Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security

Size: px
Start display at page:

Download "Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security"

Transcription

1 Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security

2 Objectives List the different types of network security devices and explain how they can be used Define network address translation and network access control Explain how to enhance security through network design Security+ Guide to Network Security Fundamentals, Fourth Edition 2

3 Security Through Network Devices Not all applications designed, written with security in mind Network must provide protection Networks with weak security invite attackers Aspects of building a secure network Network devices Network technologies Design of the network itself Security+ Guide to Network Security Fundamentals, Fourth Edition 3

4 Standard Network Devices Security features found in network hardware Provide basic level of security Open systems interconnection (OSI) model Network devices classified based on function Standards released in 1978, revised in 1983, still used today Illustrates: How network device prepares data for delivery How data is handled once received Security+ Guide to Network Security Fundamentals, Fourth Edition 4

5 Standard Network Devices (cont d.) OSI model breaks networking steps into seven layers Each layer has different networking tasks Each layer cooperates with adjacent layers Security+ Guide to Network Security Fundamentals, Fourth Edition 5

6 Table 6-1 OSI reference model Security+ Guide to Network Security Fundamentals, Fourth Edition 6

7 Standard Network Devices (cont d.) Hubs Connect multiple Ethernet devices together: To function as a single network segment Use twisted-pair copper or fiber-optic cables Work at Layer 1 of the OSI model Do not read data passing through them Ignorant of data source and destination Rarely used today because of inherent security vulnerability Security+ Guide to Network Security Fundamentals, Fourth Edition 7

8 Standard Network Devices (cont d.) Switches Network switch connects network segments Operate at Data Link Layer (Layer 2) Determine which device is connected to each port Can forward frames sent to that specific device Or broadcast to all devices Use MAC address to identify devices Provide better security than hubs Security+ Guide to Network Security Fundamentals, Fourth Edition 8

9 Standard Network Devices (cont d.) Network administrator should be able to monitor network traffic Helps identify and troubleshoot network problems Traffic monitoring methods Port mirroring Network tap (test access point) Separate device installed between two network devices Security+ Guide to Network Security Fundamentals, Fourth Edition 9

10 Figure 6-1 Port mirroring Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 10

11 Figure 6-2 Network tap Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 11

12 Table 6-2 Protecting the switch Security+ Guide to Network Security Fundamentals, Fourth Edition 12

13 Standard Network Devices (cont d.) Routers Forward packets across computer networks Operate at Network Layer (Layer 3) Can be set to filter out specific types of network traffic Load balancers Help evenly distribute work across a network Allocate requests among multiple devices Security+ Guide to Network Security Fundamentals, Fourth Edition 13

14 Standard Network Devices (cont d.) Advantages of load-balancing technology Reduces probability of overloading a single server Optimizes bandwidth of network computers Reduces network downtime Load balancing is achieved through software or hardware device (load balancer) Security+ Guide to Network Security Fundamentals, Fourth Edition 14

15 Standard Network Devices (cont d.) Security advantages of load balancing Can stop attacks directed at a server or application Can detect and prevent denial-of-service attacks Some can deny attackers information about the network Hide HTTP error pages Remove server identification headers from HTTP responses Security+ Guide to Network Security Fundamentals, Fourth Edition 15

16 Network Security Hardware Specifically designed security hardware devices Greater protection than standard networking devices Firewalls Hardware-based network firewall inspects packets Can either accept or deny packet entry Usually located outside network security perimeter Security+ Guide to Network Security Fundamentals, Fourth Edition 16

17 Figure 6-3 Firewall location Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 17

18 Network Security Hardware (cont d.) Firewall actions on a packet Allow (let packet pass through) Block (drop packet) Prompt (ask what action to take) Rule-based firewall settings Set of individual instructions to control actions Settings-based firewall Allows administrator to create parameters Security+ Guide to Network Security Fundamentals, Fourth Edition 18

19 Table 6-3 Rule for Web page transmission Security+ Guide to Network Security Fundamentals, Fourth Edition 19

20 Network Security Hardware (cont d.) Methods of firewall packet filtering Stateless packet filtering Inspects incoming packet and permits or denies based on conditions set by administrator Stateful packet filtering Keeps record of state of connection Makes decisions based on connection and conditions Security+ Guide to Network Security Fundamentals, Fourth Edition 20

21 Network Security Hardware (cont d.) Web application firewall Looks deeply into packets that carry HTTP traffic Web browsers FTP Telnet Can block specific sites or specific known attacks Can block XSS and SQL injection attacks Security+ Guide to Network Security Fundamentals, Fourth Edition 21

22 Network Security Hardware (cont d.) Proxies Devices that substitute for primary devices Proxy server Computer or application that intercepts and processes user requests If a previous request has been fulfilled: Copy of the Web page may reside in proxy server s cache If not, proxy server requests item from external Web server using its own IP address Security+ Guide to Network Security Fundamentals, Fourth Edition 22

