a stream.
- More specific than pattern matching, but still vulnerable to false positives.
Heuristic-Based Analysis
- Uses an algorithm to determine whether an alarm should be fired.
- Example: fires an alarm if a threshold number of unique ports are scanned on a particular host.
Importance of IDS
- IDS can alert administrators of a successful compromise, allowing them to implement mitigating actions before further damage is caused.
- IDS can help companies avoid legal and reputational damage from data breaches.
IDS in Security Plan
- IDS is a great addition to a layered security plan.
- IDS can identify vulnerabilities and weaknesses in perimeter protection devices.
- IDS logs can be used as evidence in computer forensics and incident handling efforts.
Pros and Cons of IDS
- Pros: detects external and internal attacks, scales easily, offers centralized management, provides defense in depth, and gives administrators a way to quantify attacks.
- Cons: generates false positives and negatives, reacts to attacks rather than preventing them, requires full-time monitoring and skilled staff, and generates an enormous amount of data to be analyzed.
Learn about zero-day attacks, how they spread, and ways to protect against them. Discover why firewalls are not enough and what measures you can take to safeguard your computer.
Make Your Own Quizzes and Flashcards
Convert your notes into interactive study material.
Get started for free