23 Figure 6-4 Proxy server Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 23

24 Figure 6-5 Configuring access to proxy servers Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 24

25 Network Security Hardware (cont d.) Proxy server advantages Increased speed (requests served from the cache) Reduced costs (cache reduces bandwidth required) Improved management Block specific Web pages or sites Stronger security Intercept malware Hide client system s IP address from the open Internet Security+ Guide to Network Security Fundamentals, Fourth Edition 25

26 Network Security Hardware (cont d.) Reverse proxy Does not serve clients Routes incoming requests to correct server Reverse proxy s IP address is visible to outside users Internal server s IP address hidden Security+ Guide to Network Security Fundamentals, Fourth Edition 26

27 Figure 6-6 Reverse proxy Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 27

28 Network Security Hardware (cont d.) Spam filters Enterprise-wide spam filters block spam before it reaches the host systems use two protocols Simple Mail Transfer Protocol (SMTP) Handles outgoing mail Post Office Protocol (POP) Handles incoming mail Security+ Guide to Network Security Fundamentals, Fourth Edition 28

29 Network Security Hardware (cont d.) Spam filters installed with the SMTP server Filter configured to listen on port 25 Pass non-spam to SMTP server listening on another port Method prevents SMTP server from notifying spammer of failed message delivery Security+ Guide to Network Security Fundamentals, Fourth Edition 29

30 Figure 6-7 Spam filter with SMTP server Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 30

31 Network Security Hardware (cont d.) Spam filters installed on the POP3 server All spam must first pass through SMTP server and be delivered to user s mailbox Can result in increased costs Storage, transmission, backup, deletion Third-party entity contracted to filter spam All directed to third-party s remote spam filter cleansed before being redirected to organization Security+ Guide to Network Security Fundamentals, Fourth Edition 31

32 Figure 6-8 Spam filter on POP3 server Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 32

33 Network Security Hardware (cont d.) Virtual private network (VPN) Uses unsecured network as if it were secure All data transmitted between remote device and network is encrypted Types of VPNs Remote-access User to LAN connection Site-to-site Multiple sites can connect to other sites over the Internet Security+ Guide to Network Security Fundamentals, Fourth Edition 33

34 Network Security Hardware (cont d.) Endpoints Used in communicating VPN transmissions May be software on local computer May be VPN concentrator (hardware device) May be integrated into another networking device VPNs can be software-based or hardware-based Hardware-based generally have better security Software-based have more flexibility in managing network traffic Security+ Guide to Network Security Fundamentals, Fourth Edition 34

35 Network Security Hardware (cont d.) Internet content filters Monitor Internet traffic Block access to preselected Web sites and files Unapproved sites identified by URL or matching keywords Security+ Guide to Network Security Fundamentals, Fourth Edition 35

36 Table 6-4 Internet content filter features Security+ Guide to Network Security Fundamentals, Fourth Edition 36

37 Network Security Hardware (cont d.) Web security gateways Can block malicious content in real time Block content through application level filtering Examples of blocked Web traffic ActiveX objects Adware, spyware Peer to peer file sharing Script exploits Security+ Guide to Network Security Fundamentals, Fourth Edition 37

38 Network Security Hardware (cont d.) Passive and active security can be used in a network Active measures provide higher level of security Passive measures Firewall Internet content filter Intrusion detection system (IDS) Active security measure Can detect attack as it occurs Security+ Guide to Network Security Fundamentals, Fourth Edition 38

39 Network Security Hardware (cont d.) Monitoring methodologies Anomaly-based monitoring Compares current detected behavior with baseline Signature-based monitoring Looks for well-known attack signature patterns Behavior-based monitoring Detects abnormal actions by processes or programs Alerts user who decides whether to allow or block activity Heuristic monitoring Uses experience-based techniques Security+ Guide to Network Security Fundamentals, Fourth Edition 39

40 Table 6-5 Methodology comparisons to trap port-scanning application Security+ Guide to Network Security Fundamentals, Fourth Edition 40

41 Network Security Hardware (cont d.) Host intrusion detection system (HIDS) Software-based application that can detect attack as it occurs Installed on each system needing protection Monitors system calls and file system access Can recognize unauthorized Registry modification Monitors all input and output communications Detects anomalous activity Security+ Guide to Network Security Fundamentals, Fourth Edition 41

42 Network Security Hardware (cont d.) Disadvantages of HIDS Cannot monitor network traffic that does not reach local system All log data is stored locally Resource-intensive and can slow system Security+ Guide to Network Security Fundamentals, Fourth Edition 42

43 Network Security Hardware (cont d.) Network intrusion detection system (NIDS) Watches for attacks on the network NIDS sensors installed on firewalls and routers: Gather information and report back to central device Passive NIDS will sound an alarm Active NIDS will sound alarm and take action Actions may include filtering out intruder s IP address or terminating TCP session Security+ Guide to Network Security Fundamentals, Fourth Edition 43

44 Table 6-6 NIDS evaluation techniques Security+ Guide to Network Security Fundamentals, Fourth Edition 44

45 Network Security Hardware (cont d.) Network intrusion prevention system (NIPS) Similar to active NIDS Monitors network traffic to immediately block a malicious attack NIPS sensors located in line on firewall itself Security+ Guide to Network Security Fundamentals, Fourth Edition 45

46 Network Security Hardware (cont d.) All-in-one network security appliances One integrated device replaces multiple security devices Recent trend: Combining multipurpose security appliances with traditional device such as a router Advantage of approach Network devices already process all packets Switch that contains anti-malware software can inspect all packets Security+ Guide to Network Security Fundamentals, Fourth Edition 46

47 Security Through Network Technologies Internet routers normally drop packet with a private address Network address translation (NAT) Allows private IP addresses to be used on the public Internet Replaces private IP address with public address Port address translation (PAT) Variation of NAT Outgoing packets given same IP address but different TCP port number Security+ Guide to Network Security Fundamentals, Fourth Edition 47

48 Table 6-7 Private IP addresses Figure 6-9 Network address translation (NAT) Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 48

49 Security Through Network Advantages of NAT Technologies (cont d.) Masks IP addresses of internal devices Allows multiple devices to share smaller number of public IP addresses Network access control Examines current state of system or network device: Before allowing network connection Device must meet set of criteria If not met, NAC allows connection to quarantine network until deficiencies corrected Security+ Guide to Network Security Fundamentals, Fourth Edition 49

50 Figure 6-10 Network access control framework Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 50

51 Security Through Network Design Elements Elements of a secure network design Demilitarized zones Subnetting Virtual LANs Remote access Security+ Guide to Network Security Fundamentals, Fourth Edition 51

52 Demilitarized Zone (DMZ) Separate network located outside secure network perimeter Untrusted outside users can access DMZ but not secure network Security+ Guide to Network Security Fundamentals, Fourth Edition 52

53 Figure 6-11 DMZ with one firewall Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 53

54 Figure 6-12 DMZ with two firewalls Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 54

55 Subnetting IP address may be split anywhere within its 32 bits Network can be divided into three parts Network Subnet Host Each network can contain several subnets Each subnet can contain multiple hosts Security+ Guide to Network Security Fundamentals, Fourth Edition 55

56 Subnetting (cont d.) Improves network security by isolating groups of hosts Allows administrators to hide internal network layout Security+ Guide to Network Security Fundamentals, Fourth Edition 56

57 Table 6-8 Advantages of subnetting Security+ Guide to Network Security Fundamentals, Fourth Edition 57

58 Figure 6-13 Subnets Cengage Learning 2012 Security+ Guide to Network Security Fundamentals, Fourth Edition 58

59 Virtual LANs (VLAN) Allow scattered users to be logically grouped together: Even if attached to different switches Can isolate sensitive data to VLAN members Communication on a VLAN If connected to same switch, switch handles packet transfer Special tagging protocol used for communicating between switches Security+ Guide to Network Security Fundamentals, Fourth Edition 59

60 Remote Access Working away from the office commonplace today Telecommuters Traveling sales representatives Traveling workers Strong security for remote workers must be maintained Transmissions are routed through networks not managed by the organization Provides same functionality as local users Through VPN or dial-up connection Security+ Guide to Network Security Fundamentals, Fourth Edition 60

61 Summary Standard network security devices provide a degree of security Hubs, switches, router, load balancer Hardware devices specifically designed for security give higher protection level Hardware-based firewall, Web application firewall Proxy server intercepts and processes user requests Virtual private network uses unsecured public network and encryption to provide security Security+ Guide to Network Security Fundamentals, Fourth Edition 61

62 Summary (cont d.) Intrusion detection system designed to detect attack as it occurs Network technologies can help secure a network Network address translation Network access control Methods for designing a secure network Demilitarized zones Virtual LANs Security+ Guide to Network Security Fundamentals, Fourth Edition 62

Tutorial 3. June 8, 2015

Tutorial 3. June 8, 2015 Tutorial 3 June 8, 2015 I. Basic Notions 1. Multiple-choice (Review Questions Chapter 6, 8 and 11) 2. Answers by a small paragraph (Chapter 2: viruses: MBR, rootkits, ) Multiple choice X. Which is the

More information

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.

A host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection. A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based

More information

Training Course on Network Administration

Training Course on Network Administration Training Course on Network Administration 03-07, March 2014 National Centre for Physics 1 Network Security and Monitoring 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 2 Crafting a Secure

More information

Firewalls and VPNs. Principles of Information Security, 5th Edition 1

Firewalls and VPNs. Principles of Information Security, 5th Edition 1 Firewalls and VPNs Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to: Understand firewall technology and the various approaches

More information

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA

JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA JK0-022 CompTIA Academic/E2C Security+ Certification Exam CompTIA To purchase Full version of Practice exam click below; http://www.certshome.com/jk0-022-practice-test.html FOR CompTIA JK0-022 Exam Candidates

More information

Security Technology: Firewalls and VPNs

Security Technology: Firewalls and VPNs Security Technology: Firewalls and VPNs 1 Learning Objectives Understand firewall technology and the various approaches to firewall implementation Identify the various approaches to remote and dial-up

More information

Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1

Computer Security CS 426 Lecture 36. CS426 Fall 2010/Lecture 36 1 Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls CS426 Fall 2010/Lecture 36 1 Announcements There will be a quiz on Wed There will be a guest lecture on Friday, by Prof. Chris Clifton

More information

INTRUSION DETECTION SYSTEMS and Network Security

INTRUSION DETECTION SYSTEMS and Network Security INTRUSION DETECTION SYSTEMS and Network Security Intrusion Detection System IDS A layered network security approach starts with : A well secured system which starts with: Up-to-date application and OS

More information

http://www.it-exams.com

http://www.it-exams.com -The fastest and guaranteed way to certy now! http://www.it-exams.com Exam Number : SY0-301 Exam Name : Security+ Certification Exam 2011 version Version : Demo QUESTION NO: 1 Actively monitoring data

More information

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design

FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 5 Firewall Planning and Design Learning Objectives Identify common misconceptions about firewalls Explain why a firewall

More information

Proxy Server, Network Address Translator, Firewall. Proxy Server

Proxy Server, Network Address Translator, Firewall. Proxy Server Proxy Server, Network Address Translator, Firewall 1 Proxy Server 2 1 Introduction What is a proxy server? Acts on behalf of other clients, and presents requests from other clients to a server. Acts as

More information

Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion

Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann

More information

Chapter 9 Firewalls and Intrusion Prevention Systems

Chapter 9 Firewalls and Intrusion Prevention Systems Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish

More information

FIREWALLS & CBAC. philip.heimer@hh.se

FIREWALLS & CBAC. philip.heimer@hh.se FIREWALLS & CBAC philip.heimer@hh.se Implementing a Firewall Personal software firewall a software that is installed on a single PC to protect only that PC All-in-one firewall can be a single device that

More information

Overview. Firewall Security. Perimeter Security Devices. Routers

Overview. Firewall Security. Perimeter Security Devices. Routers Overview Firewall Security Chapter 8 Perimeter Security Devices H/W vs. S/W Packet Filtering vs. Stateful Inspection Firewall Topologies Firewall Rulebases Lecturer: Pei-yih Ting 1 2 Perimeter Security

More information

Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)

Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015) s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware

More information

Firewall Security. Presented by: Daminda Perera

Firewall Security. Presented by: Daminda Perera Firewall Security Presented by: Daminda Perera 1 Firewalls Improve network security Cannot completely eliminate threats and a=acks Responsible for screening traffic entering and/or leaving a computer network

More information

PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES

PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES PROTECTING INFORMATION SYSTEMS WITH FIREWALLS: REVISED GUIDELINES ON FIREWALL TECHNOLOGIES AND POLICIES Shirley Radack, Editor Computer Security Division Information Technology Laboratory National Institute

More information

INTRODUCTION TO FIREWALL SECURITY

INTRODUCTION TO FIREWALL SECURITY INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ

More information

Firewall VPN Router. Quick Installation Guide M73-APO09-380

Firewall VPN Router. Quick Installation Guide M73-APO09-380 Firewall VPN Router Quick Installation Guide M73-APO09-380 Firewall VPN Router Overview The Firewall VPN Router provides three 10/100Mbit Ethernet network interface ports which are the Internal/LAN, External/WAN,

More information

DMZ Network Visibility with Wireshark June 15, 2010

DMZ Network Visibility with Wireshark June 15, 2010 DMZ Network Visibility with Wireshark June 15, 2010 Ashok Desai Senior Network Specialist Intel Information Technology SHARKFEST 10 Stanford University June 14-17, 2010 Outline Presentation Objective DMZ

More information

CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security

CTS2134 Introduction to Networking. Module 8.4 8.7 Network Security CTS2134 Introduction to Networking Module 8.4 8.7 Network Security Switch Security: VLANs A virtual LAN (VLAN) is a logical grouping of computers based on a switch port. VLAN membership is configured by

More information

What is a Firewall? Computer Security. Firewalls. What is a Firewall? What is a Firewall?

What is a Firewall? Computer Security. Firewalls. What is a Firewall? What is a Firewall? What is a Firewall? Computer Security Firewalls fire wall 1 : a wall constructed to prevent the spread of fire 2 usually firewall : a computer or computer software that prevents unauthorized access to

More information

CMPT 471 Networking II

CMPT 471 Networking II CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access

More information

ΕΠΛ 674: Εργαστήριο 5 Firewalls

ΕΠΛ 674: Εργαστήριο 5 Firewalls ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized

More information

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with

More information

Security Awareness. Wireless Network Security

Security Awareness. Wireless Network Security Security Awareness Wireless Network Security Attacks on Wireless Networks Three-step process Discovering the wireless network Connecting to the network Launching assaults Security Awareness, 3 rd Edition

More information

Firewalls, IDS and IPS

Firewalls, IDS and IPS Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not

More information

Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Firewall

Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme. Firewall Chapter 2: Security Techniques Background Chapter 3: Security on Network and Transport Layer Chapter 4: Security on the Application Layer Chapter 5: Security Concepts for Networks Firewalls Intrusion Detection

More information

Chapter 15. Firewalls, IDS and IPS

Chapter 15. Firewalls, IDS and IPS Chapter 15 Firewalls, IDS and IPS Basic Firewall Operation The firewall is a border firewall. It sits at the boundary between the corporate site and the external Internet. A firewall examines each packet

More information

NETWORK SECURITY. Ch. 8: Defense Mechanism - Firewall

NETWORK SECURITY. Ch. 8: Defense Mechanism - Firewall NETWORK SECURITY Ch. 8: Defense Mechanism - Firewall Firewall A firewall is a hardware, software, or a combination of both that monitors and filters traffic packets that attempt to either enter or leave

More information

Cornerstones of Security

Cornerstones of Security Internet Security Cornerstones of Security Authenticity the sender (either client or server) of a message is who he, she or it claims to be Privacy the contents of a message are secret and only known to

More information

Architecture Overview

Architecture Overview Architecture Overview Design Fundamentals The networks discussed in this paper have some common design fundamentals, including segmentation into modules, which enables network traffic to be isolated and

More information

Multi-Homing Dual WAN Firewall Router

Multi-Homing Dual WAN Firewall Router Multi-Homing Dual WAN Firewall Router Quick Installation Guide M73-APO09-400 Multi-Homing Dual WAN Firewall Router Overview The Multi-Homing Dual WAN Firewall Router provides three 10/100Mbit Ethernet

More information

Firewalls, Tunnels, and Network Intrusion Detection

Firewalls, Tunnels, and Network Intrusion Detection Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls

More information

Networking Devices. Lesson 6

Networking Devices. Lesson 6 Networking Devices Lesson 6 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Network Interface Cards Modems Media Converters Repeaters and Hubs Bridges and

More information

Internet Services & Protocols

Internet Services & Protocols Department of Computer Science Institute for System Architecture, Chair for Computer Networks Internet Services & Protocols Internet (In)Security Dr.-Ing. Stephan Groß Room: INF 3099 E-Mail: stephan.gross@tu-dresden.de

More information

Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN

Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts

More information

ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science

ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized Internet users

More information

SFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004

SFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004 SFWR ENG 4C03 Class Project Firewall Design Principals Arash Kamyab 9940313 March 04, 2004 Introduction: A computer firewall protects computer networks from unwanted intrusions which could compromise confidentiality

More information

8. Firewall Design & Implementation

8. Firewall Design & Implementation DMZ Networks The most common firewall environment implementation is known as a DMZ, or DeMilitarized Zone network. A DMZ network is created out of a network connecting two firewalls; i.e., when two or

More information

VIDEO intypedia005en LESSON 5: NETWORK PERIMETER SECURITY. AUTHOR: Alejandro Ramos Fraile

VIDEO intypedia005en LESSON 5: NETWORK PERIMETER SECURITY. AUTHOR: Alejandro Ramos Fraile VIDEO intypedia005en LESSON 5: NETWORK PERIMETER SECURITY AUTHOR: Alejandro Ramos Fraile Tiger Team Manager (SIA company). Security Consulting (CISSP, CISA) Hello and welcome to Intypedia. Today we are

More information

Advanced Higher Computing. Computer Networks. Homework Sheets

Advanced Higher Computing. Computer Networks. Homework Sheets Advanced Higher Computing Computer Networks Homework Sheets Topic : Network Protocols and Standards. Name the organisation responsible for setting international standards and explain why network standards

More information

Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA

Firewalls. Securing Networks. Chapter 3 Part 1 of 4 CA M S Mehta, FCA Firewalls Securing Networks Chapter 3 Part 1 of 4 CA M S Mehta, FCA 1 Firewalls Learning Objectives Task Statements 1.3 Recognise function of Telecommunications and Network security including firewalls,..

More information

Chapter 4: Security of the architecture, and lower layer security (network security) 1

Chapter 4: Security of the architecture, and lower layer security (network security) 1 Chapter 4: Security of the architecture, and lower layer security (network security) 1 Outline Security of the architecture Access control Lower layer security Data link layer VPN access Wireless access

More information

Firewall Introduction Several Types of Firewall. Cisco PIX Firewall

Firewall Introduction Several Types of Firewall. Cisco PIX Firewall Firewall Introduction Several Types of Firewall. Cisco PIX Firewall What is a Firewall? Non-computer industries: a wall that controls the spreading of a fire. Networks: a designed device that controls

More information

Security Design. thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/

Security Design. thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/ Security Design thm@informatik.uni-rostock.de http://wwwiuk.informatik.uni-rostock.de/ Content Security Design Analysing Design Requirements Resource Separation a Security Zones VLANs Tuning Load Balancing

More information

Introduction of Intrusion Detection Systems

Introduction of Intrusion Detection Systems Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:

More information

CS5008: Internet Computing

CS5008: Internet Computing CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is

More information

Lesson 5: Network perimeter security

Lesson 5: Network perimeter security Lesson 5: Network perimeter security Alejandro Ramos Fraile aramosf@sia.es Tiger Team Manager (SIA company) Security Consulting (CISSP, CISA) Perimeter Security The architecture and elements that provide

More information

INTERNET SECURITY: THE ROLE OF FIREWALL SYSTEM

INTERNET SECURITY: THE ROLE OF FIREWALL SYSTEM INTERNET SECURITY: THE ROLE OF FIREWALL SYSTEM Okumoku-Evroro Oniovosa Lecturer, Department of Computer Science Delta State University, Abraka, Nigeria Email: victorkleo@live.com ABSTRACT Internet security

More information

Firewall Architecture

Firewall Architecture NEXTEP Broadband White Paper Firewall Architecture Understanding the purpose of a firewall when connecting to ADSL network services. A Nextep Broadband White Paper June 2001 Firewall Architecture WHAT

More information

Firewalls, Tunnels, and Network Intrusion Detection. Firewalls

Firewalls, Tunnels, and Network Intrusion Detection. Firewalls Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.

More information

Lab 8.4.2 Configuring Access Policies and DMZ Settings

Lab 8.4.2 Configuring Access Policies and DMZ Settings Lab 8.4.2 Configuring Access Policies and DMZ Settings Objectives Log in to a multi-function device and view security settings. Set up Internet access policies based on IP address and application. Set

More information

Implementing Network Address Translation and Port Redirection in epipe

Implementing Network Address Translation and Port Redirection in epipe Implementing Network Address Translation and Port Redirection in epipe Contents 1 Introduction... 2 2 Network Address Translation... 2 2.1 What is NAT?... 2 2.2 NAT Redirection... 3 2.3 Bimap... 4 2.4

More information

Network Access Security. Lesson 10

Network Access Security. Lesson 10 Network Access Security Lesson 10 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Firewalls Given a scenario, install and configure routers and switches.

More information

CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013

CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013 CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access

More information

Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding

Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding This chapter describes the configuration for the SSL VPN Tunnel Client and for Port Forwarding. When a remote user accesses the SSL VPN

More information

Network Security Topologies. Chapter 11

Network Security Topologies. Chapter 11 Network Security Topologies Chapter 11 Learning Objectives Explain network perimeter s importance to an organization s security policies Identify place and role of the demilitarized zone in the network

More information

Basic Network Configuration

Basic Network Configuration Basic Network Configuration 2 Table of Contents Basic Network Configuration... 25 LAN (local area network) vs WAN (wide area network)... 25 Local Area Network... 25 Wide Area Network... 26 Accessing the

More information

Firewalls. Chapter 3

Firewalls. Chapter 3 Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border

More information

Lecture 23: Firewalls

Lecture 23: Firewalls Lecture 23: Firewalls Introduce several types of firewalls Discuss their advantages and disadvantages Compare their performances Demonstrate their applications C. Ding -- COMP581 -- L23 What is a Digital

More information

Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100

Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100 Information Technology Career Cluster Introduction to Cybersecurity Course Number: 11.48100 Course Description: Introduction to Cybersecurity is designed to provide students the basic concepts and terminology

More information

VLAN 802.1Q. 1. VLAN Overview. 1. VLAN Overview. 2. VLAN Trunk. 3. Why use VLANs? 4. LAN to LAN communication. 5. Management port

VLAN 802.1Q. 1. VLAN Overview. 1. VLAN Overview. 2. VLAN Trunk. 3. Why use VLANs? 4. LAN to LAN communication. 5. Management port 1. VLAN Overview 2. VLAN Trunk 3. Why use VLANs? 4. LAN to LAN communication 5. Management port 6. Applications 6.1. Application 1 6.2. Application 2 6.3. Application 3 6.4. Application 4 6.5. Application

More information

Deploying Firewalls Throughout Your Organization

Deploying Firewalls Throughout Your Organization Deploying Firewalls Throughout Your Organization Avoiding break-ins requires firewall filtering at multiple external and internal network perimeters. Firewalls have long provided the first line of defense

More information

Network Agent Quick Start

Network Agent Quick Start Network Agent Quick Start Topic 50500 Network Agent Quick Start Updated 17-Sep-2013 Applies To: Web Filter, Web Security, Web Security Gateway, and Web Security Gateway Anywhere, v7.7 and 7.8 Websense

More information

REDCENTRIC MANAGED FIREWALL SERVICE DEFINITION

REDCENTRIC MANAGED FIREWALL SERVICE DEFINITION REDCENTRIC MANAGED FIREWALL SERVICE DEFINITION SD007 V4.1 Issue Date 04 July 2014 1) SERVICE OVERVIEW 1.1) SERVICE OVERVIEW Redcentric s managed firewall service (MFS) is based on a hardware firewall appliance

More information

Figure 41-1 IP Filter Rules

Figure 41-1 IP Filter Rules 41. Firewall / IP Filter This function allows user to enable the functionality of IP filter. Both inside and outside packets through router could be decided to allow or drop by supervisor. Figure 41-1

More information

IBM. Vulnerability scanning and best practices

IBM. Vulnerability scanning and best practices IBM Vulnerability scanning and best practices ii Vulnerability scanning and best practices Contents Vulnerability scanning strategy and best practices.............. 1 Scan types............... 2 Scan duration

More information

Firewall Environments. Name

Firewall Environments. Name Complliiance Componentt DEEFFI INITION Description Rationale Firewall Environments Firewall Environment is a term used to describe the set of systems and components that are involved in providing or supporting

More information

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 40 Firewalls and Intrusion

More information

We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall

We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall Chapter 10 Firewall Firewalls are devices used to protect a local network from network based security threats while at the same time affording access to the wide area network and the internet. Basically,

More information

Introduction... Error! Bookmark not defined. Intrusion detection & prevention principles... Error! Bookmark not defined.

Introduction... Error! Bookmark not defined. Intrusion detection & prevention principles... Error! Bookmark not defined. Contents Introduction... Error! Bookmark not defined. Intrusion detection & prevention principles... Error! Bookmark not defined. Technical OverView... Error! Bookmark not defined. Network Intrusion Detection

More information

ICANWK406A Install, configure and test network security

ICANWK406A Install, configure and test network security ICANWK406A Install, configure and test network security Release: 1 ICANWK406A Install, configure and test network security Modification History Release Release 1 Comments This Unit first released with

More information

Internet Security for Small to Medium Sized Businesses

Internet Security for Small to Medium Sized Businesses Internet Security for Small to Medium Sized Businesses AN INTERNET SECURITY GUIDE FOR EVERY BUSINESS DOCUMENT VERSION 1.2 - OCTOBER 2002 COMPLIMENTS OF POWERWALLZ NETWORK SECURITY INC. 3 Introduction INTERNET

More information

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1 Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3

More information

What would you like to protect?

What would you like to protect? Network Security What would you like to protect? Your data The information stored in your computer Your resources The computers themselves Your reputation You risk to be blamed for intrusions or cyber

More information

Configuring PA Firewalls for a Layer 3 Deployment

Configuring PA Firewalls for a Layer 3 Deployment Configuring PA Firewalls for a Layer 3 Deployment Configuring PAN Firewalls for a Layer 3 Deployment Configuration Guide January 2009 Introduction The following document provides detailed step-by-step

More information

A Model Design of Network Security for Private and Public Data Transmission

A Model Design of Network Security for Private and Public Data Transmission 2011, TextRoad Publication ISSN 2090-424X Journal of Basic and Applied Scientific Research www.textroad.com A Model Design of Network Security for Private and Public Data Transmission Farhan Pervez, Ali

More information

Firewalls. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49. Firewall Design Principles

Firewalls. Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49. Firewall Design Principles Firewalls Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Firewall Design Principles Firewall Characteristics Types of Firewalls Firewall Configurations

More information

PROFESSIONAL SECURITY SYSTEMS

PROFESSIONAL SECURITY SYSTEMS PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security

More information

Top-Down Network Design

Top-Down Network Design Top-Down Network Design Chapter Five Designing a Network Topology Copyright 2010 Cisco Press & Priscilla Oppenheimer Topology A map of an internetwork that indicates network segments, interconnection points,

More information

Firewalls. Ahmad Almulhem March 10, 2012

Firewalls. Ahmad Almulhem March 10, 2012 Firewalls Ahmad Almulhem March 10, 2012 1 Outline Firewalls The Need for Firewalls Firewall Characteristics Types of Firewalls Firewall Basing Firewall Configurations Firewall Policies and Anomalies 2

More information

JK0 015 CompTIA E2C Security+ (2008 Edition) Exam

JK0 015 CompTIA E2C Security+ (2008 Edition) Exam JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router

More information

Chapter 11 Cloud Application Development

Chapter 11 Cloud Application Development Chapter 11 Cloud Application Development Contents Motivation. Connecting clients to instances through firewalls. Chapter 10 2 Motivation Some of the questions of interest to application developers: How

More information

Proxy Server, Network Address Translator, Firewall

Proxy Server, Network Address Translator, Firewall For Summer Training on Computer Networking visit Proxy Server, Network Address Translator, Firewall Prepared by : Swapan Purkait Director Nettech Private Limited swapan@nettech.in + 91 93315 90003 Proxy

More information

Protecting and controlling Virtual LANs by Linux router-firewall

Protecting and controlling Virtual LANs by Linux router-firewall Protecting and controlling Virtual LANs by Linux router-firewall Tihomir Katić Mile Šikić Krešimir Šikić Faculty of Electrical Engineering and Computing University of Zagreb Unska 3, HR 10000 Zagreb, Croatia

More information

Firewalls & Intrusion Detection

Firewalls & Intrusion Detection Firewalls & Intrusion Detection CS 594 Special Topics/Kent Law School: Computer and Network Privacy and Security: Ethical, Legal, and Technical Consideration 2007, 2008 Robert H. Sloan Security Intrusion

More information

Broadband Phone Gateway BPG510 Technical Users Guide

Broadband Phone Gateway BPG510 Technical Users Guide Broadband Phone Gateway BPG510 Technical Users Guide (Firmware version 0.14.1 and later) Revision 1.0 2006, 8x8 Inc. Table of Contents About your Broadband Phone Gateway (BPG510)... 4 Opening the BPG510's

More information

Chapter 8 Security Pt 2

Chapter 8 Security Pt 2 Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,

More information

s@lm@n CompTIA Exam N10-006 CompTIA Network+ certification Version: 5.1 [ Total Questions: 1146 ]

s@lm@n CompTIA Exam N10-006 CompTIA Network+ certification Version: 5.1 [ Total Questions: 1146 ] s@lm@n CompTIA Exam N10-006 CompTIA Network+ certification Version: 5.1 [ Total Questions: 1146 ] Topic break down Topic No. of Questions Topic 1: Network Architecture 183 Topic 2: Network Operations 149

More information

12. Firewalls Content

12. Firewalls Content Content 1 / 17 12.1 Definition 12.2 Packet Filtering & Proxy Servers 12.3 Architectures - Dual-Homed Host Firewall 12.4 Architectures - Screened Host Firewall 12.5 Architectures - Screened Subnet Firewall

More information

Application Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder )

Application Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder ) Application Note Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder ) This document describes how to configure McAfee Firewall Enterprise to provide

More information

Internet Security Firewalls

Internet Security Firewalls Overview Internet Security Firewalls Ozalp Babaoglu! Exo-structures " Firewalls " Virtual Private Networks! Cryptography-based technologies " IPSec " Secure Socket Layer ALMA MATER STUDIORUM UNIVERSITA

More information

UIP1868P User Interface Guide

UIP1868P User Interface Guide UIP1868P User Interface Guide (Firmware version 0.13.4 and later) V1.1 Monday, July 8, 2005 Table of Contents Opening the UIP1868P's Configuration Utility... 3 Connecting to Your Broadband Modem... 4 Setting

More information

SonicWALL Clean VPN. Protect applications with granular access control based on user identity and device identity/integrity

SonicWALL Clean VPN. Protect applications with granular access control based on user identity and device identity/integrity SSL-VPN Combined With Network Security Introducing A popular feature of the SonicWALL Aventail SSL VPN appliances is called End Point Control (EPC). This allows the administrator to define specific criteria

More information

Chapter 4 Customizing Your Network Settings

Chapter 4 Customizing Your Network Settings Chapter 4 Customizing Your Network Settings This chapter describes how to configure advanced networking features of the RangeMax Dual Band Wireless-N Router WNDR3300, including LAN, WAN, and routing settings.

More information

Chapter 5. Figure 5-1: Border Firewall. Firewalls. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall

Chapter 5. Figure 5-1: Border Firewall. Firewalls. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall. Figure 5-1: Border Firewall Figure 5-1: Border s Chapter 5 Revised March 2004 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Border 1. (Not Trusted) Attacker 1 1. Corporate Network (Trusted) 2 Figure

More information

Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html

Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html Red Hat Docs > Manuals > Red Hat Enterprise Linux Manuals > Red Hat Enterprise Linux 4: Security Guide Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html

More information

Firewall Firewall August, 2003

Firewall Firewall August, 2003 Firewall August, 2003 1 Firewall and Access Control This product also serves as an Internet firewall, not only does it provide a natural firewall function (Network Address Translation, NAT), but it also

More information